Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{210107,
        author = {Vishwa Ketanbhai Patel and Dr. Premal Patel and Dr. Satvik Khara},
        title = {A Hybrid Dense-LSTM Framework for Generalizable Network Intrusion Detection: A Cross-Dataset Evaluation},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {13},
        number = {5},
        pages = {4536-4545},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=210107},
        abstract = {Conventional Intrusion Detection Systems (IDS) typically rely on one learning paradigm, which restricts how well they adjust to new network environments and respond to rapidly changing cyber threats. As attacks become more sophisticated, the weaknesses of such single-method designs become increasingly apparent. This study addresses the problem by introducing a hybrid deep learning framework that combines Dense Neural Networks with Long Short-Term Memory (LSTM) networks for reliable network intrusion detection. The Dense branch learns statistical relationships across high-dimensional traffic features, whereas the LSTM branch captures the temporal dependencies present in network traffic flows. The outputs of both branches are joined in a feature concatenation layer prior to final classification. To counter class imbalance and improve the representation of minority attack classes, the Synthetic Minority Oversampling Technique (SMOTE) is applied before training. 
The model is trained and validated on the CICIDS2017 dataset, while UNSW-NB15 is used for cross-dataset testing to assess generalization. Results show stable convergence and effective learning of complex traffic patterns, with the hybrid model outperforming single-architecture baselines in detection accuracy and F1-score, most notably for minority attack classes after SMOTE balancing. 
Cross-dataset evaluation exposed clear feature distribution shifts between the two datasets, highlighting that domain generalization remains a difficult challenge in intrusion detection, yet it also confirmed that hybrid deep learning is practically viable. Overall, these findings position the proposed framework as a scalable and adaptable basis for real-world cybersecurity applications and for future work on cross-dataset network anomaly detection.},
        keywords = {Intrusion Detection System, Deep Learning, Siamese Network, Long Short-Term Memory, Network Security, Zero Day Attack, Cross-Dataset Generalization, Cyber security, Synthetic Minority Oversampling Technique},
        month = {October},
        }