An Attention-Enhanced CNN-BiGRU Framework for Intrusion Detection

Intrusion detection systems (IDS) are essential for network security, as they help identify malicious activities and potential threats in network traffic. Traditional IDS methods, such as signature-based approaches, face limitations in detecting novel and evolving attacks. In recent years, deep learning techniques, particularly Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs), have shown significant promise in overcoming these challenges by learning complex representations from raw network traffic data. However, existing deep learning-based IDS models often face difficulties in capturing both local features and temporal dependencies simultaneously, and they may lack the ability to focus on the most informative parts of the data. In this paper, we propose a novel Attention-Enhanced CNN-BiGRU framework for intrusion detection. The model combines the strengths of CNN for local feature extraction, Bidirectional-Gated Recurrent Units (BiGRUs) for modeling temporal dependencies, and an attention mechanism for adaptive feature aggregation. This unified approach enhances the ability of the model to detect both short-term and long-term attack patterns in network traffic. We evaluate the proposed model on four publicly available datasets: KDD99, CIC-IDS2017, UNSW-NB15, and UGR’16. Our experimental results show that the proposed model outperforms traditional machine learning baselines and state-of-the-art deep learning models in terms of Macro-F1, Weighted-F1, and AUC. Additionally, the model demonstrates strong cross-dataset generalization and robustness to temporal concept drift, making it suitable for real-world applications.