DMThreatNet: a hybrid data mining framework for early cybersecurity threat detection using ensemble intelligence

The accelerating sophistication of cyberattacks against networked systems demands detection mechanisms that transcend the limitations of signature-based and rule-driven approaches. Data mining techniques — encompassing anomaly detection, association rule mining, classification, and feature selection — provide powerful tools for extracting latent threat intelligence from the voluminous, heterogeneous data streams generated by modern digital infrastructure. However, existing approaches predominantly apply individual data mining methods in isolation, failing to exploit the complementary strengths of combined mining paradigms. This paper introduces DMThreatNet, a four-layer hybrid data mining framework that integrates Isolation Forest and One-Class SVM for unsupervised anomaly scoring, Apriori-based association rule mining for interpretable threat pattern extraction, a CNN-LSTM hybrid deep classifier with attention mechanism for sequence-aware classification, and a Random Forest consensus feature ranker — all unified through a logistic regression meta-learner that learns optimal fusion weights from cross-validation data. The distinguishing strengths of DMThreatNet are fourfold: (i) it is the first framework to fuse unsupervised anomaly detection, association rule mining, sequence-aware deep classification, and consensus feature selection within a single learned meta-ensemble; (ii) it delivers human-readable explanations via mined Apriori rules and CNN-LSTM attention weights alongside black-box neural predictions; (iii) it scales linearly with the number of training samples (O(n log n) for the dominant components, derived analytically in Sect. 5.5); and (iv) it is robust across heterogeneous benchmarks, with consistent ≥ 98.4% F1 across six datasets spanning network flows, host events, and DDoS volumetric data. Evaluated across six publicly available benchmark datasets — NSL-KDD, CICIDS-2017, UNSW-NB15, KDD Cup 1999, BETH, and CIC-DDoS2019 — DMThreatNet achieves 98.91% accuracy, 98.88% F1-score, and 99.62% AUC-ROC, with a false positive rate of only 0.91% and inference latency of 3.2 ms per sample. These results represent statistically significant improvements over seven competitive baselines including Random Forest, XGBoost, LSTM, CNN, SVM, Decision Tree, and Naive Bayes. Ablation studies validate the synergistic contribution of each module, per-attack-type analysis reveals detection strengths across eight threat categories, and scalability experiments confirm linear throughput scaling up to 500,000 packets per second. The complete codebase is publicly available at https://github.com/sathishve/DMThreatNet .