Hybrid CNN-LSTM Framework for Intelligent Cyber Attack Detection and Prevention in U.S. Critical Digital Infrastructure: A Comparative Machine Learning Evaluation on CSE-CIC-IDS2018

Background: The accelerating digitization of United States critical infrastructure — spanning healthcare, finance, energy, transportation, and government services — has created an attack surface that traditional, signature-based intrusion detection systems are no longer equipped to defend. These legacy approaches fail predictably against zero-day exploits, distributed denial-of-service campaigns, botnets, and stealthy infiltration attacks precisely because they can only recognize threats they have already seen. Something more adaptive is needed. Methods: This study proposes and evaluates an intelligent cyber defense framework integrating Artificial Intelligence (AI), Machine Learning (ML), and Deep Learning (DL) to detect and classify cyber threats in real time. Using the CSE-CIC-IDS2018 benchmark dataset — a realistic, multi-vector network traffic corpus generated by the Canadian Institute for Cybersecurity — five model architectures were systematically compared: Random Forest, XGBoost, Support Vector Machine (SVM), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and a Hybrid CNN-LSTM model. The framework incorporated structured data preprocessing, feature engineering, class imbalance handling, and performance evaluation across accuracy, precision, recall, F1-score, ROC-AUC, and false positive rate metrics. Results: Results demonstrate that all models achieved detection accuracy above 96%, with the Hybrid CNN-LSTM model reaching 99.1% accuracy, approximately 99.0% precision and recall, and the lowest false positive rate (~2.0%) among all tested architectures. Flow Duration, Packet Length, and Destination Port emerged as the most predictive features. The hybrid model's dual capacity for spatial feature extraction and temporal sequence learning explained its consistent performance advantage over single-architecture alternatives. Conclusion: These findings suggest that hybrid deep learning frameworks offer a meaningful and deployable improvement over conventional IDS approaches, though validation against post-2020 attack data and live network streams remains necessary before operational conclusions can be drawn.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.