A Hybrid Dense-LSTM Framework for Generalizable Network Intrusion Detection: A Cross-Dataset Evaluation

Conventional Intrusion Detection Systems (IDS) typically rely on one learning paradigm, which restricts how well they adjust to new network environments and respond to rapidly changing cyber threats.As attacks become more sophisticated, the weaknesses of such single-method designs become increasingly apparent.This study addresses the problem by introducing a hybrid deep learning framework that combines Dense Neural Networks with Long Short-Term Memory (LSTM) networks for reliable network intrusion detection.The Dense branch learns statistical relationships across high-dimensional traffic features, whereas the LSTM branch captures the temporal dependencies present in network traffic flows.The outputs of both branches are joined in a feature concatenation layer prior to final classification.To counter class imbalance and improve the representation of minority attack classes, the Synthetic Minority Oversampling Technique (SMOTE) is applied before training.The model is trained and validated on the CICIDS2017 dataset, while UNSW-NB15 is used for cross-dataset testing to assess generalization.Results show stable convergence and effective learning of complex traffic patterns, with the hybrid model outperforming singlearchitecture baselines in detection accuracy and F1score, most notably for minority attack classes after SMOTE balancing.Cross-dataset evaluation exposed clear feature distribution shifts between the two datasets, highlighting that domain generalization remains a difficult challenge in intrusion detection, yet it also confirmed that hybrid deep learning is practically viable.Overall, these findings position the proposed framework as a scalable and adaptable basis for real-world cybersecurity applications and for future work on cross-dataset network anomaly detection.