Sequential Hybrid IDS

Updated 12 April 2026

Sequential Hybrid IDS are multi-stage architectures where specialized detection modules process inputs in sequence, enhancing overall threat detection through complementary algorithms.
They integrate techniques such as Conv1D, LSTM, anomaly clustering, and metaheuristic optimizations to effectively tackle issues like adversarial evolution, concept drift, and class imbalance.
Empirical results from platforms like NSL-KDD and CICIDS2017 demonstrate high accuracy and low false positives, making these systems vital for dynamic, real-time network defense.

A sequential hybrid Intrusion Detection System (IDS) is defined as an architecture where complementary detection or classification modules are arranged in a specific serial order, with the output of each module feeding forward to the next. These systems leverage the combined strengths of heterogeneous algorithms—often blending supervised, unsupervised, or deep learning components—to improve detection accuracy, reduce false positives, and capture a wider range of threat vectors than single-module or parallel-hybrid approaches. Recent research demonstrates that sequential hybrid IDSs are critical in addressing challenges such as adversarial evolution of cyberattacks, class imbalance, high-dimensional data, and operational efficiency constraints.

1. Core Architectures of Sequential Hybrid IDS

Prominent sequential hybrid IDS architectures utilize modular stages, each optimized for a designated detection function, with later stages refining or re-classifying subsets identified at previous stages. Representative examples include:

Conv1D → LSTM Deep Learning Pipelines: For example, IntrusionX processes windowed feature sequences through one or more 1D convolutional layers for local feature extraction, followed by an LSTM module for temporal modeling. The architecture outputs prediction scores via a dense classification head. Data flows as: $X_{\rm input} \rightarrow [\mathrm{Conv1D} \rightarrow \mathrm{ReLU} \rightarrow \mathrm{Pool}] \ldots \rightarrow \mathrm{reshape} \rightarrow [\mathrm{LSTM}]\ldots \rightarrow \mathrm{Dense} \rightarrow \hat{y}$ (Farabi et al., 1 Oct 2025).
Anomaly → Misuse Detection Pipelines: One architecture first deploys parallel anomaly detectors (e.g., neural network and random forest) on the input stream. Records flagged as anomalous by either classifier are forwarded to a clustering-based misuse detector (K-Means), which verifies true positives, reduces false alarms, and provides fine-grained sub-classification by attack type (Pandey et al., 2019).
GAN-based Outlier Detection → Hybrid Deep Classifier: FAST-IDS for vehicular networks executes unsupervised anomaly filtering using a BiGAN with WGAN-GP loss, then pushes only anomalous cases through a more computationally expensive CNN-LSTM classifier for detailed attack-type categorization (S et al., 30 Dec 2025).
Signature → Anomaly Detection for Concept Drift Adaptation: A two-stage IDS for SDN systems sequentially applies Adaptive Random Forest (ARF) for rapid detection of known attacks, followed by an adaptive One-Class SVM for identifying zero-day or stealth attacks that evade the signature-based model (Alqahtani, 2024).
Parallel Bidirectional Temporal/Sequence Models: Some architectures, such as BiGAT-ID, explore parallel branches (BiGRU with attention, LSTM) whose outputs are concatenated; while execution is parallel, the fusion and prediction pathway is sequential at the classifier level (Gueriani et al., 17 Aug 2025).

2. Mathematical Formulations and Module Integration

Sequential hybrid architectures require mathematically precise modeling of the constituent components and their interconnection. For instance:

Convolutional and LSTM Integration: For input $X \in \mathbb{R}^{T \times F}$ , 1D convolution layers compute

$h_i[t] = \sigma \left( \sum_{j=0}^{k-1} W_i[j] \cdot X[t + j] + b_i \right)$

with subsequent max-pooling. Outputs are reshaped to feed LSTM cells:

$i_t = \sigma(W_i \cdot H_t + U_i \cdot h_{t-1} + b_i), \quad f_t = \sigma(W_f \cdot H_t + U_f \cdot h_{t-1} + b_f), \ldots$

yielding $h_T$ for classification (Farabi et al., 1 Oct 2025).

Active Query and Sliding Window Adaptation: In near-autonomous IDS, sliding window $SW_t$ batches sequential samples. DNN softmax and KNN outlier scores per sample select $n$ hard/novel cases for expert labeling and DNN retraining, minimizing supervision and enabling rapid adaptation to new threats (Boukela et al., 2023).
Signature and Anomaly Staging: In SDN-based IDS, every flow $X_i$ first undergoes ARF classification; benign cases are further processed using a one-class SVM. Concept-drift detection statistics (e.g., ADWIN, DDM) trigger incremental model updates, balancing knowledge retention and responsiveness to evolving traffic (Alqahtani, 2024).

3. Data Preprocessing and Imbalance Handling

Preprocessing pipelines in sequential hybrid IDS favor rigorous feature engineering and distribution-preserving splits:

One-hot encoding and normalization: Categorical variables (protocol_type, service, flag) are encoded as indicator vectors. Numeric features are min-max normalized to $[0,1]$ (Farabi et al., 1 Oct 2025).
Stratified and Incremental Splitting: Dataset is partitioned train/validation/test splits stratified on class ratios (normal/attack subtype) to avoid skew (Farabi et al., 1 Oct 2025). In online settings, sliding windows process incoming streams with dynamic adaptation (Boukela et al., 2023).
Dynamic and Focal Loss Weighting: Class imbalance is addressed via dynamic class weights ( $w_c = N_{\rm total}/(C N_c)$ ) in categorical cross-entropy or focal loss strategies, prioritizing rare but actionable subclasses (e.g., U2R, R2L in NSL-KDD) (Farabi et al., 1 Oct 2025, Gueriani et al., 17 Aug 2025).
Data Augmentation: Minority over-sampling (random or SMOTE) is applied, particularly in IoT/IIoT intrusion data, to balance minority class occurrence (Gueriani et al., 17 Aug 2025).

4. Hyperparameter and Metaheuristic Optimization

Effective sequential hybrid IDS require multi-stage hyperparameter optimization:

Metaheuristic Search: IntrusionX deploys Squirrel Search Algorithm (SSA) to optimize convolutional filter counts, kernel sizes, LSTM units, learning rates, dropout, and batch size. SSA maintains a population of squirrel agents, each encoding a candidate configuration, which move via gliding and seasonal rules in the search space. Fitness is assessed by validation accuracy, and the best configuration is returned after $X \in \mathbb{R}^{T \times F}$ 0– $X \in \mathbb{R}^{T \times F}$ 1 iterations (Farabi et al., 1 Oct 2025). $X \in \mathbb{R}^{T \times F}$ 9
Layer and Head Counts: For sequential deep hybrids, layer and attention head counts are empirically determined for optimal contextualization and efficiency (e.g., BiGAT-ID: 64 BiGRU units per direction, 32 LSTM units, 8 attention heads) (Gueriani et al., 17 Aug 2025).
Compression and Pruning: In FAST-IDS, hybrid model compression incorporates structured pruning (filter importance) and static quantization, producing up to $X \in \mathbb{R}^{T \times F}$ 2 size reduction with a $X \in \mathbb{R}^{T \times F}$ 3 drop in detection performance (S et al., 30 Dec 2025).

5. Evaluation Metrics and Empirical Results

Sequential hybrid IDSs are evaluated on standard intrusion datasets (NSL-KDD, KDD’99, CICIDS2017, DAPT2020, etc.) using stratified splits and a comprehensive set of metrics:

Architecture	Dataset	Accuracy	F1-score / Recall	Notable Observations
IntrusionX	NSL-KDD	98.0% bin, 87.0% 5-class	Recall: U2R 71%, R2L 93%	Recall gains for rare classes; ablation: +2–6% for sequential hybridization (Farabi et al., 1 Oct 2025)
Hybrid DNN+KNN	CICIDS2017	AUC $X \in \mathbb{R}^{T \times F}$ 4 0.95+	Small label fraction (0.8–12%)	Quick AUC recovery on novel attacks via active learning (Boukela et al., 2023)
ARF→OC-SVM (SDN)	Multi-dataset	0.94–0.99	Recall up to 1.00	Adaptivity to drift; batch models degrade to $X \in \mathbb{R}^{T \times F}$ 5 (Alqahtani, 2024)
FAST-IDS	Custom vehicular	97.88%	Stage1 Recall: 92.8%	Two-stage filtering improves precision, real-time sub-200ms on ARM (S et al., 30 Dec 2025)
BiGAT-ID	IoMT/IIoT	99.13–99.34%	F1: 0.98–1.00	Cross-domain robustness, $X \in \mathbb{R}^{T \times F}$ 6 FPR (Gueriani et al., 17 Aug 2025)

Additionally, ablation studies consistently indicate that sequential integration—especially when combined with metaheuristic or adaptive fine-tuning—outperforms pure (single-architecture) or non-sequential baselines, particularly on minority/rare attack subclasses where detection is most challenging.

6. Efficiency, Adaptivity, and Deployment Scalability

Modern sequential hybrid IDSs are engineered for operational viability under real-time and adversarial conditions:

Efficiency: Metaheuristic optimization (e.g., SSA, hybrid compression) and architecture compression enable rapid convergence and minimal compute overhead; e.g., IntrusionX requires $X \in \mathbb{R}^{T \times F}$ 7 epochs for convergence (Farabi et al., 1 Oct 2025), and FAST-IDS reduces inference latency by $X \in \mathbb{R}^{T \times F}$ 8 after compression (S et al., 30 Dec 2025).
Adaptivity to Concept Drift: Incremental learning mechanisms (e.g., DDM, ADWIN) preserve model effectiveness under non-stationary conditions, with per-module drift detectors ensuring that only outdated or error-prone sub-models are replaced (Alqahtani, 2024).
Reproducibility and Determinism: Protocols consistently employ fixed random seeds, checkpointed models, and full workflow logging. Open-source implementations (e.g., github.com/TheAhsanFarabi/IntrusionX) are provided to guarantee reproducible deployment and benchmarking (Farabi et al., 1 Oct 2025).
Scalability: Architectures support modular expansion—new attack types, anomaly metrics, or adaptation strategies can be incorporated with minimal retraining (S et al., 30 Dec 2025).

7. Open Challenges and Future Directions

Despite empirical advances, several considerations limit the universal deployment of sequential hybrid IDS:

Data Realism and Generalization: Performance on synthetic datasets (e.g., KDD’99, NSL-KDD) may overstate generalization. There is a need for standard benchmarks rooted in naturalistic, adversarial, and evolving threat streams (Pandey et al., 2019).
Rare Attack Subclass Detection: While sequential hybrids significantly improve recall on rare/zero-day classes, precision and recall for classes with extreme imbalance (e.g., U2R) remain imperfect (Farabi et al., 1 Oct 2025).
Adaptive Thresholding and Drift Management: System robustness under rapid and nonstationary adversarial strategies—especially with ad-hoc thresholding—requires more principled adaptive mechanisms, possibly leveraging density-based clustering or density-ratio estimation (Alqahtani, 2024, Pandey et al., 2019).
Resource Constraints: Real-time IoT and vehicular deployments demand further efficiency gains. Hybrid pruning and quantization pipelines are promising but may entail more pronounced trade-offs as attack complexity rises (S et al., 30 Dec 2025).
Explainability and Forensics: As hybrid complexity increases, there is a growing need for model explainability (e.g., SHAP value assessment) to interpret decisions and support post-incident analysis (Gueriani et al., 17 Aug 2025).

Sequential hybrid IDSs, via multi-modal, staged architectures and dynamic optimization, offer demonstrably superior intrusion detection—especially in settings characterized by dynamic adversaries, rare threats, and operational constraints. These methods define the current state-of-the-art in robust, adaptive, and efficient network defense.