Abstract

The dissolution of the traditional network perimeter, driven by cloud adoption, remote work, and the proliferation of Internet of Things devices, has positioned Zero Trust Network Architecture (ZTA) as the principal paradigm for enterprise cyber defence. Zero Trust mandates continuous, per-request verification of every subject, device, and workload, a requirement that is fundamentally dependent on the accuracy and timeliness of the intrusion detection intelligence feeding its policy decision points. While deep learning has demonstrated strong intrusion detection performance in isolation, comparatively few empirical studies examine the integration of deep learning detection engines within the latency-constrained control plane of a Zero Trust deployment. This article proposes and empirically evaluates a hybrid Convolutional Neural Network-Bidirectional Long Short-Term Memory-Attention (CNN-BiLSTM-Attention) model designed for deployment as the intrusion detection engine within a NIST Special Publication 800-207-compliant Zero Trust Architecture. The model was trained and evaluated on the CICIDS2017 benchmark dataset and benchmarked against five baseline classifiers spanning classical machine learning and single-branch deep learning architectures. The proposed model achieved 99.21 per cent classification accuracy, a macro-averaged Area Under the Receiver Operating Characteristic Curve of 0.997, and a mean per-flow inference latency of 3.1 milliseconds, comfortably within the real-time threshold required for inline Policy Enforcement Point integration. These results demonstrate that hybrid deep learning architectures can simultaneously satisfy the accuracy and latency demands of real-time Zero Trust enforcement, offering both a methodological template and a quantitative benchmark for future research seeking to operationalise deep learning intrusion detection within Zero Trust deployments