{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T19:27:52Z","timestamp":1773775672933,"version":"3.50.1"},"reference-count":58,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2025,9,14]],"date-time":"2025-09-14T00:00:00Z","timestamp":1757808000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Universitat Polit\u00e8cnica de Val\u00e8ncia (UPV), Spain"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computation"],"abstract":"<jats:p>Intrusion detection systems (IDSs) are critical for securing modern networks, particularly in IoT and IIoT environments where traditional defenses such as firewalls and encryption are insufficient against evolving cyber threats. This paper proposes an enhanced hybrid deep learning model that integrates convolutional neural networks (CNNs), Long Short-Term Memory (LSTM), and Gated Recurrent Units (GRU) in a multi-branch architecture designed to capture spatial and temporal dependencies while minimizing redundant computations. Unlike conventional hybrid approaches, the proposed parallel\u2013sequential fusion framework leverages the strengths of each component independently before merging features, thereby improving detection granularity and learning efficiency. A rigorous preprocessing pipeline is employed to handle real-world data challenges: missing values are imputed using median filling, class imbalance is mitigated through SMOTE (Synthetic Minority Oversampling Technique), and feature scaling is performed with Min\u2013Max normalization to ensure convergence consistency. The methodology is validated on the TON_IoT and CICIDS2017 dataset, chosen for its diversity and realism in IoT\/IIoT attack scenarios. Three hybrid models\u2014CNN-LSTM, CNN-GRU, and the proposed CNN-LSTM-GRU\u2014are assessed for binary and multiclass intrusion detection. Experimental results demonstrate that the CNN-LSTM-GRU architecture achieves superior performance, attaining 100% accuracy in binary classification and 97% in multiclass detection, with balanced precision, recall, and F1-scores across all classes. Furthermore, evaluation on the CICIDS2017 dataset confirms the model\u2019s generalization ability, achieving 99.49% accuracy with precision, recall, and F1-scores of 0.9954, 0.9943, and 0.9949, respectively, outperforming CNN-LSTM and CNN-GRU baselines. Compared to existing IDS models, our approach delivers higher robustness, scalability, and adaptability, making it a promising candidate for next-generation IoT\/IIoT security.<\/jats:p>","DOI":"10.3390\/computation13090222","type":"journal-article","created":{"date-parts":[[2025,9,15]],"date-time":"2025-09-15T09:43:41Z","timestamp":1757929421000},"page":"222","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":12,"title":["An Integrated Hybrid Deep Learning Framework for Intrusion Detection in IoT and IIoT Networks Using CNN-LSTM-GRU Architecture"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5419-2242","authenticated-orcid":false,"given":"Doaa Mohsin Abd Ali","family":"Afraji","sequence":"first","affiliation":[{"name":"Department of Computer Engineering, Universitat Polit\u00e8cnica de Val\u00e8ncia, 46022 Valencia, Spain"},{"name":"Department of Computer Science, College of Education, Mustansiriyah University, Baghdad 10052, Iraq"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0862-0533","authenticated-orcid":false,"given":"Jaime","family":"Lloret","sequence":"additional","affiliation":[{"name":"Integrated Management Coastal Zones Research Institute, Universitat Polit\u00e8cnica de Val\u00e8ncia, 46022 Valencia, Spain"}]},{"given":"Lourdes","family":"Pe\u00f1alver","sequence":"additional","affiliation":[{"name":"Department of Computer Engineering, Universitat Polit\u00e8cnica de Val\u00e8ncia, 46022 Valencia, Spain"}]}],"member":"1968","published-online":{"date-parts":[[2025,9,14]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"5977","DOI":"10.1007\/s12652-020-02521-x","article-title":"The impact of 5G on the evolution of intelligent automation and industry digitization","volume":"14","author":"Attaran","year":"2023","journal-title":"J. Ambient Intell. Hum. Comput."},{"key":"ref_2","first-page":"114","article-title":"Internet of Things (IoT) and Its Influence on Digital Transformation","volume":"2","author":"Khan","year":"2023","journal-title":"J. Emerg. Technol. Digit. Transform."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Gohar, A., and Nencioni, G. (2021). The role of 5G technologies in a smart city: The case for intelligent transportation system. Sustainability, 13.","DOI":"10.3390\/su13095188"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Oladimeji, D., Gupta, K., Kose, N.A., Gundogan, K., Ge, L., and Liang, F. (2023). Smart transportation: An overview of technologies and applications. Sensors, 23.","DOI":"10.3390\/s23083880"},{"key":"ref_5","first-page":"09","article-title":"Internet of Things (IoT) in Smart Factories: A Systematic Review","volume":"1","author":"Obafemi","year":"2024","journal-title":"Res. J. Civ. Ind. Mech. Eng."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"11016","DOI":"10.1109\/JIOT.2021.3051414","article-title":"Deep learning in the industrial internet of things: Potentials, challenges, and emerging applications","volume":"8","author":"Khalil","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_7","unstructured":"Marcu, O.C., and Bouvry, P. (2024). Big Data Stream Processing. [Doctoral Dissertation, University of Luxembourg]."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"108836","DOI":"10.1016\/j.comnet.2022.108836","article-title":"A comparative study on online machine learning techniques for network traffic streams analysis","volume":"207","author":"Shahraki","year":"2022","journal-title":"Comput. Netw."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"2373","DOI":"10.30574\/wjarr.2024.23.2.2582","article-title":"Advanced modelling and recurrent analysis in network security: Scrutiny of data and fault resolution","volume":"23","author":"Chukwunweike","year":"2024","journal-title":"World J. Adv. Res. Rev."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1016\/j.procs.2020.02.114","article-title":"Stream data analytics for network attacks\u2019 prediction","volume":"169","author":"Miloslavskaya","year":"2020","journal-title":"Procedia Comput. Sci."},{"key":"ref_11","first-page":"1","article-title":"Navigating the Cybersecurity Landscape: A Comprehensive Review of Cyber-Attacks, Emerging Trends, and Recent Developments. World Sci","volume":"190","author":"Mallick","year":"2024","journal-title":"News"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Djenna, A., Harous, S., and Saidouni, D.E. (2021). Internet of things meet internet of threats: New concern cybersecurity issues of critical cyber infrastructure. Appl. Sci., 11.","DOI":"10.3390\/app11104580"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"102647","DOI":"10.1016\/j.rineng.2024.102647","article-title":"Securing modern power systems: Implementing comprehensive strategies to enhance resilience and reliability against cyber-attacks","volume":"23","author":"Abdelkader","year":"2024","journal-title":"Results Eng."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Shah, Y., and Sengupta, S. (2020, January 28\u201331). A survey on classification of cyber-attacks on IoT and IIoT devices. Proceedings of the 2020 11th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), New York, NY, USA.","DOI":"10.1109\/UEMCON51285.2020.9298138"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Alnajim, A.M., Habib, S., Islam, M., Thwin, S.M., and Alotaibi, F. (2023). A comprehensive survey of cybersecurity threats, attacks, and effective countermeasures in Industrial Internet of Things. Technologies, 11.","DOI":"10.3390\/technologies11060161"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Suprabhath Koduru, S., Machina, V.S.P., and Madichetty, S. (2023). Cyber attacks in cyber-physical microgrid systems: A comprehensive review. Energies, 16.","DOI":"10.20944\/preprints202304.0691.v1"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Safitra, M.F., Lubis, M., and Fakhrurroja, H. (2023). Counterattacking cyber threats: A framework for the future of cybersecurity. Sustainability, 15.","DOI":"10.3390\/su151813369"},{"key":"ref_18","first-page":"1","article-title":"A comprehensive survey of attacks without physical access targeting hardware vulnerabilities in IoT\/IIoT devices, and their detection mechanisms. ACM Trans","volume":"27","author":"Polychronou","year":"2021","journal-title":"Des. Autom. Electron. Syst."},{"key":"ref_19","unstructured":"Waisi, A., and Ali, Z. (2023). Optimized Monitoring and Detection of Internet of Things Resource-Constrained Cyber Attacks, submitted."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Mohamed, N., Taherdoost, H., and Madanchian, M. (2024, January 28\u201329). Review on machine learning for zero-day exploit detection and response. Proceedings of the International Conference on Smart Technology, Vancouver, BC, Canada.","DOI":"10.1007\/978-3-031-64957-8_13"},{"key":"ref_21","first-page":"70","article-title":"Zero-Day Exploits: Understanding the Most Dangerous Cyber Threats","volume":"1","author":"Pureti","year":"2022","journal-title":"Int. J. Adv. Eng. Technol. Innov."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"3753","DOI":"10.1007\/s10586-022-03776-z","article-title":"Internet of Things intrusion detection systems: A comprehensive review and future directions","volume":"26","author":"Heidari","year":"2023","journal-title":"Clust. Comput."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1186\/s42400-021-00077-7","article-title":"A critical review of intrusion detection systems in the internet of things: Techniques, deployment strategy, validation strategy, attacks, public datasets and challenges","volume":"4","author":"Khraisat","year":"2021","journal-title":"Cybersecurity"},{"key":"ref_24","first-page":"38","article-title":"Advancements in anomaly detection techniques in network traffic: The role of artificial intelligence and machine learning","volume":"2","author":"PM","year":"2024","journal-title":"J. Sci. Res. Technol."},{"key":"ref_25","unstructured":"Gaioto, F. (2023). Big Data Intrusion Detection Using AI-Based Supervised Classifiers and Machine Learning Ensembles for Cybersecurity Threat Prevention, submitted."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"351047","DOI":"10.1155\/2013\/351047","article-title":"Intrusion detection systems based on artificial intelligence techniques in wireless sensor networks","volume":"9","author":"Alrajeh","year":"2013","journal-title":"Int. J. Distrib. Sens. Netw."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Lopez-Martin, M., Carro, B., Sanchez-Esguevillas, A., and Lloret, J. (2017). Conditional variational autoencoder for prediction and feature recovery applied to intrusion detection in IoT. Sensors, 17.","DOI":"10.3390\/s17091967"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Azam, Z., Islam, M.M., and Huda, M.N. (2023). Comparative analysis of intrusion detection systems and machine learning based model analysis through decision tree. IEEE Access, in press.","DOI":"10.1109\/ACCESS.2023.3296444"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Mala, K., and Annapurna, H.S. (2023, January 24\u201325). Cloud network traffic classification and intrusion detection system using deep learning. Proceedings of the 2023 International Conference Integrated Intelligence and Communication Systems (ICIICS), Bengaluru, India.","DOI":"10.1109\/ICIICS59993.2023.10421114"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Rashid, A., Siddique, M.J., and Ahmed, S.M. (2020, January 17\u201319). Machine and deep learning based comparative analysis using hybrid approaches for intrusion detection system. Proceedings of the 2020 3rd International Conference Advancements in Computational Sciences (ICACS), Lahore, Pakistan.","DOI":"10.1109\/ICACS47775.2020.9055946"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Sharon, A., Mohanraj, P., Abraham, T.E., Sundan, B., and Thangasamy, A. (2022). An intelligent intrusion detection system using hybrid deep learning approaches in cloud environment. Computer, Communication, and Signal Processing, Springer.","DOI":"10.1007\/978-3-031-11633-9_20"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"190","DOI":"10.36548\/jismac.2020.4.002","article-title":"Hybrid intrusion detection system for internet of things (IoT)","volume":"2","author":"Smys","year":"2020","journal-title":"J. ISMAC"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"386","DOI":"10.1016\/j.ins.2019.10.069","article-title":"A hybrid deep learning model for efficient intrusion detection in big data environment","volume":"513","author":"Hassan","year":"2020","journal-title":"Inf. Sci."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"365","DOI":"10.32604\/iasc.2022.022259","article-title":"A novel hybrid deep learning framework for intrusion detection systems in WSN-IoT networks","volume":"33","author":"Maheswari","year":"2022","journal-title":"Intell. Autom. Soft Comput."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1016\/j.comcom.2021.05.024","article-title":"Internet of Things attack detection using hybrid deep learning model","volume":"176","author":"Sahu","year":"2021","journal-title":"Comput. Commun."},{"key":"ref_36","first-page":"in press","article-title":"A hybrid deep learning intrusion detection model for fog computing environment","volume":"30","author":"Kalaivani","year":"2021","journal-title":"Intell. Autom. Soft Comput."},{"key":"ref_37","first-page":"3946","article-title":"DeepIoT.IDS: Hybrid deep learning for enhancing IoT network intrusion detection","volume":"69","author":"Maseer","year":"2021","journal-title":"Comput. Mater. Continua"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"1973","DOI":"10.1007\/s00170-022-10329-6","article-title":"A deep hybrid learning model for detection of cyber attacks in industrial IoT devices","volume":"123","author":"Shahin","year":"2022","journal-title":"Int. J. Adv. Manuf. Technol."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"3","DOI":"10.4316\/AECE.2022.01001","article-title":"A hybrid deep learning approach for intrusion detection in IoT networks","volume":"22","year":"2022","journal-title":"Adv. Electr. Comput. Eng."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1186\/s13677-024-00685-x","article-title":"Enhancing intrusion detection: A hybrid machine and deep learning approach","volume":"13","author":"Sajid","year":"2024","journal-title":"J. Cloud Comput."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"107417","DOI":"10.1016\/j.comnet.2020.107417","article-title":"Hybrid approach to intrusion detection in fog-based IoT environments","volume":"180","author":"Westphall","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1109\/JIOT.2021.3085194","article-title":"ToN_IoT: The role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion data sets","volume":"9","author":"Booij","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"82","DOI":"10.1007\/s10922-025-09963-8","article-title":"Federated RNN for Intrusion Detection System in IoT Environment Under Adversarial Attack","volume":"33","author":"Rezaei","year":"2025","journal-title":"J. Netw. Syst. Manag."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"822","DOI":"10.1109\/TNSM.2025.3525554","article-title":"Federated learning under attack: Exposing vulnerabilities through data poisoning attacks in computer networks","volume":"22","author":"Nowroozi","year":"2025","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Liu, L., Feng, J., Li, J., Chen, W., Mao, Z., and Tan, X. (2024). Multi-layer CNN-LSTM network with self-attention mechanism for robust estimation of nonlinear uncertain systems. Front. Neurosci., 18.","DOI":"10.3389\/fnins.2024.1379495"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Xu, G., Ren, T., Chen, Y., and Che, W. (2020). A one-dimensional CNN-LSTM model for epileptic seizure recognition using EEG signal analysis. Front. Neurosci., 14.","DOI":"10.3389\/fnins.2020.578126"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"6100","DOI":"10.1109\/ACCESS.2024.3350978","article-title":"Enhanced CNN-LSTM deep learning for SCADA IDS featuring Hurst parameter self-similarity","volume":"12","author":"Balla","year":"2024","journal-title":"IEEE Access"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Alkanhel, R.I., Saleh, H., Elaraby, A., Alharbi, S., Elmannai, H., Alaklabi, S., and Mostafa, S. (2024). Hybrid CNN-GRU model for real-time blood glucose forecasting: Enhancing IoT-based diabetes management with AI. Sensors, 24.","DOI":"10.3390\/s24237670"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Naidu, G., Zuva, T., and Sibanda, E.M. (2023). A review of evaluation metrics in machine learning algorithms. Artificial Intelligence Application in Networks and Systems, Springer.","DOI":"10.1007\/978-3-031-35314-7_2"},{"key":"ref_50","unstructured":"Powers, D.M. (2020). Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation. arXiv."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"723","DOI":"10.1016\/j.surg.2023.05.023","article-title":"Evaluating prediction model performance","volume":"174","author":"Cabot","year":"2023","journal-title":"Surgery"},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Varoquaux, G., and Colliot, O. (2023). Evaluating machine learning models and their diagnostic value. Machine Learning for Brain Disorder, Humana.","DOI":"10.1007\/978-1-0716-3195-9_20"},{"key":"ref_53","unstructured":"GeeksforGeeks (2023). F1 Score in Machine Learning, GeeksforGeeks."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"99837","DOI":"10.1109\/ACCESS.2022.3206425","article-title":"CNN-LSTM: Hybrid deep neural network for network intrusion detection system","volume":"10","author":"Halbouni","year":"2022","journal-title":"IEEE Access"},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Henry, A., Gautam, S., Khanna, S., Rabie, K., Shongwe, T., Bhattacharya, P., and Chowdhury, S. (2023). Composition of hybrid deep learning model and feature optimization for intrusion detection system. Sensors, 23.","DOI":"10.3390\/s23020890"},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Khacha, A., Saadouni, R., Harbi, Y., Gherbi, C., Harous, S., and Aliouat, Z. (2023, January 21\u201323). Robust intrusion detection for IoT networks: An integrated CNN-LSTM-GRU approach. Proceedings of the 2023 International Conference Networking and Advanced Systems (ICNAS), Algiers, Algeria.","DOI":"10.1109\/ICNAS59892.2023.10330519"},{"key":"ref_57","doi-asserted-by":"crossref","first-page":"107531","DOI":"10.1016\/j.future.2024.107531","article-title":"Generative adversarial networks to detect intrusion and anomaly in IP flow-based networks","volume":"163","author":"Lent","year":"2025","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1007\/s11235-024-01254-y","article-title":"LEA-RPL: Lightweight energy-aware RPL protocol for internet of things based on particle swarm optimization","volume":"88","author":"Mokrani","year":"2025","journal-title":"Telecommun. Syst."}],"container-title":["Computation"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2079-3197\/13\/9\/222\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:45:31Z","timestamp":1760035531000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2079-3197\/13\/9\/222"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,14]]},"references-count":58,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2025,9]]}},"alternative-id":["computation13090222"],"URL":"https:\/\/doi.org\/10.3390\/computation13090222","relation":{},"ISSN":["2079-3197"],"issn-type":[{"value":"2079-3197","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,14]]}}}