Behavior-Based Zero-Day Attack Detection Using Hybrid Deep Learning Models in Enterprise Networks
Bibliographic Information
Complete Author List & Affiliations
Research Abstract & Methodology
Modern enterprise infrastructures face unprecedented exposure from zero-day cyber threats that evade signature-based Intrusion Detection Systems (IDS). This research presents a hybrid deep learning architecture that analyzes raw flow features across temporal and spatial dimensions.
1. Spatial Feature Extraction (Convolutional Layers)
Convolutional neural network (CNN) kernels scan packet headers and payload entropy matrices to identify localized invariant patterns that distinguish anomalous payload structures from benign protocols.
2. Temporal Sequence Modeling (BiLSTM / Recurrent Layers)
Bidirectional Long Short-Term Memory (BiLSTM) units capture long-range temporal dependencies across network sessions, pinpointing multi-stage reconnaissance, lateral movement, and command-and-control communication beacons.
3. High Detection Precision & Low False-Positive Thresholds
Evaluated against benchmark enterprise intrusion datasets, the hybrid approach demonstrates superior detection accuracy compared to standard shallow classifiers, drastically reducing alert fatigue for Security Operations Center (SOC) teams.