Improving Intrusion Detection with Hybrid Deep Learning Models: A Study on CIC-IDS2017, UNSW-NB15, and KDD CUP 99

Abstract

Intrusion Detection Systems (IDS) play a critical role in cybersecurity, protecting networks from evolving cyber threats. This study evaluates the effectiveness of deep learning models, including Capsule Networks (CapsNet), Bidirectional Long Short-Term Memory (BiLSTM), and a hybrid CapsNet + BiLSTM model across three benchmark datasets: CIC-IDS2017, UNSW-NB15, and KDD CUP 99. Experimental results show that the hybrid CapsNet + BiLSTM model outperforms individual architectures, achieving 99% accuracy on CIC-IDS2017, 97% on UNSW-NB15, and 98% on KDD CUP 99. The confusion matrices validate its robustness in detecting complex attack types, including DoS, DDoS, and botnets. These findings proposed that deep learning-based hybrid models can significantly enhance network security, improve anomaly detection, and strengthen real-time cyber threat mitigation strategies.