A novel intrusion detection framework using hybrid deep learning to detect IIoT cloud environments attacks.

Skip to main content An official website of the United States government Here's how you know Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Log in Dashboard Publications Account settings Log out Search… Search NCBI Primary site navigation Search Logged in as: Dashboard Publications Account settings Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide PERMALINK Copy As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice Sci Rep . 2026 Apr 7;16:11666. doi: 10.1038/s41598-025-15419-5 Search in PMC Search in PubMed View in NLM Catalog Add to search A novel intrusion detection framework using hybrid deep learning to detect IIoT cloud environments attacks Suha Chen Suha Chen 1 Electrical Engineering and Automation, Xinyang Normal University, Xinyang, 451001 Henan China Find articles by Suha Chen 1, ✉ , Xu Feng Xu Feng 2 Electrical Engineering and Automation, Xinyang, 451001 Henan China Find articles by Xu Feng 2 Author information Article notes Copyright and License information 1 Electrical Engineering and Automation, Xinyang Normal University, Xinyang, 451001 Henan China 2 Electrical Engineering and Automation, Xinyang, 451001 Henan China ✉ Corresponding author. Received 2024 Dec 28; Accepted 2025 Aug 7; Collection date 2026. © The Author(s) 2026 Open Access This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by-nc-nd/4.0/ . PMC Copyright notice PMCID: PMC13062022  PMID: 41946732 Abstract The Internet of Things (IoT) presents considerable hurdles, especially in maintaining security across its swiftly proliferating applications. Administering security protocols and updating individual IoT devices to address emerging risks is resource intensive. Furthermore, the extensive data produced by IoT devices presents a significant opportunity for machine learning to improve threat detection. This study investigates the application of deep learning frameworks for the analysis of IoT network traffic to enhance intrusion detection and strengthen cybersecurity. A hybrid intrusion detection system (HIDS) is suggested, utilizing an iterative ensemble method that combines Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks for enhanced classification accuracy. Adaptive Synthetic Sampling (ADASYN) is utilized to rectify data imbalance, whereas Recursive Feature Elimination (RFE) enhances classifier efficacy by eliminating extraneous features. This comprehensive approach improves detection precision and system robustness against cyber-attacks. The proposed CNN–LSTM-based IDS was evaluated on five benchmark datasets. Across these datasets, the model consistently achieved high performance, including 98.89% accuracy on KDDCup99, 97% on CAN-BUS, 97% on NSL-KDD, and 99% on CICIDS, demonstrating its robustness across diverse IoT-Fog scenarios. Although increasing the model complexity yielded only marginal gains in detection performance, it substantially increased computational demands, indicating diminishing returns from more complex architectures. Customized deep learning approaches combined with effective preprocessing significantly improved IDS performance in IoT-Fog cybersecurity frameworks. Keywords: Intrusion detection system, IoT security, CNN, IoT-fog environments, Attack detection Subject terms: Mathematics and computing, Engineering, Electrical and electronic engineering Introduction One important aspect of the development of internet applications is network security. Nonetheless, throughout the last ten years 1 , 2 , cyberattacks have become more common. Therefore, developing fresh approaches to identify and neutralize these dangers is imperative 3 . Creating novel intrusion detection methods is one practical approach 4 . Fortifying against these cyber-attacks requires the use of IDS, access control, and key management 5 . Among them, IDS emerges as a widely adopted tool for safeguarding network integrity. Cyberattacks today come in many forms, including viruses, Denial of Service (DoS) attacks, and data breaches, which make system and network security extremely difficult to handle 6 , 7 . To counteract these threats, organizations frequently deploy IDSs. These detection methods are typically classified as either signature-based or anomaly-based Network Intrusion Detection Systems (NIDS) 8 , 9 . The main focus of this research is on anomaly-based detection, which aims to identify deviations from established norms, representing typical activities or connections 10 , 11 . Anomaly-based techniques offer the advantage of detecting novel (or 0-day) attacks, unlike their signature-based counterparts, which only recognize known threats 12 . In recent years, the rapid adoption of fog computing in conjunction with IoT has introduced new dimensions of vulnerability. Unlike traditional cloud-centric models, IoT-Fog environments operate with decentralized architectures, bringing computation closer to the edge to meet latency-sensitive demands. This proximity to end devices, while beneficial for performance, significantly expands the attack surface due to limited computational resources, device heterogeneity, and weaker physical protections. Traditional intrusion detection mechanisms often fall short in these environments. Consequently, there is an urgent need for intelligent, lightweight, and adaptable IDS solutions tailored specifically to the IoT-Fog paradigm. The researchers have implemented Intrusion Detection Systems (IDSs) across different platforms to address the security concerns of diverse networks 13 – 15 . In order to examine possible security breaches from different areas inside a network or computer, these intrusion detection systems (IDSs) collect data. ML techniques empower these computers to execute tasks based on generalized data or samples, facilitating self-improvement through learning from available information 16 . Because ML techniques are trained on both common and uncommon traffic patterns, they can detect other attack types, which makes them excellent at identifying unknown attacks in network traffic 17 . However, depending on the dataset, machine learning techniques may or may not be effective 18 . This is especially true when high-dimensional data is present. Redundant or inefficient characteristics are one example of a factor that might slow down computation and reduce identification accuracy 19 , 20 . Given this, Feature Selection (FS) appears to be a more practical method for resolving these issues 21 . In the realm of intrusion detection, both Feature Selection (FS) and Deep Learning (DL) techniques are applied 22 . FS is particularly crucial today due to the abundance of network data attributes, many of which are repetitive or irrelevant. By employing FS, the detection model can concentrate on the most pertinent features, reduce dimensionality, improve interpretability, and enhance detection accuracy 23 , 24 . However, deep learning methods are particularly good at extracting complex patterns and time-related relationships from network traffic data. Complex incursion patterns that could provide a challenge to conventional rule-based or statistical techniques can be identified by DL models 25 – 27 . The network intrusion detection process can be greatly enhanced by combining DL’s skill in pattern recognition with FS’s data pre-processing capabilities. In the dynamic field of network security, this synergy makes it easier to quickly and accurately identify both known and unknown cyberthreats 28 . The present research introduces a network intrusion detection system called HIDS (Hybrid IDS), employing RFE and ADASYN with Deep Learning based on CNN Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) algorithm. CNN and LSTMs are chosen for due to their complementary strengths in handling network traffic data. CNNs are adept at capturing spatial relationships within structured data, such as patterns in packet features or statistical attributes. They efficiently extract hierarchical features, leveraging their convolutional architecture to identify local patterns critical for distinguishing normal from malicious traffic. LSTMs, on the other hand, excel at modeling temporal dependencies in sequential data. Their ability to retain long-term memory enables them to detect anomalies that unfold over time, such as gradual or sustained attacks, while addressing vanishing gradient issues that hinder simpler models like RNNs. Compared to alternative architectures, CNNs and LSTMs offer a balanced trade-off between computational efficiency and performance. While GRUs are simpler and transformers excel at capturing global dependencies, LSTMs provide better modeling for complex, long-term sequences often found in network traffic. Transformers, though powerful, demand substantial computational resources and are less suited for smaller datasets or real-time systems without extensive adaptation. The combination of CNN and LSTM allows IDS systems to capture both static and dynamic patterns in network data, making this hybrid approach particularly effective for detecting a wide range of intrusions. The following is a summary of this study’s main contributions: Development and application of a hybrid intrusion detection system (HIDS): This study introduces and implements a novel HIDS tailored for IoT-Fog environments, integrating CNN and LSTM architectures to capture both spatial and temporal characteristics in network traffic. The model’s hybrid structure enhances detection accuracy and generalization, particularly for complex, sequential intrusions. Combined with ADASYN for data balancing, HIDS addresses real-world data imbalance challenges and improves detection robustness. Implementation of a feature extractor method: The proposed hybrid method incorporates Recursive Feature Elimination (RFE) mechanism to identify the informative features from the dataset. This not only improves the accuracy of IDS models but also enhances their interpretability by focusing on key indicators of intrusion. Improve performance: Experimental results demonstrate the model’s superior performance across benchmark datasets, achieving high detection accuracy and generalizability, with a detailed analysis of its efficiency and interpretability challenges. This study evaluates the proposed Hybrid IDS (HIDS) using five widely recognized benchmark datasets: KDDCup99, NSL-KDD, CAN-BUS, CICIDS, and Bot-IoT. These datasets collectively cover a spectrum of IoT-Fog attack scenarios, from traditional network intrusions (KDDCup99, NSL-KDD) to vehicular networks (CAN-BUS) and modern IoT traffic (CICIDS and Bot-IoT). The remainder of this paper is structured as follows. Section " Related works " discusses related works, providing an overview of existing intrusion detection techniques and highlighting their limitations. Section " Proposed method " outlines the proposed hybrid deep learning method, detailing its preprocessing, feature selection, and ensemble classification components. Section " Experiments and results " describes the experimental setup, including datasets and evaluation metrics, followed by a detailed presentation of the results in. Conclusion and future work concludes the paper, summarizing the findings and offering insights for future research. Related works According to anomaly-based IDS, an attack is any departure from the norm. When creating IDSs for IoT, one must take into account some constraints because of the intrinsic structure of IoT. A review of several IDS systems has been done in the literature. A synopsis of IDS research created especially for IoT intrusion detection is provided in this section. Anomaly detection To improve security in IoT contexts, an anomaly-based IDS designed for the Internet of Things has been created. Using a fog-cloud architecture, this novel approach combines machine learning (ML) and deep learning (DL) methods to create ensemble learning, which identifies anomalous communication patterns and prevents cyberattacks. In order to distinguish between normal and attack events, the method feeds the outputs of a succession of LSTM) networks into a decision. Additionally, the study presents an architecture that suggests deploying the IDS as Software as a Service (SaaS) in the fog and Infrastructure as a Service (IaaS) in the cloud. The ToN-IoT dataset is used to evaluate the effectiveness of this technology 30 . The study’s noteworthy contributions include the development of a real-time IoT traffic analysis system and the idea of implementing security protocols as SaaS and IaaS, which effectively solve the issues that come with operating in an IoT context. To standardize and validate Machine Learning (ML)-based Intrusion Detection Systems (IDSs) utilized inside federated learning (FL) architectures for Internet of Things (IoT) applications, a multicriteria decision-making (MCDM) framework has been developed. Stopping techniques In the realm DL models, Early Stopping Techniques play a crucial role. Early stopping is a regularization technique employed during the training phase of DL models to prevent overfitting and enhance generalization performance. The concept behind early stopping is to halt the training process when the performance on a validation dataset starts to degrade, indicating that further training may lead to overfitting. As a result, the model is able to generalize well to new data and is kept from unduly memorizing the training set. In 29 talk on when to stop early and stress the importance of choosing the ideal stopping point using a thorough approach. The possibility of quickly generating more accurate progress estimates by carefully placing additional validation sites in between the original ones during early pausing is demonstrated in 30 . This emphasizes even more how early halting is relevant in a wide range of domains. in 31 provide an online evaluation metric for side-channel analysis and apply it for early stopping in already-existing Convolutional Neural Networks in order to further highlight the broad variety of applications of early stopping beyond conventional deep learning tasks. These illustrations highlight the range of circumstances in which early halting can be beneficial. Stopping techniques in the IoT Early stopping techniques in the context of IoT typically refer to strategies used in machine learning algorithms deployed on IoT devices or edge computing nodes. The goal of early stopping techniques is to improve the efficiency of model by stopping the training process when certain criteria are met. By implementing early stopping techniques in IoT applications, developers can ensure that machine learning models are trained efficiently, effectively utilize limited computational resources, and adapt to changing data patterns in real-time environments. Additionally, 32 conducted a survey of machine learning and deep learning techniques for Internet of Things security, emphasizing the broad use of learning algorithms in practical contexts and the improvement of training approaches for IoT security 33 . provided evidence of the effectiveness of deep learning in botnet attack detection, highlighting the significance of early halting strategies in deep learning model training for IoT network security. The study in 34 proposed a lightweight intrusion detection model for Industrial IoT networks (GA-mADAM-IIoT), combining a genetic algorithm for feature selection with an attention mechanism and LSTM to process multivariate sensor time-series data. Its hybrid design improved efficiency in detecting subtle threats while keeping the model computationally lean, a concept relevant to our approach’s balance of performance and resource use. The authors in 35 introduced an explainable privacy-preserving IDS that integrates scaled dot-product attention within Cyber Physical System–Industrial IoT networks (CPS-IIoT-P2Attention). By prioritizing sensitive data protection while maintaining strong detection capabilities, this work underscores the growing importance of privacy-conscious deep learning IDS designs, which parallels future extensions of our HIDS. In 36 , researchers developed an explainable ensemble transfer learning framework to detect zero-day botnet attacks in Internet of Vehicles traffic named XAIEnsembleTL-IoV. Its integration of Explainable AI techniques demonstrates the value of interpretability in IDS models, complementing our own vision of incorporating transparency features into CNN–LSTM architectures. The authors in 37 focused on a privacy-preserving deep neural network for anomaly detection in CPS-enabled IoT systems (CPS-IoT-PPDNN) to emphasizing resilience and explainability. Its methodology highlights how combining detection performance with user trust is increasingly critical, aligning with our model’s goal of balancing effectiveness and operational transparency. A hybrid autoencoder and modified particle swarm optimization approach for IoT intrusion detection proposed in 38 to demonstrate how metaheuristic-based feature selection can improve IDS performance by reducing irrelevant data. This work provides context for our choice of RFE as a feature reduction strategy, showing multiple paths toward streamlined input representations. Finally, the study in 39 proposed a deep hybrid model for intrusion detection in industrial control systems, combining convolutional layers for spatial pattern extraction with LSTM for sequence learning. This architecture reinforces the validity of fusing CNN and LSTM, supporting our approach while demonstrating that hybrid temporal-spatial frameworks are state-of-the-art in IDS research. Table 1 shows a comparison between the solutions reviewed in the related works. Table 1. Comparative of various IDS works. Reference Methodology/Technique Strengths Limitations 13 Fog-cloud architecture combining ML and DL Real-time IoT traffic analysis, SaaS and IaaS deployment for security Computational overhead in cloud-fog integration 14 Multi-criteria decision-making (MCDM) framework with fuzzy Delphi method Standardized evaluation criteria for ML-based IDS in IoT Complexity in integrating evaluation criteria across systems 28 NetFlow-based feature set for network IDS Scalable and flexible feature extraction Limited implementation in real-world networks 29 Gini Impurity-based Weighted Random Forest Addresses class imbalance effectively Poor performance on multiclass classification 30 Transfer learning for intrusion detection Effective for zero-day attacks, knowledge transfer High computational cost, resource-intensive 31 Dynamic patience parameter for early stopping Balances overfitting and underfitting Computational complexity in real-time adjustments 34 Grey Wolf Optimization with MapReduce for service composition Efficient resource allocation in cloud-based IoT Limited applicability to small-scale systems 35 Comprehensive survey of IoT IDS Identifies challenges and future directions in IDS research Lacks practical implementation examples 36 Hybrid optimization for industrial IoT data aggregation Enhances data accuracy and reliability Complexity in deployment for large networks 37 Blockchain-based intrusion detection for IoT Drones Robust security and scalability High computational resource requirements 38 Systematic review of ML in Internet of Drones Highlights AI potential in IoT security Requires integration with other technologies 39 Hybrid deep learning for IoT intrusion detection Combines feature extraction and classification effectively High training time and resource requirements Open in a new tab Also, a comparative analysis between deep learning models is shown in Table 2 . Table 2. Comparative analysis between deep learning models. Model Strengths Weaknesses Suitability for IDS RNN Captures temporal patterns in sequences Prone to vanishing gradients; struggles with long-term dependencies Outdated for IDS tasks due to lack of stability and scalability GRU Efficient and simpler than LSTM; good for short-term dependencies May underperform in modeling complex, long-term dependencies Suitable for some IDS tasks but less robust than LSTM CNN Excels at spatial feature extraction; computationally efficient Cannot model temporal relationships Effective for feature extraction but insufficient alone for IDS LSTM Handles long-term dependencies; stable for sequential data Computationally intensive compared to GRUs Strong choice for IDS when temporal modeling is critical Transformers Captures global attention and long-range dependencies High computational cost; less effective for small datasets Suitable for large-scale IDS but may require preprocessing and resources Open in a new tab Proposed method In this study, an effective ensemble classification technique is used to create a strong intrusion detection system. The following are the main procedures in this study: Preprocessing: Preparing the acquired dataset for analysis by cleaning, transforming, and organizing the data. Oversampling using ADASYN: Use the Adaptive Synthetic Sampling Method (ADASYN) for generating synthetic samples for minority classes in order to address the problem of data imbalance. Feature elimination using RFE: Utilizing Recursive Feature Elimination (RFE) to eliminate irrelevant features from the data set, enhancing the efficiency and effectiveness of the IDS. Ensemble classification: Implementing an ensemble classification method using hybrid deep learning model, specifically the LSTM and CNN algorithm to improve the prediction performance of the IDS by combining multiple classification models. Overall, this approach aims to tackle data imbalance, enhance feature selection, and boost prediction accuracy, ultimately resulting in the creation of an intrusion detection system for network security that is more reliable and efficient. Preprocessing using min–max scaling Equation ( 1 ) shows how the preprocessed data from the datasets are transformed and rescaled to fall between 0 and 1. This is done by applying min–max scaling. 1 where: X represents the input data. X' is the preprocessed output data. X min represents input data’s minimum value. X max represents input data’s maximum value. Figure 1 illustrates the complete architecture of the proposed Hybrid IDS model. The system starts with data preprocessing using Min–Max normalization and ADASYN to handle imbalance. Feature selection is then performed via RFE to reduce dimensionality. The selected features are passed through two 1D-CNN layers followed by max and average pooling. The output is then processed through an LSTM layer to capture sequential patterns. Finally, a dense layer with softmax activation classifies the traffic type. This pipeline ensures efficient detection of both static and time-dependent anomalies in IoT-Fog network traffic. Fig. 1. Open in a new tab schematic diagram of the proposed method. Oversampling data We employ Adaptive Synthetic Sampling (ADASYN) in this method to improve oversample the data. ADASYN, like the SMOTE and Random Under-sampling, is method for addressing class imbalance, but they differ in their approaches and effectiveness. ADASYN and SMOTE are both oversampling techniques that generate synthetic samples for the minority class, but ADASYN adapts the generation process to focus on regions where the data is sparse or classification is difficult. This makes ADASYN more effective in improving recall and achieving a balanced precision-recall trade-off. SMOTE, in contrast, creates synthetic samples uniformly for all minority class instances, which can sometimes result in redundant samples or noisy data near decision boundaries, leading to suboptimal performance in complex datasets. Random Under-sampling, on the other hand, reduces class imbalance by randomly removing samples from the majority class. While it simplifies the dataset and reduces computation, it often sacrifices valuable information, which can negatively impact the classifier’s performance. ADASYN avoids this issue by retaining all original samples and enhancing the minority class representation, making it more suitable for smaller or complex datasets. Although ADASYN is computationally more intensive, its adaptive nature often results in better detection of minority class instances and superior performance metrics, particularly in tasks like anomaly detection. ADASYN is an oversampling technique that tackles class imbalance by generating synthetic data points for the minority class, with emphasis on areas where the data distribution is sparse, or classification is difficult. It begins by calculating the complexity of each minority sample using the proportion of majority-class neighbors in its k-nearest neighborhood. Minority samples in more challenging regions (those with more majority-class neighbors) are assigned higher weights, ensuring that more synthetic data is generated in these areas. The synthetic samples are created by interpolating between a minority sample and its nearest neighbors, adaptively increasing representation where needed. By adapting to the local density of data points, ADASYN helps mitigate the challenges posed by severe data imbalance in classification tasks. The steps involved in the ADASYN algorithm are typically as follows: Calculate the class imbalance ratio: Find the ratio in the dataset between the number of samples from the majority class and the minority class. Determine the amount of synthetic samples to generate: Determine how many synthetic samples are needed for each sample from a minority class. This is dependent on the ratio of class imbalance, where larger ratios lead to the production of more synthetic samples 40 . 2 In the context of ADASYN, where: - n s indicates how many samples of minority classes there are in the dataset. - n b indicates how many samples of majority classes there are in the dataset. - β is a parameter that determines the balance between generating synthetic samples for minority and majority classes. It typically lies between 0 and 1. Identify the k-nearest neighbors Determine the k-nearest neighbors of each minority class sample from both the majority and minority classes. One parameter that needs to be supplied is the value of k. 3 where K is the total number of neighbors both minority and majority class samples—considered for each minority class sample, and k is the number of nearest neighbors taken into account for each minority class sample. Calculate imbalance ratio of KNN: For every minority class sample, find the imbalance ratio between the total number of neighbors and the number of neighbors in the minority class. Compute the synthetic samples: Create synthetic samples for each minority class sample by calculating the imbalance ratio of its k-nearest neighbors. When the imbalance ratio of the minority class samples is lower, more synthetic samples are produced; when the imbalance ratio is higher, fewer synthetic samples are produced. Equation ( 4 ) is used to determine how many samples must be synthesized for each minority sample, and Eq. ( 5 ) is used to produce the samples 41 . 4 5 where g is the samples number needs to be synthesized, a sample that synthesized is denoted as , the minority sample that is in use at the moment is represented as Xi, a random minority sample among d neighbors is denoted as XZi . The synthetic samples made by ADASYN look a lot like the feature space of the original minority class cases, but they highlight areas where classification is harder. ADASYN doesn’t just add fake points evenly; it makes synthetic samples in locations where there aren’t many minority points or around decision boundaries. This leads to: Contextually relevant data points: The synthetic records keep realistic combinations of network parameters (such protocol type, service, or packet flow statistics) that seem like real minority-class traffic patterns and show rare attack behaviors. Better decision boundaries: These samples fill in gaps in the feature space, which makes the IDS less biased toward the majority class. This helps it find unusual but important incursions like R2L or U2R assaults in KDDCup99 or spoofing attacks in CAN-BUS. Balanced representation: The CNN-LSTM model can learn meaningful differences between attack types that were previously relatively rare, which improves recall and F1-score across all datasets. Overall, adding ADASYN-generated samples makes the training set richer and more balanced, which helps the hybrid IDS find small differences and attack patterns that weren’t as common before without overfitting to the majority class. Imbalance ratio The Imbalance Ratio (IR) is a key metric in ADASYN that quantifies how unevenly distributed the classes are in the dataset 42 . ADASYN uses IR to determine how many synthetic samples need to be generated for each minority class to achieve a desired balance. A higher IR means that more synthetic samples will be created to close the gap between majority and minority instances. The Imbalance Ratio is calculated as Eq. ( 6 ). 6 where ​ is the number of majority-class samples and ​ is the number of minority-class samples. ADASYN uses this ratio to determine how many synthetic points each minority instance requires, higher IR values trigger more synthetic data generation. The IR = 1 indicates the best balance between the data sets and IR = 0 indicates the more severely imbalanced in dataset. For example, if IR = 50, there are 50 times more majority-class samples than minority-class samples. By reducing IR, ADASYN enables the classifier to see enough examples of each class, which: Improves recall for rare attack types. Prevents the classifier from being biased toward the majority class. Leads to more balanced F1-scores across all classes. Feature selection Finding features that have a beneficial effect on results and removing those that introduce errors is the main goal of feature selection. Strongly correlated features with the target attribute are selected to improve computational efficiency and model performance. For feature selection, we used the wrapper technique with Recursive Feature Elimination (RFE) 43 . Using this strategy, the input data is divided into distinct subgroups, and then different models are created depending on these subsets. The top features are then selected using particular performance measures. Here’s a detailed explanation of why RFE is often the method of choice for feature selection in IDS systems. Selection criterion RFE is a model-based feature selection method that works by removing the least important features over and over again, using a model’s importance score to do so. This makes it a great choice for IDS systems, where the importance of features may not be clear right once. RFE relies on an underlying model to evaluate the importance of features during the elimination process. In this study, we used a Random Forest Classifier as the underlying estimator for RFE because of its proven effectiveness in handling high-dimensional intrusion detection datasets and its ability to provide robust, non-linear feature importance rankings 5 . The Random Forest model assigns an importance score to each feature based on the mean decrease in Gini impurity (i.e., how much each feature contributes to correctly classifying samples across decision trees). At each RFE iteration, the least important feature (lowest importance score) was removed, and the model retrained on the remaining features. This iterative elimination ensured that only features with the greatest predictive contribution were retained. To avoid underfitting (too few features) or overfitting (too many features), we evaluated model performance (accuracy and F1-score) after each iteration of feature removal. The process continued until the model’s performance stabilized or began to decline. In practice, we identified an “elbow point” where removing more features did not produce meaningful accuracy gains. Across datasets, this resulted in 10 retained features for KDDCup99 and NSL-KDD, 7 retained features for CAN-BUS, and 10 retained features for CICIDS (as summarized in Table 1 ). This process ensured that the final feature sets were optimal for detection performance while also reducing computational complexity. Improve performance By eliminating irrelevant and redundant features, RFE helps improve the performance of the IDS in multiple ways: Reduce overfitting: A smaller collection of features lowers the chance of overfitting, which happens when the model gets too complicated and picks up noise in the data instead of patterns that can be used in other situations. This is especially important for IDS systems, since assaults might alter and feature distributions can shift over time. More generalization: RFE makes the model better at generalizing to new data by keeping only the most important features. This makes intrusion detection more accurate. Faster training and inference: A smaller number of features means that training and making predictions happen faster. This is very important for real-time IDS systems that need to swiftly process and analyze network data. Transparency and interpretability Interpretability is a key consideration for IDS systems, particularly when the model needs to explain why a particular traffic event was classified as an intrusion. RFE enhances the interpretability of the feature set by selecting a smaller, more meaningful subset of features. Model transparency : By focusing only on the most relevant features, RFE makes it easier to understand the reasoning behind intrusion detection decisions. This transparency is valuable for security teams who need to verify and trust the IDS’s predictions. Feature importance : RFE also provides a ranking of features based on their importance in the model. This ranking can be used to understand which traffic attributes contribute most to detecting intrusions. Compatibility with various models Another significant advantage of RFE is that it is model agnostic, meaning it can be used with different machine learning algorithms. In an IDS context, this allows flexibility in selecting the best model for the task at hand. Use with different models : RFE can work with a variety of models such as Support Vector Machines (SVM), Random Forests, Logistic Regression, and even deep learning models. This flexibility allows the IDS to be adapted to different types of traffic data or attack detection strategies. Adaptability: If the performance of the IDS system degrades over time due to changes in traffic patterns or new types of attacks, the choice of the underlying model can be adjusted without changing the feature selection process. Following the application of RFE to all four datasets (KDDCup99, CAN-BUS, NSL-KDD, and CICIDS), the most informative subset of features was identified for each dataset. This reduction makes sure that just the most important features for intrusion detection stay in the model, which makes it easier to understand and faster to compute. These chosen features pick up on important signs of strange network activity. For instance, src_bytes , and dst_bytes (from KDDCup99 and NSL-KDD) are important signs of how traffic flows, whereas message_ID and payload_length from CAN-BUS show changes in vehicle communications. CICIDS kept statistical flow attributes (such flow_duration and fwd_packet_length_mean ) that clearly show the difference between regular and malicious traffic. The reduced feature sets that obtained through RFE for all datasets are shown in Table 3 . Table 3. Reduced feature sets obtained through RFE for all datasets. Dataset Features retained (Top RFE-Selected Attributes) KDDCup99 protocol_type, service, src_bytes, dst_bytes, flag, serror_rate, srv_serror_rate, dst_host_count, dst_host_srv_count, count CAN-BUS message_ID, DLC, payload_length, transmission_rate, signal_pattern, error_flag, timestamp NSL-KDD protocol_type, service, flag, src_bytes, dst_bytes, count, srv_count, dst_host_count, dst_host_same_srv_rate, dst_host_diff_srv_rate CICIDS flow_duration, fwd_packet_length_mean, bwd_packet_length_mean, flow_packets_s, flow_bytes_s, packet_length_variance, avg_packet_size, init_win_bytes_fwd, fwd_header_length, subflow_fwd_packets Open in a new tab Also, Table 4 shows a comparison between feature selection and dimensionality reduction methods. Table 4. Comparison between feature selection and dimensionality reduction techniques. Method Approach Advantages Disadvantages Suitability for IDS RFE Iteratively removes the least important features based on a predictive model’s importance scores - Identifies the most relevant features - Considers feature interactions - Model-agnostic and interpretable - Computationally expensive for very high-dimensional data - Dependent on the choice of base model Highly suitable for IDS, especially when interpretability and domain-relevant features are critical PCA Reduces dimensionality by transforming features into orthogonal principal components - Fast and computationally efficient - Captures variance in the data - Unsupervised, requiring no labels - Loses feature interpretability - May not prioritize features critical for classification Useful for preprocessing IDS data but less effective when interpretability of features is necessary Wrapper Uses a predictive model to evaluate subsets of features and selects the subset that produces the best model performance - More accurate than filter methods - Considers feature interactions - Computationally expensive - Prone to overfitting, especially with small datasets Suitable for IDS when model accuracy is the priority, but computational cost must be considered Autoencoders Neural networks designed to learn compressed latent representations of input features - Can capture nonlinear relationships between features - Effective for high -dimensional data - Requires large datasets and significant computational resources - Black-box approach, reducing interpretability Suitable for IDS with large-scale data and complex patterns but less ideal when transparency is required Open in a new tab In the proposed method the RFE was used to rank our features based on their significance, as shown in Fig. 2 . The algorithm for RFE must run repeatedly until the required number of features is chosen. To find the most pertinent features in a dataset, machine learning practitioners frequently utilize the RFE technique. When working with high-dimensional data where the number of features is high in comparison to the number of samples it is very helpful. Fig. 2. Open in a new tab Features in KDD99 dataset. Here’s how Recursive Feature Elimination works: Model training: RFE starts by training a machine learning model on the entire set of features. Feature ranking: Once the initial model is trained, RFE ranks the features based on their importance or contribution to the model’s performance. The importance of features is typically measured using coefficients (for linear models) or feature importance’s (for tree-based models). Feature elimination: The least important feature (or features) is removed from the dataset. Model retraining: The model is then retrained on the reduced feature set. Iteration: Until the desired level of performance is attained or a set number of features are reached, steps 2–4 are repeated. The key idea behind RFE is that through the iterative removal of the least significant features and retraining the model, it focuses on the most relevant features, leading to a simpler and potentially more interpretable model without sacrificing predictive performance. In the KDD99 process, After obtaining the required dataset through RFE, we used the “n_features_to_select” argument to extract the top 10 features. We eliminated unnecessary data in NSL-KDD by choosing a subset of pertinent features. Deep learning This paper suggests an IDS model based on CNN-LSTM, whose architecture is shown in Fig. 1 . The CNN, LSTM, feature fusion, and data preprocessing components make up the majority of the model. To satisfy the needs of the neural network, the input is numerically processed and standardized in the data preprocessing component. Convolutional, pooling, and fully connected (FC) layers make up the CNN component, which is primarily responsible for extracting local features and determining whether the feature distribution of the electricity consumption data is normal. The fundamental purpose of the LSTM component, which consists of several LSTM cells, is to employ its memory ability to identify the periodicity of electrical information. The structure of the proposed model is illustrated in Fig. 3 . Fig. 3. Open in a new tab Deep learning model architectural diagram. The CNN, LSTM, feature fusion, and data preprocessing components make up the majority of the model. To satisfy the needs of the neural network, the input is numerically processed and standardized in the data preprocessing component. Convolutional, pooling, and fully connected (FC) layers make up the CNN component, which is primarily responsible for extracting local features and determining whether the feature distribution of the electricity consumption data is normal. The fundamental purpose of the LSTM component, which consists of several LSTM cells, is to employ its memory ability to identify the periodicity of electrical information. The proposed hybrid CNN–LSTM architecture integrates two convolutional layers for spatial feature extraction and one LSTM layer for sequential dependency modeling. All layers were tuned for balanced performance and computational feasibility in Fog-IoT environments. As shown in Table 5 , the CNN layers use ReLU activation to efficiently extract hierarchical features, while the LSTM layer uses dropout regularization (0.2 dropout, 0.4 recurrent dropout) to avoid overfitting. A softmax output layer provides multi-class predictions. Training was performed using the Adam optimizer with a learning rate of 0.001, batch size of 64, and 50 epochs (with early stopping applied to prevent unnecessary training once validation loss plateaued). These configurations ensured both high detection accuracy and reasonable computational costs, aligning with the lightweight requirements of Fog-IoT systems. Table 5. Detailed model architecture and training specifications. Component Specification Input Layer Normalized feature vectors from preprocessed datasets (10–12 selected features after RFE) CNN Layer 1 128 filters, 1D convolution, kernel size = 8, activation = ReLU Max Pooling Pool size = 2 CNN Layer 2 64 filters, 1D convolution, kernel size = 4, activation = ReLU Average Pooling Pool size = 2 LSTM Layer 140 units, dropout = 0.2, recurrent dropout = 0.4 Dense Layer Fully connected, 128 neurons, activation = ReLU Dropout 0.3 applied to Dense Layer to prevent overfitting Output Layer Softmax activation for multi-class classification Optimizer Adam optimizer Learning Rate 0.001 Batch Size 64 Epochs 50 (with early stopping applied) Loss Function Categorical cross-entropy Open in a new tab Convolutional neural network (CNN) Among the deep learning algorithms based on an artificial neural network architecture is the CNN algorithm. Figure 4 shows its basic architecture, which consists of an input layer, two pooling layers, two FC layers, four convolutional layers, and two pooling layers. The core of CNN, responsible for processing data from a receiving cell, is the convolution layer. The computation for the output volume (W o ) size is shown in Eq. ( 7 ) and is defined as follows: 7 where the variables P, Wi, S, and M stand for the stride, input volume size, kernel size of the convolutional layer neurons, and amount of zero padding, respectively. Fig. 4. Open in a new tab CNN algorithm structure. The convolutional layer’s job is to take features out of the data. It is composed of several convolution kernel layers, each of which is associated with a weight and a deviation coefficient. The weight coefficient, bi, and the input of convolutional layer I are supposed to equal X j−1 , weigh t i , and b i , respectively, when the convolution kernel (i) is operating. One way to express the convolution process is: 8 where f(x) is the activation function, ⊗ denotes the convolution operation, and Xj is the output result of convolution kernel I. The characteristic information is extracted from the input data by the convolution kernel by frequent sweeping. Furthermore, ReLU is used as the convolutional layer’s activation function. The ReLU activation function is simpler to derive than the sigmoid, tanh, and other activation functions 44 . This makes it possible to avoid gradient disappearance and expedite model training. ReLU can be written as follows: 9 Through down sampling, the pooling layer removes redundant information from the CNN, achieving invariance and reducing CNN complexity. Average pooling and maximum pooling are the two primary methods for finishing pooling. When pooling data, average pooling selects the calculation area’s average value as the pooling result, whereas max pooling selects the area’s maximum value as the pooling result. In the current study, the maximum pooling method is used since it can preserve more important information than average pooling. Max pooling is shown as follows: 10 where Maximum is the max pooling operations, p is the element (n) of the pooling area r, and is the output result of the pooling region j. FC layers serve as the CNN’s overall "classifiers." Their primary job is to remap the features of the pooling and convolutional layers from the hidden-layer space to the sample-marker space by weighting them. To avoid over-fitting, a corresponding dropout procedure is configured in the FC layer to randomly remove neurons. Long short-term memory (LSTM) The RNNs class that includes the LSTM method is able to learn long-term dependencies and store sequential data in memory. It deals with the vanishing gradient issue that RNNs have by virtue of the gradient updates’ slow decline over computation. Tasks requiring time series data are especially well-suited for LSTM. Because of its characteristics, it can be used in a variety of fields, including speech recognition, video processing, and natural language processing. Cells, or memory blocks, are the fundamental building pieces of the LSTM algorithm. Three fundamental components make up the LSTM algorithm, as shown in Fig. 5 : the forget gate (ft), input gate (it), and output gate (ot). Data input and output at time t are made easier by input and output gates. By comparing the current data inputs with the previous state, the forget gate decides which data to keep and which to discard. Fig. 5. Open in a new tab LSTM architecture. The following mathematical formula describes how the gates in an LSTM relate to one another: 11 12 13 14 15 16 Definition of model To improve IDS, a hybrid deep learning model was created utilizing LSTM and one-dimensional (1D) CNN algorithms. The model features a layer-by-layer sequential method. The suggested model’s flow diagram is displayed in Fig. 6 . Fig. 6. Open in a new tab Flow diagram of proposed model. In the created sequential model, the input layer comes first. The size of the dataset is described in this layer. Figure 6 illustrates how two CNN algorithms were used. To get the best results, the CNNs’ parameter settings were changed. Table 6 displays these parameters in tabular form. The application of the pooling layer came after the convolution procedure. Reducing the dimensionality of the extracted feature matrix is the primary function of the pooling layer. Vital information is maintained in the pooling layer while the processing load is decreased. Between the first and second CNNs, max pooling was used, and following the second CNN, average pooling. The LSTM algorithm was applied successively after CNN. The LSTM method that is being used has the following parameters set: units = 140, dropout = 0.2, and recu_drop = 0.4. The flatten layer’s size were adjusted for the dense layer following the application of the LSTM algorithm. Dense layers referred to as fully connected layers come after the flatten layer. A 30% ratio was used to implement the dropout function. The inclusion of the dropout layer prevents the algorithm from overlearning. The function of this layer is to randomly ignore particular nodes. This somewhat alludes to a scenario where neurons can alter how they rectify each other’s mistakes. Table 6 . The CNN parameters. Filters Num Size of kernel Activation CNN D1 128 8 ReLu CNN D1_2 64 4 ReLu Open in a new tab In both CNN algorithms, the activation function was the ReLu function (16). Because it removes negative numbers and simplifies computation, the ReLu function was used. 17 The softmax activation function comes at the end of the model’s output layer. Using this function, one can get the most likely label in terms of probability by computing the probability of the maximum value for the sample under evaluation in a multiclass probability problem 45 . It should be mentioned that deep learning models like CNN and LSTM are very expressive, which makes them great for finding complicated patterns in IoT-Fog network traffic. However, they are also susceptible to overfit, which means they learn noise that is peculiar to a dataset instead than generalizable incursion patterns. To fix this, a number of complimentary solutions we were used: Dropout regularization: We added dropout layers after the LSTM and Dense layers. During training, these layers randomly “dropped” 20–30% of neurons. This stops the model from depending too much on certain neurons and helps it create stronger feature representations. Early halting: Validation loss was used to keep an eye on training, and early halting happened when performance stayed the same for five epochs in a row. This kept the model from getting too good at training, which may happen if it was trained too often. L2 Weight regularization: We added a tiny L2 penalty to the weights of the convolutional and dense layers to stop them from being too big and make the model more general. k-fold cross-validation: While tweaking the hyperparameters, we used fivefold cross-validation. We separated each dataset into five folds. The model was trained on four of the folds and tested on the fifth, going through all of the folds. This made sure that the performance evaluation and tweaking were strong and could be used for more than just one train-test split. Balanced training batches: we added more data from ADASYN to the training batches in a way that kept the number of samples from each class equal. This made it less likely that the model would memorize patterns from the majority class and made it better at defending against attacks from the minority class. These methods worked together to lower the danger of overfitting and greatly increase the model’s ability to generalize to new IoT-Fog data, as seen by its consistently good performance on all five datasets. Computational complexity The computational complexity of the proposed hybrid CNN-LSTM model are influenced by several factors, here’s a detailed discussion based on computational complexity. Hybrid nature (CNN-LSTM) CNN Component : Convolutional layers process data in spatial dimensions, with a complexity of where n and m are the input dimensions, k is the kernel size, and c is the number of filters. This makes CNNs computationally expensive for large input data. LSTM Component : LSTMs introduce temporal dependencies with a complexity of , where n is the sequence length and h is the hidden state size. This is relatively expensive, especially for long sequences. Combination : Combining CNNs and LSTMs increases the complexity due to sequential processing. CNNs extract features first, which are then passed to LSTMs, demanding significant computational resources compared to simpler models like Logistic Regression or Random Forests. Dropout and POOLING : Dropout layers and pooling (max and average) help reduce overfitting and dimensionality but add minor computational overhead. Experiments and results This section explains assessment measures that are commonly used to assess the performance of deep learning models. The characteristics of a confusion matrix, a two-dimensional matrix with information on the Actual and Predicted classes, including True Positive (TP), False Negative (FN), False Positive (FP), and True Negative (TN), serve as the foundation for these measures. 18 19 20 21 22 23 Dataset This study assessed the effectiveness of the hybrid neural network-based intrusion detection system (HIDS) method using four datasets: KDDCup99, CAN-BUS, NSL-KDD, and CICIDS. KDDCup99 dataset The KDDCup99 dataset is derived from the 1998 DARPA Intrusion Detection Evaluation Program and is one of the most widely used datasets for evaluating intrusion detection systems. Number of records: Approximately 4.9 million in the full dataset; a reduced 10% subset of 494,021 records. Features: 41 features and a label for classification. Features include categorical attributes (e.g., protocol type, service) and numerical attributes (e.g., packet statistics). Attack types: Classified into 5 main classes: o Normal: Legitimate traffic. o Denial of Service (DoS): Overloads resources (e.g., Smurf, Neptune). o Probe: Scans for vulnerabilities (e.g., Satan, Portsweep). o Remote to Local (R2L): Gains local access (e.g., Guess_Password, FTP_write). o User to Root (U2R): Escalates privileges (e.g., Buffer_overflow, Rootkit). Class distribution in the 10% subset: o Normal: ~ 20% (97,278 samples) o DoS: ~ 79% (391,458 samples) o Probe: ~ 1% (4,107 samples) o R2L: < 1% (1,126 samples) o U2R: < 0.01% (52 samples) CAN-BUS dataset The CAN-BUS dataset is used for evaluating intrusion detection systems in the context of automotive security, focusing on vehicular networks. Number of records: Varies by specific implementations; often in the range of thousands to millions depending on the dataset version. Features: Raw CAN messages with fields such as message ID, data length code (DLC), and data payload. Attack types: Common attacks include: o Fuzzing: Injects random or malformed messages. o Replay: Re-sends previously captured messages. o Denial of Service (DoS): Floods the bus to disrupt legitimate communication. o Spoofing: Sends forged messages to mimic legitimate devices. Class distribution: Typically imbalanced with normal traffic dominating the dataset, reflecting real-world automotive systems. NSL-KDD dataset The NSL-KDD dataset is an improved version of KDDCup99, addressing its major issues like redundancy and imbalance. Number of records: o Training set: 125,973 samples o Testing set: 22,544 samples Features: 41 features and a label similar to KDDCup99. Attack types: Same as KDDCup99 (Normal, DoS, Probe, R2L, U2R) but with refined distribution. Class distribution in the training set: o Normal: ~ 53% (67,343 samples) o DoS: ~ 40% (45,927 samples) o Probe: ~ 4% (11,656 samples) o R2L: ~ 2% (995 samples) o U2R: < 1% (52 samples) Advantages: Balanced testing sets and removal of duplicate records for fairer evaluation. CICIDS dataset The CICIDS dataset was developed by the Canadian Institute for Cybersecurity and is one of the most comprehensive modern intrusion detection datasets in year 2019. Number of records: ~ 16 million network flow records across multiple days. Features: 80 statistical features derived from network traffic flows (e.g., packet length, duration, flow byte rate). Attack types: Includes modern attack scenarios: o DoS/DDoS: Distributed denial of service. o Brute Force: Password cracking attempts. o Botnet: Command-and-control traffic. o Web Attacks: Exploits like SQL injection and XSS. o Infiltration: Compromises internal hosts. o Others: Cryptocurrency mining, data exfiltration. Class distribution: o Normal: ~ 80% of the data o Attack categories vary depending on specific traffic days. Advantages: Captures realistic modern attack scenarios with diverse traffic patterns and up-to-date vulnerabilities. A summary of the data set is shown in Table 7 . Table 7. Summary of the data set. Dataset Total records Features Attack types Key characteristics KDDCup99 ~ 4.9 M 41 DoS, Probe, R2L, U2R Highly imbalanced, outdated attack types CAN-BUS Thousands to millions Raw CAN data Fuzzing, Replay, DoS, Spoofing Focuses on automotive network attacks NSL-KDD ~ 148K 41 DoS, Probe, R2L, U2R Balanced test set, reduced redundancy CICIDS ~ 16M 80 Modern attacks (e.g., DDoS, Web Attacks) Realistic modern attack scenarios Open in a new tab Test 1 In this study, the efficacy of the hybrid neural network-based intrusion detection system (HIDS) technique was evaluated using four datasets: KDDCup99, CAN-BUS, NSL-KDD, and CICIDS. The findings of this study were contrasted with methods in 9 . Metrics like accuracy, precision, recall, and F1-score were used to compare the two. Its utilization of real-world datasets was criticized in some studies, where it was seen as a shortcoming. The KDDCup99 dataset’s metrics results are shown in Fig. 7 . Each method’s accuracy, precision, recall, and F1-score are shown. As you can see, the suggested solution still has superior values in this evaluation even if the outcomes are extremely similar to one another. The F1-score is a more appropriate metric for evaluating performance with unbalanced data since it takes both precision and recall into account. The data in intrusion detection for the Internet of Things is often imbalanced, meaning that the number of valid occurrences far outweighs the number of illegal intrusion incidents. Under these conditions, a high degree of accuracy might be achieved by classifying every event as normal (the majority class) and ignoring the damaging instances, which make up the minority class. Fig. 7. Open in a new tab KDDCup99 Results. But this would result in a lower recall, or the inability to detect harmful events, which would lead to missed detections. By taking into account both false positives (precision) and false negatives (recall), the F1-score provides a fair evaluation. Recall quantifies the ability to recognize positive events (like incursions) among the full collection of positive cases, whereas precision indicates the accuracy of positive predictions. The model’s performance is fairly assessed across all classes by the F1-score, which is calculated by taking the harmonic mean of precision and recall. As such, it provides a more trustworthy measure for assessing intrusion detection systems in data-unbalanced settings. It demands equal consideration for the minority class and penalizes models that unduly favor the majority class. Figure 8 illustrates the performance metrics of various machine learning methods on the CAN-BUS dataset, including accuracy, F1-score, precision, and recall for each method. Among the individual approaches, HIDS emerged as the top performer on the CAN-BUS dataset due to its notably high F1-score and accuracy. Additionally, both Voting and SVM demonstrated impressive results, achieving an accuracy of 98% and an F1-score of 97.5%, respectively. KNN also showcased strong performance on this dataset, achieving an F1-score of 95% and an accuracy of 97%. Because machine learning methods were carefully chosen and combined, the study’s high F1-scores were able to effectively solve the problem of imbalanced data. As a result, intrusion detection accuracy and recall increased. Interestingly, the tree-based Voting method worked well as an optimizer to improve weak learners in the ensemble learning application of non-tree-based IDS. Fig. 8. Open in a new tab CAN-BUS dataset results. The training and validation outcomes of every model on the NSL-KDD dataset are shown in Fig. 9 . showcasing their accuracy, F1-scores, precision, and recall. This dataset comprises labeled network traffic data. In this study, the performance on the NSL-KDD dataset stood out, achieving the highest accuracy and F1-scores compared to KNN, NB, Voting, and SVM. While still achieving impressive results, this work attained an accuracy of 98% and an F1-score of 97%, which, albeit excellent, were slightly lower in comparison to a previous study 9 . The superior F1-scores and accuracy in this research could be attributed to its enhanced ability to handle the dataset’s complexity. Additionally, the employment of SVM, LR, and Voting approach aimed to enhance weak learners at the ensemble level, potentially contributing to the improved performance. Fig. 9. Open in a new tab NSL-KDD dataset results. The performance of different machine learning methods on the CICIDS dataset which includes network traffic data tagged with instances of harmful and legitimate activity is shown in Fig. 10 . The dataset is used for intrusion detection. On the CICIDS dataset, excellent accuracy was attained in this investigation. In particular, the accuracy and F1-score of this study were both 99.00%. On this dataset, both strategies produced impressive results. For an illustration of this, please see the column chart in Fig. 10 . Fig. 10. Open in a new tab CICIDS dataset results. Table 8 summarizes the performance of the HIDS compared with baseline IDS methods on the KDDCup99, CAN-BUS, NSL-KDD, and CICIDS datasets in Test 1. Table 8. Comparative performance of HIDS vs. state-of-the-art IDS methods across all datasets. Dataset Method Accuracy (%) Precision (%) Recall (%) F1-score (%) KDDCup99 HIDS 98.9 98.0 98.5 98.2 Voting 97.0 95.0 98.0 97.0 SVM 96.0 96.5 95.5 96.0 LR 93.0 93.0 93.0 93.0 NB 88.0 87.8 88.1 88.0 KNN 96.5 97.0 98.0 97.5 CAN-BUS HIDS 97.0 97.0 97.5 97.2 Voting 80.0 81.0 82.0 80.0 SVM 88.0 89.5 86.6 88.0 LR 70.0 69.0 72.0 70.0 NB 95.0 95.2 95.1 95.0 KNN 96.0 95.9 96.1 96.0 NSL-KDD HIDS 97.0 97.4 97.2 97.0 Voting 78.0 79.0 80.0 78.0 SVM 81.0 82.5 80.5 81.0 LR 71.0 70.0 73.0 71.0 NB 93.0 92.2 93.1 93.0 KNN 97.0 96.5 97.0 96.9 CICIDS HIDS 99.0 97.0 96.0 97.0 Voting 81.0 76.0 68.0 69.0 SVM 79.0 80.5 78.5 79.0 LR 69.0 70.0 71.0 69.0 NB 91.0 90.3 91.0 91.0 KNN 95.0 94.5 95.0 95.0 Bot-IoT HIDS 99.1 98.5 98.0 98.2 Voting 82.0 80.0 78.0 79.0 SVM 85.0 84.0 82.5 83.0 LR 73.0 72.0 70.0 71.0 NB 92.0 91.5 90.5 91.0 KNN 96.5 95.5 95.0 95.0 Open in a new tab Test 2 In this evaluation, the solutions were assessed based on ROC, TNR, and MCC parameters, with results presented in Figs. 11 , 12 , 13 and 14 . Across all datasets, the proposed solution consistently demonstrated superior performance in terms of ROC, TNR, and MCC. This high level of effectiveness stems from the utilization of hybrid neural networks at the core of the solution, enabling us to achieve optimal accuracy and efficiency. The Hybrid Intrusion Detection System (HIDS) stands out for its superior classification capabilities, achieved through the integration of CNN and LSTM via an iterative ensemble approach. Additionally, the adaptive generation of synthesized samples by HIDS is leveraged to enhance classification accuracy further. Furthermore, a process of eliminating inappropriate features contributes to the overall enhancement of classification performance. Fig. 11. Open in a new tab KDD Results. Fig. 12. Open in a new tab CAN-BUS Results. Fig. 13. Open in a new tab NSL-KDD Results. Fig. 14. Open in a new tab CICIDS dataset results. Table 9 summarizes the performance of the HIDS compared with benchmark models on the KDDCup99, CAN-BUS, NSL-KDD, and CICIDS datasets in Test 2. Table 9. Comparative performance of HIDS vs. baseline IDS models (ROC, TNR, MCC). Dataset Method ROC (AUC) TNR (%) MCC KDDCup99 HIDS 99 97 97 Voting 90 70 91 SVM 98 89 89 LR 92 92 76 NB 98 90 90 KNN 98 97 97 CAN-BUS HIDS 99 99 99 Voting 98 67 79 SVM 99 90 92 LR 97 95 95 NB 98 89 92 KNN 98 98 99 NSL-KDD HIDS 99 98 98 Voting 92 75 94 SVM 99 92 95 LR 94 85 95 NB 98 91 91 KNN 99 98 85 CICIDS HIDS 96 96 96 Voting 94 93 93 SVM 92 85 87 LR 94 84 87 NB 93 92 73 KNN 93 92 92 Open in a new tab Test 3 In this section, we do an analysis of all the assessment metrics given in Section " Experiments and results " with perform on Bot-IoT dataset. The Bot-IoT dataset is a benchmark dataset designed to evaluate IDS in IoT environments. It simulates realistic IoT network traffic, including both normal and malicious activities, and features diverse attack scenarios such as DDoS, data theft, and reconnaissance. The dataset supports multiple protocols like HTTP, MQTT, and DNS, providing a rich variety of network-level features for machine learning and deep learning research. Known for its comprehensiveness, it includes millions of records, making it suitable for robust model training and evaluation. However, challenges like class imbalance, feature selection, and preprocessing complexity must be addressed when using the dataset 42 . We conduct a comparative analysis using several methods, such as Deep Reinforcement Learning (DLR), Recurrent Neural Networks (RNN), Generative Adversarial Networks (GANs), Capsule Networks (CapsNets), and CNN. This facilitates our understanding of the effectiveness of our strategy relative to other basic alternatives. Furthermore, we conduct an ablation study to investigate how different methods we employ affect the functionality of our approach. Figure 15 presents an examination of HIDS efficacy throughout its initial evolution, considering various learning rates. The results indicate that HIDS performs superiorly at all phases. The learning rate, models, and performance metrics are modified for the research. The performance measurements exhibit both favorable and unfavorable characteristics. The Net Present Value (NPV) and the Marginal Cost of Capital (MCC) are precise performance metrics indicating unfavorable outcomes. Contrary metrics, such as the False Positive Rate (FPR) and the False Negative Rate (FNR), are also examined. Fig. 15. Open in a new tab ( a ). Comparison of models according to the FPR ( b ). Comparison of models according to the FNR ( c ). Comparison of models according to the NPV ( d ). Comparison of models according to the FDR ( e ). Comparison of models according to the MCC. Figure 15 a presents the False Positive Rate (FPR) for all tested models across the datasets. As expected, a lower FPR indicates superior IDS performance, since it reflects fewer benign events misclassified as intrusions. The proposed HIDS consistently achieved the lowest FPR values among the compared methods, demonstrating its ability to minimize false alerts. This indicates that HIDS significantly reduces the incidence of false positives, resulting in a higher accuracy of forecasts. Figure 15 b shows the False Negative Rate (FNR), where lower values similarly reflect better performance (i.e., fewer attacks missed). In this case, with a slight difference, only the GAN model performed better than the proposed solution. In the other cases, the HIDS outperformed baseline methods, registering the lowest FNR values across all datasets. This means that the system detected the vast majority of attacks, with minimal undetected intrusions. Together, the low FPR and FNR of HIDS indicate a balanced and reliable detection capability: the model avoids overwhelming operators with false alarms while still catching nearly all real threats. Furthermore, Fig. 15 c illustrates that the NPV model significantly outperforms several baseline methods when applied with an 70% learning percentage. The HIDS model outperforms DRL by 19%, CNN by 12%, RNN by 10%, GAN by 20%, and CapsNet by 12%. These modifications indicate that the model has improved its negative predictive values, hence enhancing its accuracy and reliability in predicting negative instances. Similarly, Fig. 15 d demonstrates that the FDR approach significantly outperforms the baseline algorithms at a learning percentage of 40%. It surpasses DRL by 20%, CNN by 10%, RNN by 11%, GAN by 29%, and CapsNet by 13%. The FDR technique effectively reduces the false discovery rate, facilitating the model’s ability to generate accurate predictions by minimizing false positives. These results indicate that the NPV model and FDR scheme outperform previous predictive approaches. Figure 15 e illustrates that at the 50% learning stage, the HIDS scheme significantly outperforms several baseline algorithms in terms of MCC. Specifically, the HIDS model achieves improvements of 40% over DRL, 19% over CNN, 19% over RNN, 35% over GAN, and 10% over CapsNet. These results highlight the robustness and effectiveness of the proposed HIDS algorithm in accurately intrusion detection. The substantial gains in MCC underscore the model’s superior ability to balance sensitivity and specificity, offering a reliable tool for precise and effective intrusion detection. Conclusion and future work In conclusion, our study offers a novel hybrid CNN and LSTM intrusion detection system that is specifically created with the Internet of Things in mind. According to the outcomes of our experiments, our model performs better than current IDS models in key areas such as accuracy, false positive rate, detection rate and F1 score due to its capacity to dynamically change training epochs and execute early stopping. These developments in intrusion detection have significant ramifications for the IoT ecosystem as a whole. Our system’s accurate and effective intrusion detection guarantees that providers can maintain the availability and integrity of vital data. Subsequent research attempts may enhance the utilization of neural networks in early stopping to maximize the convergence speed and performance of IDS models. In addition, the integration of a wider array of data sources and the utilization of powerful machine learning methodologies may augment the IDS’s capacity to predict intricate cyber-threats. The results observation that efficiency improvements of the HIDS can be negligible for complex architectures suggests potential challenges like overfitting, the curse of dimensionality, and model capacity saturation. To address these issues, regularization techniques like dropout, batch normalization, and early stopping can mitigate overfitting. Dimensionality reduction through methods like Principal Component Analysis (PCA) or enhanced feature selection can alleviate the effects of high-dimensional data. Architecture optimization using neural architecture search, pruning redundant layers, or employing ablation studies to identify unnecessary components can streamline the model. Expanding on these aspects would offer a deeper understanding of the proposed HIDS and guide practical implementations. Moreover, The HIDS can be improved by using techniques like SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations). SHAP assigns importance scores to input features, while LIME approximates the model’s behavior by perturbing inputs. This enhances interpretability, fosters trust, reduces false positives, and provides valuable insights for security experts. Integrating these tools bridges the gap between model complexity and practical deployment in real-world network security. Expanding on these aspects would provide a more comprehensive analysis of the results and offer practical insights for deploying the model in real-world network security scenarios. Author contributions All authors participated in the conception and design of the study. Data collection, simulation, and analysis were conducted by Suha Chen and Xu Feng . Data availability The datasets used and/or analyzed during the current study available from the corresponding author on reasonable request. Declarations Competing interests The authors declare no competing interests. Footnotes Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. References 1. Thakkar, A. & Lohiya, R. A survey on intrusion detection system: feature selection, model, performance measures, application perspective, challenges, and future research directions. Artif. Intell. Rev. 55 (1), 453–563 (2022). [ Google Scholar ] 2. Liu, Y., Dong, X., Zio, E. & Cui, Y. Active Resilient Secure Control for Heterogeneous Swarm Systems Under Malicious Cyber-Attacks. IEEE Trans. Syst. Man Cybernetics: Syst. 25 , 1–10. 10.1109/TSMC.2025.3580940 (2025). [ Google Scholar ] 3. Yi, L., Yin, M. & Darbandi, M. A deep and systematic review of the intrusion detection systems in the fog environment. Transact. Emerg. Telecommun. Technol. 34 (1), e4632 (2023). [ Google Scholar ] 4. Yan, X. et al. PKNet: Infrared Small Target Detection via Parallel Interactive Kolmogorov-Arnold Network. IEEE Trans. Geosci. Remote Sens. 1 . 10.1109/TGRS.2025.3635130 (2025). 5. Sun, G., Liao, D., Zhao, D., Xu, Z. & Yu, H. Live Migration for Multiple Correlated Virtual Machines in Cloud-Based Data Centers. IEEE Trans. Serv. Comput. 11 (2), 279–291. 10.1109/TSC.2015.2477825 (2018). [ Google Scholar ] 6. Dai, X. et al. Task Offloading for Cloud-Assisted Fog Computing With Dynamic Service Caching in Enterprise Management Systems. IEEE Trans. Industr. Inf. 19 (1), 662–672. 10.1109/TII.2022.3186641 (2023). [ Google Scholar ] 7. Xu, G. et al. Event Driven Publish/Subscribe Communication Protocol for IIoT by Report and Traceable Ring Signature. IEEE Trans. Industr. Inf. 21 (9), 6670–6678. 10.1109/TII.2025.3567265 (2025). [ Google Scholar ] 8. Wang, S. et al. Interactive Siamese Network-Based Roadside Perception for Multi-Vehicle Tracking. IEEE Trans. Intell. Transp. Syst. 1–15. 10.1109/TITS.2025.3611287 (2025). 9. Xu, G. et al. CBRFL: A framework for Committee-based Byzantine-Resilient Federated Learning. J. Netw. Comput. Appl. 238 , 104165. 10.1016/j.jnca.2025.104165 (2025). [ Google Scholar ] 10. Yaghoobi, A. & Harandi, M. N. Quantum-enhanced adaptive scheduling for real-time IoT task optimization in fog-cloud systems. Comput. Netw. 278 , 112088 (2026). [ Google Scholar ] 11. Li, Z., Ding, S., Zhang, L. & Song, G. Filter-based predefined-time optimal fault-tolerant consensus control for nonlinear multi-agent systems via reinforcement learning. Neurocomputing. 10.1016/j.neucom.2026.133224 (2026). [ Google Scholar ] 12. Chen, Y., Li, H., Song, Y. & Zhu, X. Recoding Hybrid Stochastic Numbers for Preventing Bit Width Accumulation and Fault Tolerance. IEEE Trans. Circuits Syst. I Regul. Pap. 72 (3), 1243–1255. 10.1109/TCSI.2024.3492054 (2025). [ Google Scholar ] 13. Abbas, Y. et al. Drone-Based Public Surveillance Using 3D Point Clouds and Neuro-Fuzzy Classifier. Computers Mater. Continua . 82 (3), 4759–4776. 10.32604/cmc.2025.059224 (2025). [ Google Scholar ] 14. Zhang, C. et al. A Comprehensive Fracture Characterization Method for Shale Reservoirs. Pet. Sci. 10.1016/j.petsci.2025.03.022 (2025). [ Google Scholar ] 15. Cheng, X. et al. Memory-efficient programmable packet parsing for multi-tenant terabit networks. Comput. Netw. 264 , 111240. 10.1016/j.comnet.2025.111240 (2025). [ Google Scholar ] 16. Zhang, C. et al. Coupled formation of fracture assemblages in shale and their influence on permeability. GSA Bull. 10.1130/B38277.1 (2025). [ Google Scholar ] 17. Jiang, H. et al. Cooperative Content Caching in Vehicular Edge Computing Networks: A Two-Stage Deep Reinforcement Learning Approach. IEEE Trans. Mob. Comput. 1–18. 10.1109/TMC.2026.3664597 (2026). 18. Chen, L. et al. IWOA-Optimized Deep Learning for Bearing Fault Diagnosis Under Noisy and Variable Conditions. IEEE Trans. Instrum. Meas. 74 , 1–18. 10.1109/TIM.2025.3602547 (2025). [ Google Scholar ] 19. Feng, S. et al. Q-Learning Assisted Resource Allocation for User-Centric Optical Wireless Communication Networks. IEEE Trans. Green. Commun. Netw. 9 (4), 2264–2278. 10.1109/TGCN.2025.3553202 (2025). [ Google Scholar ] 20. Zhou, D. et al. Mission-Driven Resource Scheduling in Satellite-Terrestrial Networks: From Perspective of Collaboration and Reconfiguration. IEEE Trans. Commun. 73 (8), 6705–6719. 10.1109/TCOMM.2025.3529250 (2025). [ Google Scholar ] 21. Xu, W. et al. Blockchain-Based Verifiable Decentralized Identity for Intelligent Flexible Manufacturing. IEEE Internet Things J. 12 (16), 32366–32378. 10.1109/JIOT.2025.3576735 (2025). [ Google Scholar ] 22. Wang, D. et al. Weight Pruning and Parameter Quantization Assisted Multi-Scale Lightweight Network for Interference Recognition. IEEE Trans. Cogn. Commun. Netw. 12 , 1313–1326. 10.1109/TCCN.2025.3614368 (2026). [ Google Scholar ] 23. Wang, F., Zhang, S., Hong, E. & Quek, T. Q. S. Constellation as a Service: Tailored Connectivity Management in Direct-Satellite-to-Device Networks. IEEE Commun. Mag. 1–7. 10.1109/MCOM.001.2500138 (2025). 24. Wu, T. et al. Deployment and Edge Association for Energy-Efficient Federated Learning. IEEE Trans. Cogn. Commun. Netw. 11 (6), 4126–4140. 10.1109/TCCN.2025.3543365 (2025). [ Google Scholar ] 25. Zhang, K. et al. Leveraging machine learning to proactively identify phishing campaigns before they strike. J. Big Data . 12 (1), 124. 10.1186/s40537-025-01174-x (2025). [ Google Scholar ] 26. Jiang, H. et al. $\mathsf {RobustHealth}$: Non-Interactive Privacy-Preserving System for Heterogeneous Mobile Health Diagnosis. IEEE Trans. Mob. Comput. 1–15. 10.1109/TMC.2025.3634422 (2025). 27. Zhang, F. et al. Breaking the Edge: Enabling Efficient Neural Network Inference on Integrated Edge Devices. IEEE Trans. Cloud Comput. 13 (2), 694–710. 10.1109/TCC.2025.3559346 (2025). [ Google Scholar ] 28. He, X. et al. Influencing factors and quantitative prediction of gas content of deep marine shale in Luzhou block. Sci. Rep. 15 , 1896. 10.1038/s41598-025-86095-8 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 29. Zhong, M., Zhang, J., Zheng, G. & Liu, H. Data–Driven Model–Free Adaptive Dynamic Programming Resilient Control for Nonlinear Networked Control Systems Under DoS Attacks. IEEE Trans. Cybernetics . 55 (12), 5700–5713. 10.1109/TCYB.2025.3594793 (2025). [ DOI ] [ PubMed ] [ Google Scholar ] 30. Zhang, K., Wang, Y., Bhatti, U. A., Zhou, Y. & Jin, M. Enhanced ransomware attacks detection using feature selection, sensitivity analysis, and optimized hybrid model. J. Big Data . 12 (1), 245. 10.1186/s40537-025-01289-1 (2025). [ Google Scholar ] 31. Zhao, Z. et al. Secure Internet of Things (IoT) using a novel Brooks Iyengar quantum Byzantine Agreement-centered blockchain Networking (BIQBA-BCN) model in smart healthcare. Inf. Sci. 629 , 440–455. 10.1016/j.ins.2023.01.020 (2023). [ Google Scholar ] 32. Liu, Q. et al. Reinforcement learning from human feedback with cooperative policy-reward optimization for LLMs. Expert Syst. Appl. 301 , 130113. 10.1016/j.eswa.2025.130113 (2026). [ Google Scholar ] 33. Pacheco, J., Benitez, V. H., Felix-Herran, L. C. & Satam, P. Artificial neural networks-based intrusion detection system for internet of things fog nodes. IEEE Access 8 , 73907–73918 (2020). [ Google Scholar ] 34. Xu, N., Wu, Y., Zong, G., Niu, B. & Zhao, X. Resilient Adaptive Secure Control for MIMO Switched CPSs Under Unknown Deception Attacks. IEEE Trans. Green. Commun. Netw. 10 , 1160–1170. 10.1109/TGCN.2025.3615157 (2026). [ Google Scholar ] 35. Ning Xu, L., Tang, A. A. & Al-Barakati Fixed-time optimal bipartite containment fault-tolerant control for multi-agent systems under multiple faults and saturated actuation. Math. Comput. Simul. 10.1016/j.matcom0.226.01.001 (2026). [ Google Scholar ] 36. Yue, S., Zhang, L., Zhao, N., Xu, N. & Fawaz, E. Alsaadi. SMS-Based Event-Triggered Fault Tolerant Control of Nonlinear Systems Using Adaptive Dynamic Programming. Int. J. Robust Nonlinear Control . 10.1002/rnc.70380 (2026). [ Google Scholar ] 37. Chu, C. & He, Y. A unified neural event-triggered control approach of high-order switched uncertain systems with time-varying state constraints. Robotic Intell. Autom. 10.1108/RIA-09-2025-0295 (2026). [ Google Scholar ] 38. Saheed, Y. K. & Chukwuere, J. E. Xaiensembletl-iov: A new explainable artificial intelligence ensemble transfer learning for zero-day botnet attack detection in the internet of vehicles. Res. Eng. 24 , 103171 (2024). [ Google Scholar ] 39. Zhou, Z. et al. Minimizing SLA violation and power consumption in Cloud data centers using adaptive energy-aware algorithms. Future Generation Comput. Syst. 86 , 836–850. 10.1016/j.future.2017.07.048 (2018). [ Google Scholar ] 40. Zhang, W., Zhao, X., Niu, B. & Guangdeng Zong. Integral barrier Lyapunov functions-based adaptive fuzzy event-triggered fault tolerant control for PDE-ODE cascade systems with state constraints. Nonlinear Dyn. 10.1007/s11071-025-12081-4 (2026). [ Google Scholar ] 41. Tang, L., Wang, H., Zhao, X., Xu, N. & Li, L. Adaptive Fixed-Time Bipartite Containment Control for Saturated Nonlinear Multi-Agent Systems Based on Optimized Backstepping Technique. Math Methods Appl. Sci. 10.1002/mma.70508 (2026). 42. Alosaimi, S. & Almutairi, S. M. An intrusion detection system using BoT-IoT. Appl. Sci. 13 (9), 5427 (2023). [ Google Scholar ] 43. Li, J., Chen, Z., Niu, B., Xu, N. & Zhao, X. Event-Driven Prescribed Performance Consensus Control for Nonlinear MASs With Unknown Input Saturation and Control Direction. Int. J. Gen Syst . 10.1080/03081079.2026.2621250 (2026). [ Google Scholar ] 44. Ding, X. et al. Design and Performance Evaluation for BILCM-ID System With Improved Stopping Criterion. IEEE Trans. Veh. Technol. 74 (4), 6779–6784. 10.1109/TVT.2024.3519540 (2025). [ Google Scholar ] 45. Pramilarani, K. & Kumari, P. V. Cost based random forest classifier for intrusion detection system in internet of things. Appl. Soft Comput. 151 , 111125 (2024). [ Google Scholar ] Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Data Availability Statement The datasets used and/or analyzed during the current study available from the corresponding author on reasonable request. Articles from Scientific Reports are provided here courtesy of Nature Publishing Group ACTIONS View on publisher site PDF (5.0 MB) Cite Collections Permalink PERMALINK Copy RESOURCES Similar articles Cited by other articles Links to NCBI Databases Cite Copy Download .nbib .nbib Format: AMA APA MLA NLM Add to Collections Create a new collection Add to an existing collection Name your collection * Choose a collection Unable to load your collection due to an error Please try again Add Cancel Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top