A cross-attention CNN–LSTM fusion model for network traffic anomaly detection

Abstract

Detecting cyber intrusions in modern IoT networks is challenging because of their large scale, heterogeneous device ecosystems, and high-volume traffic patterns. This paper presents a cross-attention CNN–LSTM fusion architecture that jointly learns the spatial and temporal characteristics of network traffic for binary intrusion detection. The proposed network combines a convolutional branch that extracts local feature interactions with a recurrent branch that captures sequential dependencies, and couples them through a bidirectional multi-head cross-attention module that allows each branch to selectively attend to information produced by the other. To strengthen generalization and mitigate overfitting, the architecture integrates Gaussian noise injection at the input, $$L_{2}$$ weight regularization, dropout, and label smoothing. The framework is evaluated on two recent benchmark datasets, ToN-IoT and CIC-IoT 2023, which together cover diverse IoT traffic scenarios and a wide range of contemporary attack types. Experimental results show that the proposed model attains 99.42% accuracy on ToN-IoT and 99.44% accuracy on CIC-IoT 2023, with AUC values of 0.9997 on ToN-IoT and 0.9988 on CIC-IoT 2023, consistently outperforming standalone CNN, standalone LSTM, and classical machine learning baselines, and achieving competitive or superior accuracy relative to several recent state-of-the-art hybrid models reported in the literature.