Jul 2026· 2026 5th International Conference on Distributed Computing and Electrical Circuits and Electronics (ICDCECE)· pp. 1-8· 0 citations· 15 references
Abstract
The advent of Internet of Things (IoT) and Cyber-Physical Systems (CPS) has led to the rapid development of highly dynamic and complex communication infrastructures in various domains ranging from healthcare, transportation, industrial automation to intelligent energy systems. Even though intrusion detection and network security is a wellresearched research area, existing intrusion detection systems cannot efficiently overcome shortcomings such as unknown threat detection, false-positive alert detection, network adaptivity and improved accuracy with large-scale real-time heterogeneous traffic data. In order to overcome these challenges, this paper proposes an AI-enabled threat detection framework using hybrid deep learning techniques for intelligent cyber threat analysis and intrusion detection. First, network traffic data is pre-processed, Min-Max-normalized, and enhanced by feature selection along with the Principal Component Analysis (PCA)-based dimension reduction to minimise the redundancy and to improve the quality of the dataset. Second, the optimized feature set is leveraged for AIenabled detection of anomalies using Autoencoder, spatial traffic patterns detection using Convolutional Neural Network (CNN), and the temporal dependencies of virtual attacks in traffic data using an LSTM-Recurrent Neural Network (LSTM-RNN). Finally, a hybrid Deep Neural Network (DNN) and Decision Tree classifier on the output of the hybrid model, classifies the normal and malicious network traffic with a reduced false-positive rate. Experimental results of the proposed framework on network intrusion datasets confirmed the efficiency of the proposed framework significantly outperforming the existing standalone deep learning approaches in terms of accuracy, precision, recall, F1-score, scalability, and real-time cyber threat detection.
The Internet of Things (IoT) technologies have been rapidly adopted in the field of Cyber-Physical Systems (CPS) and
have greatly enhanced the automation, connectivity and operational efficiency of industrial and critical infrastructure (ICI)
environments. The advent of greater device connectivity, however, has also grown the attack surface, leaving CPS environments
open to many different cyber threats. The traditional methods of intrusion detection are not effective in detecting more complex
and advanced attacks because the features are manually designed and cannot be easily adapted. In this publication, a Deep
Learning (DL)framework for security monitoring is presented in this study, which uses CNN to improve the intrusion detection
capability of the cyber-attack system in the IoT-enabled CPS environment. The intended framework accepts the network traffic
data out of the UNSW-NB15 dataset to learn complicated cyber security threats and identify attacks from normal data traffic. We
compared the proposed CNN model against a conventional Support Vector Machine (SVM) classifier. The experimental results
demonstrate that the CNN model surpasses the others across key metrics, including precision, accuracy, F1 score and recall. The
proposed approach has proved to be efficient in capturing hidden traffic characteristics and improves the reliability of cyber
threat detection framework in dynamic IoT-based CPS systems. The evaluation results confirm that deep learning methods can
be a scalable and efficient way to enhance the cybersecurity of next-generation cyber-physical infrastructures.
Sowjanya Samineni, D. Chiranjeevi· International Journal for Re...· 0 citations
The rapid expansion of smart networks, encompassing the Internet of Things (IoT), software-defined networking (SDN), and 5G-enabled edge infrastructure, has dramatically increased the attack surface available to malicious actors, while simultaneously producing high-velocity, heterogeneous traffic that traditional signature-based intrusion detection systems struggle to analyze in real time. This paper proposes a Hybrid Deep Learning and Machine Learning (DL-ML) framework for intelligent cyber threat detection that fuses a Convolutional Neural Network combined with a Bidirectional Long Short-Term Memory (CNN-BiLSTM) branch, which captures spatial and temporal traffic patterns, with a gradient-boosted ensemble branch (XGBoost/Random Forest), which captures statistical flow-level signatures. The outputs of both branches are combined through a weighted feature-fusion and ensemble layer that produces a unified threat classification and severity score. The framework was evaluated on a large-scale smart-network intrusion dataset comprising over 1.8 million labeled flow records spanning six traffic classes: normal, DDoS, botnet, port scanning, malware communication, and spoofing. Experimental results show that the proposed hybrid model achieves 98.8% accuracy, 96.4% precision, 95.6% recall, and a 96.0% F1-score, exceeding the strongest individual baseline (LSTM) by 3.7 percentage points in F1-score and achieving an AUC of 0.992.
Rajesh Yadav, Dinesh Kumar, Sanjeev Kumar et al.· International journal of com...· 1 citation
The rapid growth of heterogeneous network environments such as the Internet of Things (IoT), Industrial IoT (IIoT), cloud computing, and software‐defined networks has significantly increased exposure to sophisticated cyberattacks, making intrusion detection a critical component of modern cybersecurity infrastructures. Traditional intrusion detection systems and conventional machine learning techniques often face limitations when handling high‐dimensional network traffic, class imbalance, and evolving attack patterns, resulting in reduced detection performance and limited scalability under complex network environments. These challenges reduce their effectiveness in practical, large‐scale deployments. To overcome these issues, this paper proposes a hybrid intrusion detection framework based on an Autoencoder and a TabTransformer, optimized using the Whale Optimization Algorithm (WOA). The Autoencoder is employed to perform unsupervised feature learning, transforming high‐dimensional network traffic data into compact and noise‐resistant latent representations. These latent features are then processed by the TabTransformer, which utilizes multi‐head self‐attention to capture complex inter‐feature relationships and enhance classification performance. The WOA is incorporated to automatically optimize key hyperparameters, improving convergence speed, stability, and generalization capability of the model. The proposed framework is primarily evaluated using the CIC‐IDS2018 benchmark dataset. In addition, supplementary cross‐dataset validation on the CIC‐IDS2017 and UNSW‐NB15 datasets is conducted to assess the generalization capability of the proposed framework. Experimental results demonstrate that the proposed model achieves an accuracy of 99.87%, precision of 99.85%, recall of 99.88%, and an F1‐score of 99.86% while maintaining very low false alarm and false negative rates. Comparative analysis with existing deep learning‐based intrusion detection approaches confirms the superior and balanced performance of the proposed method. Overall, the Hybrid Autoencoder–TabTransformer framework provides an effective intrusion detection solution that demonstrates strong performance under the evaluated experimental conditions.
Rui Guo, Guangjun Wen· Transactions on Emerging Tel...· 0 citations
The rapid expansion of Internet of Things (IoT) devices has introduced significant security challenges, creating a growing need for advanced Intrusion Detection Systems (IDS) capable of identifying cyber threats in real time. Traditional IDS solutions often struggle to cope with the dynamic and heterogeneous nature of modern IoT environments. As a result, Artificial Intelligence (AI)-based approaches have emerged as promising alternatives due to their ability to learn complex patterns and adapt to evolving threats. This study investigates the integration of Machine Learning (ML) and Deep Learning (DL) techniques to enhance the accuracy, efficiency, and adaptability of IDS in IoT networks. A Next Generation AI-based IDS is proposed to detect and classify various types of cyberattacks. The framework combines anomaly detection, behavioral analysis, and malicious pattern recognition to identify and mitigate security threats with minimal latency. To improve attack detection, a pre-trained Adaptive Recurrent Neural Network (A-RNN) is employed to effectively extract attack patterns from network traffic data. These extracted patterns are then processed using a hybrid Stacked Long Short-Term Memory (S-LSTM) and Convolutional Neural Network (CNN) architecture for accurate attack classification. The effectiveness of the proposed model is evaluated using two real-world datasets, namely the BETH Dataset and the IoT-23 Dataset. Experimental results demonstrate that the proposed AI-driven IDS achieves superior performance compared to existing approaches, highlighting its potential as a robust and efficient solution for securing IoT environments against emerging cyber threats.
D. G, D. R, Sushmitha J et al.· Genetics and Molecular Resea...· 0 citations
Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations