A Multi-Model Deep Learning Framework for Enhanced Network Intrusion Detection Across Diverse Datasets

Abstract

Network Intrusion Detection Systems (NIDS) are essential for protecting contemporary communication infrastructures from ever advanced cyber threats. Conventional detection methods frequently inadequately address intricate spatial-temporal correlations in network traffic, leading to diminished detection accuracy and increased false alarm rates. A hybrid deep learning architecture combining Seq2Seq and ConvLSTM subnets is created and assessed on three benchmark datasets: CIC-IDS2017, CIC-ToN-IoT, and UNSW-NB15. The datasets were amalgamated from various source files and underwent thorough preprocessing, encompassing label encoding, one-hot encoding, MinMax normalization, feature selection via SelectKBest, and outlier elimination. Various machine learning and deep learning models were employed, including RandomForest, DecisionTree, Naïve Bayes, XGBRF, CNN, ConvLSTM, Seq2Seq, LuNET, Voting Classifier, and an LSTM+GRU hybrid. Performance was evaluated using accuracy, precision, recall, and F1-score. Experimental findings indicate that the Voting Classifier and LSTM+GRU attained flawless 100% scores across all metrics on CIC-IDS2017 and CIC-ToN-IoT, however RandomForest exhibited superior performance on UNSW-NB15 with 91.5% accuracy and 91.6% F1-score. Moreover, model interpretability is augmented through LIME and SHAP-based explainable AI, offering both instance-level and global feature attribution with enhanced transparency. Simultaneously, a Flask-based web interface integrated with SQLite facilitates secure, user-driven, real-time intrusion prediction and deployment. The framework guarantees precise, comprehensible, and implementable intrusion detection.