An Optimized Spatial-Temporal Deep Learning Model for Network Intrusion Detection Using ConvLSTM and Bidirectional GRU

Abstract

The increasing sophistication of cyber-attacks and the rapid expansion of network communication have created significant challenges for conventional Network Intrusion Detection Systems (NIDS). Traditional machine learning approaches often struggle to identify complex intrusion patterns due to their limited ability to capture spatial and temporal dependencies in network traffic. To overcome these limitations, this work proposes an enhanced hybrid deep learning framework integrating Sequence-to-Sequence (Seq2Seq), Convolutional Long Short-Term Memory (ConvLSTM), Bidirectional Long Short-Term Memory (BiLSTM), and Gated Recurrent Unit (GRU) architectures for accurate network intrusion detection and classification. Initially, Random Forest is implemented as a baseline classification algorithm, followed by a hybrid Seq2Seq-ConvLSTM model for extracting spatial and sequential features from network traffic. As an extension, Bidirectional and GRU layers are incorporated to improve temporal dependency learning, enhance feature representation, and reduce computational latency. The proposed framework is evaluated using the UNSW-NB15 dataset through performance metrics including accuracy, precision, recall, and F1-score. Experimental results demonstrate that the Random Forest model achieves 90.31% accuracy, while the hybrid Seq2Seq-ConvLSTM model achieves 97.00% accuracy. The extended stacked model achieves the highest accuracy of 98.24%, with 98.41% precision, 95.59% recall, and 96.91% F1-score. Furthermore, Explainable Artificial Intelligence (XAI) using Local Interpretable Model-Agnostic Explanations (LIME) provides insights into important features influencing intrusion predictions. Finally, the trained model is deployed through a Flask-based web application, enabling users to upload network traffic datasets and obtain intrusion predictions through an interactive interface. The proposed extension improves classification performance and computational efficiency, providing an effective approach for intelligent network intrusion detection.