A Deep Learning Algorithm to Cybersecurity: Enhancing Intrusion Detection with a Hybrid GRU and BiLSTM Model
Received: 21 February 2025 | Revised: 1 April 2025, 7 April 2025, and 9 April 2025 | Accepted: 12 April 2025 | Online: 4 June 2025
Corresponding author: Ameer A. Ghani
Abstract
Cyber security in networks and Internet of Things (IoT) environments is becoming complex with the evolution of sophisticated cyberattacks, and the existence of effective Intrusion Detection Systems (IDSs) is necessary. This work proposes a Network-based Intrusion Detection System (NIDS) for a hybrid Deep Learning (DL) model with Gated Recurrent Units (GRU) and Bidirectional Long Short-Term Memory (BiLSTM) to improve attack detection and classification. Pre-processing of datasets, feature selection with Pearson Correlation Coefficient (PCC), and training-testing with two benchmark datasets, CSE-CIC-IDS2018 and ToN_IoT, were performed. Surpassing standalone GRU and Bidirectional Long Short-Term Memory (BiLSTM) systems, the proposed hybrid model detected 99.86% of the attacks of the ToN_IoT dataset and 98.69% of the CSE-CIC-IDS2018 dataset while maintaining high accuracy, recall, and F1 score of over 99%. These results confirm that the proposed model can effectively counter traditional NIDS weaknesses through accuracy improvement in detections and with diversity and dynamics in networks' complex trends and IoT environments.
Keywords:
cyber security, IoT, IDS, DL, GRU, LSTMDownloads
References
H. Liu and B. Lang, "Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey," Applied Sciences, vol. 9, no. 20, Jan. 2019, Art. no. 4396.
C. Yin, Y. Zhu, J. Fei, and X. He, "A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks," IEEE Access, vol. 5, pp. 21954–21961, 2017.
R. Vinayakumar, M. Alazab, K. P. Soman, P. Poornachandran, A. Al-Nemrat, and S. Venkatraman, "Deep Learning Approach for Intelligent Intrusion Detection System," IEEE Access, vol. 7, pp. 41525–41550, 2019.
A. A. Abdullah and S. A. Hussein, "Detection and Mitigation Distribution Denial of Service Attack Based on Blockchain Concept," Ingénierie des Systèmes d’Information, vol. 29, no. 3, pp. 1043–1049, Jun. 2024.
L. Ashiku and C. Dagli, "Network Intrusion Detection System using Deep Learning," Procedia Computer Science, vol. 185, pp. 239–247, Jan. 2021.
B. R. Yadav, "Machine Learning Algorithms: Optimizing Efficiency in AI Applications," International Journal of Engineering and Management Research, vol. 14, no. 5, pp. 49–57, Jul. 2024.
E. F. Abdullah, A. A. Lafta, and S. A. Alasadi, "Information Gain-Based Enhanced Classification Techniques," in Next Generation of Internet of Things, 2021, pp. 499–511.
A. Fatani, M. Abd Elaziz, A. Dahou, M. A. A. Al-Qaness, and S. Lu, "IoT Intrusion Detection System Using Deep Learning and Enhanced Transient Search Optimization," IEEE Access, vol. 9, pp. 123448–123464, 2021.
S. A. Alasadi and W. S. Bhaya, "Anomaly Detection System for Internet Traffic based on TF-IDF and BFR Clustering Algorithms," International Journal of Engineering and Technology, vol. 7, no. 4.19, pp. 600–604, Nov. 2018.
A. A. Hagar and B. W. Gawali, "Deep Learning for Improving Attack Detection System Using CSE-CICIDS2018," NeuroQuantology, vol. 20, no. 7, pp. 3064–3074, Aug. 2022.
T. Gaber, J. B. Awotunde, M. Torky, S. A. Ajagbe, M. Hammoudeh, and W. Li, "Metaverse-IDS: Deep learning-based intrusion detection system for Metaverse-IoT networks," Internet of Things, vol. 24, Dec. 2023, Art. no. 100977.
N. W. Khan et al., "A hybrid deep learning-based intrusion detection system for IoT networks," Mathematical Biosciences and Engineering, vol. 20, no. 8, pp. 13491–13520, 2023.
S. Sadhwani, M. A. H. Khan, R. Muthalagu, and P. M. Pawar, "BiLSTM-CNN Hybrid Intrusion Detection System for IoT Application." Research Square, Jan. 03, 2024.
H. İ. Coşar, Ç. Arısoy, and H. Ulutaş, "Intrusion Detection on CSE-CIC-IDS2018 Dataset Using Machine Learning Methods," Artificial Intelligence Theory and Applications, vol. 4, no. 2, pp. 143–154, Oct. 2024.
M. L. Mutleg, A. M. Mahmood, and M. M. J. Al-Nayar, "Deep Learning Based Intrusion Detection System of IoT Technology: Accuracy Versus Computational Complexity," International Journal of Safety and Security Engineering, vol. 14, no. 5, pp. 1547–1558, Oct. 2024.
M. Sarhan, S. Layeghy, N. Moustafa, M. Gallagher, and M. Portmann, "Feature extraction for machine learning-based intrusion detection in IoT networks," Digital Communications and Networks, vol. 10, no. 1, pp. 205–216, Feb. 2024.
J. Li, M. S. Othman, H. Chen, and L. M. Yusuf, "Optimizing IoT intrusion detection system: feature selection versus feature extraction in machine learning," Journal of Big Data, vol. 11, no. 1, Feb. 2024, Art. no. 36.
Canadian Institute for Cybersecurity, "A Realistic Cyber Defense Dataset (CSE-CIC-IDS2018)." Available at: https://registry.opendata.aws/cse-cic-ids2018
N. Moustafa, "The ToN_IoT Datasets," UNSW Canberra at ADFA, [Online]. Available: https://research.unsw.edu.au/projects/toniot-datasets.
I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, "Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization," presented at the 4th International Conference on Information Systems Security and Privacy, May 2025, pp. 108–116.
N. Moustafa, "A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets," Sustainable Cities and Society, vol. 72, Sep. 2021, Art. no. 102994.
T. M. Booij, I. Chiscop, E. Meeuwissen, N. Moustafa, and F. T. H. den Hartog, "ToN_IoT: The Role of Heterogeneity and the Need for Standardization of Features and Attack Types in IoT Network Intrusion Data Sets," IEEE Internet of Things Journal, vol. 9, no. 1, pp. 485–496, Jan. 2022.
A. Alsaedi, N. Moustafa, Z. Tari, A. Mahmood, and A. Anwar, "TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems," IEEE Access, vol. 8, pp. 165130–165150, 2020.
N. Moustafa, M. Keshk, E. Debie, and H. Janicke, "Federated TON_IoT Windows Datasets for Evaluating AI-based Security Applications." arXiv, Oct. 04, 2020.
N. Moustafa, M. Ahmed, and S. Ahmed, "Data Analytics-Enabled Intrusion Detection: Evaluations of ToN_IoT Linux Datasets," in 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Guangzhou, China, Sep. 2020, pp. 727–735.
N. Moustafa, "New Generations of Internet of Things Datasets for Cybersecurity Applications based Machine Learning: TON_IoT Datasets," in Proceedings of the eResearch Australasia Conference, Brisbane, Australia. 2019.
N. Moustafa, "A Systemic IoT-Fog-Cloud Architecture for Big-Data Analytics and Cyber Security Systems: A Review of Fog Computing." arXiv, May 04, 2019.
J. Ashraf et al., "IoTBoT-IDS: A novel statistical learning-enabled botnet detection framework for protecting networks of smart cities," Sustainable Cities and Society, vol. 72, Sep. 2021, Art. no. 103041.
F. Bolikulov, R. Nasimov, A. Rashidov, F. Akhmedov, and Y.-I. Cho, "Effective Methods of Categorical Data Encoding for Artificial Intelligence Algorithms," Mathematics, vol. 12, no. 16, Jan. 2024, Art. no. 2553.
R. Cassandro, Q. Li, and Z. S. Li, "An Entropy-based Data Reduction Method for Data Preprocessing," in 2023 IEEE International Conference on Prognostics and Health Management (ICPHM), Jun. 2023, pp. 351–356.
B. H. Bhavani and N. C. Naveen, "An Approach to Determine and Categorize Mental Health Condition using Machine Learning and Deep Learning Models," Engineering, Technology & Applied Science Research, vol. 14, no. 2, pp. 13780–13786, Apr. 2024.
W. T. Valavan, N. Joseph, and G. U. Srikanth, "Network Intrusion Detection System Based on Information Gain with Deep Bidirectional Long Short-Term Memory," International Journal of Intelligent Engineering and Systems, vol. 17, no. 4, pp. 45–56, Aug. 2024.
M. Bartouli, A. Msolli, A. Helali, and H. Fredj, "A Real-Time Charge Predictive Model for Intelligent Networks," Engineering, Technology & Applied Science Research, vol. 14, no. 5, pp. 17091–17098, Oct. 2024.
K. A. Nadhum, S. M. Sam, and S. Usman, "Prediction Model Using Deep Learning for Lung Illness Severity Among Covid-19 Patients in Iraq," in 2024 5th International Conference on Smart Sensors and Application (ICSSA), Penang, Malaysia, Sep. 2024, pp. 1–6.
Downloads
How to Cite
License
Copyright (c) 2025 Ameer Ahmed Ghani, Suad A. Alasadi
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
