Hybrid-CNNTree: A Convolutional Neural Network and Decision Tree Fusion Model for Wormhole Attack Detection

Wireless Sensor Networks (WSNs) and Internet of Things (IoT) infrastructures remain critically vulnerable to wormhole attacks, which establish covert tunnels between colluding adversaries and bypass conventional cryptographic defenses. Such attacks severely degrade network availability, privacy, and routing integrity, making them one of the stealthiest and most disruptive threats in modern distributed systems. This research introduces a novel, deployment-ready intrusion detection system (IDS) that integrates audit-driven preprocessing, dataset shift analysis, and hybrid deep–machine learning architectures with conformal calibration. The proposed pipeline employs Principal Component Analysis (PCA) for dimensionality reduction, Population Stability Index (PSI) and Maximum Mean Discrepancy (MMD) for dataset shift auditing, and Correlation Alignment (CORAL) for unsupervised domain adaptation. Six classical machine learning baselines—Decision Tree (DT), Random Forest (RF), K-Nearest Neighbour (KNN), Naïve Bayes (NB), Extreme Gradient Boosting (XGBoost), and CatBoost—were benchmarked against deep learning architectures, including standalone CNNs and hybrid fusion models (CNN+DT and CNN+RF). Validation employed stratified k-fold cross-validation, bootstrap confidence intervals, and conformal prediction, reporting not only accuracy but also risk-calibrated uncertainty estimates. Experimental results on three benchmark datasets (Wormhole, UNSW-NB15, CICIDS2017) reveal that CNN+Random Forest consistently outperforms all baselines, achieving 100% training accuracy, 99.56% validation accuracy, and 99.40% testing accuracy on the Wormhole dataset, 0.922 accuracy with balanced F1=0.94 on UNSW-NB15, and near-perfect F1=0.9996 with AUC ≈ 1.0 on CICIDS2017. Transfer learning experiments demonstrated resilience under domain adaptation, with mixed training achieving 94.2% F1 on UNSW and 99.9% on CICIDS, while deep domain adaptation methods (DANN, MMD, DeepCORAL) provided additional insights into cross-dataset generalization. By embedding feature leakage audits, dataset drift quantification, and conformal calibration, this work advances IDS research toward transparent, explainable, and reproducible models suitable for real-world IoT/WSN deployment.