IntrusionX: A Hybrid Convolutional-LSTM Deep Learning Framework with Squirrel Search Optimization for Network Intrusion Detection

TL;DR

This work tackles intrusion detection in the face of evolving cyber threats, high-dimensional data, and severe class imbalance by introducing IntrusionX, a hybrid Conv1D-LSTM model optimized with the Squirrel Search Algorithm. The approach combines leak-free preprocessing, stratified data splits, and dynamic class weighting to improve minority-class recall, evaluated on the NSL-KDD benchmark. Results show $98\%$ binary accuracy and $87\%$ accuracy on five classes, with notable recalls of $71\%$ for U2R and $93\%$ for R2L, demonstrating effective handling of imbalance. The study emphasizes reproducibility and metaheuristic hyperparameter optimization, offering a robust pathway for deploying imbalance-aware IDS and setting the stage for evaluation on modern datasets and real-time networks.

Abstract

Intrusion Detection Systems (IDS) face persistent challenges due to evolving cyberattacks, high-dimensional traffic data, and severe class imbalance in benchmark datasets such as NSL-KDD. To address these issues, we propose IntrusionX, a hybrid deep learning framework that integrates Convolutional Neural Networks (CNNs) for local feature extraction and Long Short-Term Memory (LSTM) networks for temporal modeling. The architecture is further optimized using the Squirrel Search Algorithm (SSA), enabling effective hyperparameter tuning while maintaining computational efficiency. Our pipeline incorporates rigorous preprocessing, stratified data splitting, and dynamic class weighting to enhance the detection of rare classes. Experimental evaluation on NSL-KDD demonstrates that IntrusionX achieves 98% accuracy in binary classification and 87% in 5-class classification, with significant improvements in minority class recall (U2R: 71%, R2L: 93%). The novelty of IntrusionX lies in its reproducible, imbalance-aware design with metaheuristic optimization.

Figures (4)

• Figure 1: IntrusionX workflow pipeline including preprocessing, Conv--LSTM architecture, SSA optimization, and evaluation.
• Figure 2: Confusion matrix for binary classification.
• Figure 3: ROC curve for binary classification with AUC score.
• Figure 4: Confusion matrix for 5-class classification.