Cnn-lstm hybrid deep learning framework for real-time intrusion detection in industrial iot networks

Abstract

With Industrial Internet of Things (IIoT) devices growing rapidly, the attack surface for threats has increased and needs efficient and timely intrusion detection systems (IDS). Existing systems do not consider spatial and temporal information as complementary, and they missed this information, which is valuable for multi-stage attacks detection. This paper proposes a novel CNN-LSTM deep learning architecture, which combines the spatial features extracted from CNNs and the temporal features extracted from two temporal LSTM layers with bidirectional inputs. On the benchmark datasets, NSL-KDD and CIC-IoT23, which have 120,000 labelled packets, the proposed architecture achieves a classification accuracy of 97.8%, precision of 97.4%, recall of 98.1%, and an F1-score of 97.7%, outperforming recent benchmarks, including Transformer variants, with an accuracy of 95.2% and pure BiLSTM networks with an accuracy of 93.4%. The inference time of the system is 2.3ms per packet, which meets the requirements of real-time operation. The ablation experiments confirm the contributions of the CNN and LSTM layers, respectively. The approach proposed can be a fast, light and scalable solution for future IIoT security systems.