An Intelligent Cyber Threat Detection Framework Using a Hybrid Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) Machine Learning Mode

Abstract

The attack surface for contemporary cyber threats has greatly increased due to the growing reliance on networked digital systems and internet-driven services. Conventional security solutions that rely on static signatures and predetermined rules are no longer adequate as cyberattacks become more sophisticated and adaptable. Due to these conventional methods\' inability to detect new and zero-day threats, network infrastructures are more vulnerable and detection is delayed. This paper offers an intelligent cyber threat detection framework based on a hybrid deep learning architecture that combines Long Short-Term Memory (LSTM) networks with Convolutional Neural Networks (CNN) in order to get around these restrictions. The suggested system does away with the requirement for human feature engineering by using the CNN module to automatically learn and extract significant spatial patterns from network traffic features. The detection of intricate and dynamic attack patterns is therefore made possible by using the LSTM module to represent the temporal linkages and sequential behaviors found in network traffic flows. Widely used intrusion detection datasets are used to verify the efficacy of the suggested model. Standard criteria, such as accuracy, precision, recall, F1-score, and false positive rate, are used to evaluate performance. According to experimental results, the hybrid CNN–LSTM architecture regularly outperforms both individual deep learning models and traditional machine learning techniques in terms of detection performance. The proposed approach demonstrates strong generalization capability and is well suited for real-time deployment in dynamic cybersecurity environments.

Introduction

The rapid growth of digital communication, cloud computing, and Internet of Things (IoT) technologies has significantly increased the complexity of network infrastructures, leading to greater cybersecurity risks. Traditional security solutions, such as firewalls and rule-based intrusion detection systems (IDS), rely on predefined rules and signatures, making them ineffective against new and evolving cyber threats such as ransomware, denial-of-service (DoS) attacks, malware, and advanced persistent threats (APTs).

To address these limitations, this study proposes an intelligent cyber threat detection framework based on a hybrid Convolutional Neural Network (CNN)–Long Short-Term Memory (LSTM) architecture. CNN automatically extracts important spatial features from network traffic data, while LSTM learns temporal dependencies and sequential attack patterns. By combining these complementary strengths, the hybrid model can accurately detect both known and previously unseen cyber threats in real-time network environments.

The literature review highlights that traditional machine learning algorithms such as Support Vector Machines (SVM), Random Forest (RF), and K-Nearest Neighbors (KNN) achieve reasonable detection accuracy but depend heavily on manual feature engineering. Deep learning methods improve performance, with CNNs excelling at spatial feature extraction and LSTMs capturing temporal relationships. Hybrid CNN–LSTM models have demonstrated higher detection accuracy and lower false alarm rates, although many existing models face challenges related to computational complexity and scalability.

The proposed framework follows a structured pipeline consisting of six stages: data collection, data preprocessing and normalization, feature extraction using CNN, temporal learning using LSTM, threat classification, and performance evaluation. Network traffic data is collected from standard intrusion detection datasets or real-time sources, cleaned and normalized, processed through CNN and LSTM layers, and finally classified as normal or malicious using fully connected layers. Model performance is evaluated using metrics such as accuracy, precision, recall, F1-score, and false positive rate (FPR).

The implementation employs widely used open-source tools, including Python, TensorFlow/Keras, NumPy, Pandas, and Scikit-learn. The CNN–LSTM model is trained on labeled network traffic data, tested on unseen samples, and uses deep learning techniques such as convolution, pooling, dropout, and dense layers to achieve reliable cyber threat detection.

Conclusion

This paper proposed an intelligent cyber threat detection framework leveraging a hybrid CNN–LSTM machine learning model. By integrating the spatial feature extraction capabilities of CNN with the temporal sequence modeling strength of LSTM, the framework effectively identifies both known and previously unseen cyber threats. Experimental evaluation on standard intrusion detection datasets demonstrates that the hybrid model outperforms traditional machine learning techniques such as SVM and Random Forest, achieving higher accuracy, improved precision and recall, and reduced false positive rates. The proposed approach is not only robust in detecting complex attack patterns but also exhibits strong generalization, making it suitable for deployment in dynamic, large-scale, and real-time network environments. Moreover, its adaptability and scalability indicate significant potential for securing IoT systems, cloud infrastructures, enterprise networks, and critical infrastructures. Future enhancements, including lightweight edge deployment, federated learning, and explainable AI, can further strengthen the practical applicability of the framework, making it a promising solution for modern cybersecurity challenges.

References

[1] J. M. Ismaila and V. Z. Sabo, “Anomaly Detection Via Network Intrusion Using a Hybrid CNN and LSTM,” Int. J. Emerg. Multidiscip. Comput. Sci. AI, vol. 4, no. 1, pp. 25–34, Mar. 2025. [2] M. A. S. Sandila, S. Sultan, Z. ul Hassan, and A. Ali, “A Hybrid Deep Learning Approach for Intrusion Detection in Network Traffic Using Convolutional and Recurrent Neural Networks,” Spectrum Eng. Sci., vol. 3, no. 7, pp. 1669–1688, Jul. 2025. [3] Izhar, A. Abdullah, M. Z. Hussain, and M. Z. Hasan, [4] “Enhancing IoT/IIoT Intrusion Detection: A Comparative Study of Hybrid CNN–LSTM and Advanced DNN ML [5] Model on Edge-IIoTset,” Spectrum Eng. Sci., vol. 3, no. 10, pp. 1420–1433, Oct. 2025. [6] S. Akkepalli and S. K., “A Novel Framework of AnomalyBased Network Intrusion Detection Using Hybrid CNN, [7] Bi-LSTM Deep Learning Techniques,” J. Inf. Syst. Eng. Manage., vol. 10, no. 19s, 2025. [8] M. Oduwale, B. K. Alese, O. O. Obe, and O. A. [9] Odeniyi, “Hybrid CNN–LSTM Deep Learning Model for Security Risk Detection in Industrial Internet of Things (IIoT) Networks,” Int. J. Artif. Intell. Mach. Learn. Intell. [10] Syst., vol. 1, no. 2, July–Dec. 2025. [11] S. A. Ahmed, E. H. Khalifa, M. Nawaz, F. A. Abdalla, and A. F. A. Mahmoud, “Enhancing Cloud Data Center Security through Deep Learning: A Comparative Analysis of RNN, CNN, and LSTM Models for Anomaly and Intrusion Detection,” Eng. Technol. Appl. Sci. Res., vol. 15, no. 1, pp. 20071–20076, Feb. 2025. [12] H. Rana, F. Zainab, F. Raoof, and A. Zahoor, “A Prediction of Network Intrusion Using CNN-LSTM: Hybrid Deep Learning Approach,” KIET J. Comput. Inf. Sci., vol. 7, no. 2, Jan. 2025. [13] R. Baidar, S. Maric, and R. Abbas, “Hybrid Deep Learning-Federated Learning Powered Intrusion Detection Learning Model for Intrusion Detection in Smart Grid,” arXiv:2509.07208, Sep. 2025. [14] M. J. Jouhari and M. Guizani, “Lightweight CNNBi LSTM Based Intrusion Detection Systems for Resource Constrained IoT Devices,” arXiv:2406.02768, Jun. 2024. [15] M. Gada, K. Damania, and S. Sankhe, “Cyberbullying Detection Using LSTM-CNN Architecture and Its Applications,” in Proc. 2021 Int. Conf. Comput. Commun. Informatics (ICCCI), pp. 1–6, 2021. [16] Bul’ajoul, W. James, and S. A. Shaikh, “A New Architecture for Network Intrusion Detection and Prevention,” IEEE Access, vol. 7, pp. 18558–18573, 2018. [17] Zhang, J. Chen, Y. Zhou, L. Han, and J. Lin, “A Multiple-Layer Representation Learning Model for Network-Based Attack Detection,” IEEE Access, vol. 7, pp. 91992–92008, 2019. Nguyen and K. Kim, “Genetic Convolutional Neural Network for Intrusion Detection Systems,” Future Gener. Comput. Syst., vol. 113, pp. 418–427, 2020. [18] S. K. Dutta et al., “Network Traffic Anomaly Detection Using Deep Learning: A Review,” Int. J. Adv. Comput. Sci. Appl., vol. 11, no. 8, pp. 526–538, 2020. (general review reference) M. Wang and H. Lu, “A Deep Learning-Based Intrusion [19] Y. Kim, D. Lee, and S. Won, “Deep Learning-Based Anomaly Detection Techniques for Cyber Threats,” IEEE Commun. Surveys Tuts., vol. X, no. Y, pp. 1–30, 2023. (survey style reference).

Copyright

Copyright © 2026 Manjali Gupta, Jitender Kumar, Bharti . This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.