Deep Learning-Based Intrusion Detection System Using a Hybrid CNN-LSTM Model for Real-Time Cybersecurity Threat Detection in IoT Networks

Abstract

Companies are increasingly facing the need for robust, real-time cybersecurity solutions that can effectively defuse a myriad of network threats in the fast-changing Internet of Things (IoT) landscape. Typical static signature based or handcrafted rules based intrusion detection systems (IDS) cannot handle the polymorphic malware, zero day attacks and the very dynamic traffic behavior patterns of today's IoT environments. To address this lack, the present study introduces a hybrid deep learning framework which combines the Convolutional Neural Networks (CNN) and the Long Short-Term Memory (LSTM) networks into a single end-to-end trainable model. CNN component: Reveals spatial patterns within individual network flows; LSTM component: Models temporal evolution of the patterns across sequential traffic windows, which enable the model to be able to detect both immediate and multi-step intrusion patterns.

The proposed architecture is trained and evaluated on three popular benchmark datasets of CICIDS2017, UNSW-NB15 and ToN-IoT with a preprocessing pipeline consisting of Min-Max normalization, class balancing using SMOTE and feature selection based on correlation. The model is compared with the standalone CNN, LSTM baseline model and the conventional classifiers such as Support Vector Machines (SVM), Random Forest (RF), and K-Nearest Neighbors (KNN). The CNN-LSTM model excels over all the baselines on every metric in the CICIDS2017 dataset with a detection accuracy of 99.3%, an F1-score of 99.1% and an inference latency of 3.9ms. Cross-dataset experiments validate the model's generalizability to other datasets: UNSW-NB15 and ToN-IoT. The resource profiling feature on an emulated IoT edge platform confirms that it can meet the processing limitations of a physical IoT gateway. Overall, the results of this study put forth a CNN-LSTM IDS as a realistic solution that can be deployed in next-generation IoT network security.