Hybrid CNN-BiLSTM-Machine Learning Architecture (HACBML) for Enhancing Anomaly Detection in Server Security

As the cyberspace-related threats to servers continue to develop, there has been an increment in the requirement of advanced solutions to identify aberrations. This paper proposes a Hybrid CNN-BiLSTM-Machine Learning (HACBML) model that aims to improve anomaly-detection performance in server logs. The framework integrates the benefits of deep learning to obtain features and the classic machine learning classifiers to make decisions throughout the process of improving server security. The pipeline starts by preprocessing the data, using Min-Max Scaling to normalize features and SMOTE to mitigate class imbalance. Convolutional Neural Networks (CNNs) are then used to encode spatial representations, and Bidirectional Long Short-Term Memory (BiLSTM) networks are used to encode temporal relationships in the logs. An attention mechanism draws attention to the most informative parts of the sequence, and Global Average Pooling is used to reduce the number of features, and the result is fed into fully connected layers. To achieve optimal performance, hyperparameter optimization is performed using the Whale Optimization Algorithm (WOA). A few classifiers were tested, including Softmax, Support Vector Machine (SVM), and AdaBoost. Among these, the SVM using WOA achieved the best accuracy (91%), as well as the macro F1-score (87%) and weighted F1-score (90%). The findings demonstrate its strong ability to classify both the majority and minority classes effectively. Overall, the HACBML framework is beneficial for balancing the datasets and providing accurate anomaly detection results.