Intrusion detection with HACDT-Net and TRBM-Net using a hybrid deep learning framework with enhanced sampling techniques.

Intrusion detection systems (IDS) are becoming essential for protecting network infrastructures due to the quick growth of cyber threats. Class imbalance makes it difficult for conventional machine learning-based IDS models to detect uncommon attack types, which results in a significant number of false negatives. Recent developments in Deep Learning (DL), particularly hybrid architectures and adaptive sampling techniques, offer promising solutions to improve intrusion detection accuracy. This article aims to enhance network intrusion detection by integrating DL models with advanced resampling techniques to address class imbalance and improve feature extraction. Two hybrid models are explored: Hybrid of Autoencoder-CNN and Transformer-DNN (HACTD-Net), and 1D-TCN-ResNet-BiGRU-Multi-Head Attention (TRBM-Net), each leveraging different approaches for feature learning and class balancing. The HACTD-Net models employ ADASYN-SMOTE and ENN to improve minority-class representation. The TRBM-Net model integrates Borderline SMOTE-OSS hybrid sampling to generate synthetic attack samples while filtering noise. We evaluate these representations using the CICIDS2017 and NF-BoT-IoT-v2 datasets, assessing their performance in terms of accuracy, precision, recall, and F1-score. The HACTD-Net models attained 99.88% accuracy in classification, demonstrating robust performance against various network attacks. The TRBM-Net model, incorporating a multi-head self-attention mechanism, achieved 99.72% accuracy, effectively enhancing minority-class detection while reducing false alarms. This study demonstrates that hybrid deep learning models combined with optimized resampling techniques significantly improve IDS performance. The integration of contextual and spatial feature extraction with balanced training data enhances detection rates, particularly for rare attack types. These results provide a basis for developing real-time, adaptive IDS solutions for modern network security challenges.