Underwater Wireless Sensor Networks (UWSNs) face numerous threats during deployment, such as deep-sea noise, frequency shifts, bit errors, propagation delays, channel openness, and multipath effects. These threats increase the risk of network attacks and interference. Current research primarily focuses on intrusion detection at the network layer, neglecting the anomalies and low detection rates at the MAC and physical layers. In this study, we developed an underwater sensor network intrusion attack system based on underwater communication nodes, relay nodes, and shore-based communication servers. The system is constructed with routing, MAC, and physical layers. We set up attack transmission protocols to conduct underwater acoustic replay attacks, MAC attacks, and cross-node server malicious attacks, and collected real-time attack data within the network. We propose an improved CNN-LSTM architecture for underwater acoustic communication intrusion detection. This algorithm connects the CNN and LSTM models via intermediate layer components, redeploys convolutional layers, max-pooling layers, and activation function components, and optimizes through fully connected layers and softmax layers. The algorithm inherits the advantage of the CNN model in processing feature data through convolution and pooling and the strength of the LSTM model in handling sequential data, making it more suitable for underwater acoustic communication data. Experimental results show that the improved model achieves prediction accuracies of up to \(98.99\%\) , \(99.06\%\) , and \(98.75\%\) on ocean communication datasets at different transmission distances.