Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Research on CNN-BiLSTM Network Traffic Anomaly Detection Model Based on MindSpore

Qiuyan Xiang, Shuang Wu, Dongze Wu, Yuxin Liu, Zhenkai Qin

TL;DR

This work tackles the challenge of detecting anomalies in IoT/IIoT network traffic by proposing a CNN-BiLSTM model implemented on MindSpore. It processes time-series traffic features with a Conv1D front end and a bidirectional LSTM to capture both local patterns and temporal dependencies, using a dynamic threshold trained with validation performance. Evaluated on the NF-BoT-IoT dataset, the approach achieves about 99% across accuracy, precision, recall, and F1, demonstrating strong detection capability and robustness. The study highlights practical potential for IoT security while acknowledging future needs for cross-domain adaptation and real-time deployment, with avenues like lightweight architectures and federated learning for multi-scenario environments.

Abstract

With the widespread adoption of the Internet of Things (IoT) and Industrial IoT (IIoT) technologies, network architectures have become increasingly complex, and the volume of traffic has grown substantially. This evolution poses significant challenges to traditional security mechanisms, particularly in detecting high-frequency, diverse, and highly covert network attacks. To address these challenges, this study proposes a novel network traffic anomaly detection model that integrates a Convolutional Neural Network (CNN) with a Bidirectional Long Short-Term Memory (BiLSTM) network, implemented on the MindSpore framework. Comprehensive experiments were conducted using the NF-BoT-IoT dataset. The results demonstrate that the proposed model achieves 99% across accuracy, precision, recall, and F1-score, indicating its strong performance and robustness in network intrusion detection tasks.

Research on CNN-BiLSTM Network Traffic Anomaly Detection Model Based on MindSpore

TL;DR

This work tackles the challenge of detecting anomalies in IoT/IIoT network traffic by proposing a CNN-BiLSTM model implemented on MindSpore. It processes time-series traffic features with a Conv1D front end and a bidirectional LSTM to capture both local patterns and temporal dependencies, using a dynamic threshold trained with validation performance. Evaluated on the NF-BoT-IoT dataset, the approach achieves about 99% across accuracy, precision, recall, and F1, demonstrating strong detection capability and robustness. The study highlights practical potential for IoT security while acknowledging future needs for cross-domain adaptation and real-time deployment, with avenues like lightweight architectures and federated learning for multi-scenario environments.

Abstract

With the widespread adoption of the Internet of Things (IoT) and Industrial IoT (IIoT) technologies, network architectures have become increasingly complex, and the volume of traffic has grown substantially. This evolution poses significant challenges to traditional security mechanisms, particularly in detecting high-frequency, diverse, and highly covert network attacks. To address these challenges, this study proposes a novel network traffic anomaly detection model that integrates a Convolutional Neural Network (CNN) with a Bidirectional Long Short-Term Memory (BiLSTM) network, implemented on the MindSpore framework. Comprehensive experiments were conducted using the NF-BoT-IoT dataset. The results demonstrate that the proposed model achieves 99% across accuracy, precision, recall, and F1-score, indicating its strong performance and robustness in network intrusion detection tasks.
Paper Structure (11 sections, 8 equations, 3 figures)

This paper contains 11 sections, 8 equations, 3 figures.

Table of Contents

  1. Introduction
  2. Related Work
  3. Model Description
  4. CNN
  5. BiLSTM
  6. Experimental Results and Analysis
  7. Dataset
  8. Experimental Environment
  9. Evaluation Metrics
  10. Experimental Results and Analysis
  11. Conclusion

Figures (3)

  • Figure 1: The overall architecture of the proposed CNN-BiLSTM network traffic anomaly detection model based on the MindSpore framework. The model integrates convolutional layers for local feature extraction and a bidirectional LSTM for temporal dependency modeling, enabling effective identification of complex spatiotemporal patterns in network traffic data.
  • Figure 2: Context-aware representation learning using a bidirectional LSTM. The left-to-right and right-to-left LSTM layers encode the input sequence into $\mathbf{h}{Lt}$ and $\mathbf{h}{Rt}$, which are concatenated to form the context vector $\mathbf{h}_c$. The final prediction $\mathbf{P}$ is obtained via a softmax layer.
  • Figure 3: Training loss curve of the CNN-BiLSTM model over 20 epochs. The model demonstrates rapid convergence and stable training dynamics, with the loss decreasing from 0.1650 to 0.0002.