A Hybrid Deep Learning and Machine Learning Model for Intelligent Cyber Threat Detection in Smart Networks

Abstract

The rapid expansion of smart networks, encompassing the Internet of Things (IoT), software-defined networking (SDN), and 5G-enabled edge infrastructure, has dramatically increased the attack surface available to malicious actors, while simultaneously producing high-velocity, heterogeneous traffic that traditional signature-based intrusion detection systems struggle to analyze in real time. This paper proposes a Hybrid Deep Learning and Machine Learning (DL-ML) framework for intelligent cyber threat detection that fuses a Convolutional Neural Network combined with a Bidirectional Long Short-Term Memory (CNN-BiLSTM) branch, which captures spatial and temporal traffic patterns, with a gradient-boosted ensemble branch (XGBoost/Random Forest), which captures statistical flow-level signatures. The outputs of both branches are combined through a weighted feature-fusion and ensemble layer that produces a unified threat classification and severity score. The framework was evaluated on a large-scale smart-network intrusion dataset comprising over 1.8 million labeled flow records spanning six traffic classes: normal, DDoS, botnet, port scanning, malware communication, and spoofing. Experimental results show that the proposed hybrid model achieves 98.8% accuracy, 96.4% precision, 95.6% recall, and a 96.0% F1-score, exceeding the strongest individual baseline (LSTM) by 3.7 percentage points in F1-score and achieving an AUC of 0.992.