HYBRID DEEP LEARNING APPROACHES FOR CYBER THREAT DETECTION IN NETWORK AND SOCIAL MEDIA

Abstract

The rapid proliferation of digital platforms has given rise to two critical and structurally distinct categories of cyber threat: cyberbullying embedded in multimodal social-media content, and network intrusion attacks manifested in enterprise-level packet traffic. Existing detection systems address these threats in isolation and are characterised by a reliance on unimodal inputs, limited cross-modal reasoning, poor generalisation to class-imbalanced data, and an inability to capture the simultaneous spatial and temporal dependencies inherent in real-world attack behaviour. For Cyberbullying Detection, a Hybrid Multimodal Image-Text Classification frame work is proposed, evaluated on the Facebook Hateful Meme Dataset comprising 10,000 meme samples. Meme images are processed by a Dense Residual High-Resolution Network (DR-HRNet), which maintains high-resolution spatial feature maps through out its four-stage parallel branch architecture and enriches them via a Dense Residual Convolutional Block (DRCB) that combines dense connectivity with residual learning. Meme captions are concurrently encoded by Multi-Scale DeBERTa (MC-DeBERTa), an enhanced transformer that exploits disentangled self-attention with relative posi tion embeddings and stacks a Multi-Scale Dilated Convolutional Block (MDCB) atop the encoder to capture linguistic patterns at multiple granularities. The extracted vi sual and textual feature vectors are fused via Multimodal Compact Bilinear (MCB) Pooling, which models higher-order cross-modal interactions in a computationally efficient manner. The fused representation is classified by an Adaptive EfficientNetV2 backbone augmented with a Transformer Spatial Pooling (TSP) module that captures global contextual relationships before the final softmax decision layer. The proposed framework achieves a test accuracy of 99.5% and an F1-score of 99.30% on the Bully and Non-Bully classes respectively, with a macro-average AUC of 0.995, significantly outperforming unimodal and conventional multimodal baselines. For Network Intrusion Detection, a Graph-Based Hybrid GAT-BiLSTM framework is proposed, evaluated on the CICIDS2017 benchmark comprising approximately 2.83 million labelled network flows across five consolidated traffic categories (BENIGN, DDoS, PortScan, DoS, and Other). Each network flow is modelled as a node in a cosine-similarity k-Nearest Neighbour (kNN) graph with k = 10 and an adaptive dis v tance threshold, enabling the structural relationships between flows to be explicitly represented. Two stacked multi-head Graph Attention Network (GAT) layers with batch normalisation, dropout, and residual connections learn spatial inter-flow topology by dynamically assigning differential attention weights to neighbouring nodes. The resulting node embeddings are processed by a Bidirectional Long Short-Term Memory (BiLSTM) network that captures long-range temporal dependencies in both forward and backward directions, modelling the sequential behavioural evolution of network traf fic. A two-layer Multi-Layer Perceptron (MLP) head with a class-frequency weighted cross-entropy loss function performs the final five-class classification, counteracting the extreme class imbalance that is mitigated further through controlled random under sampling and stratified node splitting. Training employs the AdamW optimiser with ReduceLROnPlateau scheduling and early stopping. The proposed framework achieves a test accuracy of 94.20%, precision of 94.53%, recall of 94.20%, and F1-score of 94.20%, with a macro-average ROC-AUC of 0.997, outperforming standalone GNN, CNN, MLP, and LSTMbaselines on all metrics. Collectively, this thesis demonstrates that hybrid deep learning architectures designed with specialised feature extractors, learned fusion or graph-aggregation mechanisms, and imbalance-aware training strategies provide a principled and effective approach to multi-domain cyber threat detection. The two proposed methodologies advance the state of the art in their respective domains and establish a generalised design philosophy for future cross-domain intelligent cybersecurity systems.