AI-Powered Real-Time CNN-LSTM Intrusion Detection: From Streaming Traffic to Actionable Alerts

DOI

https://www.doi.org/10.59256/ijsreat.20260602018

Published In

Volume 6, Issue 2 (2026)

Published Online

March-April 2026

Pages

123-128

Article Type

Original Article

Check for updates

Contemporary intrusion detection systems (IDS) face mounting challenges as network environments grow in scale, heterogeneity, and adversarial sophistication. This paper introduces a real-time IDS grounded in a hybrid deep neural network (DNN) that unifies convolutional and recurrent learning to detect both known and emerging network threats. The architecture pairs a convolutional neural network (CNN), which distills discriminative spatial patterns from per-flow feature vectors, with a long short-term memory (LSTM) network, which models temporal dependencies across sequential traffic observations. Comprehensive evaluation on three established benchmark datasets—NSL-KDD, UNSW-NB15, and CIC-IDS2017—demonstrates that the model achieves 97–99% classification accuracy, surpassing classical machine learning baselines including SVM and Random Forest, and matching the performance of recently published deep learning approaches. The primary contributions are threefold: (1) an end-to-end streaming traffic inference pipeline suitable for real-time deployment, (2) a parameter-efficient hybrid CNN-LSTM architecture optimized for multi-class intrusion classification, and (3) rigorous cross-dataset evaluation establishing the generalizability of the proposed approach. Future research will investigate federated learning extensions for distributed privacy-preserving training and explainable AI techniques for operator-interpretable alert generation