Hybrid CNN–LSTM Intrusion Detection Framework for Industrial IoT Security

Aims: The rapid adoption of the Industrial Internet of Things (IIoT) has increased the exposure of safety-critical industrial systems to sophisticated cyberattacks, necessitating intrusion detection mechanisms that are both accurate and operationally reliable. Traditional intrusion detection systems were shown to struggle with the complex statistical correlations and temporal dynamics inherent in IIoT traffic, often resulting in elevated false alarm rates and unreliable detection of evolving attacks. This study proposed a lightweight hybrid CNN–LSTM intrusion detection framework that jointly modelled correlated statistical traffic descriptors and their temporal evolution.

Methods: Convolutional layers were used to learn compact representations from high-dimensional IIoT traffic features, while a Long Short-Term Memory (LSTM) layer captured temporal dependencies associated with multi-stage and slow-rate attacks. The model was evaluated on a large-scale Industrial IoT intrusion detection dataset using imbalance-aware metrics, threshold analysis, and probability calibration.

Results: Experimental results demonstrated strong generalisation performance, achieving an F1-score of 0.968 and a ROC-AUC of 0.780 under controlled experimental conditions. Importantly, the proposed approach maintained a low and controllable false alarm rate across a wide range of decision thresholds and produced well-calibrated prediction confidences.

Conclusion: These properties indicated that the framework was suitable for real-time deployment in resource-constrained IIoT environments, where operational reliability and risk-aware decision making are critical.

Keywords: Industrial internet of things; intrusion detection system; deep learning; CNN–LSTM; network security; temporal traffic analysis; false alarm rate; cyber-physical systems.

1. INTRODUCTION

The Industrial Internet of Things (IIoT) is now an essential part of a new manufacturing system, energy grid, smart grid, and critical infrastructure that can be monitored in real-time, automated, and rely on data to help create decisions [1]. The IIoT environments are heterogeneous, have deterministic communication patterns, and life-long machine-to-machine traffic, unlike conventional enterprise networks, produced by sensors, actuators, and controllers. This traffic usually has fixed statistical characteristics when it is in a normal operational state but may shift suddenly in the presence of harmful activity, malfunctioning equipment or incorrect configuration.

Assaults in IIoT setup have much more serious implications than in conventional IT infrastructure. Intrusions may cause physical damage, downtime of production, safety issues and cascading failures of interdependent systems [2]. Consequently, IIIoT intrusion detection systems must meet high standards of accuracy, reliability, and real-time availability. One of the critical issues in this regard is the price of false alarms. False positives in large numbers may overload operators with unnecessary shutdowns, which undermines the confidence in automated security systems [3]. With a safety-critical industrial scenario, even a minor rate of false alarms can lead to significant financial loss or even downtime. This means that successful IIoT intrusion detection should not only be highly accurate in detection but also have a narrow control over false alarm rates when operating under realistic traffic conditions.

The conventional types of intrusion detection systems (IDS) are mostly based on signature-based rules or static techniques of anomaly detection [4]. The signature-based IDS performs well with recognised patterns of attack but cannot identify zero-day attacks or emerging threats, and they are becoming more widespread in IIoTs. In addition, it is not feasible to keep signature databases current in large-scale industrial networks, as they are prone to errors. Machine learning-based IDS has also been suggested; nevertheless, many existing methods assume network traffic is independent and identically distributed samples and do not consider the sequential and temporal nature of IIoT communications [4]. Decision trees, support vector machines or shallow neural networks are examples of a static classifier that uses handcrafted features based on individual traffic windows and thus cannot detect multi-stage attacks and low-rate, slow intrusions.

Most importantly, the traditional IDS is not time-conscious. Industrial attacks can be developed and progress slowly, as the slightest increase in traffic statistics may be built up over a long period of time. Unless these temporal dependencies are modelled, the static IDS can either fail to detect an attack at all or create unstable predictions that cause higher false alarm rates [5]. Deep learning provides a conceptual model of overcoming the shortcomings of traditional IDS by learning hierarchical and temporal representations directly using data [6]. The data sets of IIoT traffic are high-dimensional, which are correlated statistical characteristics, including entropy, mutual information, jitter, and the higher orders of interaction between packets. CNNs can effectively learn robust representations in high-dimensional descriptor spaces as they have features with local dependencies and correlations.

Nevertheless, CNNs do not suffice to learn how to model the temporal dynamics of attacks, which is critical in IIoT settings. The ability of recurrent architectures to learn long-range temporal dependencies and the potential of recurrent architectures, and especially Long Short-Term Memory (LSTM) networks, to model sequential patterns in network traffic have been demonstrated. A hybrid architecture can be used to simultaneously learn the spatial feature interactions and temporal attack dynamics by using CNN-based feature extraction and LSTM-based temporal modelling [7]. IIoT deployments impose strict constraints on computational complexity, memory footprint, and inference latency, particularly when intrusion detection must be executed on edge gateways or industrial controllers. In this work, we explicitly addressed these constraints by designing and evaluating a lightweight CNN–LSTM intrusion detection model that balances detection performance with computational efficiency, enabling practical deployment in resource-constrained IIoT environments [8].

The objective of this study was not to propose a novel deep learning architecture per se, but to investigate whether a carefully constrained hybrid CNN–LSTM intrusion detection system can be made operationally reliable for Industrial IoT environments. Specifically, this work focused on four questions that are largely underexplored in prior IIoT IDS literature:

(i) whether false alarm rates can be explicitly controlled via decision threshold analysis,

(ii) whether prediction confidences can be made statistically calibrated for risk-aware deployment,

(iii) whether temporal robustness can be verified beyond aggregate accuracy metrics, and

(iv) whether such properties can be achieved using a lightweight architecture suitable for edge deployment.

Accordingly, the primary contribution of this paper lies not in architectural novelty, but in a deployment-oriented evaluation framework that bridges the gap between academic IDS performance and industrial operational requirements. This paper makes the following key contributions:

A deployment-oriented evaluation of IIoT IDS focusing on false alarm controllability, calibration, and temporal robustness rather than accuracy alone.

Threshold-aware false alarm analysis enabling operational tuning of IDS behaviour.

Quantitative calibration assessment for risk-aware industrial decision making.

Temporal robustness analysis demonstrating stability across sequence positions.

The CNN–LSTM architecture serves as a controlled vehicle to study these properties rather than as the primary source of novelty.

2. RELATED WORK

• • Traditional Intrusion Detection Systems in IoT and IIoT

Non-experimental IoT and Industrial IoT intrusion detection systems have primarily been based on rule-based and anomaly-based detection paradigms. In its many variations, rule-based IDS, based on signature matching, determines malicious activity by matching observed traffic to predefined patterns that are related to known attacks [9]. Although useful in the detection of already known attack types, such systems are not very adaptable and cannot detect zero-day or polymorphic attacks, the latter being more frequent in IIoT ecosystems. Moreover, industrial networks are heterogeneous and large-scale, so continuous signature maintenance is practically impossible, which reduces the coverage in detection over time.

Anomaly-based IDS is an attempt to overcome these shortcomings by learning normal traffic behaviour and indicating anomalies as possible intrusions [10]. With IIoT systems, though, it is difficult to establish a consistent ground of normal behaviour because of changes in modes of operation, devices, and production schedules. This has led to the fact that anomaly-based systems usually have high false alarm rates that are especially troublesome in the safety-critical industry. The failure of conventional IDS to scale sensitivity and reliability has prompted the consideration of data-driven methods that can gain knowledge of the complex patterns of traffic by analysing the data presented to them.

• CNN-Based Intrusion Detection Approaches

CNNs have attracted a lot of interest in network intrusion detection because they can automatically learn hierarchical features of high-dimensional inputs [11]. CNN-based IDS are commonly used in IoT and IIoT settings, where they process either statistical traffic features, packet sequences reconfigured into fixed-size matrices, or flow-level representations. The key advantage of CNNs is their ability to model local correlations between features, especially in cases where the traffic descriptors have structured dependencies, i. e., between entropy and packet rates and directional statistics.

Although CNN-based IDS has a high level of feature extraction, they have significant weaknesses in its use alone. Most CNN-only methods assume that traffic samples represent independent observations, implying that a sample of network traffic can be used to detect malicious behaviour. It is not the case in an industrial setting, where attacks tend to have a slow development and can appear as a slight temporal shift as opposed to a sudden anomaly. This means that CNN-based models cannot observe slow-rate or multi-stage attacks and can give unstable predictions as the traffic constant changes. These constraints indicate the importance of architectures that are not restricted to learned features that are static [12].

• LSTM and Recurrent Neural Network-Based IDS

To overcome the time constraints of competitors, Recurrent Neural Networks (RNNs), especially Long Short-Term Memory (LSTM) networks, have been popularly used to overcome the time constraints of traditional classifiers [13]. The explicit dependencies on sequencing LSTM-based IDS on network traffic are used to identify attack behaviours that manifest over a slender period. LSTMs can give a natural way to differentiate normal operation dynamics and malicious deviation in IIoT environments, where the communication patterns are usually periodic and correlated with time.

It has been established that LSTM-based models can be used to detect temporally correlated attacks better than traditional machine learning approaches. Nevertheless, the input features that are generally being used by LSTM-only methods are raw or have undergone minor processing, which can be a constraint on their capabilities of modelling complex interactions among high-dimensional traffic features. In addition, recurrent models tend to be more expensive and harder to train on massive data, casting doubt on their practicality to train IIoT in real-time. Consequently, although LSTMs are effective in capturing temporal dynamics, they have complementary mechanisms that can be used to improve the quality of feature representation [14].

• Hybrid Deep Learning Intrusion Detection Systems

To use the advantages of CNNs and LSTMs in a complementary way, recent studies suggested hybrid deep learning models that combine convolutional feature extraction and recurrent temporal modelling [15]. In such systems, the CNN layers are commonly taught to obtain compressed representations of the traffic characteristics, but the LSTM layers are used to learn the temporal dynamics. Hybrid IDS are also shown to have better detection ability than single-model techniques, especially on complex or dynamic attacks [16].

Despite the above promise, current studies of hybrid IDS have a few critical limitations. First, most assessments are conducted centred on general accuracy or F1-score, which gives minor information about operational measures, including false alarm rate, threshold sensitivity, or calibration quality. Second, most studies are based on random train-test splits, which are inadequate in capturing the influence of time, which may overstate reported performance [17,18]. Third, most hybrid IDS tests do not analyse temporal consistency, and the question about how prediction errors and feature triggers change with sequence positions remains open. Above all, the issue of whether hybrid IDS outputs can be well-calibrated is not evaluated in many works, although IIoT deployments are increasingly demanding probabilistic outputs to aid in risk-sensitive decision making [19]. These systems cannot be practically applicable in the industrial environment due to the lack of calibration and threshold analysis.

• Research Gap

In short, current intrusion detection solutions for the IoT and IIoT networks have three major limitations. To begin with, most hybrid deep learning IDS focus on the accuracy of classification and do not consider the cost of the operation of false alarms, which is of paramount importance in the industrial sector that requires safety. Second, the literature does not typically examine temporal stability, so there is an open question regarding the behaviour of models at various levels of traffic sequences. Third, it lacks calibration and threshold-sensitive analysis, which makes it difficult to trust the implementation of these systems in any IIoT infrastructure. The paper explicitly tackles these limitations through the proposition of a lightweight CNN–LSTM intrusion detection system and its test with imbalance-sensitive metrics, false alarms evaluation, calibration evaluation, and time-resilience evaluation, thus filling the gap between the academic performance and the industrial usability.

3. METHODOLOGY

• • Dataset Description

The dataset applied in this study is the Intrusion Detection Systems (IDS) dataset, which is an extensive Industrial IoT dataset aimed at simulating realistic benign and malicious communication patterns produced by heterogeneous IIoT devices. It has 2,426,574 traffic samples, each of which is characterised by 23 statistical features of network flow behaviour. The problem of classification is created as a binary problem, with the traffic classified as Benign or Attack. This binary formulation is concurrent with the typical operational needs in IIoT situations where quick and dependable distinction between typical functioning and malevolent interference is valued over microscopic categorisation of attacks. Specifically, the dataset corresponds to the BoTNeTIoT Industrial IoT benchmark (BoTNeTIoT-L01), which has been widely used in IIoT IDS research.

The data set has a reasonably skewed distribution of classes, with benign traffic taking 78.84 percent of the sample and attack traffic taking 21.16 percent of the sample. This asymmetry is indicative of actual industrial networks, of which the events of malice are less common but have disproportional operational consequences. The size and classification of IoT on Intrusion Detection Systems (IDS) render it appropriate for assessing intrusion detection systems in realistic IIoT circumstances.

Table 1, summary of the dataset used in this study, including feature dimensionality, class distribution, and sample counts.

Table 1. Dataset summary.

• Feature Description

There are several families of statistical traffic descriptors, such as MI_dir, H, HH, and HpHp, that are calculated in short time windows. These characteristics represent two opposite sides of IIoT network behaviour. Directional mutual information is an MI family that enables communication asymmetry. H and HH family are entropy-based metrics, which measure the level of randomness and variability in the interaction between packets, and the higher-order statistics are used to measure temporal instability and burstiness, typically of attack traffic: jitter, variance, and covariance. The HpHp provides model interactions of higher-order characteristics of packets to add further discriminatory capabilities to more complex attack patterns.

A correlation analysis shows that these features are not statistically independent, as there is a strong intra-family dependence between them. These forms of structured correlations encourage the application of convolutional neural networks, which are ideally suited to studying local relationships and concomitant feature representations. Figure 1illustrating strong intra-feature dependencies that motivate CNN-based representation learning.

• Data Scaling and Splitting

To achieve numerical stability in training, all the features were z-score normalised, and thus produced inputs with zero mean unit variance, which were exclusively based on the statistics of the training data. The data was split into training, validation, and test sets to aid the model building, hyperparameter optimisation, and objective performance assessment. Only early stopping and learning-rate scheduling were done on the validation set, and final performance reporting was done on the test set. This three-way split ensures robust evaluation while preventing information leakage across experimental stages Table 2.

Table 2. Dataset splits.

• Sequence Construction

To capture the temporal reliance of the IIoT traffic, a sliding window method was employed to structure the samples into fixed-length sequences. The sequences are 10-time steps long, and the time steps are full of the 23-feature vectors. The length of the sequence was selected empirically and was traded off between the detection performance and computational efficiency. Short sequences were found to poorly represent an evolving attack behaviour, whereas the length of sequences was found to generate weaker performance improvements and higher computational cost. The 10 length of the sequence, thus, gives practical and statistically grounded temporal context to the modelling of the attack dynamics.

• Data Splitting and Temporal Leakage Control

To avoid temporal leakage caused by overlapping sliding windows, data splitting was performed prior to sequence construction. Raw traffic records were first partitioned into training, validation, and test sets at the sample level using mutually exclusive index ranges. Sliding window sequences were then constructed independently within each split, ensuring that no overlapping or near-duplicate windows appeared across training, validation, and test sets. This procedure guaranteed that temporal dependencies were learned only within each data partition and prevented information leakage arising from shared observations across splits. As a result, the reported performance metrics reflect genuine generalisation rather than artefacts of window overlap or non-independent sampling.