A Hybrid CNN-LSTM Framework with PSO-Optimized Feature Selection for Real-Time Network Intrusion Detection

Abstract

The proliferation of sophisticated cyberattacks necessitates advanced intrusion detection systems (IDS) capable of identifying both known and novel threats in real-time. Traditional signature-based detection systems exhibit limitations in detecting zero-day attacks, whilst pure anomaly-based approaches suffer from high false positive rates. This paper proposes a novel hybrid intrusion detection framework that synergistically integrates signature-based pattern matching, statistical anomaly detection, and a deep learning architecture combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks. To address the computational challenges of high-dimensional network traffic features, we employ Particle Swarm Optimization (PSO) for automated feature selection, reducing dimensionality from 78 to 38 features whilst improving detection accuracy. The CNN component extracts spatial patterns from network flow features, whilst the bidirectional LSTM captures temporal dependencies in traffic sequences. An intelligent ensemble fusion mechanism combines outputs from multiple detection engines using optimized weighted averaging. Extensive evaluation on three benchmark datasets (NSL-KDD, CICIDS2017, UNSW-NB15) demonstrates that the proposed framework achieves 97.14% accuracy on NSL-KDD and 96.94% on CICIDS2017 with false positive rates below 2.5%, outperforming state-of-the-art methods by 2.4-4.1%. The PSO-optimized feature selection provides 2.3× processing speedup, enabling sub-millisecond per-flow detection latencies suitable for deployment on high-speed networks. Cross-dataset evaluation reveals superior generalization capabilities, with 5.24% higher accuracy on unseen datasets compared to baseline approaches.