CNN-BI-LSTM Adaptive Threat Hunting - Code and Scripts

This project provides the complete implementation for the paper "Adaptive Threat Hunting Using Machine Learning: A CNN-BI-LSTM Framework for AI-Driven Cybersecurity Defence in IoT Environments". It is a deep learning pipeline designed to detect network intrusions and botnet activity across three well-known cybersecurity benchmark datasets – CTU-13 Scenario 4, CICIDS2017, and NSL-KDD. The workflow runs in three stages. First, download_datasets.py fetches the raw datasets automatically. Second, feature_engineering.py preprocesses them through a six-stage pipeline including normalisation, encoding, dimensionality reduction, and stratified splitting. Third, cnn_bilstm_tensorflow.py trains a hybrid CNN-BiLSTM model that combines convolutional layers for local pattern extraction with bidirectional LSTM layers for sequential threat modelling. The model achieves strong results across all three datasets, peaking at 99.8% accuracy on CTU-13. The requirements.txt pins all dependencies for reproducibility, and the README.md documents the full setup and usage instructions, including optional flags for hyperparameter grid search, cross-validation, TFLite export, and latency benchmarking, making the project suitable for both research replication and edge IoT deployment.本项目为论文《基于机器学习的自适应威胁狩猎：面向物联网（IoT）环境AI驱动网络安全防御的卷积神经网络-双向长短期记忆网络（CNN-BI-LSTM）框架》提供完整实现。本项目是一套深度学习流水线，旨在从CTU-13场景4、CICIDS2017与NSL-KDD这三个知名网络安全基准数据集当中检测网络入侵与僵尸网络活动。该工作流分为三个阶段：第一阶段，通过`download_datasets.py`自动获取原始数据集；第二阶段，借助`feature_engineering.py`，通过包含归一化、编码、降维和分层划分在内的六阶段流水线对数据集完成预处理；第三阶段，通过`cnn_bilstm_tensorflow.py`训练混合CNN-BI-LSTM模型，该模型结合了用于局部模式提取的卷积层与用于序列威胁建模的双向长短期记忆网络（LSTM）。该模型在三个数据集上均取得了优异性能，在CTU-13数据集上的准确率峰值可达99.8%。项目中的`requirements.txt`文件锁定了全部依赖项以保障可复现性，`README.md`文档完整记录了项目的安装与使用说明，包括用于超参数网格搜索、交叉验证、TFLite导出以及延迟基准测试的可选参数，使得本项目既可用于研究复现，也适用于边缘物联网（IoT）部署。