Multi-agent Reinforcement Learning-based Network Intrusion Detection System

TL;DR

This paper introduces a multi-agent reinforcement learning-based network intrusion detection system that adapts to evolving attack patterns, handles class imbalance effectively, and outperforms current methods in detection accuracy and false positive reduction.

Contribution

The paper presents a novel multi-agent RL architecture with improved DQN and cost-sensitive learning for robust, adaptive intrusion detection.

Findings

Effective handling of class imbalance in intrusion detection

Superior detection rate compared to state-of-the-art methods

Low false positive rate achieved on CIC-IDS-2017 dataset

Abstract

Intrusion Detection Systems (IDS) play a crucial role in ensuring the security of computer networks. Machine learning has emerged as a popular approach for intrusion detection due to its ability to analyze and detect patterns in large volumes of data. However, current ML-based IDS solutions often struggle to keep pace with the ever-changing nature of attack patterns and the emergence of new attack types. Additionally, these solutions face challenges related to class imbalance, where the number of instances belonging to different classes (normal and intrusions) is significantly imbalanced, which hinders their ability to effectively detect minor classes. In this paper, we propose a novel multi-agent reinforcement learning (RL) architecture, enabling automatic, efficient, and robust network intrusion detection. To enhance the capabilities of the proposed model, we have improved the DQN algorithm by implementing the weighted mean square loss function and employing cost-sensitive learning techniques. Our solution introduces a resilient architecture designed to accommodate the addition of new attacks and effectively adapt to changes in existing attack patterns. Experimental results realized using CIC-IDS-2017 dataset, demonstrate that our approach can effectively handle the class imbalance problem and provide a fine grained classification of attacks with a very low false positive rate. In comparison to the current state-of-the-art works, our solution demonstrates a significant superiority in both detection rate and false positive rate.