Musa L. Kazimoto
Tanzania Institute of Accountancy

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

A Hybrid LSTM-GNN-Q-Learning Model for Zero-Day Attack Detection: Evaluation on CICIDS2017 with Simulated Zero-Day Setting Musa L. Kazimoto; Juma S. Ally; Stanley Leonard
Journal of Information System and Informatics Vol 8 No 3 (2026): June
Publisher : Asosiasi Doktor Sistem Informasi Indonesia

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.63158/journalisi.v8i3.1670

Abstract

Zero-day attacks exploit previously unseen vulnerabilities, making them difficult to identify using signature-based approaches. Their ability to bypass conventional detection mechanisms can result in significant financial losses, system compromise, and data breaches. To address this challenge, this study proposes a Hybrid Predictive Deep Learning (HPDL) model that integrates the Long Short-Term Memory (LSTM) network for modelling temporal relationships, Graph Neural Networks (GNN) for structural relationship modelling, and Q-Learning for feature weighting and adaptive decision making. The model was evaluated on CICIDS2017 dataset under a simulated zero-day setting by holding out four attack types (Brute Force, SQL Injection, XSS, and Infiltration), totaling 2,179 zero-day samples deliberately excluded from training and validation and used only for final testing. Experimental results show that the proposed HPDL model achieved a zero-day attack detection accuracy of 99.63% and F1-score of 0.9970, outperforming LSTM-only and GNN-only baseline models, which achieved accuracies of 98.5% and 85.0%, respectively. These results indicate that integrating temporal, structural, and reinforcement learning paradigms provides an effective approach for zero-day attack detection.