International Journal of Computing and Digital Systems | 2026
Authors: Kareem M.I.; Matloob A.Z.K.
DOI: 10.12785/ijcds/1571161562
Journal: International Journal of Computing and Digital Systems
Year: 2026
Publisher: University of Bahrain
Document Type: Article
Open Access: All Open Access; Gold Open Access
Cited by: 0
This study presents a hybrid CNNAttention model in the identification of both ransomware and zero-day intrusion, which directly comes to terms with the fact that traditional CNN-based intrusion detection models are limited in the context of acquiring contextual relevance between network flows. In contrast to the uniform treatment of extracted features in either antecedent CNN or hybrid classifiers, the model has been proposed to use an attention mechanism directly on convolutional feature maps so as to dynamically weight discriminative traffic patterns of stealthy and previously unknown attacks. The framework has been assessed on the basis of the UGRansome dataset, which covers the heterogeneous ransomware behaviours and the zero-day scenarios. An integrated preprocessing pipeline is used to maintain flow-level semantics and also allows end-to-end learning over mixed numerical and nominal features. The proposed architecture is compared to baseline CNN, SVM and CNN-SVM models to establish the contribution that can be attributed to attention based feature reweighting. The experimental findings indicate that CNNAttention model has better detection performance, especially in stealthy, and zero-day attack classes, with an overall accuracy of 97% and a continuously higher F1-scores of the baseline models. The findings confirm that the attention-based feature selection mechanism raises the sensitivity to the non-obvious signs of an attack as opposed to just raising the depth or complexity of the model. These results confirm the suggested architecture as an effective and generalisable application in detection of intelligent intrusion in modern network settings. © 2026, University of Bahrain. All rights reserved.
Anomaly Detection; CICIDS2017; CNN with Attention Mechanism; Cybersecurity; Deep Learning; Feature Extraction; PortScan Detection; Ransomware Detection; UGRansome Dataset; Zero-Day Attacks