Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Survey for Deep Reinforcement Learning Based Network Intrusion Detection

Wanrong Yang, Alberto Acuto, Yihang Zhou, Dominik Wojtczak

TL;DR

The performance of DRL models is comprehensively analyzed, showing that while DRL holds promise, many recent technologies remain underexplored, and proposes integrating DRL with generative methods to further improve performance.

Abstract

Cyber-attacks are becoming increasingly sophisticated and frequent, highlighting the importance of network intrusion detection systems. This paper explores the potential and challenges of using deep reinforcement learning (DRL) in network intrusion detection. It begins by introducing key DRL concepts and frameworks, such as deep Q-networks and actor-critic algorithms, and reviews recent research utilizing DRL for intrusion detection. The study evaluates challenges related to model training efficiency, detection of minority and unknown class attacks, feature selection, and handling unbalanced datasets. The performance of DRL models is comprehensively analyzed, showing that while DRL holds promise, many recent technologies remain underexplored. Some DRL models achieve state-of-the-art results on public datasets, occasionally outperforming traditional deep learning methods. The paper concludes with recommendations for enhancing DRL deployment and testing in real-world network scenarios, with a focus on Internet of Things intrusion detection. It discusses recent DRL architectures and suggests future policy functions for DRL-based intrusion detection. Finally, the paper proposes integrating DRL with generative methods to further improve performance, addressing current gaps and supporting more robust and adaptive network intrusion detection systems.

A Survey for Deep Reinforcement Learning Based Network Intrusion Detection

TL;DR

The performance of DRL models is comprehensively analyzed, showing that while DRL holds promise, many recent technologies remain underexplored, and proposes integrating DRL with generative methods to further improve performance.

Abstract

Cyber-attacks are becoming increasingly sophisticated and frequent, highlighting the importance of network intrusion detection systems. This paper explores the potential and challenges of using deep reinforcement learning (DRL) in network intrusion detection. It begins by introducing key DRL concepts and frameworks, such as deep Q-networks and actor-critic algorithms, and reviews recent research utilizing DRL for intrusion detection. The study evaluates challenges related to model training efficiency, detection of minority and unknown class attacks, feature selection, and handling unbalanced datasets. The performance of DRL models is comprehensively analyzed, showing that while DRL holds promise, many recent technologies remain underexplored. Some DRL models achieve state-of-the-art results on public datasets, occasionally outperforming traditional deep learning methods. The paper concludes with recommendations for enhancing DRL deployment and testing in real-world network scenarios, with a focus on Internet of Things intrusion detection. It discusses recent DRL architectures and suggests future policy functions for DRL-based intrusion detection. Finally, the paper proposes integrating DRL with generative methods to further improve performance, addressing current gaps and supporting more robust and adaptive network intrusion detection systems.

Paper Structure

This paper contains 28 sections, 20 equations, 7 figures, 11 tables.

Table of Contents

  1. Introduction
  2. Reinforcement Learning Basics
  3. Overview
  4. Markov decision process
  5. Q-learning
  6. Deep Reinforcement Learning
  7. Deep Q Network, DQN
  8. Policy Gradient
  9. Actor-Critic Network
  10. Inverse reinforcement learning
  11. Evaluation
  12. Tools used for RL based network intrusion
  13. DRL in Network Intrusion detection
  14. Dataset
  15. Modeling workflow
  16. ...and 13 more sections

Figures (7)

  • Figure 1: An overview of network intrusion detection and specific working flow of anomaly-based netwotk intrusion detection.
  • Figure 2: Number of related publications start from 2017 (Taking reinforcement learning and network intrusion as searching key words, data is collected from Web of Science).
  • Figure 3: Agent interaction with environment based MDP in RL.
  • Figure 4: Classic deep Q network learning process
  • Figure 5: Classic structure of Actor-Critic network.
  • ...and 2 more figures