Aug 2026· Journal of Cyber Security and Mobility· 0 citations
TL;DR
A Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) model for effective IoT malware detection is proposed, which enhances detection capability for both known and zero-day attacks.
Abstract
The rapid expansion of the Internet of Things (IoT) has intensified security concerns. Many IoT devices operate with limited computational resources and inadequate built-in protection. This makes them vulnerable to malware attacks such as Distributed Denial-of-Service (DDoS), botnets, and ransomware. Traditional signature-based detection techniques struggle to identify evolving and previously unseen threats, highlighting the need for intelligent detection mechanisms. This study proposes a Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) model for effective IoT malware detection. The CNN component extracts spatial features from network traffic, including packet-level and flow-based characteristics. The LSTM component captures temporal dependencies and sequential attack patterns. By integrating spatial and temporal learning, the hybrid architecture enhances detection capability for both known and zero-day attacks. Experimental results demonstrate superior performance compared to standalone CNN and LSTM models, achieving 99.92% accuracy, precision, recall, and F1-score, with a ROC-AUC of 0.999703.
The rapid growth of the Internet of Things (IoT) has significantly improved connectivity and automation across various domains. However, it has also increased the risk of cyber threats, particularly botnet attacks that compromise connected devices and disrupt network operations. Traditional machine learning techniques often struggle to detect sophisticated and evolving botnet attacks due to the complexity and high-dimensional nature of network traffic. This project proposes a Hybrid Deep Learning Model for Efficient IoT Botnet Attack Detection by integrating Artificial Neural Networks , Convolutional Neural Networks , Long Short-Term Memory, and Recurrent Neural Networks into a stacked ACLR framework. The proposed model leverages the feature extraction capability of CNN, the temporal learning strength of LSTM and RNN, and the classification power of ANN to accurately identify malicious network traffic. The model is trained and evaluated using the UNSW-NB15 dataset after appropriate preprocessing, including data cleaning, normalization, and label encoding. Experimental results demonstrate that the proposed approach achieves high detection accuracy, precision, recall, F1-score, and ROCAUC, outperforming several existing machine learning and deep learning methods. The proposed hybrid framework provides a robust, scalable, and reliable solution for real-time botnet attack detection, enhancing the security and resilience of modern IoT networks against evolving cyber threats.
MUNAGALA KUSUMA, Dr.M.Ramesh· International Journal of Eng...· 0 citations
Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
IoT devices keep multiplying, and so do the ways attackers can get into them. Most of these devices simply don't have the CPU, RAM, or power budget to run the deep learning-based intrusion detection systems (IDS) that perform best in the research literature, which creates a real gap between what's accurate and what's actually deployable. In this paper we build a hybrid CNN-LSTM classifier and, instead of shrinking it after the fact, we design it to be small from the start: depthwise-separable convolutions handle the spatial side, a deliberately narrow LSTM layer picks up temporal patterns across flow sequences, and the whole thing goes through structured pruning and post-training quantization before it ever gets tested. We ran it against TON_IoT and IoTID20, two datasets built from different testbeds with different attack mixes, and stacked it up against Random Forest, SVM, and plain (uncompressed) CNN and LSTM models. The compressed hybrid model came out ahead on both datasets - 98.6% accuracy on TON_IoT, 97.9% on IoTID20 - while ending up about 71% smaller and 58% faster at inference than its own uncompressed version. So it seems like joint design (architecture and compression together, not compression bolted on later) is a workable path to models that are both accurate and small enough to actually run at the edge. We close with a look at the accuracy/latency/energy trade-offs we hit along the way, and where this could go next - federated learning, online updates, that kind of thing.
Dr.T.Prabakar· International journal of res...· 0 citations
The increasing development of the Internet of Things has led to several security threats and vulnerabilities associated with interconnected networks and, thus, makes them suitable targets for DDoS attacks. The increased dimensionality of traffic in the context of the Internet of Things makes IDS hard because deep learning models running independently are unable to adequately address the complexity associated with the interaction between network attributes. In this context, this research suggests a new architecture based on deep learning methods for binary classifications and featuring hybridization of multi-layer 1D-CNNs with LSTM networks. To reduce computational resources needed for training on IoT-based datasets, the ANOVA F-test is implemented to choose the key features before training. The proposed architecture includes dual convolutional layers having 64 and 128 filters, respectively, that allow to analyze the hierarchical spatial structures. Next, the data from convolutional layers is passed to the LSTM layer that analyzes high-order structural dependencies within feature maps generated at earlier stages. The proposed model was trained using the CICIoT2023 benchmark and showed superior performance compared to a standalone architecture featuring either CNNs or LSTM networks. Across five independent trials, the model achieved a mean accuracy of 98.72% ± 0.06%, with a precision of 98.91% and a recall of 98.65%. Furthermore, the proposed hybrid architecture shows high computational efficiency, achieving a remarkably low inference time of 0.15 ms per sample and a compact model footprint of 0.30 MB. These metrics confirm the model's suitability for deployment on resource-constrained IoT edge devices, providing a robust balance between high detection accuracy and low architectural complexity. These findings confirm that the constructive collaboration between spatial and structural feature modeling provides a robust, stable, and scalable solution for mitigating DDoS threats in modern IoT ecosystems.
Vinaykumar N Soni, Ashwinikumar Jha· International Journal of Ele...· 0 citations
The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has
increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of
modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks
but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary
network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural
Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and
evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble
model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning,
categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were
trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and
inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision,
68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and
the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed
standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary
intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally
efficient models for anomaly-based intrusion detection.
Ketki Naik, Sanjeev Ghosh· International Journal for Re...· 0 citations
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
