A Robust Hybrid CNN–LSTM Framework for High-Accuracy Zero-Day Intrusion and Ransomware Detection Using the UGRansome Dataset: A Robust Hybrid CNN–LSTM Framework for High-Accuracy Zero-Day Intrusion and Ransomware Detection Using the UGRansome Dataset - Farah Hatem Khorsheed; Enas Abbas Abed; Zainab Hassan Mohammed; Walaa Badr Khudhair Alwan (Universitas Muhammadiyah Sidoarjo, 2026)
The rapid evolution of cyber-attacks—particularly zero-day intrusions and ransomware—has intensified the need for intelligent and resilient detection systems capable of handling imbalanced, high-dimensional network traffic. This research proposes a robust hybrid deep learning framework combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks for enhanced anomaly detection using the UGRansome dataset, a realistic benchmark designed for ransomware and zero-day behavior analysis. The methodology integrates advanced preprocessing, including categorical encoding, feature normalization, and Synthetic Minority Over-sampling Technique (SMOTE) to alleviate class imbalance. The hybrid architecture leverages CNN layers for spatial feature extraction and LSTM layers for modeling temporal dependencies, enabling improved detection of emerging and stealthy threats. Experimental results demonstrate superior performance compared to standalone deep learning baselines, achieving 97.89% accuracy, 0.999 macro AUC, and strong detection capability across minority classes. Confusion matrix visualizations and classification metrics confirm the model’s robustness and generalization. The findings highlight the potential of hybrid deep learning models for proactive cybersecurity defense and establish a foundation for future intelligent intrusion detection systems