A cross-attention CNN–LSTM fusion model for network traffic anomaly detection

Résumé

Abstract Detecting cyber intrusions in modern IoT networks is challenging because of their large scale, heterogeneous device ecosystems, and high-volume traffic patterns. This paper presents a cross-attention CNN–LSTM fusion architecture that jointly learns the spatial and temporal characteristics of network traffic for binary intrusion detection. The proposed network combines a convolutional branch that extracts local feature interactions with a recurrent branch that captures sequential dependencies, and couples them through a bidirectional multi-head cross-attention module that allows each branch to selectively attend to information produced by the other. To strengthen generalization and mitigate overfitting, the architecture integrates Gaussian noise injection at the input, $$L_{2}$$ weight regularization, dropout, and label smoothing. The framework is evaluated on two recent benchmark datasets, ToN-IoT and CIC-IoT 2023, which together cover diverse IoT traffic scenarios and a wide range of contemporary attack types. Experimental results show that the proposed model attains 99.42% accuracy on ToN-IoT and 99.44% accuracy on CIC-IoT 2023, with AUC values of 0.9997 on ToN-IoT and 0.9988 on CIC-IoT 2023, consistently outperforming standalone CNN, standalone LSTM, and classical machine learning baselines, and achieving competitive or superior accuracy relative to several recent state-of-the-art hybrid models reported in the literature.

Citer ce document

Accès au document

Texte intégral en lecture en ligne, réservé aux abonnés SPHAERO et aux membres de l'institution. Se connecter

Auteur(s)

Statistiques

Consultations : 1

Téléchargements : 0