Journal of Scientific Innovation and Advanced Research (JSIAR)

Peer-reviewed | Open Access | Multidisciplinary

Journal of Scientific Innovation and Advanced Research (JSIAR) Published: February 2026 Volume: 2, Issue: 2 Pages: 108-122

A Hybrid CNN–LSTM Framework for Real-Time Network Traffic Anomaly Detection in Intelligent Cybersecurity Systems

Original Research Article
Yogesh Agrawal1
1Department of Computer Science and Engineering, Chitkara University, Chitkara University, India
Manpreet Kaur2
2Department of Computer Science and Engineering, Chitkara University, Chitkara University, India
*Author for correspondence: Yogesh Agrawal
Department of Computer Science and Engineering, Chitkara University, Chitkara University, India
E-mail ID: yogeshagr5feb@gmail.com

ABSTRACT

The rapid expansion of digital communication networks has significantly increased the exposure of critical infrastructures to sophisticated cyber attacks. Traditional intrusion detection systems often rely on signature-based mechanisms, which are limited in their ability to identify previously unseen threats and complex attack behaviors. In addition, many classical machine learning approaches treat network traffic instances independently and therefore fail to capture temporal patterns that characterize modern multi-stage cyber intrusions. To address these challenges, this study proposes a hybrid deep learning framework that integrates Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks for intelligent network anomaly detection. The proposed architecture leverages the complementary strengths of the two models. CNN layers automatically extract discriminative spatial features from network traffic attributes, while LSTM layers capture sequential dependencies that reflect evolving attack behaviors across traffic flows. This hybrid structure enables the system to effectively learn both structural and temporal characteristics of network data, improving its ability to detect complex anomalies. The framework was evaluated using two widely recognized benchmark datasets, namely NSL-KDD and CICIDS2017, which represent both traditional and modern network attack scenarios. Experimental evaluation demonstrates that the proposed CNN--LSTM model achieves strong classification performance across both datasets, obtaining a detection accuracy of 97.8% on the NSL-KDD dataset and 98.6% on the CICIDS2017 dataset. Comparative analysis further shows that the proposed approach outperforms conventional machine learning techniques such as Support Vector Machines (89.5%) and Random Forest (92.3%), as well as standalone deep learning models including CNN (95.4%) and LSTM (96.1%). Confusion matrix analysis indicates a low number of false positives and false negatives, while ROC curve evaluation confirms a high true positive rate with minimal false alarm rates. The proposed hybrid CNN--LSTM framework enhances anomaly detection capability by combining spatial feature extraction with temporal sequence modeling. The results demonstrate its effectiveness in identifying complex cyber attack patterns and highlight its potential for deployment in modern, real-time cybersecurity monitoring systems.

Keywords: Anomaly Detection, Intrusion Detection Systems, Deep Learning, Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), Network Security, Cyber Attack Detection