Toward Intelligent Cyber Threat Detection: A Stacked Bidirectional Long Short‐Term Memory and Autoencoder Approach

ABSTRACT Intrusion Detection Systems play a key role in detecting cyberattacks within contemporary networks. However, more advanced cyber threats, especially botnet attacks, have revealed certain limitations of conventional Intrusion Detection Systems such as a high rate of false positives and a lack of real‐time detection capability. To address these issues, a DeepBotnet‐Boosted Stacked Bidirectional Autoencoder model is proposed for intrusion detection. The proposed model combines Stacked Bi‐directional Long Short‐Term Memory networks to learn the temporal network traffic pattern using a Deep Autoencoder to produce latent features and improve anomaly detection. A Crossover Boosted Bobcat Optimization algorithm is a bio‐inspired algorithm that balances exploration and exploitation to choose the most relevant network features. Also, the Synthetic Minority Oversampling Technique is employed in preprocessing to overcome the class imbalance issue. The effectiveness of the proposed framework is validated with various publicly available datasets, including the Wireless Sensor Network‐Detection System, the Network Security Laboratory‐Knowledge Discovery in Databases , the University of New South Wales‐Network‐Based 2015, and the Network Intrusion dataset, Canadian Institute for Cybersecurity‐Intrusion Detection System 2017. Experimental results demonstrate that the proposed model outperforms baseline techniques, including the Autoencoder‐Dense‐Transformer Neural Network, the Convolutional Neural Network‐Long Short‐Term Memory, the Graph Neural Networks‐based Network Anomaly Detection, the Gated Attention Dual Long Short‐Term Memory, the Genetic algorithm‐based random forest, and the Convolutional Neural Network‐Gated Recurrent Unit, achieving an accuracy of 98.8%, with a performance improvement of 2%–5% across the evaluated datasets. These results indicate the scalability and real‐time applicability of the hybrid model and optimization‐based feature selection plan to detect botnet intrusion.