Intrusion Detection Solution Research Articles

Network Intrusion Detection Based on Convolutional Recurrent Neural Network, Random Forest, and Federated Learning

This paper presents a novel network intrusion detection framework that combines convolutional recurrent neural networks (CRNN) and random forest (RF) models within a federated learning setting. The proposed approach aims to address the challenges of data privacy, computational efficiency, and model generalization in traditional network intrusion detection methods. By leveraging the spatial feature extraction capabilities of CRNN and the feature selection and noise reduction properties of RF, the framework enhances the accuracy and robustness of attack detection. The integration of federated learning enables collaborative model training without compromising data privacy. Extensive experiments on benchmark datasets demonstrate the superiority of the proposed method compared to state-of-the-art techniques, achieving high performance metrics such as accuracy, precision, recall, F1 score, and AUC. The proposed framework offers a promising solution for secure and efficient network intrusion detection in real-world scenarios, contributing to the advancement of cybersecurity practices.

Edge-featured multi-hop attention graph neural network for intrusion detection system

With the development of the Internet, the application of computer technology has rapidly become widespread, driving the progress of Internet of Things (IoT) technology. The attacks present on networks have become more complex and stealthy. However, traditional network intrusion detection systems with singular functions are no longer sufficient to meet current demands. While some machine learning-based network intrusion detection systems have emerged, traditional machine learning methods cannot effectively respond to the complex and dynamic nature of network attacks. Intrusion detection systems utilizing deep learning can better enhance detection capabilities through diverse data learning and training. To capture the topological relationships in network data, using graph neural networks (GNNs) is most suitable. Most existing GNNs for intrusion detection use multi-layer network training, which may lead to over-smoothing issues. Additionally, current intrusion detection solutions often lack efficiency. To mitigate the issues mentioned above, this paper proposes an Edge-featured Multi-hop Attention Graph Neural Network for Intrusion Detection System (EMA-IDS), aiming to improve detection performance by capturing more features from data flows. Our method enhances computational efficiency through attention propagation and integrates node and edge features, fully leveraging data characteristics. We carried out experiments on four public datasets, which are NF-CSE-CIC-IDS2018-v2, NF-UNSW-NB15-v2, NF-BoT-IoT, and NF-ToN-IoT. Compared with existing models, our method demonstrated superior performance.

A cloud‐based hybrid intrusion detection framework using XGBoost and ADASYN‐Augmented random forest for IoMT

AbstractInternet of Medical Things have vastly increased the potential for remote patient monitoring, data‐driven care, and networked healthcare delivery. However, the connectedness lays sensitive patient data and fragile medical devices open to security threats that need robust intrusion detection solutions within cloud‐edge services. Current approaches need modification to be able to handle the practical challenges that result from problems with data quality. This paper presents a hybrid intrusion detection framework that enhances the security of IoMT networks. There are three modules in the design. First, an XGBoost‐based noise detection model is used to identify data anomalies. Second, adaptive resampling with ADASYN is done to fine‐tune the class distribution to address class imbalance. Third, ensemble learning performs intrusion detection through a Random Forest classifier. This stacked model coordinates techniques that filter noise and preprocess imbalanced data, identifying threats with high accuracy and reliability. These results are then experimentally validated on the UNSW‐NB15 benchmark to demonstrate effective detection under realistically noisy conditions. The novel contributions of the work are a new hybrid structural paradigm coupled with integrated noise filtering, and ensemble learning. The proposed advanced oversampling with ADASYN gives a performance that surpasses all others with a reported 92.23% accuracy.

A comprehensive intrusion detection method for the internet of vehicles based on federated learning architecture

Cybersecurity breaches within the Internet of Vehicles (IoV) have been increasingly reported annually with the proliferation of intelligent connected vehicles. Two primary obstacles are faced by current intrusion detection systems: substantial computational demands and stringent data privacy regulations, complicating both efficient deployment and the safeguarding of data privacy. Consequently, there is a pressing need for intrusion detection solutions that are both efficient and considerate of privacy concerns. This paper introduces FED-IoV, an innovative intrusion detection method tailored for the IoV, leveraging a federated learning architecture. FED-IoV aims to collaboratively perform detection tasks across distributed edge devices, thereby minimizing data privacy risks. Vehicular communication traffic data is transformed into images, and a bespoke, efficient model, MobileNet-Tiny, is employed for feature extraction, rendering FED-IoV capable of achieving high detection accuracy whilst being viable for deployment on devices with limited resources. Through evaluation against the authoritative datasets CAN-Intrusion and CICIDS2017, exceptional accuracy rates of 98.51 % and 97.74 %, respectively, were demonstrated by FED-IoV within a federated learning context, and excellent detection capabilities on imbalanced datasets were also shown. Moreover, a prediction latency of under 10 milliseconds per sample was maintained on devices with limited computational power, such as the Raspberry Pi 4 8GB, showcasing significantly better accuracy and real-time performance relative to existing approaches. The successful deployment of FED-IoV ushers in a novel, privacy-preserving, and efficient intrusion detection solution for IoV security.

A COMPREHENSIVE EVALUATION OF FACE RECOGNITION SOFTWARE: BALANCING TOTAL COST OF OWNERSHIP, ACCURACY AND SPEED

As face recognition technology continues to play a pivotal role in various domains, selecting an optimal software solution becomes imperative. This paper thoroughly analyzes face recognition algorithms, emphasizing a holistic assessment of implementing them that includes the overall cost of ownership, accuracy, and speed. The research aims to guide decision-makers in choosing a solution that balances these three critical factors. The study employs a rigorous methodology and evaluates various intrusion detection solutions across multiple industries. It examines the cost of ownership comprehensively, including initial investment, maintenance expenses, and potential hidden costs. A cost-benefit analysis is conducted to unveil the true economic implications of each implementation. The accuracy of the face recognition algorithms which is the core of intrusion detection systems is assessed through the learnings from academia and real-world feedback from the security industry. Furthermore, the paper examines the critical aspect of speed, recognizing its important role in real-time applications. The evaluation considers the processing speed of each software solution, considering its responsiveness to various environments and working with large-scale datasets. This research provides a comprehensive overview of face recognition algorithms, offering small business decision-makers valuable insights to make informed choices for their intrusion detection solutions. By combining the total cost of ownership, accuracy, and speed, organizations can select a solution that aligns with their specific needs and maximizes the return on investment in intrusion detection technology.

IOT NETWORK INTRUSION DETECTION SYSTEM USING MACHINE LEARNING TECHNIQUES

The proliferation of Internet of Things (IoT) devices has transformed various industries by providing smart and automated solutions. However, the extensive connectivity and diverse nature of IoT devices have also introduced significant security challenges, particularly in terms of network intrusion. This paper explores the development and implementation of an Intrusion Detection System (IDS) for IoT networks using Machine learning techniques. The proposed IDS aims to detect and mitigate various cyber threats by analyzing network traffic and identifying anomalous patterns indicative of intrusions. This research contributes to the field of IoT security by providing a robust and scalable intrusion detection solution that leverages the power of machine learning.

Providing a hybrid approach to increase the accuracy of intrusion detection systems in computer networks

Intrusion detection is a critical obstacle in the realm of security and data mining methodologies. Consequently, researchers have extensively investigated the quest for the swiftest and most precise means of identifying intrusions. Essentially, intrusion detection systems are tasked with recognizing any unauthorized activities, misuse, or harm inflicted upon a system, be it by internal or external users. Recently, in order to design intrusion detection systems, artificial intelligence and machine learning methods have been used, each of which has its own characteristics and advantages. Accordingly, this article focuses on using machine learning to improve the accuracy of the intrusion detection process. In fact, by using machine learning, trends, and patterns can be easily identified and thus used in a network environment to detect intrusion. It can be very useful. For this purpose, we utilize Radial Basis Function (RBF) neural networks and support vector machine (SVM) algorithm to improve decision-making and intrusion detection. By employing RBF neural networks, important features of the data are extracted, which in turnPlease check if the author details and affiliations are presented correctly. Kindly amend if necessary. enhance the overall performance of the solution and the efficiency of the SVM algorithm. This is because feature reduction ultimately leads to improved effectiveness of the SVM algorithm. In methods lacking this capability, the learning algorithm is compelled to utilize features that have no specific correlation with intrusion and essentially do not contribute to identifying attacks. Such learning approaches essentially learn from noisy data, which negatively impacts the intrusion detection solution. Finally, the proposed solution was evaluated using Python programming language and KDD99 data set. The results of the evaluation indicate that the proposed solution has a higher accuracy and precision than other evaluated solutions. So, the accuracy is 97, and the precision is over 99%.

A comparative assessment of machine learning algorithms in the IoT-based network intrusion detection systems

The rapid increase in online risks is a reflection of the exponential growth of Internet of Things (IoT) networks. Researchers have proposed numerous intrusion detection techniques to mitigate the harm caused by these threats. Enterprises use intrusion detection systems (IDSs) and intrusion prevention systems (IPSs) to keep their networks safe, stable, and accessible. Network intrusion detection solutions have lately integrated powerful Machine Learning (ML) techniques to safeguard IoT networks. Selecting the proper data features for effectively training such ML models is critical to maximizing detection accuracy and computational efficiency. However, the efficiency of these systems degrades in high-dimensional data spaces, and it is crucial to have a suitable feature extraction method to eliminate extraneous data from the classification procedure. The detection accuracy and false positive rate of many ML-based IDSs also rise when the samples used to train the models are unbalanced. This study provides a detailed overview of the UNSW-NB15(DS-1) and NF-UNSWNB15(DS-2) datasets for intrusion detection, which will be utilized to develop and evaluate our models. In addition, this model uses the MaxAbsScaler algorithm to implement a filter-based feature scaling strategy . Then, use the condensed feature set to perform several ML techniques, including Support Vector Machines (SVM), K-nearest neighbors (KNN), Logistic Regression (LR), Naive Bayes (NB), Decision Tree (DT), and Random Forest (RF), considering multiclass classification. Accuracy tests for the multiclass classification scheme were improved from 60% to 94% using the MaxAbsScaler-based feature scaling method.

An efficient intrusion detection technique for traffic pattern learning

Efficient intrusion detection algorithms are required for network traffic learning patterns in order to protect advanced network communication channels. These systems can be used to detect normal and unusual patterns, signatures, and rule violations. In recent years, conventional and deep machine learning algorithms have been utilized in the field of network intrusion detection for network traffic learning systems. The use of machine learning opens up new attack surfaces that are very intriguing to investigate. Attackers can introduce noisy data into training data to influence testing patterns in computer networks. The goal of this work is to create an efficient intrusion detection solution for network traffic learning patterns using a supervised and unsupervised technique. We developed an effective intrusion detection system (IDs) using an appropriate NSLKDD dataset for network traffic patterns. The model was trained and evaluated using the Genetic Optimization Algorithm (GOA) and the Niave Bayesian technique to recognize usual and unexpected network traffic patterns. We created a strategy that begins with a random population and subsequent iterates through the fitness function, returning the best parents with high detection accuracy. The best parents were determined using the n-parameters iterated by the crossover and mutation procedures. A cross over function was created to combine genes from two fitness parents by randomly selecting portions from each parent. The individual components of the crossover offsprings are randomly flipped to achieve the mutation. The fitness of the previous generation was obtained to generate a new generation, and this process was repeated n times. This was created to detect network intrusions using Nave Bayes' binary categorization problem and evolutionary algorithms. We accomplished this task by aggregating noise into training set before broadcasting the average number, and it is critical not to have that public average too frequently. The experimental results reveal that our proposed GA fared better than the NB technique, with a detection accuracy of 95.0% versus a recommendable detection accuracy of 53.0%.

Network intrusion detection: An optimized deep learning approach using big data analytics

Managing enormous amounts of data, such as big data, and detecting network traffic intrusions are inefficiently handled by current computing technologies. Traditional analytical techniques cannot manage the incursions in continuous internet traffic and the enormous log data of server activity, leading to many inaccurate results and a prolonged training period. As a result, this research provides an efficient deep learning-based approach to enhance the attack identification task by addressing the basic big data complexity linked to many heterogeneous security data types. This framework employs a novel feature selection method incorporatingthe Aquila Optimizer (AO) and Fuzzy Entropy Mutual Information (FEMI) algorithms to pick distinctive characteristics. Subsequently, a modified canonical correlation-based technique is applied to combine selected characteristics. Then, the intrusion identification and categorization are carried out using the optimized ResNet152V2 method. Additionally, data augmentation using Auxiliary Classifier Generative Adversarial Network (ACGAN) is performed. Finally, we used the CICDDoS2019 and ToN-IoT datasets to validate the suggested methodology. By comparing the presented approach to several baseline methods, the effectiveness of the suggested methodology is assessed using various performance measures, including F1-score, recall, precision, accuracy, confusion matrix, and ROC curve. Finally, simulation results show that the suggested strategy is superior to other existing techniques and demonstrate that it is a resilient solution for network intrusion detection.

A novel anomaly detection model for the industrial Internet of Things using machine learning techniques

In recent decades, the pervasive integration of the Internet of Things (IoT) technologies has revolutionized various sectors, including industry 4.0, telecommunications, cloud computing, and healthcare systems. Industry 4.0 applications, characterized by real-time data exchange, increased reliance on automation, and limited computational resources at the edge, have reshaped global business dynamics, aiming to innovate business models through enhanced automation technologies. However, ensuring security in these environments remains a critical challenge, with real-time data streams introducing vulnerabilities to zero-day attacks and limited resources at the edge demanding efficient intrusion detection solutions. This study addresses this pressing need by proposing a novel intrusion detection model (IDS) specifically designed for Industry 4.0 environments. The proposed IDS leverages a Random Forest classifier with Principal Component Analysis (PCA) for feature selection. This approach addresses the challenges of real-time data processing and resource limitations while offering high accuracy. Based on the Bot-IoT dataset, the model achieves a competitive accuracy of 98.9% and a detection rate of 97.8%, outperforming conventional methods. This study demonstrates the effectiveness of the proposed IDS for securing Industry 4.0 ecosystems, offering valuable contributions to the field of cybersecurity.

Securing cloud-enabled smart cities by detecting intrusion using spark-based stacking ensemble of machine learning algorithms

<abstract> <p>With the use of cloud computing, which provides the infrastructure necessary for the efficient delivery of smart city services to every citizen over the internet, intelligent systems may be readily integrated into smart cities and communicate with one another. Any smart system at home, in a car, or in the workplace can be remotely controlled and directed by the individual at any time. Continuous cloud service availability is becoming a critical subscriber requirement within smart cities. However, these cost-cutting measures and service improvements will make smart city cloud networks more vulnerable and at risk. The primary function of Intrusion Detection Systems (IDS) has gotten increasingly challenging due to the enormous proliferation of data created in cloud networks of smart cities. To alleviate these concerns, we provide a framework for automatic, reliable, and uninterrupted cloud availability of services for the network data security of intelligent connected devices. This framework enables IDS to defend against security threats and to provide services that meet the users' Quality of Service (QoS) expectations. This study's intrusion detection solution for cloud network data from smart cities employed Spark and Waikato Environment for Knowledge Analysis (WEKA). WEKA and Spark are linked and made scalable and distributed. The Hadoop Distributed File System (HDFS) storage advantages are combined with WEKA's Knowledge flow for processing cloud network data for smart cities. Utilizing HDFS components, WEKA's machine learning algorithms receive cloud network data from smart cities. This research utilizes the wrapper-based Feature Selection (FS) approach for IDS, employing both the Pigeon Inspired Optimizer (PIO) and the Particle Swarm Optimization (PSO). For classifying the cloud network traffic of smart cities, the tree-based Stacking Ensemble Method (SEM) of J48, Random Forest (RF), and eXtreme Gradient Boosting (XGBoost) are applied. Performance evaluations of our system were conducted using the UNSW-NB15 and NSL-KDD datasets. Our technique is superior to previous works in terms of sensitivity, specificity, precision, false positive rate (FPR), accuracy, F1 Score, and Matthews correlation coefficient (MCC).</p> </abstract>

Deep Learning-Inspired IoT-IDS Mechanism for Edge Computing Environments.

The Internet of Things (IoT) technology has seen substantial research in Deep Learning (DL) techniques to detect cyberattacks. Critical Infrastructures (CIs) must be able to quickly detect cyberattacks close to edge devices in order to prevent service interruptions. DL approaches outperform shallow machine learning techniques in attack detection, giving them a viable alternative for use in intrusion detection. However, because of the massive amount of IoT data and the computational requirements for DL models, transmission overheads prevent the successful implementation of DL models closer to the devices. As they were not trained on pertinent IoT, current Intrusion Detection Systems (IDS) either use conventional techniques or are not intended for scattered edge-cloud deployment. A new edge-cloud-based IoT IDS is suggested to address these issues. It uses distributed processing to separate the dataset into subsets appropriate to different attack classes and performs attribute selection on time-series IoT data. Next, DL is used to train an attack detection Recurrent Neural Network, which consists of a Recurrent Neural Network (RNN) and Bidirectional Long Short-Term Memory (LSTM). The high-dimensional BoT-IoT dataset, which replicates massive amounts of genuine IoT attack traffic, is used to test the proposed model. Despite an 85 percent reduction in dataset size made achievable by attribute selection approaches, the attack detection capability was kept intact. The models built utilizing the smaller dataset demonstrated a higher recall rate (98.25%), F1-measure (99.12%), accuracy (99.56%), and precision (99.45%) with no loss in class discrimination performance compared to models trained on the entire attribute set. With the smaller attribute space, neither the RNN nor the Bi-LSTM models experienced underfitting or overfitting. The proposed DL-based IoT intrusion detection solution has the capability to scale efficiently in the face of large volumes of IoT data, thus making it an ideal candidate for edge-cloud deployment.

Convolutional neural network for intrusion detection using blockchain technology

Cyber-physical systems (CPS) are becoming increasingly ubiquitous, connecting the physical world with the cyber realm. This convergence has exposed CPS to a growing threat landscape, necessitating robust intrusion detection systems (IDS) to safeguard critical infrastructure. Deep learning (DL) has emerged as a powerful tool for IDS, and convolutional neural networks (CNNs) have demonstrated exceptional performance in this domain. However, traditional IDS models are susceptible to data tampering and manipulation, compromising their integrity and effectiveness. Blockchain technology, with its inherent immutability and tamper-proof nature, offers a promising solution to enhance the security and reliability of IDS models. In this study, we propose a CNN-based IDS model that leverages blockchain technology to secure network traffic data. Our hypothesis is that integrating blockchain with CNNs can significantly improve the security and robustness of IDS models against data tampering and manipulation. To test our hypothesis, we employ a greedy-based genetic algorithm to select the most relevant features from network traffic data, followed by training a CNN model using the selected features. Finally, we evaluate the trained CNN model on a real-world dataset, demonstrating its ability to accurately classify network traffic as normal or intrusive. The results of our evaluation reveal that the proposed CNN-based IDS model achieves a classification accuracy of 99.2%, surpassing traditional IDS models. Moreover, our model exhibits enhanced resilience against data tampering and manipulation, demonstrating the effectiveness of blockchain integration in safeguarding the integrity of IDS models. Our findings underscore the potential of blockchain-enhanced CNNs as a robust and secure solution for intrusion detection in CPS, ensuring the integrity and protection of critical infrastructure.

Deep Neural Decision Forest (DNDF): A Novel Approach for Enhancing Intrusion Detection Systems in Network Traffic Analysis.

Intrusion detection systems, also known as IDSs, are widely regarded as one of the most essential components of an organization's network security. This is because IDSs serve as the organization's first line of defense against several cyberattacks and are accountable for accurately detecting any possible network intrusions. Several implementations of IDSs accomplish the detection of potential threats throughout flow-based network traffic analysis. Traditional IDSs frequently struggle to provide accurate real-time intrusion detection while keeping up with the changing landscape of threat. Innovative methods used to improve IDSs' performance in network traffic analysis are urgently needed to overcome these drawbacks. In this study, we introduced a model called a deep neural decision forest (DNDF), which allows the enhancement of classification trees with the power of deep networks to learn data representations. We essentially utilized the CICIDS 2017 dataset for network traffic analysis and extended our experiments to evaluate the DNDF model's performance on two additional datasets: CICIDS 2018 and a custom network traffic dataset. Our findings showed that DNDF, a combination of deep neural networks and decision forests, outperformed reference approaches with a remarkable precision of 99.96% by using the CICIDS 2017 dataset while creating latent representations in deep layers. This success can be attributed to improved feature representation, model optimization, and resilience to noisy and unbalanced input data, emphasizing DNDF's capabilities in intrusion detection and network security solutions.

Multi head self-attention gated graph convolutional network based multi‑attack intrusion detection in MANET

Designing of intrusion detection system (IDS), and mobile ad hoc networks (MANET) prevention technique with examined detection rate, memory consumption with minimum overhead are vital concerns. Node mobility and node energy are the two optimization problems in MANETs wherein nodes travel uncertainly in any direction, evolving in a continuous change of topology. With the proposed approach, a Centrality Coati Optimization Algorithm based Cluster Gradient for multi attack intrusion identification is devised. This study focuses on the problems of node mobility and energy to develop a clustering algorithm for cluster head selection in MANET that is incited by Dual Network Centrality. Compact cluster formation is carried out by Coati Optimization Algorithm (COA). The Multi-head Self-Attention based Gated Graph Convolutional Network (MSA-GCNN) with a hybrid type of IDS recognizes several attacks, including DoS and Zero-Day attacks. The proposed technique is implemented in NS-2 network simulator. The performance of proposed approach is examined under some parameters, like attack detection rate, memory consumption, computational time for detecting the intruder. The outcomes display that the proposed technique decreases the IDS traffic and entire consumption of memory and sustains a higher attack identification rate with less computational time. The proposed technique attains 4.299 %, 10.375 % and 6.935 % Accuracy, 5.262 %, 8.375 % and 7.945 % Precision, 7.282 %, 10.365 % and 5.935 % Recall, 9.272 %, 5.355 % and 8.965 % ROC is higher compared with the existing methods such as, Epsilon Swarm Optimized Cluster Gradient along deep belief classifier for multiple attack intrusion detection (ESOC-MA-ID-MANET), Intrusion Detection secure solution for intrusion detection in cloud computing utilizing hybrid deep learning approach called EOS-IDS and improved heap optimization (IHO-MA-ID-MANET) for induction detection technique respectively.

A Double-Layer Indemnity Enhancement Using LSTM and HASH Function Technique for Intrusion Detection System

The Intrusion Detection System (IDS) is the most widely used network security mechanism for distinguishing between normal and malicious traffic network activities. It aids network security in that it may identify unforeseen hazards in network traffic. Several techniques have been put forth by different researchers for network intrusion detection. However, because network attacks have increased dramatically, making it difficult to execute precise detection rates quickly, the demand for effectively recognizing network incursion is growing. This research proposed an improved solution that uses Long Short-Term Memory (LSTM) and hash functions to construct a revolutionary double-layer security solution for IoT Network Intrusion Detection. The presented framework utilizes standard and well-known real-time IDS datasets such as KDDCUP99 and UNSWNB-15. In the presented framework, the dataset was pre-processed, and it employed the Shuffle Shepherd Optimization (SSO) algorithm for tracking the most informative attributes from the filtered database. Further, the designed model used the LSTM algorithm for classifying the normal and malicious network traffic precisely. Finally, a secure hash function SHA3-256 was utilized for countering the attacks. The intensive experimental assessment of the presented approach with the conventional algorithms emphasized the efficiency of the proposed framework in terms of accuracy, precision, recall, etc. The analysis showed that the presented model attained attack prediction accuracy of 99.92% and 99.91% for KDDCUP99 and UNSWNB-15, respectively.

An efficient deep learning-based solution for network intrusion detection in wireless sensor network

An efficient deep learning-based solution for network intrusion detection in wireless sensor network

Cloud Intrusion Detection System Based on SVM

The demand for better intrusion detection and prevention solutions has elevated due to the current global uptick in hacking and computer network attacks. The Intrusion Detection System (IDS) is essential for spotting network attacks and anomalies, which have increased in size and scope. A detection system has become an effective security method that monitors and investigates security in cloud computing. However, several existing methods have faced issues such as low classification accuracy, high false positive rates, and low true positive rates. To solve these problems, a detection system based on Support Vector Machine (SVM) is proposed in this paper. In this method, the SVM classifier is utilized for network data classification into normal and abnormal behaviors. The Cloud Intrusion Detection Dataset is used to test the effectiveness of the suggested system. The experimental results show which the suggested system can detect abnormal behaviors with high accuracy.

SDN-enabled Deep Learning based Detection Mechanism (DDM) to tackle DDoS attacks in IoTs

The intelligence-embedded devices also called the Internet of Things, have heterogeneous characteristics and generate enormous data. To oblige the expansion of smart devices in the age of data, software-defined networking (SDN) has emerged as a promising cost-effective, scalable, versatile solution for IoT services. However, the proliferation and pervasiveness of IoT devices also bring some serious security concerns of cyber threats and attacks. This work presents a real-time intrusion detection and mitigation solution for SDN-enabled IoT infrastructure to provide autonomous security in high-traffic IoT networks in the 5G and beyond future. The suggested approach used an ensemble of Convolution Long short-term memory + Bidirectional Long short-term memory (ConvLSTM2D+BLSTM) at the SDN network layer to automate flow feature extraction and classification. For evolving distributed denial of service (DDoS) attacks, the testing is conducted on the CICIDS2017 dataset. The experimental results showed that the proposed security approach could detect and mitigate threats in real-time with high accuracy of 99.69% rate, 99.93% precision, and 99.65% F1-score by performing 10-fold cross-validation.