An Enhanced CNN-Bidirectional LSTM Model for Real-Time Multi-Class Attack Detection in Network Traffic

The rapid growth of network traffic and sophisticated cyber threats has necessitated the development of intelligent intrusion detection systems capable of accurately identifying diverse attack types in real-time. This paper presents an enhanced hybrid deep learning framework that combines Convolutional Neural Networks (CNN) with Bidirectional Long Short-Term Memory (BiLSTM) networks for multi-class network attack classification. The proposed model leverages CNN layers for spatial feature extraction from network traffic data, while BiLSTM layers capture temporal dependencies and bidirectional contextual information within flow sequences. We evaluate our approach on a comprehensive dataset comprising nine distinct traffic classes, including eight attack types (Arp_Spoofing, BotNet_DDOS, HTTP_Flood, ICMP_Flood, MQTT_Flood, Port_Scanning, TCP_Flood, UDP_Flood) and normal traffic. Experimental results demonstrate that our model achieves exceptional overall performance with 99.55% test accuracy. However, a detailed per-class analysis reveals a critical class imbalance challenge: while the model excels at detecting majority classes (HTTP_Flood, MQTT_Flood, TCP_Flood, UDP_Flood) with over 99% accuracy, it fails to identify minority attack classes (Arp_Spoofing, BotNet_DDOS, ICMP_Flood, Port_Scanning) due to insufficient training samples. The confusion matrix analysis identifies 265 misclassified samples, primarily originating from underrepresented classes. These findings highlight both the effectiveness of the CNNBiLSTM architecture for network intrusion detection and the crucial importance of addressing class imbalance in cybersecurity datasets. Our research provides insights for developing more robust and equitable multiclass intrusion detection systems capable of protecting networks against the full spectrum of cyber threats.