An adaptive contextual memory controller based long short-term memory (ACMC-LSTM) for intrusion detection in network traffic
Abstract
Intrusion detection systems (IDSs) are essential for protecting contemporary networks from ever-more-sophisticated cyberattacks. It is difficult for traditional detection techniques to identify long-term dependencies in sequential network traffic data. Long-Short-Term Memory (LSTM) is an important type of recurrent neural network (RNN) used to model long-duration dependencies. This paper presents an intelligent conceptual framework that simulates how humans manage memory. More specifically, it proposes an adaptive contextual memory controller (ACMC) with an LSTM model by integrating (1) the feature-wise attention and (2) the temporal attention mechanism for detecting the attacks in the network. The first assigns context-dependent weights to each feature of each input sample during model training through a lightweight sub-network with two dense layers to learn attention weights. Whereas, the second enhances the capacity to identify subtle attack patterns in network traffic by preferentially focusing on the most pertinent time steps in a sequence. In the feature selection step, a median-based relevance threshold on the normalized hybrid feature importance scores derived from the mutual information (MI) and random forest (RF) method is applied. The ACMC-LSTM model is rigorously tested on the CICIDS2017 and IoTID20 datasets, while its results are evaluated in terms of accuracy, precision, recall, F1_score, ROC-AUC, and FPR. Experimental results show that this model improves detection accuracy, reduces FPR, and outperforms standard LSTM and many neural network methods, achieving accuracies of 0.9804 and 0.9358 on these datasets, respectively. The results of the proposed model outperform those of many machine learning models, including standard LSTM, multilayer perceptron (MLP), logistic regression with SGD (SGD Logistic), recurrent neural network (RNN), gated recurrent unit (GRU), Autoencoder models, and many previously proposed models.
Related
- A temperature-adaptive logit-standardized knowledge distillation for lightweight network intrusion detection
- Neuro-immune transformer with contextual self-attention for IoT intrusion detection
- Adaptive edge-cloud isolation forest-autoencoder pipeline in real-time with delta policy feedback for zero-day IoT smartwatch intrusion detection
- XGB-AGMoE: A Validation-Adaptive XGBoost-Anchored Granular Mixture-of-Experts Framework for Multi-Class Intrusion Detection in IoMT WiFi–MQTT Traffic
- A multi-objective bayesian optimized neural network approach for intrusion detection
BibTeX
@article{alslivani2026adaptive,
title = {{An adaptive contextual memory controller based long short-term memory (ACMC-LSTM) for intrusion detection in network traffic}},
author = {Mudatheer M. Al-Slivani and Ibrahim O. Alrubaye and Mayameen S. Kadhim and Ahmed Dheyaa Radhi and Hussein A. A. Al-Khamees and Nor Samsiah Sani and Mohd Aliff Afira Sani and Mohammed Amin Almaiah},
journal = {Scientific Reports},
year = {2026},
month = oct,
doi = {10.1038/s41598-026-64248-7},
url = {https://www.nature.com/articles/s41598-026-64248-7},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - An adaptive contextual memory controller based long short-term memory (ACMC-LSTM) for intrusion detection in network traffic
AU - Mudatheer M. Al-Slivani
AU - Ibrahim O. Alrubaye
AU - Mayameen S. Kadhim
AU - Ahmed Dheyaa Radhi
AU - Hussein A. A. Al-Khamees
AU - Nor Samsiah Sani
AU - Mohd Aliff Afira Sani
AU - Mohammed Amin Almaiah
PY - 2026
DA - 2026/10/06
JO - Scientific Reports
DO - 10.1038/s41598-026-64248-7
UR - https://www.nature.com/articles/s41598-026-64248-7
AB - Intrusion detection systems (IDSs) are essential for protecting contemporary networks from ever-more-sophisticated cyberattacks. It is difficult for traditional detection techniques to identify long-term dependencies in sequential network traffic data. Long-Short-Term Memory (LSTM) is an important type of recurrent neural network (RNN) used to model long-duration dependencies. This paper presents an intelligent conceptual framework that simulates how humans manage memory. More specifically, it proposes an adaptive contextual memory controller (ACMC) with an LSTM model by integrating (1) the feature-wise attention and (2) the temporal attention mechanism for detecting the attacks in the network. The first assigns context-dependent weights to each feature of each input sample during model training through a lightweight sub-network with two dense layers to learn attention weights. Whereas, the second enhances the capacity to identify subtle attack patterns in network traffic by preferentially focusing on the most pertinent time steps in a sequence. In the feature selection step, a median-based relevance threshold on the normalized hybrid feature importance scores derived from the mutual information (MI) and random forest (RF) method is applied. The ACMC-LSTM model is rigorously tested on the CICIDS2017 and IoTID20 datasets, while its results are evaluated in terms of accuracy, precision, recall, F1_score, ROC-AUC, and FPR. Experimental results show that this model improves detection accuracy, reduces FPR, and outperforms standard LSTM and many neural network methods, achieving accuracies of 0.9804 and 0.9358 on these datasets, respectively. The results of the proposed model outperform those of many machine learning models, including standard LSTM, multilayer perceptron (MLP), logistic regression with SGD (SGD Logistic), recurrent neural network (RNN), gated recurrent unit (GRU), Autoencoder models, and many previously proposed models.
SN - 2045-2322
ER -