2026· International journal of research and innovation in applied science· 0 citations
TL;DR
The findings demonstrate that the proposed multi-layer deep learning framework significantly improves cyberattack detection accuracy, reduces false-positive alerts, enhances real-time response capabilities, and strengthens proactive cybersecurity defense mechanisms.
Abstract
The rapid expansion of digital technologies, cloud computing platforms, Internet of Things (IoT) devices, and interconnected communication infrastructures has significantly increased the frequency and complexity of cyberattacks across modern organizations. Conventional cybersecurity mechanisms such as firewalls, antivirus software, and signature-based intrusion detection systems have become increasingly inadequate against sophisticated threats, including advanced persistent threats, ransomware, zero-day attacks, phishing campaigns, and distributed denial-of-service attacks. The dynamic and adaptive nature of modern cyber threats necessitates the development of intelligent cybersecurity frameworks capable of real-time threat detection, predictive analysis, automated response, and adaptive defense mechanisms.
This study presents a multi-layer deep learning framework for intelligent cyberattack prevention. The proposed framework integrates multiple deep learning architectures, including Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM) networks, and Autoencoder models, to enhance threat detection accuracy, anomaly identification, behavioral analysis, and predictive cyber defense capabilities. The framework operates through layered analytical processes involving data acquisition, preprocessing, feature extraction, anomaly detection, threat classification, attack prediction, and automated response management.
The system was implemented using Python programming language, TensorFlow deep learning libraries, cloud-based datasets, and network traffic monitoring environments. Experimental evaluations were conducted using benchmark cybersecurity datasets containing various attack categories, including denial-of-service attacks, brute-force intrusions, malware activities, phishing attempts, and botnet traffic. Performance metrics, including detection accuracy, precision, recall, false-positive rate, and response time, were analyzed to evaluate system effectiveness.
The findings demonstrate that the proposed multi-layer deep learning framework significantly improves cyberattack detection accuracy, reduces false-positive alerts, enhances real-time response capabilities, and strengthens proactive cybersecurity defense mechanisms. The study concludes that deep learning-driven cybersecurity systems provide highly effective solutions for addressing evolving cyber threats within modern digital infrastructures.
The rapid expansion of smart networks, encompassing the Internet of Things (IoT), software-defined networking (SDN), and 5G-enabled edge infrastructure, has dramatically increased the attack surface available to malicious actors, while simultaneously producing high-velocity, heterogeneous traffic that traditional signature-based intrusion detection systems struggle to analyze in real time. This paper proposes a Hybrid Deep Learning and Machine Learning (DL-ML) framework for intelligent cyber threat detection that fuses a Convolutional Neural Network combined with a Bidirectional Long Short-Term Memory (CNN-BiLSTM) branch, which captures spatial and temporal traffic patterns, with a gradient-boosted ensemble branch (XGBoost/Random Forest), which captures statistical flow-level signatures. The outputs of both branches are combined through a weighted feature-fusion and ensemble layer that produces a unified threat classification and severity score. The framework was evaluated on a large-scale smart-network intrusion dataset comprising over 1.8 million labeled flow records spanning six traffic classes: normal, DDoS, botnet, port scanning, malware communication, and spoofing. Experimental results show that the proposed hybrid model achieves 98.8% accuracy, 96.4% precision, 95.6% recall, and a 96.0% F1-score, exceeding the strongest individual baseline (LSTM) by 3.7 percentage points in F1-score and achieving an AUC of 0.992.
Rajesh Yadav, Dinesh Kumar, Sanjeev Kumar et al.· International journal of com...· 1 citation
This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models, and discusses critical challenges affecting the deployment of ML-based IDS.
Ranobir Hasan, H. Jamal, Kamal Kamal et al.· The Eastasouth Journal of In...· 0 citations
The attack surface for contemporary cyber threats has greatly increased due to the growing reliance on networked
digital systems and internet-driven services. Conventional security solutions that rely on static signatures and predetermined
rules are no longer adequate as cyberattacks become more sophisticated and adaptable.
Due to these conventional methods' inability to detect new and zero-day threats, network infrastructures are more vulnerable and
detection is delayed. This paper offers an intelligent cyber threat detection framework based on a hybrid deep learning
architecture that combines Long Short-Term Memory (LSTM) networks with Convolutional Neural Networks (CNN) in order to
get around these restrictions.
The suggested system does away with the requirement for human feature engineering by using the CNN module to automatically
learn and extract significant spatial patterns from network traffic features. The detection of intricate and dynamic attack
patterns is therefore made possible by using the LSTM module to represent the temporal linkages and sequential behaviors
found in network traffic flows. Widely used intrusion detection datasets are used to verify the efficacy of the suggested model.
Standard criteria, such as accuracy, precision, recall, F1-score, and false positive rate, are used to evaluate performance.
According to experimental results, the hybrid CNN–LSTM architecture regularly outperforms both individual deep learning
models and traditional machine learning techniques in terms of detection performance. The proposed approach demonstrates
strong generalization capability and is well suited for real-time deployment in dynamic cybersecurity environments.
Manjali Gupta, J. Kumar, Bharti· International Journal for Re...· 0 citations
The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has
increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of
modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks
but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary
network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural
Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and
evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble
model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning,
categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were
trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and
inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision,
68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and
the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed
standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary
intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally
efficient models for anomaly-based intrusion detection.
Ketki Naik, Sanjeev Ghosh· International Journal for Re...· 0 citations
The rapid growth of heterogeneous network environments such as the Internet of Things (IoT), Industrial IoT (IIoT), cloud computing, and software‐defined networks has significantly increased exposure to sophisticated cyberattacks, making intrusion detection a critical component of modern cybersecurity infrastructures. Traditional intrusion detection systems and conventional machine learning techniques often face limitations when handling high‐dimensional network traffic, class imbalance, and evolving attack patterns, resulting in reduced detection performance and limited scalability under complex network environments. These challenges reduce their effectiveness in practical, large‐scale deployments. To overcome these issues, this paper proposes a hybrid intrusion detection framework based on an Autoencoder and a TabTransformer, optimized using the Whale Optimization Algorithm (WOA). The Autoencoder is employed to perform unsupervised feature learning, transforming high‐dimensional network traffic data into compact and noise‐resistant latent representations. These latent features are then processed by the TabTransformer, which utilizes multi‐head self‐attention to capture complex inter‐feature relationships and enhance classification performance. The WOA is incorporated to automatically optimize key hyperparameters, improving convergence speed, stability, and generalization capability of the model. The proposed framework is primarily evaluated using the CIC‐IDS2018 benchmark dataset. In addition, supplementary cross‐dataset validation on the CIC‐IDS2017 and UNSW‐NB15 datasets is conducted to assess the generalization capability of the proposed framework. Experimental results demonstrate that the proposed model achieves an accuracy of 99.87%, precision of 99.85%, recall of 99.88%, and an F1‐score of 99.86% while maintaining very low false alarm and false negative rates. Comparative analysis with existing deep learning‐based intrusion detection approaches confirms the superior and balanced performance of the proposed method. Overall, the Hybrid Autoencoder–TabTransformer framework provides an effective intrusion detection solution that demonstrates strong performance under the evaluated experimental conditions.
Rui Guo, Guangjun Wen· Transactions on Emerging Tel...· 0 citations
Modern networks are becoming increasingly complex as the number of interconnections grows and the number of Internet of Things (IoT) devices rapidly increases, making it possible for complex cyberattacks, including zero-day attacks, distributed denial-of-service (DDoS) attacks, and advanced persistent threats (APTs), to take root. Current traditional IDSs and individual machine learning/deep learning methods have drawbacks, including limited ability to learn from new attacks, high false alarm rates, limited interpretability, and scalability issues. These constraints hinder their usefulness in enterprise-level and IoT-based cybersecurity applications. To overcome these challenges, this paper introduces HybridML-CyberShield, a hybrid machine learning system designed for proactive cyber threat intelligence and intrusion detection. The framework introduces CNN–BiLSTM deep learning networks to represent traffic in a spatiotemporal manner and adopts ensemble machine learning classifiers, such as Random Forest, Support Vector Machine, and Gradient Boosting, to enhance the robustness of traffic detection and its interpretability. A Proactive Threat Scoring Mechanism (PTSM) is added to prioritise threats based on attack probability, attack severity, and confidence, enabling adaptive incident response prioritisation. Additionally, SHAP and LIME models also provide both global and local interpretability, resulting in greater transparency and analyst trust. Experimental evaluation across various benchmark cybersecurity datasets shows that HybridML-CyberShield achieves up to 98.4% accuracy on the CICIDS2017 dataset, with strong F1-scores, AUC-ROC values, and fewer false-positive alerts. The proposed architecture is scalable, transparent and almost real-time for enterprise and IoT cybersecurity monitoring environments.
Ramesh N. S. V. S. C. Sripada, A. Bhavani, Kiran B. Malagi et al.· Discover Computing· 0 citations