Hybrid Topological Data Analysis and LSTM Networks for Enhanced Network Intrusion Detection Using CIC-IDS2017 Dataset

2026-06-30

AI Summary

This study addresses the challenge of detecting sophisticated cyber threats—such as DDoS attacks, brute-force attempts, and web-based intrusions—by proposing a novel intrusion detection approach that integrates topological data analysis (TDA) with long short-term memory (LSTM) networks. The method leverages persistent homology to extract topological features from network traffic, including Betti curves and persistence diagrams, and for the first time embeds these features into a deep learning framework where they are complementarily fused with LSTM-captured temporal dependencies. Evaluated on the CIC-IDS2017 dataset using five-fold cross-validation, the proposed model achieves perfect performance with both AUC and F1-score of 1.000, significantly outperforming baseline models such as TDA combined with random forest and isolation forest, thereby demonstrating the efficacy and superiority of jointly modeling topological and temporal characteristics for intrusion detection.

Abstract

Network intrusion detection systems (NIDS) are crucial in cybersecurity infrastructure, needing advanced techniques to detect hostile activity in network traffic. This research introduces a hybrid approach that combines Topological Data Analysis (TDA) with Long Short-Term Memory (LSTM) networks to improve anomaly detection in network security. Our multi-layered design combines TDA's persistent homology with LSTM networks to capture topological characteristics of network traffic patterns and simulate temporal sequences. We assessed our methodology using the CIC-IDS2017 dataset, which includes over 2.8 million labelled flows, 77 network variables, and 14 attack categories that reflect modern threat landscapes such as DDoS, brute force, web attacks, penetration, and botnet activities. Integrating Betti curves and persistence diagrams with deep learning architectures enhances feature extraction performance. Our hybrid TDA+LSTM model has an AUC of 1.000 and F1-score of 1.000, with 5-fold cross-validation producing a mean AUC of 1.000 $\pm$ 0.000 and mean F1 of 0.999 $\pm$ 0.001. An ablation research demonstrates the complimentary contributions of topological (F1=0.990) and temporal characteristics (F1=1.000). Comparative research shows that the suggested strategy beats TDA+Random Forest (F1=0.994) and Isolation Forest (F1=0.835) baselines in several attack categories.

Problem

• Network Intrusion Detection
• Anomaly Detection
• Cybersecurity
• CIC-IDS2017 Dataset
• Hostile Activity

Innovation

• Topological Data Analysis
• LSTM Networks
• Persistent Homology
• Network Intrusion Detection
• Hybrid Deep Learning