CNN-BI-LSTM Adaptive Threat Hunting - Code and Scripts
Description
This project provides the complete implementation for the paper "Adaptive Threat Hunting Using Machine Learning: A CNN-BI-LSTM Framework for AI-Driven Cybersecurity Defence in IoT Environments". It is a deep learning pipeline designed to detect network intrusions and botnet activity across three well-known cybersecurity benchmark datasets – CTU-13 Scenario 4, CICIDS2017, and NSL-KDD. The workflow runs in three stages. First, download_datasets.py fetches the raw datasets automatically. Second, feature_engineering.py preprocesses them through a six-stage pipeline including normalisation, encoding, dimensionality reduction, and stratified splitting. Third, cnn_bilstm_tensorflow.py trains a hybrid CNN-BiLSTM model that combines convolutional layers for local pattern extraction with bidirectional LSTM layers for sequential threat modelling. The model achieves strong results across all three datasets, peaking at 99.8% accuracy on CTU-13. The requirements.txt pins all dependencies for reproducibility, and the README.md documents the full setup and usage instructions, including optional flags for hyperparameter grid search, cross-validation, TFLite export, and latency benchmarking, making the project suitable for both research replication and edge IoT deployment.
Files
Steps to reproduce
1. Set up the environment Install Python 3.12 and the uv package manager, then initialise the project and install all dependencies: bashuv init --python 3.12 uv add -r requirements.txt 2. Download the datasets This fetches CTU-13 Scenario 4, CICIDS2017, and NSL-KDD into a local datasets/ folder: bashuv run python download_datasets.py 3. Run feature engineering Preprocesses all three datasets and saves the resulting NumPy arrays to preprocessed/: bashuv run python feature_engineering.py 4. Train and evaluate the model Run once per dataset. Each run trains the CNN-BiLSTM model and reports accuracy, precision, recall, F1-score, FPR, and FNR: bashuv run python cnn_bilstm_tensorflow.py --dataset CTU-13 uv run python cnn_bilstm_tensorflow.py --dataset CICIDS2017 uv run python cnn_bilstm_tensorflow.py --dataset NSL-KDD 5. Optional — Advanced experiments bash# Hyperparameter grid search (replicates Table IV) uv run python cnn_bilstm_tensorflow.py --dataset CTU-13 --grid_search # 5-fold cross-validation uv run python cnn_bilstm_tensorflow.py --dataset CTU-13 --cross_val # Export model to TFLite for edge/IoT deployment uv run python cnn_bilstm_tensorflow.py --dataset CTU-13 --tflite # Measure inference latency (replicates §4.8) uv run python cnn_bilstm_tensorflow.py --dataset CTU-13 --latency Trained models are saved to the models/ directory after each run.