A Transferable and Automatic Tuning of Deep Reinforcement Learning for Cost Effective Phishing Detection

TL;DR

This paper introduces a method for automatically tuning and transferring deep reinforcement learning policies for cost-effective phishing detection, addressing challenges in configuration, adaptability, and robustness against attacks.

Contribution

It proposes a transferable and automatic tuning approach for DRL policies, improving performance calibration and robustness in phishing detection tasks.

Findings

Effective transfer of security policies across datasets

Enhanced robustness against adversarial attacks

Improved calibration of DRL-based detection performance

Abstract

Many challenging real-world problems require the deployment of ensembles multiple complementary learning models to reach acceptable performance levels. While effective, applying the entire ensemble to every sample is costly and often unnecessary. Deep Reinforcement Learning (DRL) offers a cost-effective alternative, where detectors are dynamically chosen based on the output of their predecessors, with their usefulness weighted against their computational cost. Despite their potential, DRL-based solutions are not widely used in this capacity, partly due to the difficulties in configuring the reward function for each new task, the unpredictable reactions of the DRL agent to changes in the data, and the inability to use common performance metrics (e.g., TPR/FPR) to guide the algorithm's performance. In this study we propose methods for fine-tuning and calibrating DRL-based policies so that they can meet multiple performance goals. Moreover, we present a method for transferring effective security policies from one dataset to another. Finally, we demonstrate that our approach is highly robust against adversarial attacks.