Network anomaly detection using hybrid deep learning framework

Abstract

Network anomaly detection has become increasingly important as modern communication networks face sophisticated and evolving cyber threats that cannot be effectively identified using conventional signature-based intrusion detection systems. Deep learning has demonstrated significant potential for detecting complex attack patterns; however, individual architectures often exhibit limitations in capturing diverse characteristics of network traffic. This paper proposes TriFusion-Net, a hybrid deep learning framework that integrates convolutional neural networks (CNN), long short-term memory (LSTM)-based recurrent neural networks (RNN), and feedforward neural networks (FNN) to improve flow-based network anomaly detection. CNN is employed to extract local spatial patterns from network flow features, LSTM models sequential feature dependencies, and the FNN classifier performs nonlinear decision making for binary intrusion classification. The proposed framework is evaluated using the CIC-IDS-2018 benchmark dataset containing large-scale benign and malicious network traffic. A unified preprocessing pipeline, including data cleaning, feature selection, normalization, and class balancing, is adopted to ensure robust model training and evaluation. Experimental results demonstrate that TriFusion-Net achieves an overall accuracy of 95.66%, with 87.88% precision, 94.99% recall, 91.30% F1-score, and 97.75% receiver operating characteristic area under the curve (ROC-AUC), outperforming the individual deep learning models considered in this study. These results indicate that the proposed hybrid framework provides an effective and computationally efficient solution for real-time network anomaly detection in modern cybersecurity environments.