A Two-Stage Hybrid Intrusion Detection Framework Based on Hierarchical Attack Mapping and Pruned CNN-GRU Models

Abstract

This study presents a realistic two-step approach to network intrusion detection that combines two established security paradigms, namely, anomaly-based and signature-based detection. The proposed hybrid architecture achieves high detection accuracy and maintains system customizability and scalability for real-world applications, even for resource-limited edge devices. The proposed method first compares all network traffic packets with a large resource of known attack signatures (data-driven signature file), which is generated from actual data from network attacks, helping in faster detection of known threats. Packets that do not match this signature verification are then processed to a more advanced analytical step, where a specialized CNN-GRU hybrid model takes over. This model was optimally pruned, significantly reducing computational costs and inference delays but still allowing it to identify attacks without adversely affecting system throughput. To ensure strict evaluation, six high-profile benchmark datasets, namely NSL-KDD, UNSW-NB15, BCCC, CIC-UNSW-NB15, NF-ToN-IoT-v3, and CICIOT2023, were aligned under a single feature schema. In addition, a hierarchical attack taxonomy was designed, where on the simplest level a binary classification (Normal or Attack) is performed, followed by the classification of general attack types and, lastly, the fine-grained classification of particular attack forms. Each dataset was used to train a dedicated and pruned CNN-GRU model. For inference, an advanced voting system is used to combine the predictions of all constituent models, producing a much-trusted determination of network activity. Across both binary and multi-class evaluations, the system achieves up to 99.99% accuracy, with high F1-scores between 94% and 100%. This high accuracy did not come at the cost of speed, as the pruning process notably reduced computational overhead and sped up analysis. Its modular architecture allows the system to be easily adapted with new datasets or even directly analyze live network traffic, making it a robust and scalable solution for modern cybersecurity challenges. Unlike existing intrusion detection approaches that suffer from critical limitations, such as dependence on a single-stage anomaly detection, training on limited data, and relying on complex designs that hinder their scalability and increase computational cost, the proposed two-stage pruned CNN-GRU architecture with hierarchical attack mapping is capable of overcoming these limitations and maintaining high detection accuracy while reducing computational overhead.