Getaye/lcga-self-healing-ids

LCGA Self-Healing IDS

A Lightweight Hybrid Deep Learning Framework for Real-Time Cyber Threat Detection and Intent-Aware Self-Healing Network Security

MSc Thesis — Addis Ababa University, Department of Computer Science

  

A lightweight, explainable hybrid deep-learning framework for real-time cyber threat detection and intent-aware self-healing network security.

Table of Contents

• —Highlights
• —Architecture
• —Key Contributions
• —Live Demo
• —Repository Structure
• —Kaggle Notebooks
• —Quick Start
• —Authors
• —Citation
• —License

Highlights

Architecture

Network Traffic
   ↓
LCGA Detector (~41K params)
Conv1D → GRU → Attention
Multi-class classification (12 CICIDS2017 classes)
   ↓
DT Surrogate + SHAP
Real-time explanations
   ↓
MAPE-K Orchestrator
Monitor → Analyze → Plan → Execute → Verify
   ↓
Healing Action
BLOCK_IP / RATE_LIMIT / ...

Key Contributions

1. 1.LCGA: A lightweight CNN-GRU-Attention model with 41K parameters, achieving 99.67% accuracy on CICIDS2017.
2. 2.DT Surrogate + SHAP: Real-time explanations via a distilled Decision Tree surrogate, with major speed gains over LIME.
3. 3.MAPE-K Closed Loop: Adaptive verification windows reduce MTTR while improving self-healing behavior.
4. 4.Reproducibility: Code, experiments, and demo are organized for easy reuse.

Live Demo

Try the interactive dashboard on Hugging Face Spaces: lcga-self-healing-ids

Repository Structure

lcga-self-healing-ids/
├── .devcontainer/
├── .github/
├── .streamlit/
├── config/
│   ├── config.yaml
│   └── intents.yaml
├── models/
├── notebooks/
├── results/
├── src/
│   ├── preprocessing/
│   ├── models/
│   ├── xai/
│   ├── mape_k/
│   ├── evaluation/
│   └── utils/
├── .gitignore
├── LICENSE
├── README.md
├── app.py
├── packages.txt
└── requirements.txt

Kaggle Notebooks

Quick Start

git clone https://github.com/getaye21/lcga-self-healing-ids.git
cd lcga-self-healing-ids
pip install -r requirements.txt
streamlit run app.py

Authors

• —Getaye Fiseha — Lead
• —Mersen Getu — Co-investigator
• —Chara Girma — Co-investigator
• —Advisor: Dr. Yaregal A.
• —Institution: Addis Ababa University, 2026

Citation

@mastersthesis{fiseha2026lcga,
  title   = {A Lightweight Hybrid Deep Learning Framework for Real-Time Cyber Threat Detection and Intent-Aware Self-Healing Network Security},
  author  = {Fiseha, Getaye and Getu, Mersen and Girma, Chara},
  school  = {Addis Ababa University},
  year    = {2026},
  type    = {MSc Thesis}
}

License

MIT License. See the LICENSE file.