GuardianNet: A Lightweight Intrusion Detection System Using Unsupervised Layer-wise Deep Auto-encoder and Bidirectional Long Short-Term Memory for Binary Classification

GuardianNet: A Lightweight Intrusion Detection System Using Unsupervised Layer-wise Deep Auto-encoder and Bidirectional Long Short-Term Memory for Binary Classification | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article GuardianNet: A Lightweight Intrusion Detection System Using Unsupervised Layer-wise Deep Auto-encoder and Bidirectional Long Short-Term Memory for Binary Classification Faraz Fatahnaie, Mohammadreza Binesh Marvasti, Seyyed Amir Asghari, and 1 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7259929/v1 This work is licensed under a CC BY 4.0 License Status: Under Revision Version 1 posted 13 You are reading this latest preprint version Abstract As digital infrastructure expands, the threat of network intrusions grows, especially from interconnected networks like the Internet of Things and cloud computing. Reliable intrusion detection systems are essential. Deep learning excels at identifying complex patterns but struggles with overfitting and gradient vanishing, limiting effectiveness. To address these challenges, a recent study proposes a framework called GuardianNet, combining an unsupervised layer-wise deep autoencoder with a bidirectional long short-term memory network optimized through hyperparameter tuning processes. This approach improves the ability of the intrusion detection system to extract vital features from raw data, thereby enhancing its ability to distinguish attacks from benign connections. The effectiveness of the proposed approach was evaluated on three benchmark datasets called KDDCUP99, UNSW-NB15, and CICIDS17. Two experiments were conducted on these datasets to justify the methods adopted in GuardianNet. Finally, a comparison is employed between several state-of-the-art methodologies and ours regarding frequent evaluation criteria in the domain. Cybersecurity intrusion detection machine learning deep learning deep autoencoder bidirectional long short-term memory Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Revision Version 1 posted Editorial decision: Revision requested 08 Jan, 2026 Reviews received at journal 08 Jan, 2026 Reviews received at journal 07 Jan, 2026 Reviews received at journal 04 Jan, 2026 Reviewers agreed at journal 22 Dec, 2025 Reviewers agreed at journal 21 Dec, 2025 Reviewers agreed at journal 19 Dec, 2025 Reviewers agreed at journal 18 Dec, 2025 Reviewers agreed at journal 18 Dec, 2025 Reviewers invited by journal 18 Dec, 2025 Editor assigned by journal 18 Dec, 2025 Submission checks completed at journal 04 Aug, 2025 First submitted to journal 31 Jul, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7259929","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":563655664,"identity":"4a553b1b-11f8-4ede-9556-d4a0a3cf37db","order_by":0,"name":"Faraz Fatahnaie","email":"","orcid":"","institution":"Kharazmi University","correspondingAuthor":false,"prefix":"","firstName":"Faraz","middleName":"","lastName":"Fatahnaie","suffix":""},{"id":563655666,"identity":"ff9fee9d-6cbb-4a12-a926-c050ef00bfe1","order_by":1,"name":"Mohammadreza Binesh Marvasti","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAxUlEQVRIiWNgGAWjYBADHn4eHgiLjUgdBjySPaRqYTA4w0OkWt32s88kfvz5I2N85uwxCYYaOwY+6QP4tZidSTeT7G0z4DE725cmwXAsmYGNL4GAlgNpzAa8DUAt53nMJBjYDjCwEXKg2flnzIZ//hjwGPeDtPwjRsuNNMbHPGwGPAa8PWYSjG1EaXnG+Fi2zZhH4swZY4vEvmQeIhyWxnDwzR85e/6eHMMbH77Zycn3ENCCChKAyYAkDaNgFIyCUTAKsAMAs3I08wEoBosAAAAASUVORK5CYII=","orcid":"","institution":"Kharazmi University","correspondingAuthor":true,"prefix":"","firstName":"Mohammadreza","middleName":"Binesh","lastName":"Marvasti","suffix":""},{"id":563655669,"identity":"dcf69f57-a709-4b49-8617-8c74b1ead1db","order_by":2,"name":"Seyyed Amir Asghari","email":"","orcid":"","institution":"University of Tehran","correspondingAuthor":false,"prefix":"","firstName":"Seyyed","middleName":"Amir","lastName":"Asghari","suffix":""},{"id":563655673,"identity":"deee1921-b07e-47dd-a501-7b33b81845db","order_by":3,"name":"Yvon Savaria","email":"","orcid":"","institution":"Polytechnique Montréal","correspondingAuthor":false,"prefix":"","firstName":"Yvon","middleName":"","lastName":"Savaria","suffix":""}],"badges":[],"createdAt":"2025-07-31 08:38:29","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7259929/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7259929/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":98777410,"identity":"3fbf5722-a66e-4a31-ad5a-f38d8e98e9e8","added_by":"auto","created_at":"2025-12-22 12:26:59","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":677601,"visible":true,"origin":"","legend":"","description":"","filename":"supercomputing.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7259929/v1_covered_1d735738-70d7-481a-b70f-d12b0f82e2a4.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"GuardianNet: A Lightweight Intrusion Detection System Using Unsupervised Layer-wise Deep Auto-encoder and Bidirectional Long Short-Term Memory for Binary Classification","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"the-journal-of-supercomputing","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [The Journal of Supercomputing](https://www.springer.com/journal/11227)","snPcode":"11227","submissionUrl":"https://submission.nature.com/new-submission/11227/3","title":"The Journal of Supercomputing","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Cybersecurity, intrusion detection, machine learning, deep learning, deep autoencoder, bidirectional long short-term memory","lastPublishedDoi":"10.21203/rs.3.rs-7259929/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7259929/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"As digital infrastructure expands, the threat of network intrusions grows, especially from interconnected networks like the Internet of Things and cloud computing. Reliable intrusion detection systems are essential. Deep learning excels at identifying complex patterns but struggles with overfitting and gradient vanishing, limiting effectiveness. To address these challenges, a recent study proposes a framework called GuardianNet, combining an unsupervised layer-wise deep autoencoder with a bidirectional long short-term memory network optimized through hyperparameter tuning processes. This approach improves the ability of the intrusion detection system to extract vital features from raw data, thereby enhancing its ability to distinguish attacks from benign connections. The effectiveness of the proposed approach was evaluated on three benchmark datasets called KDDCUP99, UNSW-NB15, and CICIDS17. Two experiments were conducted on these datasets to justify the methods adopted in GuardianNet. Finally, a comparison is employed between several state-of-the-art methodologies and ours regarding frequent evaluation criteria in the domain.","manuscriptTitle":"GuardianNet: A Lightweight Intrusion Detection System Using Unsupervised Layer-wise Deep Auto-encoder and Bidirectional Long Short-Term Memory for Binary Classification","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-12-22 04:09:22","doi":"10.21203/rs.3.rs-7259929/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-01-08T18:30:29+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-01-08T14:36:12+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-01-07T13:48:03+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-01-04T08:23:37+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"108697427242873215566062101028829674836","date":"2025-12-22T11:26:19+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"287994532904736247492772570700579264322","date":"2025-12-21T06:26:28+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"82593482135726006739423084634974458174","date":"2025-12-19T06:10:57+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"160153311020975130044973031230790886138","date":"2025-12-19T00:21:57+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"326179189439814429004115646361161987374","date":"2025-12-18T19:34:18+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-12-18T15:53:42+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-12-18T15:37:04+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-08-04T13:12:10+00:00","index":"","fulltext":""},{"type":"submitted","content":"The Journal of Supercomputing","date":"2025-07-31T08:33:03+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"the-journal-of-supercomputing","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [The Journal of Supercomputing](https://www.springer.com/journal/11227)","snPcode":"11227","submissionUrl":"https://submission.nature.com/new-submission/11227/3","title":"The Journal of Supercomputing","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"77913caa-5df6-457a-94b8-db4e26f8d833","owner":[],"postedDate":"December 22nd, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"in-revision","subjectAreas":[],"tags":[],"updatedAt":"2026-05-05T22:53:55+00:00","versionOfRecord":[],"versionCreatedAt":"2025-12-22 04:09:22","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7259929","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7259929","identity":"rs-7259929","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}