Deep Learning-Based Hybrid Model for Intrusion Detection Using Seq2Seq and ConvLSTM Architectures

Abstract

Network Intrusion Detection Systems (NIDS) often struggle to detect new and advanced cyberattacks because they fail to effectively capture long-term dependencies and hidden patterns in network traffic. Modern cyberattacks exhibit complex and evolving behaviors, while traditional systems are not designed to analyze such temporal changes in depth. To address this challenge, this work proposes a novel deep learning model that integrates Seq2Seq and ConvLSTM architectures. The Seq2Seq component enables the system to read, model, and learn from sequential network traffic data, while the ConvLSTM component captures significant spatial–temporal patterns and dynamic variations in the data over time. By combining these two approaches, combining Seq2Seq conv1d and LSTM and Bidirectional and GRU the proposed model achieves a deeper understanding of network behavior and improves the accuracy of anomaly and intrusion detection. In addition, the system incorporates LIME as an explainability mechanism, allowing the model to highlight the specific features or data segments that influenced its decision to classify traffic as normal or malicious. This enhances the transparency and trustworthiness of the system by clearly justifying its predictions. The proposed model was evaluated on well-known benchmark datasets, including CIC-IDS2017, CIC-ToN-IoT, and UNSW-NB15, and the experimental results demonstrate superior performance compared to traditional NIDS, achieving higher accuracy, improved attack detection rates, and reduced false alarms.