Hybrid CNN-LSTM Framework for Intelligent Cyber Attack Detection and Prevention in U.S. Critical Digital Infrastructure: A Comparative Machine Learning Evaluation on CSE-CIC-IDS2018

Technical Summary: Hybrid CNN-LSTM Framework for Intelligent Cyber Attack Detection

Problem Statement
The accelerating digitization of United States critical infrastructure (healthcare, finance, energy, transportation, and government) has created an attack surface that traditional, signature-based Intrusion Detection Systems (IDS) are ill-equipped to defend. Legacy approaches fail against zero-day exploits, distributed denial-of-service (DDoS) campaigns, botnets, and stealthy infiltration attacks because they rely on recognizing previously seen threats. Furthermore, existing AI-driven solutions often struggle with high false positive rates, computational overhead in real-time environments, and a lack of adaptability to evolving threat landscapes. The study addresses the need for an adaptive, intelligent defense framework capable of detecting and classifying cyber threats in real-time with high sensitivity and low false alarm rates.

Methodology
The study employs a quantitative, experimental design using the CSE-CIC-IDS2018 benchmark dataset, a realistic multi-vector network traffic corpus generated by the Canadian Institute for Cybersecurity. The methodology proceeds through eight interconnected stages:

1. Data Preprocessing: The raw dataset, characterized by severe class imbalance (benign traffic vastly outnumbering attacks) and data quality issues (missing/infinite values), underwent systematic cleaning. This included removing NaN/infinite values, eliminating duplicate records, and applying Min-Max normalization. To address class imbalance, a combination of random oversampling for minority attack classes and undersampling for the dominant benign class was applied exclusively to the training set, while the test set retained the original distribution to reflect real-world conditions.
2. Feature Engineering: A three-phase approach was used: Pearson correlation analysis to remove redundant features (correlation > 0.95), Random Forest-based feature importance ranking to exclude low-signal attributes, and a test of Principal Component Analysis (PCA), which was ultimately discarded as it offered marginal gains at the cost of interpretability. The final feature set included Flow Duration, Packet Length statistics, Forward/Backward Packet counts, Destination Port, Protocol Type, and inter-arrival times.
3. Model Development: Five architectures were systematically compared:
   • Random Forest and XGBoost: Classical ensemble classifiers serving as industry-standard baselines.
   • Support Vector Machine (SVM): A kernel-based classifier (trained on a stratified 30% subsample due to computational constraints).
   • Convolutional Neural Network (CNN): Designed to extract spatial feature interactions from reshaped 2D traffic matrices.
   • Long Short-Term Memory (LSTM): Designed to capture temporal sequences of network flows.
   • Hybrid CNN-LSTM: A dual-pathway architecture where CNN layers perform spatial feature extraction, feeding into LSTM layers for temporal sequence modeling.
4. Framework Architecture: The models were integrated into an end-to-end cyber defense pipeline comprising modules for traffic collection, preprocessing, feature extraction, AI-based threat detection, attack classification, and automated threat prevention.
5. Evaluation: Models were trained on an 80/20 stratified split. Performance was assessed using Accuracy, Precision, Recall, F1-Score, ROC-AUC, and False Positive Rate (FPR).

Key Results
All evaluated models achieved detection accuracy above 96%, but the Hybrid CNN-LSTM model demonstrated superior performance across all metrics:

• Accuracy: The Hybrid model achieved 99.1%, outperforming Random Forest (96.8%), XGBoost (97.5%), CNN (98.1%), and LSTM (98.4%).
• Precision and Recall: The Hybrid model reached approximately 99.0% precision and 98.8% recall, indicating a genuine improvement in discriminative capability rather than a trade-off between the two.
• False Positive Rate (FPR): The Hybrid model achieved the lowest FPR at ~2.0%, a significant reduction compared to Random Forest (5.5%) and XGBoost (4.8%). This reduction is operationally critical for mitigating analyst alert fatigue in high-volume environments.
• Feature Importance: Analysis revealed that Flow Duration (0.28 importance), Packet Length (0.24), and Destination Port (~0.18) were the most predictive features, collectively accounting for roughly 70% of the classification signal.
• ROC-AUC: The framework achieved an AUC of 1.00 on the test set, indicating near-perfect class separability under the experimental conditions.

Significance and Claims
The paper claims that the Hybrid CNN-LSTM framework offers a meaningful and deployable improvement over conventional IDS approaches. The significance of the work lies in its demonstration that integrating spatial feature extraction (CNN) with temporal sequence learning (LSTM) allows for the simultaneous capture of within-flow feature signatures and across-flow behavioral sequences, which single-architecture models miss.

The authors emphasize that the framework's ability to maintain high detection sensitivity while drastically reducing false positives addresses a primary operational bottleneck in cybersecurity: alert fatigue. By achieving ~99% accuracy and ~2% FPR, the study suggests that hybrid deep learning can provide scalable, low-false-alarm cybersecurity suitable for protecting U.S. critical infrastructure.

Limitations and Scope
The paper maintains a modest stance regarding operational deployment. It explicitly acknowledges that:

• The results are based on the 2018 CSE-CIC-IDS2018 dataset, which does not reflect post-2020 threats such as ransomware-as-a-service, AI-generated phishing, or supply chain intrusions.
• The evaluation was conducted on replayed traffic rather than live network streams, meaning real-time inference latency under production loads was not measured.
• The SVM model was trained on a subsample, potentially underestimating its performance relative to other models.
• Explainability was not addressed; the deep learning models function as "black boxes," which remains a barrier for adoption in regulated industries.
• The study concludes that while the framework shows strong empirical promise, validation against contemporary attack data and live network streams is necessary before operational conclusions can be drawn.