Innovative Cloud Security Solutions: Hybrid RNN and CNN Models for Intrusion Detection

1.      Conclusion

The study systematically explores and evidences the applicability of deep learning models for intrusion detection in IoT networks such that it helps security professionals to evolve measures required inside those intricate settings. The research produced stark advantages of using contemporary modelling techniques for anomaly detection in utilising a dataset relatively well-balanced between different classes - i.e. across various types of network intrusions and normal activities alike.

The specific problem resulted in the development and testing of three unique models by experimentations:CNN Model, LSTM-GRU Model and Hybrid model (combination on CNN + LSTM -GRUs) Especially, the hybrid model provided perfect 99% of Accuracy(), Precision(), Recall() and F1(). The reliability of this model in accommodating spatial and temporal features make it a strong candidate for easy implementation as security systems are concerned, towards IoT networks.

Performance metrics and confusion matrices also supported the isolated abilities of each model, as well as their complementarity when incorporated into a hybrid system (for better/unsatisfactorily suited comparison). This shows its power in providing a substantially lower false positive and negative rates as these can be major shortcomings of traditional intrusion detection systems.

A comparative analysis of the different performance metrics across the models was also provided, demonstrating that specific benefits arise from integrating multiple deep learning architectures. The aforementioned integrated approach increases the effectiveness of detection mechanisms and resilience to evolving, elaborate cyber threats.

The results of this study can provide a valuable guideline for future research related to cybersecurity, especially in the IoT context. Future work could involve practice; The scalability of the hybrid model needs to be evaluated in a more robust and realistic manner, large network conditions as well assessing e performance up against real-time solutions such as intrusion detection. Also, if the models are going to continually be refined, they could include more detailed behavior data or new deep learning techniques that would focus even closer on idiosyncratic patterns of network anomalies.

This research not only takes a further step towards theoretical understanding of machine learning in cybersecurity, it also lays the groundwork for creating powerful and accurate intrusion detection systems that are vital to securing this ever-expanding digital domain filled by IoT networks

With an emphasis on the developments of cyber era, cloud computing has become a key to modern business operation where it provides scalability and flexibility efficiency [1]-[4]. But as usage of cloud-based environments grows, so does the appeal from a cyber-threat perspective. These environments are by nature dynamic, distributed and prone to a variety of sophisticated attacks for which traditional security controls typically fail.

In order to protect such environments, Intrusion Detection Systems (IDS) [5][6] play a key role as they keep monitoring the network traffic so that it can alert if any malicious activities are detected. While traditional IDS solutions mainly use pre-defined rules (signatures) for detecting intrusion. Such techniques are good at protecting against known threats but no longer practical when confronted with zero-day vulnerabilities, polymorphic malware and volumetric distributed denial of service(DDOS) attacks (all common throughout modern cloud-based systems).

In this study various common and emerging cyber-attacks, such as Denial of Service (DoS), Distributed Denial of Service (DDoS) and ransomware attacks. These attacks were selected to be increasingly common in cloud and IoT environments, hence being vital threats to mitigate with advanced intrusion detection systems.

In this research paper a new convolutional approach based on Recurrent Neural Networks(RNN) and Convolutional Neural Network has been used to increase the potential of Intrusion Detection Systems in cloud environments[7]. This hybrid model makes use of both RNNs to capture and forecast patterns over time, together with the ability for spatial feature extraction from data flows which is well handled by CNNs. Thus, this architecture combines both networks to detect not just the known types of intrusions but also discover anomalous patterns that could be a new untouched attack.

The rationale for an IDS this sophisticated is the fact that more and more of the cyber threats are automated, so it must be on par. Further machine learning models deployed such as the one suggested in this paper are able to learn from new data that it receives, allowing itself to update its threat detection abilities without manual updates of their databases. In cloud environments where the threat landscape can change quickly, this is especially advantageous.

Finally, The hybrid RNN-CNN model introduced represents a significant advancement in security, facilitating the development of more precise recognition models that enhance cloud infrastructure defense against a wide range of cyber threats. This paper explores the architecture thoroughly and demonstrates its effectiveness from all perspectives, paving the way for a new security paradigm characterized by dynamic, intelligent, and robust intrusion detection.

1.      Related Work

Intrusion detection systems (IDS) work through multiple methods to weed out anomalies leveraging algorithms as diverse in their implementation from data mining, machine learning and statistical approaches. There are researchers that studied the IDS's performance by investigating singular algorithmic approaches [8] and others motivate a hybrid methodology to improve on an exact issue in IDSs, however not much has been done so far. For example, Atefi et al. used a combination of genetic algorithms and support vector machines (SVM) for anomaly detection, where support vector machines (SVM) becomes more specific in precision compared to the use of an SVM only while further performance improvements were achieved when both approaches are combined into one hybrid Intrusion detection systems (IDS) [9].

Research by Khoei et al. applied three ensemble learning approaches such as bagging, boosting and stacking to anomaly detection problems tested them on data samples that are noisy using decision trees,naıve bayes, and K-nearest neighbors traditional solutions. In summary, their work showed that recognition rates using stacking-based approaches clearly outperformed those based on a single method [14].

At a classification level, Rakshe and Gonjari employed support vector machines (SVM) as well random forest approach to obtain accuracies greater than 95% in some cases using the NSL-KDD dataset. Such comparison is random forest performed better than SVM in traffic classification [11]. Kumar et al. created an IDS using Naïve Bayes, ID3 (Iterative Dichotomiser 3) and (Multilayer Perceptron) MLP algorithms with ensemble learning in the CICIDS2017 dataset. In this case, the ID3 algorithm performed well above average in terms of precision (83.7), recall (82.54), accuracy (98) and F1 score [12].

Zhang et al. implemented an XGBoost-based misuse IDS for Local Area Network (LAN) individual using the real-time data obtained from 10 country users located in Asia [13]. Similarly, the study by Taher et al. proposed a signature-based IDS with Artificial Neural Network (ANN) and SVM implementation [14];

This problem has driven big cloud service providers (Amazon Web Service (AWS), Azure and Google) to use signature, behavioral as well machine learning detection techniques [15]. Gao et al. developed a novel malware detection model based on cloud semi-supervised learning, which includes a detection component built on a recurrent neural network (RNN) to ensure tenant privacy in public clouds [16].

Venkata Rao et al. recommended the Deep Wrap Neural Network (DLCNN) for detecting internet worms and NetFlow related to various attacks, assessing its effectiveness using PCAP and KDD-CUP-99 datasets [17]. Hasan Alkahtani and colleagues applied machine learning and deep learning techniques to detect malware in Android systems, with SVM achieving the highest accuracy using the CICAndMal2017 dataset, and Long Short-Term Memory (LSTM) performing well on the Drebin dataset [18].

These studies collectively underline the potential and effectiveness of hybrid and machine learning approaches in enhancing the capabilities of IDS, setting a foundational backdrop for hybrid RNN-CNN model.

2.       Methodology

The methodology of this study encompasses a series of integrated steps, starting from data collection to the detailed development and evaluation of various deep learning models specifically tailored for intrusion detection in internet of things (IoT) networks [19][20].

Figure 1.Proposed method

3.      Data Collection

ToN_IoT [21][22]is designed as an extensive benchmarking resource to advance AI-driven cybersecurity solutions across IoT and IIoT (Industrial Internet-of-Things) environments; adopted in this study. This is home to a broad spectrum of data types that range from telemetry for numerous IoT and IIoT sensors, system logs (from Windows and Linux platforms), as well very precise records regarding network traffic. The name ToN stands for one of the types Dataset it contains which is Telemetry, IoT and Network data so this made a wide range datasets to use in Cybersecurity research.

The dataset has been collected at a high-quality lab setup; Internet of Things (IoT) Laboratory in Cyber section, School of Engineering and Information Technology University of NSW(UNSW), Canbera based CDOT facility located within the Australian Defence Force Academy. In this, we have a larger scale Infrastructure 4.0 network with virtual machines (VMs), cloud infrastructure and Halcyon Resource Identifier in IoT Fog Computing environment deployed by various embedded type of sensors used for these kinds if infrastructure monitoring. Researchers to gather baseline operational data as well as a variety of cyber-attacks i.e., DoS, DDoS and ransomware attacks targeted at web application, IoT gateway and computing systems used this testbed.

This well-prepared dataset has its components stored in directories containing everything from training images to validation and model checkpointing. Raw data is collected from IoT/IIoT sensors, network traffic and all system logs of different types. To ensure universal use, the raw files has been converted into a common format such as CSV by our team for further exploratory analysis across different platforms. This dataset also provides a directory called “Train_Test_datasets” which is especially designed in order to train and test machine learning models for cybersecurity. In addition, "SecurityEvents_GroundTruth_datasets" contain timestamps and IP addresses for simulated attack events. This well-organized and detailed dataset offers a significant asset for developing AI-driven cybersecurity solutions, while accurately reflecting the conditions of future threats in IoT/ IIoT networks.

Moreover, ToN_IoT dataset is specially appropriate to train efficient intrusion detection models like the one constructed using an easy-to-use API of Spark MLLib. It consists of several kinds of network intrusions as well as normal behaviors, which makes it a great dataset to develop and evaluate secure networking solutions.

Types of Attacks Evaluated

For this study, models were tested against different types of cyber-attacks that are common and one emerging network attacks which pose a big threat to modern cloud and iot environments.

• Denial of Service (DoS): attacks attempt to make a network service unavailable by overwhelming it with an enormously high flood of illegitimate requests. This mass of requests is larger than the capacity resources (network, application) and leaves no space for a proper user request to respond. Such an attack is frequently employed to cripple websites, online services, or network resources significantly disrupting the operation time of organizations and incurring potential monetary and reputational loss.
• Distributed Denial of Service (DDoS): Distributed DoS attacks are a step-up from the previous type, more severe and complex. While DoS attacks come from one source, DDoS is when traffic floods in multiple sources and it can be orchestrated through millions of compromised devices and coordinated by botnet. Because of its distributed nature, DDoS attacks are more difficult to defend against since the malicious traffic surge comes from multiple locations in unison making it hard to distinguish and filter out or block without interfering with legitimate activity. DDoS attacks overload the availability of even enterprise-grade network infrastructures, and can turn a simple service internal outage to obvious operational issues.
• Ransomware: is a type of malware that is designed to block access to a computer system or data, typically by encrypting it, until the victim pays money. Typically, ransomware attacks get in through a system infection via phishing emails, malicious downloads or an exploitable network defense vulnerability. After, infecting a system it encrypts the sensitive files on that machine and then leaves behind a note stating ransom for an encryption key to decrypt those vital details. Ransom: This type of attack asks for a ransom to not permanently delete driving data. The ransomware has grown into one of the most infamous and devastating cyber-attacks that disrupts operations, interrupting not only those for individuals and businesses but also critical infrastructure by making financial losses.

As such, these particular attacks were selected as the focus due to their rapidly increasing number of times observed and level of complexity along with a severe impact on cloud / IoT environments. The principal of the threats that now needs to be managed by modern intrusion detection system is Denial-of-Service, Distributed-Denial-of-Service and Ransomware. It was chosen so that non financial brute force killing blow attacks are a testing methodology to check the developed models resilience and robustness against real life cyber threats.

The dataset used for this research consisted of simulations of these attacks, enabling the ultimate test bed in terms to both content and realism from those sort s detection models. These simulated attack scenarios injected into the models helped validate how well they could respond against real-life cyber threats and thereby, determine whether building a secure network operation around them to protect cloud or IoT systems was feasible. His complete evaluation process is designed to ensure that the models are both theoretically sound and effective in practice, able to protect digital infrastructures from threatening cyber attacks.

4.      Data Preprocessing

The first step of data preprocessing was downloading and loading the dataset into a Pandas DataFrame[23]- [25], The imbalance in class distribution was addressed. The 'normal' class was significantly larger than the other classes, potentially resulting in a poor predictor that would consistently predict 'normal.' To mitigate this issue, downsampling was applied, reducing the number of normal samples to 20,000 and thereby balancing the dataset for training.

Figure 2 class down sampling

Next step in preprocessing phase is to change the non-numeric columns into Label encoding for further proceeding those with machine understanding format. This takes care of the other categorical data and makes it numerical. Moreover, feature scaling have done to make the values of features within a similar scale using MinMaxScaler[26][27] which assist in acceleration of learning for neural networks. One-hot encoding transforms the output variable 'type' into a binary matrix format, enabling its use as the target in the subsequent classification task.

5.      Model Development

The research contributed three varied models to test their capability of intrusion detection:

The first model is a CNN Model and includes 1D convolutions. Useful when dealing with complex data, namely any spatial hierarchy. The architecture uses multiple layers: Conv1D and MaxPooling1D, ended by a Flatten layer with Dense layers. A dropout layer was added to prevent overfitting.

The second model is an LSTM-GRU [28]-[30] Model: The structure of this one contains a mix style version that uses some architectural layers based on the differences between both techniques. This architecture is meant to capture long-term and short-term dependencies respectively in data, which becomes necessary for detecting anomalies in sequential type of data such as network traffic.

The third model, which is a Hybrid Model that tries to take in the power of both first (CNN) and second (LSTM-GRU). It seeks to exploit the spatiotemporal feature learning capabilities for improved detection accuracy.

6.      Model Training

All models were trained using the same dataset with an 80/20 training and test split to evaluate performance. Adam was used as the optimizer [31] with binary cross-entropy loss function [32, 33], given that this is a multi-class target variable. The model was trained for ten epochs with a batch size of 32 to achieve an optimal balance between improving the learning process and managing computational overhead.

7.      Model Evaluation

These models were then evaluated by computing metrics like accuracy, precision, recall and F1-score. Confusion matrices were also used to visualize the performance of each model in classifying different types of network traffic. Sensitivity and specificity calculations were also performed to determine the models' ability to identify region-true positives (i.e., positively labeled as a given functional land cover) or true negatives for each grid cell into which Mexico was gridded.

Such approach was designed methodologically to test different model architectures as standalone models, and investigate the synergetic effect of combining various features in order to tackle a challenging problem - detecting intrusions on IoT networks.

Accuracy: This is the most straightforward performance metric, representing the ratio of correctly predicted observations to the total observations. It is particularly useful when the class distribution is balanced. The accuracy can be calculated using the following formula:

Precision : is a metric that measures the accuracy of positive predictions made by a model, calculated as the ratio of true positives to the total positive predictions (true positives plus false positives). It's crucial when the cost of false positives is high.

Recall is a metric that measures the ability of a model to correctly identify all relevant instances in a dataset. It is calculated as the ratio of true positives to the sum of true positives and false negatives. High recall indicates that the model successfully captures most of the actual positive cases.

The F1 score is a metric that combines both precision and recall into a single value. It is the harmonic mean of precision and recall, providing a balance between the two. The F1 score is particularly useful when the cost of false positives and false negatives are both important to consider. It is calculated using the formula:

8.      Results

This study is very significant in presenting the effectiveness of different variants of deep learning models [34] for intrusion detection in IoT networks. The data selected for the experiments was well-balanced, replicating class imbalances across different attack categories (scanning, denial of service -DoS-, injection) and normal traffic patterns.

Three different models CNN, LSTM-GRU and a hybrid model (combination of both) were evaluated after down sampling [35]-[38] followed by preprocessing. The key metrics used to measure each model's performance are Accuracy, Precision, Recall, and F1 Score.

9.      Model Evaluation and Performance

CNN model shows awesomeness in these 4 matrixs 95% accuracy, 96% presicison,95% recall and 95% f1 score. They show how the CNN model is very powerful in the spatial features extraction, which is a very important in the identification of intrusion patterns in the network traffic.

Figure 3  Confusion Matrix CNN

The LSTM-GRU model had the best performance for appropriately capturing temporal dependencies (98% accuracy), information precision and recall values, which were 98%, while the F1-score was also equal to! While this underpins its capability in addressing sequential data recognizing time-series [39] behavior across the network traffic and Ozdemir's more intricate intrusion attempts as well.

Figure 4 Confusion matrix LSTM-GRU

Although the hybrid model performed best compared to other associated models integrating CNN and LSTM-GRU architectures, this performance was intuitive because of its unified approach dealing with both spatial and temporal domains. Indeed, this had the highest aggregate accuracy (99%), precision (99%), recall( 00%) and F1 score(98.95) of all tested models.

Figure 5 Confusion Matrix CNN-LSTM-GRU

10.   Confusion Matrix Analysis

Based on the classification results of various types of network attack, further comparison from confusion matrices is shown for these models [40],[41],[42]. The matrices show good true positive rate in the most classes and as far mis-classifications are concerned, the hybrid model shows lowest value which continues to prove its better overall performance.

11.   Comprehensive Analysis

Comparison across models performance in various metrics using bar chart shows that as the CNN, LSTM-GRU and Hybrid model all has similar results on their Key metrices; Accuracy, Precision, Recall and F1 score. The high level of uniformity indicates that each model excels within its domain—CNN with spatial features, LSTM-GRU with temporal and Hybrid works in the middle ground combining both.

This equal performance can be explained by the fact that this dataset is large and diverse, ensuring each model has a collection of examples allowing it to learn required patterns for obtaining high accuracy. This means the data itself lends well to different types of analysis (spatial, temporal, spatio-temporal).

Such findings are indispensable as they highlight that AI-based models can indeed improve the performance of traditional security devices, especially for complex IoT systems considering their huge diversities and data sizes providing a key point for the implementation of powerful yet efficient detection approaches. This could also indicate, as a rule of thumb for when computational efficiency is sought by design simpler models such as CNN or even LSTM-GRU would be able to perform similarly well yet giving us prediction capability. Nonetheless, the Hybrid model enables a strong suit for those cases in which one believes that combining spatial and temporal analysis could be advantageous.

Figure 6 Comparison of Models Metrics

These results are essential for building efficient security tools such that the data diversity and volume of these environments make traditional intrusion detection mechanisms not optimally working in an IoT network. This high performance on the combined model means a useful avenue for research and retrieval in setting where speed is most important.