Hybrid CNN–Transformer Model for Real-Time Cybercrime Detection

Abstract

The rapid expansion of Internet-connected systems has increased the volume and diversity of malicious network activity, creating a continuing need for intrusion detection methods that can recognize attacks from network traffic patterns rather than relying only on previously known signatures. This article presents a Hybrid CNN–Transformer (HCNT) architecture for real-time, multi-class cybercrime detection in network traffic. The approach combines one-dimensional convolutional neural networks, which are used to learn local feature interactions, with Transformer encoder layers that model longer-range relationships through multi-head self-attention. The proposed architecture uses three dilated residual convolutional blocks, learnable positional encodings, and a two-layer Transformer encoder followed by a multi-layer classification head. Five traffic classes are considered: normal traffic, Denial-of-Service (DoS), probing, Remote-to-Local (R2L), and User-to-Root (U2R). The study uses 5,000 labelled network connection records with 41 features. Class imbalance is addressed using SMOTE, while feature standardisation is fitted only on the training portion to reduce the risk of data leakage. In the reported experiment, the model reaches 97.20% test accuracy, a macro-averaged F1-score of 0.9639, and a macro ROC-AUC of 0.9971. An INT8 TensorFlow Lite version reduces the model size and records a mean inference latency of 1.87 ms in the reported benchmark. SHAP DeepExplainer is also used to examine feature contributions for different attack classes. The results indicate that combining local feature extraction with global dependency modelling can provide an effective framework for the stated experimental setting, while the limited dataset and absence of adversarial and long-term drift evaluation remain important limitations.