DRL-GAN: A Hybrid Approach for Binary and Multiclass Network Intrusion Detection

TL;DR

This paper introduces a hybrid intrusion detection approach combining GAN-generated synthetic data with deep reinforcement learning, improving detection of rare attack types in network security.

Contribution

It presents a novel method that uses GANs to generate synthetic data for training DRL models, enhancing minority class detection in intrusion detection systems.

Findings

Synthetic data improves minority class classification accuracy.

Hybrid GAN-DRL approach outperforms traditional methods.

Better detection of rare network attacks.

Abstract

Our increasingly connected world continues to face an ever-growing amount of network-based attacks. Intrusion detection systems (IDS) are an essential security technology for detecting these attacks. Although numerous machine learning-based IDS have been proposed for the detection of malicious network traffic, the majority have difficulty properly detecting and classifying the more uncommon attack types. In this paper, we implement a novel hybrid technique using synthetic data produced by a Generative Adversarial Network (GAN) to use as input for training a Deep Reinforcement Learning (DRL) model. Our GAN model is trained with the NSL-KDD dataset for four attack categories as well as normal network flow. Ultimately, our findings demonstrate that training the DRL on specific synthetic datasets can result in better performance in correctly classifying minority classes over training on the true imbalanced dataset.