Lightweight Dual-Stream IDS: Feature-Pruned CNN-LSTM with Fast Random-Learning Aquila Optimisation

The accelerating proliferation of heterogeneous networked devices has intensified the frequency and sophistication of cyber-attacks, rendering classical signature-based intrusion detection systems (IDSs) increasingly inadequate. This study introduces a resource-aware hybrid IDS that integrates an advanced meta-heuristic feature-selection strategy with a dual-stream deep-learning classifier (DSDL) to secure contemporary network environments. Raw flow records from the UNSW-NB15 benchmark undergo a three-stage preprocessing pipeline comprising label cleansing, statistical-temporal feature extraction, and binary relabelling to discriminate benign from malicious traffic while preserving multiclass indices for forensic analysis. To reduce dimensionality and suppress noisy attributes, to propose the fast random-learning aquila optimiser (FROBLAO)—a Lévy-flight-driven variant of the aquila optimiser augmented with chaotic random learning. By jointly maximising classification accuracy and minimising subset size, FROBLAO compresses the original 49-feature space to 25 highly discriminative descriptors, shaving 31 % off model parameters and 18 % off training time. The selected features feed an ensemble convolutional neural network with long short-term memory (CNN-LSTM) architecture: one-dimensional convolutions capture local protocol-level patterns, whereas stacked Long Short-Term Memory layers model long-range temporal dependencies. Five-fold stratified cross-validation yields 99.37 % accuracy, 99.32 % precision, 99.41 % recall, and an AUC- ROC of 0.997—outperforming contemporary CNN, Bi-GRU, Transformer, and ResNet baselines by 1.2-4.3 %. Robustness tests under Gaussian noise, feature dropout, and VPN-like obfuscation confirm graceful performance degradation, highlighting the framework’s resilience. Real-time inference on an NVIDIA Jetson Nano requires < 5 W and < 0.8 ms per 1 000 flows, demonstrating suitability for edge-gateway deployment. The proposed FROBLAO-enhanced CNN-LSTM IDS thus offers a compact, high-accuracy solution for safeguarding modern heterogeneous networks