Multi-Stage Hybrid Neural Network for Network Intrusion Detection Using Seq2Seq and ConvLSTM

Abstract

The rapid increase in cyberattacks has created a growing demand for intelligent and reliable Network Intrusion Detection Systems (NIDS) capable of identifying complex threats with high accuracy. Traditional intrusion detection methods often face difficulties in recognizing sophisticated attack patterns and maintaining low false alarm rates. This study proposes a Multi-Stage Hybrid Neural Network that combines Sequence-to-Sequence (Seq2Seq) and Convolutional Long Short-Term Memory (ConvLSTM) models to improve intrusion detection performance. The proposed framework utilizes benchmark datasets such as CICIDS2017, CIC-ToN-IoT, and UNSW-NB15 for training and evaluation. Before model development, the datasets undergo preprocessing, including data cleaning, feature encoding, normalization, and train-test splitting to improve learning efficiency. The Seq2Seq model captures sequential relationships in network traffic, while the ConvLSTM network extracts both spatial and temporal features to enhance attack classification. To improve model transparency, Local Interpretable Modelagnostic Explanations (LIME) are incorporated to explain the factors influencing prediction outcomes. Experimental results demonstrate that the proposed hybrid framework achieves high detection accuracy while reducing false positive rates. The combination of hybrid deep learning and explainable artificial intelligence provides an efficient, interpretable, and practical solution for modern network intrusion detection.