# Lightweight Hybrid Deep Learning Architecture and Model for Security in IOT
## 3 Proposed Hybrid Model CNN-LSTM  
Research works lag in terms of intrusion detection, according to the survey [18], since research models are targeted at detecting single attacks. There are few research models aimed at detecting repeated attacks, and the system's computing cost is quite high, making it inappropriate for a wide range of applications. This suggested research focuses on Convolutional Neural Networks (CNN), which have gained popularity in recent years. A deep learning classifier Convolutional Neural Network (CNN) is used for the classification of data that excels in managing a variety of database collections [19]. IDS based on CNN have only recently evolved, and their performance outperforms that of existing detection approaches. The proposed study model integrates the recurrent neural network (RNN) model-based Long Short-Term Memory (LSTM) to produce remarkable performance in identifying a wide range of network anomalies and malicious assaults, even though convolutional performs better. Figure 1 depicts the current hybrid CNN-LSTM prototype. A suitable dataset is selected, from which original and valuable features can be extracted by deleting redundant features and replacing them with improved ones using a deep learning LSTM model. The Intrusion Detection System can be used for classification and detection of assaults after the model has been trained using CNN and a corresponding weight set has been obtained. A well-known data classification model that excels at handling a wide range of database resources. The performance of convolutional network-based intrusion detection systems has recently improved, and it currently beats earlier detection methods [20]. Although convolutional performs better, the suggested research model \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Ref.No** & **Dataset** &
\begin{tabular}{c} **ML/DL** \\ **Classifier** \\ \end{tabular} & **Type of Attack** & **Accuracy** \\ \hline
[4] & KDDCUP99 & CNN & DoS & 92.9\% \\ \hline
[11] & CAIDA & WDLSTM &
\begin{tabular}{c} anomaly \\ detection \\ \end{tabular} & 96.7\% \\ \hline
[15] & KDDCUP99 & CNN & Malware & 97.2\% \\ \hline
[16] & NSL-KDD & DBN & DoS & 96.3\% \\ \hline
[17] & DARPA & GBRBM-DNN & Fault Detection & 98.5\% \\ \hline
[18] & \
\begin{tabular}{c} CICIDS and \\ NSL-KDD \\ \end{tabular} & Bi-LSTM & Failure Detection & 95.5\% \\ \hline Our Model & UNSW NB 15 & Hybrid Model &
\begin{tabular}{c} Various types of \\ attacks \\ \end{tabular} & 99\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of Attacks with different datasets. employs LSTM, an RNN diversification, to produce greater performance in the detection of attacks. As illustrated in Figure 1, the proposed model is divided into the following phases: data collection, Feature extraction, and Improved features; then the training can be performed by the convolutional network, and attack detection. The collecting of network vital data is an important step in this procedure. After collecting the intrusion dataset, the preprocessing is conducted following the data cleaning steps such as dealing with the missing and filling values along with the noisy data. Afterwards, features which are relevant can be extracted as per the requirement. The following step is used to make the training set, feature set, and testing set. The training model will obtain fine-tuned data using one or many convolutional layers, connection weights of the neuron, and outputs (see Figure 2). Finally, the identification step works with the data trained, and obtained information is merged for weight production, and the training period is employed for threat identification. The input layer with a matrix set \(p_{0}\)\(q_{0}\) and an output layer with a group of neurons for each label makes up the network structure. This research focuses on creating features that can be tweaked to capture the attacks and how they are effective in detecting in the industrial sector.