Deep Reinforcement Learning for Cyber Security

TL;DR

This paper surveys the application of deep reinforcement learning techniques to enhance cyber security, addressing complex, dynamic, and high-dimensional defense challenges through various DRL-based methods and strategies.

Contribution

It provides a comprehensive review of DRL approaches in cyber security, highlighting recent developments, applications, and future research directions.

Findings

DRL effectively addresses complex cyber defense problems.

Multiple DRL-based intrusion detection and defense strategies are discussed.

Future research directions include scalability and real-world deployment challenges.

Abstract

The scale of Internet-connected systems has increased considerably, and these systems are being exposed to cyber attacks more than ever. The complexity and dynamics of cyber attacks require protecting mechanisms to be responsive, adaptive, and scalable. Machine learning, or more specifically deep reinforcement learning (DRL), methods have been proposed widely to address these issues. By incorporating deep learning into traditional RL, DRL is highly capable of solving complex, dynamic, and especially high-dimensional cyber defense problems. This paper presents a survey of DRL approaches developed for cyber security. We touch on different vital aspects, including DRL-based security methods for cyber-physical systems, autonomous intrusion detection techniques, and multiagent DRL-based game theory simulations for defense strategies against cyber attacks. Extensive discussions and future research directions on DRL-based cyber security are also given. We expect that this comprehensive review provides the foundations for and facilitates future studies on exploring the potential of emerging DRL to cope with increasingly complex cyber security problems.

Tables

Table 1. TABLE I: Summary of features of DRL types and their notable methods

DRL types	Value-based	Policy-gradient	Actor-critic
Features	- Compute value of action given a state $Q(s,a)$. - No learned explicit policy. - Sample efficient [72].	- No value function is needed. - Explicit policy is constructed. - Sample inefficient [72].	- Actor produces policy $\pi (s,a)$. - Critic evaluates action by $V\left(s\right)$. - Often perform better than value-based or policy-gradient methods.
Typical methods	- DQN [29] - Double DQN [47] - Dueling Q-network [48] - Prioritized Experience Replay DQN [63]	- REINFORCE [64] - Vanilla Policy Gradient [65] - TRPO [66] - PPO [67]	- DDPG [69] - D4PG [70] - A3C [50] - UNREAL [71]
Applications	Suitable for problems with discrete action spaces, e.g., classic control tasks: Acrobot, CartPole, and MountainCar as described and implemented in the popular OpenAI Gym toolkit [74].	More suitable for problems with continuous action spaces, e.g., classic control tasks described and implemented in the OpenAI Gym toolkit: MountainCarContinuous and Pendulum [74] or BipedalWalker and CarRacing problems [75].

Table 2. TABLE II: Summary of typical DRL applications in cyber security

Applications	Goals/Objectives	Algorithms	States	Actions	Rewards
Robustness-guided falsification of CPS [86]	Find falsifying inputs (counterexamples) for CPS	Double DQN and A3C	Defined as the output of the system.	Choose the next input value from a set of piecewise-constant input signals.	Characterized by a function of past-dependent life-long property, output signal and time.
Security and safety in autonomous vehicle systems [89]	Maximize the robustness of AV dynamics control to cyber-physical attacks that inject faulty data to sensor readings.	Q-learning with LSTM	AV’s own position and speed along with distance and speed of some nearby objects, e.g., the leading AV.	Take appropriate speeds to maintain safe spacing between AVs.	Using a utility function that takes into account the deviation from the optimal safe spacing.
Increasing robustness of the autonomous system against adversarial attacks [93]	Devise filtering schemes to detect corrupted measurements (deception attack) and mitigate the effects of adversarial errors.	TRPO	Characterized by sensor measurements and actuation noises.	Determine which estimation rule to use to generate an estimated state from a corrupted state.	Defined via a function that takes state features as inputs.
Secure offloading in mobile edge caching [142]	Learn a policy for a mobile device to securely offload data to edge nodes against jamming and smart attacks.	DQN with hotbooting transfer learning technique.	Represented via a combination of user density, battery levels, jamming strength, and radio channel bandwidth.	Agent’s actions include choosing an edge node, selecting offloading rate and time, transmit power and channel.	Computed based on secrecy capacity, energy consumption, and communication efficiency.
Anti-jamming communication scheme for CRN [152]	Derive an optimal frequency hopping policy for CRN SUs to defeat smart jammers based on a frequency-spatial anti-jamming game.	DQN that employs CNN	Consist of presence status of PUs and SINR information at time $t-1$ received from serving base station or access point.	SUs take action to leave a geographical area of heavy jamming obstructed by smart jammers or choose a frequency channel to send signals.	Represented via a utility function based on SINR and transmission cost.
Anti-jamming communication method [153], improving the previous work in [152]	Propose a smart anti-jamming scheme similar to [152] with two main differences: spectrum waterfall is used as the state, and jammers can have different channel-slot transmission structure with users.	DQN with recursive CNN due to recursion characteristic of spectrum waterfall.	Using temporal and spectral information, i.e., spectrum waterfall containing both frequency and time domain information of the network environment.	Agent’s action is to select a discretized transmission frequency from a predefined set.	Defined by a function involving SINR-based transmission rate and cost for frequency switching.
Spoofing detection in wireless networks [156, 157]	Select the optimal authentication threshold.	Q-learning and Dyna-Q	Include false alarm rate and missed detection rate of the spoofing detection system at time $t-1$	Action set includes the choices of different discrete levels of the authentication thresholds bounded within a specified interval.	Using a utility function calculated based on the Bayesian risk, which is the expected payoff in spoofing detection.
Mobile offloading for cloud-based malware detection [161], improving the previous work in [162]	Improve malware detection accuracy and speed.	Hotbooting Q-learning and DQN.	Consist of current radio bandwidth and previous offloading rates of other devices.	Select optimal offloading rate level for each mobile device.	Represented by a utility function calculated based on the detection accuracy, response speed, and transmission cost.
Autonomous defense in SDN [168]	Tackle the poisoning attacks that manipulate states or flip reward signals during the training process of RL-based defense agents.	Double DQN and A3C	Represented by an array of zeros and ones showing the state of the network (whether a node is compromised or a link is switched on/off). Array length is equal to several nodes plus several links.	Attackers learn to select a node to compromise while a defender can take four actions: isolate, patch, reconnect and migrate to protect server and preserve as many nodes as possible.	Modelled based on the status of the critical server, number of preserved nodes, migration cost and the validity of actions taken.
Secure mobile crowdsensing (MCS) system [193]	Optimize payment policy to improve the sensing performance against faked sensing attacks by formulating a Stackelberg game.	DQN	Consist of the previous sensing quality and the payment policy.	Select the server’s optimal payment vector to smartphone users.	Using a utility function that involves the total payment to users and the benefit of server from sensing reports of different accuracy levels.
Automated URL-based phishing detection [198]	Detect malicious websites (URLs)	DQN	Characterized by the vector space representation of website features such as HTTPS protocols, having IP address, prefix or suffix in URLs.	Select either 0 or 1, corresponding to a benign or phishing URL.	Based on the classification action, the reward equates to 1 or -1 if the URL is classified correctly or incorrectly.

Equations

$$Q(s_t,a_t)=E[r_{t+1}+\gamma r_{t+2}+{\gamma }^2{r}_{t+3}+...|s_t,a_t]$$

$$L_1=\sum (R-V(s){)}^2$$

$$L_2=-\log (\pi (a|s))\ast A(s)-\vartheta H(\pi )$$

$$\dot{x}(t)=f(t,x,u,w;\theta (t,a,d));x(t_0)=x_0$$

Full text

I Introduction

Internet of Things (IoT) technologies have been employed broadly in many sectors such as telecommunications, transportation, manufacturing, water and power management, healthcare, education, finance, government, and even entertainment. The convergence of various information and communication technology (ICT) tools in the IoT has boosted its functionalities and services to users to new levels. ICT has witnessed a remarkable development in terms of system design, network architecture, and intelligent devices in the last decade. For example, ICT has been advanced with the innovations of cognitive radio network and 5G cellular network [1, 2], software-defined network (SDN) [3], cloud computing [4], (mobile) edge caching [5, 6], and fog computing [7]. Accompanying these developments is the increasing vulnerability to cyber attacks, which are defined as any type of offensive maneuver exercised by one or multiple computers to target computer information systems, network infrastructures, or personal computer devices. Cyber attacks may be instigated by economic competitors or state-sponsored attackers. There has been thus a critical need of the development of cyber security technologies to mitigate and eliminate impacts of these attacks [8].

Artificial intelligence (AI), especially machine learning (ML), has been applied to both attacking and defending in the cyberspace. On the attacker side, ML is utilized to compromise defense strategies. On the cyber security side, ML is employed to put up robust resistance against security threats in order to adaptively prevent and minimise the impacts or damages occurred. Among these ML applications, unsupervised and supervised learning methods have been used widely for intrusion detection [9, 10, 11], malware detection [12, 13, 14], cyber-physical attacks [15, 16, 17], and data privacy protection [18]. In principle, unsupervised methods explore the structure and patterns of data without using their labels while supervised methods learn by examples based on data’s labels. These methods, however, cannot provide dynamic and sequential responses against cyber attacks, especially new or constantly evolving threats. Also, the detection and defending responses often take place after the attacks when traces of attacks become available for collecting and analyzing, and thus proactive defense solutions are hindered. A statistical study shows that 62% of the attacks were recognized after they have caused significant damages to the cyber systems [19].

Reinforcement learning (RL), a branch of ML, is the closest form of human learning because it can learn by its own experience through exploring and exploiting the unknown environment. RL can model an autonomous agent to take sequential actions optimally without or with limited prior knowledge of the environment, and thus, it is particularly adaptable and useful in real time and adversarial environments. With the power of function approximation and representation learning, deep learning has been incorporated into RL methods and enabled them to solve many complex problems [20, 21, 22, 23, 24]. The combination of deep learning and RL therefore indicates excellent suitability for cyber security applications where cyber attacks are increasingly sophisticated, rapid, and ubiquitous [25, 26, 27, 28].

The emergence of DRL has actually witnessed great success in different fields, from video game domain, e.g. Atari [29, 30], game of Go [31, 32], real-time strategy game StarCraft II [33, 34, 35, 36], 3D multi-player game Quake III Arena Capture the Flag [37], and teamwork game Dota 2 [38] to real-world applications such as robotics [39], autonomous vehicles [40], autonomous surgery [41, 42], natural language processing [43], biological data mining [44], and drug design [45]. DRL methods have also recently been applied to solve various problems in the IoT area. For example, a DRL-based resource allocation framework that integrates networking, caching, and computing capabilities for smart city applications is proposed in [46]. DRL algorithm, i.e., double dueling deep Q-network [47, 48], is used to solve this problem because it involves a large state space, which consists of the dynamic changing status of base stations, mobile edge caching (MEC) servers and caches. The framework is developed based on the programmable control principle of SDN and the caching capability of information-centric networking. Alternatively, Zhu et al. [49] explored MEC policies by using the context awareness concept that represents the user’s context information and traffic pattern statistics. The use of AI technologies at the mobile network edges is advocated to intelligently exploit operating environment and make the right decisions regarding what, where, and how to cache appropriate contents. To increase the caching performance, a DRL approach, i.e., the asynchronous advantage actor-critic algorithm [50], is used to find an optimal policy aiming to maximize the offloading traffic.

Findings from our current survey show that applications of DRL in cyber environments are generally categorized under two perspectives: optimizing and enhancing the communications and networking capabilities of the IoT applications, e.g. [51, 52, 53, 54, 55, 56, 57, 58, 59], and defending against cyber attacks. This paper focuses on the later where DRL methods are used to solve cyber security problems with the presence of cyber attacks or threats. Next section provides a background of DRL methods, followed by a detailed survey of DRL applications in cyber security in Section III. We group these applications into three major categories, including DRL-based security solutions for cyber-physical systems, autonomous intrusion detection techniques, and DRL-based game theory for cyber security. Section IV concludes the paper with extensive discussions and future research directions on DRL for cyber security.

II Deep Reinforcement Learning Preliminary

Different from the other popular branch of ML, i.e., supervised methods learning by examples, RL characterizes an agent by creating its own learning experiences through interacting directly with the environment. RL is described by concepts of state, action, and reward (Fig. 1). It is a trial and error approach in which the agent takes action at each time step that causes two changes: current state of the environment is changed to a new state, and the agent receives a reward or penalty from the environment. Given a state, the reward is a function that can tell the agent how good or bad an action is. Based on received rewards, the agent learns to take more good actions and gradually filter out bad actions.

A popular RL method is Q-learning whose goal is to maximize the discounted cumulative reward based on the Bellman equation [60]:

[TABLE]

The discount factor $\gamma\in[0,1]$ manages the importance levels of future rewards. It is applied as a mathematical trick to analyze the learning convergence. In practice, discount is necessary because of partial observability or uncertainty of the stochastic environment.

Q-learning needs to use a lookup table or Q-table to store expected rewards (Q-values) of actions given a set of states. This requires a large memory when the state and action spaces increase. Real-world problems often involve continuous state or action space, and therefore, Q-learning is inefficient to solve these problems. Fortunately, deep learning has emerged as a powerful tool that is a great complement to traditional RL techniques. Deep learning methods have two typical capabilities, i.e. function approximation and representation learning, which help them to learn a compact low-dimensional representation of raw high-dimensional data effectively [61]. The combination of deep learning and RL was the research direction that Google DeepMind has initiated and pioneered. They proposed deep Q-network (DQN) with the use of a deep neural network (DNN) to enable Q-learning to deal with high-dimensional sensory inputs [62, 29].

Using DNNs to approximate the Q-function however is unstable due to the correlations among the sequences of observations and the correlations between the Q-values $Q(s,a)$ and the target values $Q(s^{\prime},a^{\prime})$. Mnih et al. [29] proposed the use of two novel techniques, i.e., experience replay memory and target network, to address this problem (Fig. 2). On the one hand, experience memory stores an extensive list of learning experience tuples $(s,a,r,s^{\prime})$, which are obtained from the agent’s interactions with the environment. The agent’s learning process retrieves these experiences randomly to avoid the correlations of consecutive experiences. On the other hand, the target network is technically a copy of the estimation network, but its parameters are frozen and only updated after a period. For instance, the target network is updated after 10,000 updates of the estimation network, as demonstrated in [29]. DQN has made a breakthrough as it is the first time an RL agent can provide a human-level performance in playing 49 Atari games by using just raw image pixels of the game board.

As a value-based method, DQN takes long training time and has limitations in solving problems with continuous action spaces. Value-based methods, in general, evaluate the goodness of an action given a state using the Q-value function. When the number of states or actions is large or infinite, they show inefficiency or even impracticality. Another type of RL, i.e., policy gradient methods, has solved this problem effectively. These methods aim to derive actions directly by learning a policy $\pi(s,a)$ that is a probability distribution over all possible actions. REINFORCE [64], vanilla policy gradient [65], trust region policy optimization (TRPO) [66] and proximal policy optimization (PPO) [67] are notable policy gradient methods. The gradient estimation, however, often suffers from a large fluctuation [68]. The combination of value-based and policy-gradient methods has been developed to aggregate the advantages and eradicate the disadvantages of these two methods. This kind of combination has constituted another type of RL, i.e., actor-critic methods. This structure comprises two components: an actor and a critic that can be both characterized by DNNs. The actor attempts to learn a policy by receiving feedback from the critic. This iterative process helps the actor improve its strategy and converge to an optimal policy. Deep deterministic policy gradient (DDPG) [69], distributed distributional DDPG (D4PG) [70], asynchronous advantage actor-critic (A3C) [50] and unsupervised reinforcement and auxiliary learning (UNREAL) [71] are methods that utilize the actor-critic framework. An illustrative architecture of the popular algorithm A3C is presented in Fig. 3. A3C’s structure consists of a hierarchy of a master learning agent (global) and individual learners (workers). Both master agent and individual learners are modeled by DNNs with each having two outputs: one for the critic and another for the actor. The first output is a scalar value representing the expected reward of a given state $V(s)$ while the second output is a vector of values representing a probability distribution over all possible actions $\pi(s,a)$.

The value loss function of the critic is specified by:

[TABLE]

where $R=r+\gamma V(s^{\prime})$ is the discounted future reward. Also, the actor is pursuing minimization of the following policy loss function:

[TABLE]

where $A(s)=R-V(s)$ is the estimated advantage function, and $H(\pi)$ is the entropy term, which handles the exploration capability of the agent with the hyperparameter $\vartheta$ controlling the strength of the entropy regularization. The advantage function $A(s)$ shows how advantageous the agent is when it is in a particular state. The learning process of A3C is asynchronous because each learner interacts with its separate environment and updates the master network independently. This process is iterated, and the master network is the one to use when the learning is finished.

Table I summarizes comparable features of value-based, policy-gradient, and actor-critic methods, and their typical example algorithms. Valued-based methods are more sample efficient than policy-gradient methods because they are able to exploit data from other sources such as experts [72]. In DRL, a value function or a policy function is normally approximated by a universal function approximator such as a (deep) neural network, which can take either discrete or continuous states as inputs. Therefore, modelling state spaces is more straightforward than dealing with action spaces in DRL. Value-based methods are suitable for problems with discrete action spaces as they evaluate every action explicitly and choose an action at each time step based on these evaluations. On the other hand, policy-gradient and actor-critic methods are more suitable for continuous action spaces because they describe the policy (a mapping between states and actions) as a probability distribution over actions. The continuity characteristic is the main difference between discrete and continuous action spaces. In a discrete action space, actions are characterized as a mutually exclusive set of options while in a continuous action space, an action has a value from a certain range or boundary [73].

III DRL in Cyber Security: A Survey

A large number of applications of RL to various aspects of cyber security have been proposed in the literature, ranging from data privacy to critical infrastructure protection. However, drawbacks of traditional RL have restricted its capability in solving complex and large-scale cyber security problems. The increasing number of connected IoT devices in recent years have led to a significant increase in the number of cyber attack instances as well as their complexity. The emergence of deep learning and its integration with RL have created a class of DRL methods that are able to detect and fight against sophisticated types of cyber attacks, such as falsified data injection to cyber-physical systems [86], deception attack to autonomous systems [93], distributed denial-of-service attacks [114], intrusions to host computers or networks [125], jamming [142], spoofing [157], malware [161], attacks in adversarial networking environments [168], and so on. This section provides a comprehensive survey of state-of-the-art DRL-powered solutions for cyber security, ranging from defense methods for cyber-physical systems to autonomous intrusion detection approaches, and game theory-based solutions.

The structure of the survey is presented in Fig. 4. We limit the survey to existing applications of DRL to cyber security. There are other topics in cyber security where DRL has not been applied to and they are therefore discussed in Section IV (Discussions and Future Research Directions). Those potential topics include a multi-agent DRL approach to cyber security, combining host-based and network-based intrusion detection systems, model-based DRL and combining model-free and model-based DRL methods for cyber security applications, investigating methods that can deal with continuous action spaces in cyber environments, offensive AI, deepfakes, machine learning poisoning, adversarial machine learning, human-machine teaming within a human-on-the-loop architecture, bit-and-piece distributed denial-of-service attacks as well as potential attacks by quantum physics-based powerful computers to crack encryption algorithms.

III-A DRL-based Security Methods for Cyber-Physical Systems

Investigations of defense methods for cyber-physical systems (CPS) against cyber attacks have received considerable attention and interests from the cyber security research community. CPS is a mechanism controlled by computer-based algorithms facilitated by internet integration. This mechanism provides efficient management of distributed physical systems via the shared network. With the rapid development of the Internet and control technologies, CPSs have been used extensively in many areas including manufacturing [76], health monitoring [77, 78], smart grid [79, 80, 81], and transportation [83, 82]. Being exposed widely to the Internet, these systems are increasingly vulnerable to cyber attacks [84]. In 2015, hackers attacked the control system of a steel mill in Germany by obtaining login credentials via the use of phishing emails. This attack caused a partial plant shutdown and resulted in damage of millions of dollars. Likewise, there was a costly cyber attack to a power grid in Ukraine in late December 2015 that disrupted electricity supply to a few hundred thousand end consumers [85].

In an effort to study cyber attacks on CPS, Feng et al. [85] characterized the cyber state dynamics by a mathematical model:

[TABLE]

where $x$, $u$ and $w$ represent the physical state, control inputs and disturbances correspondingly (see Fig. 5). In addition, $\theta(t,a,d)$ describes cyber state at time $t$ with $a$ and $d$ referring to cyber attack and defense respectively.

The CPS defense problem is then modeled as a two-player zero-sum game by which utilities of players are summed up to zero at each time step. The defender is represented by an actor-critic DRL algorithm. Simulation results demonstrate that the proposed method in [85] can learn an optimal strategy to timely and accurately defend the CPS from unknown cyber attacks.

Applications of CPS in critical safety domains such as autonomous automotive, chemical process, automatic pilot avionics, and smart grid require a certain correctness level. Akazaki et al. [86] proposed the use of DRL, i.e., double DQN and A3C algorithms, to find falsified inputs (counterexamples) for CPS models. This allows for effective yet automatic detection of CPS defects. Due to the infinite state space of CPS models, conventional methods such as simulated annealing [87] and cross entropy [88] were found inefficient. Experimental results show the superiority of the use of DRL algorithms against those methods in terms of the smaller number of simulation runs. This leads to a more practical detection process for CPS models’ defects despite the great complexity of CPS’s software and physical systems.

Autonomous vehicles (AVs) operating in the future smart cities require a robust processing unit of intra-vehicle sensors, including camera, radar, roadside smart sensors, and inter-vehicle beaconing. Such reliance is vulnerable to cyber-physical attacks aiming to get control of AVs by manipulating the sensory data and affecting the reliability of the system, e.g., increasing accident risks or reducing the vehicular flow. Ferdowsi et al. [89] examined the scenarios where the attackers manage to interject faulty data to the AV’s sensor readings while the AV (the defender) needs to deal with that problem to control AV robustly. Specifically, the car following model [90] is considered in which the focus is on autonomous control of a car that follows closely another car. The defender aims to learn the leading vehicle’s speed based on sensor readings. The attacker’s objective is to mislead the following vehicle to a deviation from the optimal safe spacing. The interactions between the attacker and defender are characterized by a game-theoretic problem. The interactive game structure and its DRL solution are diagrammed in Fig. 6. Instead of directly deriving a solution based on the mixed-strategy Nash equilibrium analytics, the authors proposed the use of DRL to solve this dynamic game. Long short term memory (LSTM) [91] is used to approximate the Q-function for both defending and attacking agents as it can capture the temporal dynamics of the environment.

Likewise, Rasheed et al. [92] introduced an adversarial DRL method that integrates LSTM and generative adversarial network (GAN) model to cope with data infusion attacks in autonomous vehicles equipped with 5G communication links. The adversary attempts to inject faulty data to impact safe distance spacing between autonomous vehicles while the autonomous vehicles manage to minimize this deviation. LSTM is used as a generator while a convolutional neural network (CNN) is used as a discriminator to resemble a GAN structure, which is able to capture previous temporal actions of the autonomous vehicle and attacker as well as previous distance deviations. A DRL algorithm is proposed based on these observations to select optimal actions (suitable velocity) for the autonomous vehicle to avoid collisions and accidents.

Autonomous systems can be vulnerable to inefficiency from various sources such as noises in communication channels, sensor failures, errors in sensor measurement readings, packet errors, and especially cyber attacks. Deception attack to autonomous systems is widespread as it is initiated by an adversary whose effort is to inject noises to the communication channels between sensors and the command center. This kind of attack leads to corrupted information being sent to the command center and eventually degrades the system performance. Gupta and Yang [93] studied the ways to increase the robustness of autonomous systems by allowing the system to learn using adversarial examples. The problem is formulated as a zero-sum game with the players to be the command center (observer) and the adversary. The inverted pendulum problem from Roboschool [67] is used as a simulation environment. The TRPO algorithm is employed to design an observer that can reliably detect adversarial attacks in terms of measurement corruption and automatically mitigate their effects.

III-B DRL-based Intrusion Detection Systems

To detect intrusions, security experts conventionally need to observe and examine audit data, e.g., application traces, network traffic flow, and user command data, to differentiate between normal and abnormal behaviors. However, the volume of audit data surges rapidly when the network size is enlarged. This makes manual detection difficult or even impossible. An intrusion detection system (IDS) is a software or hardware platform installed on host computers or network equipment to detect and report to the administrator abnormal or malicious activities by analysing the audit data. An intrusion detection and prevention system may be able to take appropriate actions immediately to reduce impacts of the malevolent activities.

Depending on different types of audit data, IDSs are grouped into two categories: host-based or network-based IDS. Host-based IDS typically observes and analyses the host computer’s log files or settings to discover anomalous behaviors. Network-based IDS relies on a sniffer to collect transmitting packets in the network and examines the traffic data for intrusion detection. Host-based systems normally lack cross-platform support and implementing them requires knowledge of the host operating systems and configurations. Network-based systems aim to monitor traffic over specific network segments, and they are independent of the operating systems and more portable than host-based systems. Implementing network-based systems is thus easier and they offer more monitoring power than host-based systems. However, a network-based IDS may have difficulty in handling heavy traffic and high-speed networks because it must examine every packet passing through its network segment.

Regardless of the IDS type, two common detection methods are used: signature-based and anomaly-based detection. Signature detection involves the storage of patterns of known attacks and comparing characteristics of possible attacks to those in the database. Anomaly detection observes the normal behaviors of the system and alerts the administrator if any activities are found deviated from normality, for instance, the unexpected increase of traffic rate, i.e., number of IP packets per second. Machine learning techniques, including unsupervised clustering and supervised classification methods, have been used widely to build adaptive IDSs [94, 95, 96, 97, 98]. These methods, e.g., neural networks [99], k-nearest neighbors [99, 100], support vector machine (SVM) [101, 99], random forest [102] and recently deep learning [103, 104, 105], however normally rely on fixed features of existing cyber attacks so that they are deficient in detecting new or deformed attacks. The lack of prompt responses to dynamic intrusions also leads to ineffective solutions produced by unsupervised or supervised techniques. In this regard, RL methods have been demonstrated effectively in various IDS applications [106]. The following subsections review the use of DRL methods in both host-based and network-based IDSs.

III-B1 Host-based IDS

As the volume of audit data and complexity of intrusion behaviors increase, adaptive intrusion detection models demonstrate limited effectiveness because they can only handle temporally isolated labeled or unlabeled data. In practice, many complex intrusions comprise temporal sequences of dynamic behaviors. Xu and Xie [107] proposed an RL-based IDS that can handle this problem. System call trace data are fed into a Markov reward process whose state value can be used to detect abnormal temporal behaviors of host processes. The intrusion detection problem is thus converted to a state value prediction task of the Markov chains. The linear temporal difference (TD) RL algorithm [108] is used as the state value prediction model where its outcomes are compared with a predetermined threshold to distinguish normal traces and attack traces. Instead of using the errors between real values and estimated ones, TD learning algorithm uses the differences between successive approximations to update the state value function. Experimental results obtained from using system call trace data show the dominance of the proposed RL-based IDS in terms of higher accuracy and lower computational costs compared to SVM, hidden Markov model, and other machine learning or data mining methods. The proposed method based on the linear basis functions, however, has a shortcoming when sequential intrusion behaviors are highly nonlinear. Therefore, a kernel-based RL approach using least-squares TD [109] was suggested for intrusion detection in [110, 111]. Relying on the kernel methods, the generalization capability of TD RL is enhanced, especially in high-dimensional and nonlinear feature spaces. The kernel least-squares TD algorithm is, therefore, able to predict anomaly probabilities accurately, which contributes to improving the detection performance of IDS, especially when dealing with multi-stage cyber attacks.

III-B2 Network-based IDS

Deokar and Hazarnis [112] pointed out the drawbacks of both anomaly-based and signature-based detection methods. On the one hand, anomaly detection has a high false alarm rate because it may categorize activities which users rarely perform as an anomaly. On the other hand, signature detection cannot discover new types of attacks as it uses a database of patterns of well-known attacks. The authors, therefore, proposed an IDS that can identify known and unknown attacks effectively by combining features of both anomaly and signature detection through the use of log files. The proposed IDS is based on a collaboration of RL methods, association rule learning, and log correlation techniques. RL gives a reward (or penalty) to the system when it selects log files that contain (or do not contain) anomalies or any signs of attack. This procedure enables the system to choose more appropriate log files in searching for traces of attack.

One of the most difficult challenges in the current Internet is dealing with the distributed denial-of-service (DDoS) threat, which is a DoS attack but has the distributed nature, occurring with a large traffic volume, and compromising a large number of hosts. Malialis and Kudenko [113, 114] initially introduced the multiagent router throttling method based on the SARSA algorithm [115] to address the DDoS attacks by learning multiple agents to rate-limit or throttle traffic towards a victim server. That method, however, has a limited capability in terms of scalability. They therefore further proposed the coordinated team learning design to the original multiagent router throttling based on the divide-and-conquer paradigm to eliminate the mentioned drawback. The proposed approach integrates three mechanisms, namely, task decomposition, hierarchical team-based communication, and team rewards, involving multiple defensive nodes across different locations to coordinately stop or reduce the flood of DDoS attacks. A network emulator is developed based on the work of Yau et al. [116] to evaluate throttling approaches. Simulation results show that the resilience and adaptability of the proposed method are superior to its competing methods, i.e., baseline router throttling and additive-increase/multiplicative-decrease throttling algorithms [116], in various scenarios with different attack dynamics. The scalability of the proposed method is successfully experimented with up to 100 RL agents, which has a great potential to be deployed in a large internet service provider network.

Alternatively, Bhosale et al. [117] proposed a multiagent intelligent system [118] using RL and influence diagram [119] to enable quick responses against the complex attacks. Each agent learns its policy based on local database and information received from other agents, i.e., decisions and events. Shamshirband et al. [120], on the other hand, introduced an intrusion detection and prevention system for wireless sensor networks (WSNs) based on a game theory approach and employed a fuzzy Q-learning algorithm [121, 122] to obtain optimal policies for the players. Sink nodes, a base station, and an attacker constitute a three-player game where sink nodes and base station are coordinated to derive a defense strategy against the DDoS attacks, particularly in the application layer. The IDS detects future attacks based on the fuzzy Q-learning algorithm that takes part in two phases: detection and defense (Fig. 7). The game commences when the attacker sends an overwhelming volume of flooding packets beyond a specific threshold as a DDoS attack to a victim node in the WSN. Using the low energy adaptive clustering hierarchy (LEACH), which is a prominent WSN protocol [123], the performance of the proposed method is evaluated and compared with that of existing soft computing methods. The results show the efficacy and viability of the proposed method in terms of detection accuracy, energy consumption and network lifetime.

In another approach, Caminero et al. [124] proposed a model, namely adversarial environment using RL, to incorporate the RL theory in implementing a classifier for network intrusion detection. A simulated environment is created where random samples drawn from a labelled network intrusion dataset are treated as RL states. The adversarial strategy is employed to deal with unbalanced datasets as it helps to avoid training bias via an oversampling mechanism and thus decrease classification errors for under-represented classes. Likewise, a study in [125] applied DRL methods such as DQN, double DQN (DDQN), policy gradient and actor-critic models for network intrusion detection. With several adjustments and adaptations, DRL algorithms can be used as a supervised approach to classifying labelled intrusion data. DRL policy network is simple and fast, which is suitable for online learning and rapid responses in modern data networks with evolving environments. Results obtained on two intrusion detection datasets show DDQN is the best algorithm among the four employed DRL algorithms. DDQN’s performance is equivalent and even better than many traditional machine learning methods in some cases. Recently, Saeed et al. [126] examined the existing multiagent IDS architectures, including several approaches that utilized RL algorithms. The adaptation capability of RL methods can help IDS to respond effectively to changes in the environments. However, optimal solution is not guaranteed because convergence of a multiagent system is hard to obtain.

III-C DRL-based Game Theory for Cyber Security

Traditional cyber security methods such as firewall, anti-virus software, or intrusion detection are normally passive, unilateral, and lagging behind dynamic attacks. Cyberspace involves various cyber components, and thus, reliable cyber security requires the consideration of interactions among these components. Specifically, the security policy applied to a component has a certain impact on the decisions taken by other components. Therefore, the decision space increases considerably, with many what-if scenarios when the system is large. Game theory has been demonstrated effectively in solving such large-scale problems because it can examine many scenarios to derive the best policy for each player [127, 128, 129, 130, 131]. The utility or payoff of a game player depends not only on its actions but also on other players’ activities. In other words, the efficacy of cyber defending strategies must take into account the attacker’s strategies and other network users’ behaviors. Game theory can model the conflict and cooperation between intelligent decision makers, resembling activities of cyber security problems, which involve attackers and defenders. This resemblance has enabled game theory to mathematically describe and analyze the complex behaviors of multiple competitive mechanisms. In the following, we present game theoretic models involving multiple DRL agents that characterize cyber security problems in different attacking scenarios, including jamming, spoofing, malware, and attacks in adversarial environments.

III-C1 Jamming attacks

Jamming attacks can be considered as a special case of DoS attacks, which are defined as any event that diminishes or eradicates a network’s capacity to execute its expected function [132, 133, 134]. Jamming is a serious attack in networking and has attracted a great interest of researchers who used machine learning or especially RL to address this problem, e.g., [135, 136, 137, 138, 139, 140, 141]. The recent development of deep learning has facilitated the use of DRL for jamming handling or mitigation. Xiao et al. [142] studied security challenges of the MEC systems and proposed an RL-based solution to provide secure offloading to the edge nodes against jamming attacks. MEC is a technique that allows cloud computing functions to take place at the edge nodes of a cellular network or generally of any network. This technology helps to decrease network traffic, reduce overhead and latency when users request to access contents that have been cached in the edges closer to the cellular customer. MEC systems, however, are vulnerable to cyber attacks because they are physically located closer to users and attackers with less secure protocols compared to cloud servers or database center. In [142], the RL methodology is used to select the defense levels and important parameters such as offloading rate and time, transmit channel and power. As the network state space is large, the authors proposed the use of DQN to handle high-dimensional data, as illustrated in Fig. 8. DQN uses a CNN to approximate the Q-function that requires high computational complexity and memory. To mitigate this disadvantage a transfer learning method named hotbooting technique is used. The hotbooting method helps to initialize weights of CNN more efficiently by using experiences that have been learned in similar circumstances. This reduces the learning time by avoiding random explorations at the start of each episode. Simulation results demonstrate that the proposed method is effective in terms of enhancing the security and user privacy of MEC systems and it can protect the systems in confronting with different types of smart attacks with low overhead.

On the other hand, Aref et al. [143] introduced a multiagent RL method to deal with anti-jamming communications in wideband autonomous cognitive radios (WACRs). WACRs are advanced radios that can sense the states of the radio frequency spectrum and network, and autonomously optimize its operating mode corresponding to the perceived states. Cognitive communication protocols, however, may struggle when there are unintentional interferences or malicious users who attempt to interrupt reliable communications by deliberate jamming. Each radio’s effort is to occupy the available common wideband spectrum as much as possible and avoid sweeping signal of a jammer that affects the entire spectrum band. The multiagent RL approach proposed in [143] learns an optimal policy for each radio to select appropriate sub-band, aiming to avoid jamming signals and interruptions from other radios. Comparative studies show the significant dominance of the proposed method against a random policy. A drawback of the proposed method is the assumption that the jammer uses a fixed strategy in responding to the WACRs strategies, although the jammer may be able to perform adaptive jamming with the cognitive radio technology. In [144], when the current spectrum sub-band is interfered by a jammer, Q-learning is used to optimally select a new sub-band that allows uninterrupted transmission as long as possible. The reward structure of the Q-learning agent is defined as the amount of time that the jammer or interferer takes to interfere with the WACR transmission. Experimental results using the hardware-in-the-loop prototype simulation show that the agent can detect the jamming patterns and successfully learns an optimal sub-band selection policy for jamming avoidance. The obvious drawback of this method is the use of Q-table with a limited number of environment states.

The access right to spectrum (or more generally resources) is the main difference between cognitive radio networks (CRNs) and traditional wireless technologies. RL in general or Q-learning has been investigated to produce optimal policy for cognitive radio nodes to interact with their radio-frequency environment [145]. Attar et al. [146] examined RL solutions against attacks on both CRN architectures, i.e., infrastructure-based, e.g., the IEEE 802.22 standard, and infrastructure-less, e.g., ad hoc CRN. The adversaries may attempt to manipulate the spectrum sensing process and cause the main sources of security threats in infrastructure-less CRNs. The external adversary node is not part of the CRN, but such attackers can affect the operation of an ad hoc CRN via jamming attacks. In an infrastructure-based CRN, an exogenous attacker can mount incumbent emulation or perform sensor-jamming attacks. The attacker can increase the local false-alarm probability to affect the decision of the IEEE 802.22 base station about the availability of a given band. A jamming attack can have both short-term and long-term effects. Wang et al. [147] developed a game-theoretic framework to battle against jamming in CRNs where each radio observes the status and quality of available channels and the strategy of jammers to make decisions accordingly. The CRN can learn optimal channel utilization strategy using minimax-Q learning policy [148], solving the problems of how many channels to use for data and to control packets along with the channel switching strategy. The performance of minimax-Q learning represented via spectrum-efficient throughput is superior to the myopic learning method, which gives high priority to the immediate payoff and ignores the environment dynamics as well as the attackers’ cognitive capability.

In CRNs, secondary users (SUs) are obliged to avoid disruptions to communications of primary users (PUs) and can only gain access to the licensed spectrum when it is not occupied by PUs. Jamming attacks are emergent in CRNs due to the opportunistic access of SUs as well as the appearance of smart jammers, which can detect the transmission strategy of SUs. Xiao et al. [149] studied the scenarios where a smart jammer aims to disrupt the SUs rather than PUs. The SUs and jammer, therefore, must sense the channel to check the presence of PUs before making their decisions. The constructed scenarios consist of a secondary source node supported by relay nodes to transmit data packets to secondary receiving nodes. The smart jammer can learn quickly the frequency and transmission power of SUs while SUs do not have full knowledge of the underlying dynamic environment. The interactions between SUs and jammer are modeled as a cooperative transmission power control game, and the optimal strategy for SUs is derived based on the Stackelberg equilibrium [150]. The aim of SU players is to select appropriate transmission powers to efficiently send data messages in the presence of jamming attacks. The jammer’s utility gain is the SUs’ loss and vice versa. RL methods, i.e., Q-learning [60] and WoLF-PHC [151], are used to model SUs as intelligent agents for coping with the smart jammer. WoLF-PHC stands for the combination of Win or Learn Fast algorithm and policy hill-climbing method. It uses a varying learning rate to foster convergence to the game equilibrium by adjusting the learning speed [151]. Simulation results show the improvement in the anti-jamming performance of the proposed method in terms of the signal to interference plus noise ratio (SINR). The optimal strategy achieved from the Stackelberg game can minimize the damage created by the jammer in the worst-case scenario.

Recently, Han et al. [152] introduced an anti-jamming system for CRNs using the DQN algorithm based on a frequency-spatial anti-jamming communication game. The game simulates an environment of numerous jammers that inject jamming signals to disturb the ongoing transmissions of SUs. The SU should not interfere with the communications of PUs and must defeat smart jammers. This communication system is two-dimensional that utilizes both frequency hopping and user mobility. The RL state is the radio environment consisting of PUs, SUs, jammers, and serving base stations/access points. The DQN is used to derive an optimal frequency hopping policy that determines whether the SU should leave an area of heavy jamming or choose a channel to send signals. Experimental results show the superiority of the DQN-based method against the Q-learning based strategy in terms of faster convergence rate, increased SINR, lower cost of defense, and improved utility of the SU. DQN with the core component CNN helps to speed the learning process of the system, which has a large number of frequency channels, compared with the benchmark Q-learning method.

To improve the work of Han et al. [152], Liu et al. [153] also proposed an anti-jamming communication system using a DRL method but having different and more extensive contributions. Specifically, Liu et al. [153] used the raw spectrum information with temporal features, known as spectrum waterfall [154] to characterize the environment state rather than using the SINR and PU occupancy as in [152]. Because of this, Liu et al.’s model does not necessitate prior knowledge about the jamming patterns and parameters of the jammer but rather uses the local observation data. This prevents the model from the loss of information and facilitates its adaptability to a dynamic environment. Furthermore, Liu et al.’s work does not assume that the jammer needs to take the same channel-slot transmission structure with the users as in [152]. The recursive CNN is utilized to deal with a complex infinite environment state represented by spectrum waterfall, which has a recursion characteristic. The model is tested using several jamming scenarios, which include the sweeping jamming, comb jamming, dynamic jamming, and intelligent comb jamming. A disadvantage of both Han et al. and Liu et al.’s methods is that they can only derive an optimal policy for one user, which inspires a future research direction focusing on multiple users’ scenarios.

III-C2 Spoofing attacks

Spoofing attacks are popular in wireless networks where the attacker claims to be another node using the faked identity such as media access control to gain access to the network illegitimately. This illegal penetration may lead to man-in-the-middle, or DoS attacks [155]. Xiao et al. [156, 157] modeled the interactions between the legitimate receiver and spoofers as a zero-sum authentication game and utilized Q-learning and Dyna-Q [158] algorithms to address the spoofing detection problem. The utility of receiver or spoofer is computed based on the Bayesian risk, which is the expected payoff in the spoofing detection. The receiver aims to select the optimal test threshold in PHY-layer spoofing detection while the spoofer needs to select an optimal attacking frequency. To prevent collisions, spoofers are cooperative to attack the receiver. Simulation and experimental results show the improved performance of the proposed methods against the benchmark method with a fixed test threshold. A disadvantage of the proposed approaches is that both action and state spaces are quantized into discrete levels, bounded within a specified interval, which may lead to locally optimal solutions.

III-C3 Malware attacks

One of the most challenging malwares of mobile devices is the zero-day attacks, which exploit publicly unknown security vulnerabilities, and until they are contained or mitigated, hackers might have already caused adverse effects on computer programs, data or networks [159, 160]. To avoid such attacks, the traces or log data produced by the applications need to be processed in real time. With limited computational power, battery life and radio bandwidth, mobile devices often offload specific malware detection tasks to security servers at the cloud for processing. The security server with powerful computational resources and more updated malware database can process the tasks quicker, more accurately, and then send a detection report back to mobile devices with less delay. The offloading process is, therefore, a key factor affecting the cloud-based malware detection performance. For example, if too many tasks are offloaded to the cloud server, there would be a radio network congestion that can lead to long detection delay. Wan et al. [161] enhanced the mobile offloading performance by improving the previously proposed game model in [162]. The Q-learning approach used in [162] to select optimal offloading rate suffers the curse of high-dimensionality when the network size is increased, or a large number of feasible offloading rates is available for selection. Wan et al. [161] thus advocated the use of hotbooting Q-learning and DQN, and showed the performance improvement in terms of malware detection accuracy and speed compared to the standard Q-learning. The cloud-based malware detection approach using DQN for selecting the optimal offloading rate is illustrated in Fig. 9.

III-C4 Attacks in adversarial environments

Traditional networks facilitate the direct communications between client application and server where each network has its switch control that makes the network reconfiguration task time-consuming and inefficient. This method is also disadvantageous because the requested data may need to be retrieved from more than one database involving multiple servers. Software-defined network is a next-generation networking technology as it can reconfigure the network adaptively. With the control being programmable with a global view of the network architecture, SDN can manage and optimize network resources effectively. RL has been demonstrated broadly in the literature as a robust method for SDN controlling, e.g., [163, 164, 165, 166, 167].

Although RL’s success in SDN controlling is abundant, the attacker may be able to falsify the defender’s training process if it is aware of the network control algorithm in an adversarial environment. To deal with this problem, Han et al. [168] proposed the use of adversarial RL to build an autonomous defense system for SDN. The attacker selects important nodes in the network to compromise, for example, nodes in the backbone network or the target subnet. By propagating through the network, the attacker attempts to eventually compromise the critical server while the defender prevents the server from being compromised and preserve as many unaffected nodes as possible. To achieve those goals, the RL defender takes four possible actions, consisting of “isolating”, “patching”, “reconnecting” and “migrating”. Two types of DRL agents are trained to model defenders, i.e., double DQN and A3C, to select appropriate actions given different network states. The reward is characterized based on the status of the critical server, the number of preserved nodes, migration costs, and the validity of the actions taken. That study considered the scenarios where attackers can penetrate the learning process of RL defender by flipping reward signs or manipulating states. These causative attacks poison the defender’s training process and cause it to perform sub-optimal actions. The adversarial training approach is applied to reduce the impact of poisoning attacks with its eminent performance demonstrated via several experiments using the popular network emulator Mininet [169].

In an adversarial environment, the defender may not know the private details of the attacker such as the type of attack, attacking target, frequency, and location. Therefore, the defender, for example, may allocate substantial resources to protect an asset that is not a target of the attacker. The defender needs to dynamically reconfigure defense strategies to increase the complexity and cost for the intruder. Zhu et al. [170] introduced a model where the defender and attacker can repeatedly change the defense and attack strategies. The defender has no prior knowledge about the attacker, such as launched attacks and attacking policies. However, it is aware of the attacker classes and can access to the system utilities, which are jointly contributed by the defense and attack activities. Two interactive RL methods are proposed for cyber defenses in [170], namely adaptive RL and robust RL. The adaptive RL handles attacks that have a diminishing exploration rate (non-persistent attacker) while the robust RL deals with intruders who have a constant exploration rate (persistent attacker). The interactions between defender and attacker are illustrated via the attack and defense cycles as in Fig. 10. The attackers and defenders do not take actions simultaneously but asynchronously. On the attack cycle, the attacker evaluates previous attacks before launching a new attack if necessary. On the defense cycle, after receiving an alert, the defender carries out a meta-analysis on the latest attacks and calculates the corresponding utility before deploying a new defense if needed. An advantage of this system model is that it does not assume any underlying model for the attacker but instead treats attack strategies as black boxes.

Alternatively, Elderman et al. [173] simulated cyber security problems in networking as a stochastic Markov game with two agents, one attacker, and one defender, with incomplete information and partial observability. The attacker does not know the network topology but attempts to reach and get access to the location that contains a valuable asset. The defender knows the internal network but does not see the attack types or position of intruders. This is a challenging cyber security game because a player needs to adapt its strategy to defeat the unobservable opponents [174]. Different algorithms, e.g., Monte Carlo learning, Q-learning, and neural networks are used to learn both defender and attacker. Simulation results show that Monte Carlo learning with the softmax exploration is the best method for learning both attacking and defending strategies. Neural network algorithms have a limited adversarial learning capability, and thus they are outperformed by Q-learning and Monte Carlo learning techniques. This simulation has a disadvantage that simplifies the real-world cyber security problem into a game of only two players with only one asset. In real practice, there can be multiple hackers simultaneously penetrating a server that holds valuable data. Also, a network may contain useful data in different locations instead of in a single location as simulated.

IV Discussions and Future Research Directions

DRL has emerged over recent years as one of the most successful methods of designing and creating human or even superhuman AI agents. Many of these successes have relied on the incorporation of DNNs into a framework of traditional RL to address complex and high-dimensional sequential decision-making problems. Applications of DRL algorithms, therefore, have been found in various fields, including IoT and cyber security. Computers and the Internet today play crucial roles in many areas of our lives, e.g., entertainment, communication, transportation, medicine, and even shopping. Lots of our personal information and important data are stored online. Even financial institutions, e.g., banks, mortgage companies, and brokerage firms, run their business online. Therefore, it is essential to have a security plan in place to prevent hackers from accessing our computer systems. This paper has presented a comprehensive survey of DRL methods and their applications to cyber security problems, with notable examples summarized in Table II. The adversarial environment of cyber systems has instigated various proposals of game theory models involving multiple DRL agents. We found that this kind of application occupies a major proportion of papers in the literature relating to DRL for cyber security problems.

IV-A Challenges and future work on applying DRL for CPS security solutions

An emerging area is the use of DRL for security solutions for cyber-physical systems [175, 176]. The large-scale and complex nature of CPSs, e.g., in environmental monitoring networks, electrical smart grid systems, transportation management network, and cyber manufacturing management system, require security solutions to be responsive and accurate. This has been addressed by various DRL approaches, e.g., TRPO algorithm [93], LSTM-Q-learning [89], double DQN, and A3C [86]. One of the great challenges in implementing DRL algorithms for CPS security solutions is the lack of realistic CPS simulations. For example, the work in [86] had to use the Matlab/Simulink CPS modelling and embed it into the OpenAI Gym environment. This implementation is expensive in terms of computational time due to the overhead caused by integrating the Matlab/Simulink CPS simulation in the OpenAI Gym library. More proper simulations of CPS models embedded directly in DRL-enabled environments are thus encouraged in a future work. Another common challenge in applying DRL algorithms is to transfer the trained policies from simulations to real-world environments. While simulations are cheap and safe for training DRL agents, the reality gap due to modelling impreciseness and errors make the transfer challenging. This is more critical for CPS modelling because of the complexity, dynamics and large scale of CPS. A research in this direction, i.e., sim-to-real transfer for DRL-based security solutions for CPS, is worth investigating as it can help to reduce time, costs and increase safety during training process of DRL agents, and eventually reduce costly mistakes when executing in real-world environments.

IV-B Challenges and future work on applying DRL for IDS

Although there have been a large number of applications of traditional RL methods for IDSs, there has been a small amount of work on DRL algorithms for this kind of application. This is probably because the integration of deep learning and RL methods has just been sustained very recently. The complexity and dynamics of intrusion detection problems are expected to be solved effectively by DRL methods, which combine the powerful representation learning and function approximation capabilities of deep learning and the optimal sequential decision-making capability of traditional RL. Applying DRL for IDS requires simulated or real intrusion environments for training agents interactively. This is a great challenge because using real environments for training is costly while simulated environments may be far from reality. Most of the existing studies on DRL for intrusion detection relied on game-based settings (e.g., Fig. 7) or labelled intrusion datasets. For example, the work in [125] used two datasets of labelled intrusion samples and adjusted the DRL machinery for it to work on these datasets in a supervised learning manner. This kind of application lacks a live environment and proper interactions between DRL agents and the environment. There is thus a gap for future research on creating more realistic environments, which are able to respond in real time to actions of the DRL agents and facilitate the full exploitation of the DRL’s capabilities to solve complex and sophisticated cyber intrusion detection problems. Furthermore, as host-based and network-based IDSs have both advantages and disadvantages, combining these systems could be a logical approach. DRL-based solutions for this kind of integrated system would be another interesting future study.

IV-C Exploring capabilities of model-based DRL methods

Most DRL algorithms used for cyber defense so far are model-free methods, which are sample inefficient as they require a large quantity of training data. These data are difficult to obtain in real cyber security practice. Researchers generally utilize simulators to validate their proposed approaches, but these simulators often do not characterize the complexity and dynamics of real cyber space of the IoT systems fully. Model-based DRL methods are more appropriate than model-free methods when training data are limitedly available because, with model-based DRL, it can be easy to collect data in a scalable way. Exploration of model-based DRL methods or the integration of model-based and model-free methods for cyber defense is thus an interesting future study. For example, function approximators can be used to learn a proxy model of the actual high-dimensional and possibly partial observable environment [177, 178, 179], which can be then employed to deploy planning algorithms, e.g., Monte-Carlo tree search techniques [180], to derive optimal actions. Alternatively, model-based and model-free combination approaches, such as model-free policy with planning capabilities [181, 182] or model-based lookahead search [31], can be used as they aggregate advantages of both methods. On the other hand, current literature on applications of DRL to cyber security often limits at discretizing the action space, which restricts the full capability of the DRL solutions to real-world problems. An example is the application of DRL for selecting optimal mobile offloading rates in [162, 161] where the action space has been discretized although a small change of the rate would primarily affect the performance of the cloud-based malware detection system. Investigation of methods that can deal with continuous action spaces in cyber environments, e.g., policy gradient and actor-critic algorithms, is another encouraging research direction.

IV-D Training DRL in adversarial cyber environments

AI can help defend against cyber attacks but can also facilitate dangerous attacks, i.e., offensive AI. Hackers can take advantages of AI to make attacks smarter and more sophisticated to bypass detection methods to penetrate computer systems or networks. For example, hackers may employ algorithms to observe normal behaviors of users and employ the users’ patterns to develop untraceable attacking strategies. Machine learning-based systems can mimic humans to craft convincing fake messages that are utilized to conduct large-scale phishing attacks. Likewise, by creating highly realistic fake video or audio messages based on AI advances (i.e., deepfakes [183]), hackers can spread false news in elections or manipulate financial markets [184]. Alternatively, attackers can poison the data pool used for training deep learning methods (i.e., machine learning poisoning) or attackers can manipulate the states or policies, falsify part of the reward signals in RL to trick the agent into taking sub-optimal actions, resulting in the agent being compromised [185]. These kinds of attacks are difficult to prevent, detect, and fight against as they are part of a battle between AI systems. Adversarial machine learning, especially supervised methods, have been used extensively in cyber security [186] but very few studies have been found on using adversarial RL [187]. Adversarial DRL or DRL algorithms trained in various adversarial cyber environments are worth comprehensive investigations as they can be a solution to battle against the increasingly complex offensive AI systems [188, 189, 190].

IV-E Human-machine teaming with human-on-the-loop models

With the support of AI systems, cyber security experts no longer examine a huge volume of attack data manually to detect and defend against cyber attacks. This has many advantages because the security teams alone cannot sustain the volume. AI-enabled defense strategies can be automated and deployed rapidly and efficiently but these systems alone cannot issue creative responses when new threats are introduced. Moreover, human adversaries are always behind the cybercrime or cyber warfare. Therefore, there is a critical need for human intellect teamed with machines for cyber defenses. The traditional human-in-the-loop model for human-machine integration struggles to adapt quickly with cyber defense system because autonomous agent carries out part of the task and need to halt to wait for human’s responses before completing the task. The modern human-on-the-loop model would be a solution for a future human-machine teaming cyber security system. This model allows agents to autonomously perform the task whilst humans can monitor and intervene operations of agents only when necessary. How to integrate human knowledge into DRL algorithms [191] under the human-on-the-loop model for cyber defense is an interesting research question.

IV-F Exploring capabilities of multiagent DRL methods

As hackers utilized more and more sophisticated and large-scale approach to attack computer systems and networks, the defense strategies need to be more intelligent and large-scale as well. Multiagent DRL is a research direction that can be explored to tackle this problem. Game theory models for cyber security reviewed in this paper have involved multiple agents but they are restricted at a couple of attackers and defenders with limited communication, cooperation and coordination among the agents. These aspects of multiagent DRL need to be investigated thoroughly in cyber security problems to enable an effective large-scale defense plan. Challenges of multiagent DRL itself then need to be addressed such as non-stationarity, partial observability, and efficient multiagent training schemes [192]. On the other hand, the RL methodology has been applied to deal with various cyber attacks, e.g. jamming, spoofing, false data injection, malware, DoS, DDoS, brute force, Heartbleed, botnet, web attack, and infiltration attack [193, 194, 195, 196, 197, 198]. However, recently emerged or new types of attacks have been largely unaddressed. One of these new types is the bit-and-piece DDoS attack. This attack injects small junk into legitimate traffic of over a large number of IP addresses so that it can bypass many detection methods as there is so little of it per address. Another emerging attack, for instance, is attacking from the computing cloud to breach systems of companies who manage IT systems for other firms or host other firms’ data on their servers. Alternatively, hackers can use quantum physics-based powerful computers to crack encryption algorithms that are currently used to protect various types of invaluable data [184]. Consequently, a future study on addressing these new types of attacks is encouraged.