Jul 2026· 2026 6th International Conference on Inventive Computation and Information Technologies (ICICIT)· pp. 237-242· 0 citations· 20 references
Abstract
As the number of network attacks continues to increase, cybersecurity systems require intelligent and scalable solutions to detect more and more complex network attacks in real time. This paper suggests an end-to-end intelligent cybersecurity system for detecting intrusion with CICIDS2017 dataset with multiple classes. Proposed system performs complete data pre-processing that consists of missing value removal, duplication elimination, label encoding, feature normalisation and Principal Component Analysis based feature selection to enhance the data quality and learning efficiency. Some ML models such as DT, RF, ET, LR, Gaussian Naïve Bayes and a soft Voting Classifier are tested along with DL architectures like DNN, CNN, LSTM, CNN-LSTM, and CNN-LSTM-GRU. In addition, the works of Generative AI models, such as VAE, GAN, and Distil GPT2 are explored for anomaly modelling, generation of minority samples, and generation of text data for cybersecurity applications. XAI techniques (LIME and SHAP) reveal the main network traffic aspects to improve transparency of the forecast. The experimental results indicate that the Voting Classifier obtained the accuracy of 99.6% and the LSTM model obtained the accuracy of 99.3%. Both models can reliably detect various types of cyber attacks. Last, the framework is also deployed as a web application that uses Flask to enable real-time deployment of intrusion prediction and visualisation.
Modern networks are becoming increasingly complex as the number of interconnections grows and the number of Internet of Things (IoT) devices rapidly increases, making it possible for complex cyberattacks, including zero-day attacks, distributed denial-of-service (DDoS) attacks, and advanced persistent threats (APTs), to take root. Current traditional IDSs and individual machine learning/deep learning methods have drawbacks, including limited ability to learn from new attacks, high false alarm rates, limited interpretability, and scalability issues. These constraints hinder their usefulness in enterprise-level and IoT-based cybersecurity applications. To overcome these challenges, this paper introduces HybridML-CyberShield, a hybrid machine learning system designed for proactive cyber threat intelligence and intrusion detection. The framework introduces CNN–BiLSTM deep learning networks to represent traffic in a spatiotemporal manner and adopts ensemble machine learning classifiers, such as Random Forest, Support Vector Machine, and Gradient Boosting, to enhance the robustness of traffic detection and its interpretability. A Proactive Threat Scoring Mechanism (PTSM) is added to prioritise threats based on attack probability, attack severity, and confidence, enabling adaptive incident response prioritisation. Additionally, SHAP and LIME models also provide both global and local interpretability, resulting in greater transparency and analyst trust. Experimental evaluation across various benchmark cybersecurity datasets shows that HybridML-CyberShield achieves up to 98.4% accuracy on the CICIDS2017 dataset, with strong F1-scores, AUC-ROC values, and fewer false-positive alerts. The proposed architecture is scalable, transparent and almost real-time for enterprise and IoT cybersecurity monitoring environments.
Ramesh N. S. V. S. C. Sripada, A. Bhavani, Kiran B. Malagi et al.· Discover Computing· 0 citations
Network infrastructure has become more complex and the amount of cybersecurity challenges has grown with the introduction of cloud computing, the Internet of Things (IoT) and next-generation communication technologies. The known attack and known signatures are the reasons why traditional IDSs fail to detect sophisticated and new attacks; they are signature-based and programmed by hand. To overcome these drawbacks, this work presents a deep learning-based cybersecurity framework for proactively detecting the intrusion in CSE-CIC-IDS2018 benchmark dataset. The proposed system combines spatial and temporal features of network traffic using a hybrid Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) network architecture with a systematic data preprocessing pipeline. In the preprocessing stage, data quality and learning efficiency are enhanced by data cleaning, handling missing data, removing duplicate data, encoding labels, normalizing features, and splitting the data into training and testing sets. The CNN part is used to automatically learn discriminative spatial features, and the LSTM was used to learn the sequential traffic dependencies to see the relation between the sequential sequence and attack detection capability was improved. Experiments were carried out on Python, TensorFlow, Keras and Google Colab with GPU support. The proposed framework was evaluated according to the accuracy, precision, recall, F1-score, and ROC-AUC and the results were found to be 98.64%, 98.41%, 98.18%, 98.29%, and 99.12%, respectively, which are considered to be excellent classification results and strong discrimination ability. Moreover, the framework demonstrated good computational efficiency with an average inference time of 2.8ms per network flow and a moderate use of GPU memory. Results of comparative analysis with the latest deep learning-based intrusion detection methods also validate the competitiveness and applicability of the proposed framework. The results highlight the efficiency, reliability, and effectiveness of the hybrid CNN-LSTM framework in proactively detecting network intrusions in contemporary cybersecurity settings.
Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
The growth of Internet of Things devices has expanded the number of attackable targets of advanced cyber threats by orders of magnitude, and the limited computational capabilities of IoT devices have made more traditional intrusion detection systems infeasible to execute at the edge. A Knowledge-Distilled Multi-Model Intrusion Detection and Prevention System is presented, which combines a Residual Graph Convolutional Network, Long Short-Term Memory classifier, and a Conditional Tabular Generative Adversarial Network enhanced with the student-only autoencoders through multi-loss knowledge distillation to create a high-performing Teacher ensemble and compresses its intelligence into an edge-deployed system. The system is evaluated using the IoT-23 benchmark of 325 million network flow records and attains 98.2% Teacher-Student fidelity, 0.94 Knowledge Retention Score, and 4.4x throughput increase with 82.7% reduction in the parameter and provides per-packet SHapely Additive exPlanation forensic explainability.
S. K, Menaka T K, N. R· 2026 4th International Confe...· 0 citations
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
S. Nagendrudu, Shaik Mohammed Anays, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.
Indu Asitha, M. N.· International Journal of Com...· 0 citations