Attention based multi-agent intrusion detection systems using reinforcement learning

Ensemble of feature augmented convolutional neural network and deep autoencoder for efficient detection of network attacks

Network traffic must be monitored and analyzed for any abnormal activity in order to detect intrusions and to notify administrators of any attacks. A novel ensemble of deep learning technique is proposed to enhance the efficiency of Packet Flow Classification in Network Intrusion Detection System (NIDS). The proposed work consists of three phases: (i) Feature Augmented Convolutional Neural Network (FA-CNN) (ii) Deep Autoencoder (iii) Ensemble of FA-CNN and Deep Autoencoder. In FA-CNN, CNN is trained with augmented features selected using Mutual Information. The FA-CNN is ensembled with Deep Autoencoder to design the ensemble of the classifier. To assess the stated ensemble model, numerous experiments are conducted on benchmark datasets like NSL-KDD and CICDS2017. The result findings are compared with the recent methodologies to assess the performance of the stated work. The results indicate that the suggested work performs better than the existing works with the overall accuracy of 97% for NSLKDD and 95% for CICIDS2017 dataset. Also, the proposed method improved the detection rate of minority attack classes like U2R in NSLKDD and Hearbleed in CICIDS2017.

Deep Q-Learning Based Reinforcement Learning Approach for Network Intrusion Detection

The rise of the new generation of cyber threats demands more sophisticated and intelligent cyber defense solutions equipped with autonomous agents capable of learning to make decisions without the knowledge of human experts. Several reinforcement learning methods (e.g., Markov) for automated network intrusion tasks have been proposed in recent years. In this paper, we introduce a new generation of the network intrusion detection method, which combines a Q-learning based reinforcement learning with a deep feed forward neural network method for network intrusion detection. Our proposed Deep Q-Learning (DQL) model provides an ongoing auto-learning capability for a network environment that can detect different types of network intrusions using an automated trial-error approach and continuously enhance its detection capabilities. We provide the details of fine-tuning different hyperparameters involved in the DQL model for more effective self-learning. According to our extensive experimental results based on the NSL-KDD dataset, we confirm that the lower discount factor, which is set as 0.001 under 250 episodes of training, yields the best performance results. Our experimental results also show that our proposed DQL is highly effective in detecting different intrusion classes and outperforms other similar machine learning approaches.