A HYBRID CNN-LSTM DEEP LEARNING ARCHITECTURE FOR REAL-TIME INTRUSION DETECTION IN SMART HOME IOT GATEWAY NETWORKS

Abstract

The attack surface for cyber threats has significantly increased due to the Internet of Things' (IoT) rapid development, and traditional intrusion detection systems are insufficient due to the IoT settings' fundamental resource limitations. In order to identify binary intrusions in smart home IoT gateway networks, this study develops and assesses a hybrid  (CNN-LSTM) architecture. The CICIoT 2023 dataset, which consists of 100,000 network flows with 43 features that depict modern IoT attack scenarios under natural class imbalance (about 90:10 benign-to-attack ratio), is used to train and assess the model. To stop data loss, the preprocessing pipeline uses StandardScaler normalization, stratified train–test separation (80:20), and anomalous-value management. After extracting spatial attack signatures from feature vectors using 1D convolutional filters, the suggested architecture uses two stacked LSTM layers to record the temporal development of attacks, using dropout regularization (rate = 0.5) to reduce overfitting. On a fully independent test set of 20,000 flows, the model, trained for 20 epochs using the Adam optimizer with binary cross-entropy loss, achieves 99.81% accuracy, 99.81% precision, 99.81% recall, and an F1-score of 99.81%. The average precision of 0.9985 and ROC-AUC of 0.9989 attest to strong performance at all decision thresholds. The detection rate of 98.1% and the false positive rate of 0.11% are operationally important, providing a workable compromise between attack coverage and alert fidelity. These results match or surpass recently published CNN-LSTM intrusion detection research, and they outperform traditional machine learning baselines, Random Forest (97.3%) and SVM (96.8%). The model is feasible for edge deployment on IoT gateway devices since it accomplishes inference in about 2.5 milliseconds per flow.