A CNN-BiLSTM-Attention Model for Network Anomaly Traffic Detection

Anomalous traffic detection plays a critical role in ensuring the security and stable operation of network systems. However, due to the high dimensionality, strong temporal dependencies, and stealthy nature of modern attacks, traditional methods that rely on predefined rules and manual feature engineering often suffer from limited accuracy and poor adaptability. To alleviate the above issues, our paper proposes an anomaly traffic detection model named CBA (namely CNN-BiLSTM-Attention). The model combines CNN, BiLSTM, and a multi-head self-attention mechanism to enhance feature extraction and sequence modeling. Its goal is to achieve efficient identification and precise response to various types of abnormal behavior. First, a multi-scale CNN module extracts the spatial structural features of traffic data. Then, a bidirectional LSTM captures time-dependent patterns by processing sequences in both forward and reverse directions. Finally, a self-attention mechanism assigns adaptive weights to critical features. This achieves deep modeling of complex, diverse, and dynamic feature traffics. Experiments performed on the CICIDS2017 dataset demonstrate that CBA outperforms multiple state-of-the-art models in accuracy, precision, recall, and F1-scores. Meanwhile, it offers a more balanced between model parameter size, inference time, and performance. These results suggest that CBA provides a promising solution for building intelligent, high-performance cybersecurity defense systems.