Deep Reinforcement Learning based Ensemble Model for Intrusion Detection System

Abstract

Powered by advancements in information and Internet technologies, there has been a rapid development in network-based applications. Meanwhile, it is recognized that more attention needs to be paid to the issue of cybersecurity. The security of the network environment plays a vital role in the stable functioning of society. Cybersecurity research has become more active lately. Researchers have proposed several approaches to protect the network. Among them, a broadly practised approach is the intrusion detection system (IDS). This work suggested the potential value of reinforcement learning in building intrusion detection systems at the packet-level. A novel embedding approach has been proposed, namely image embedding, to encode the network traffics. Utilizing image encoding and raw network traffic, which are difficult to tackle by machine learning models, can be converted to images. Thus, the experiments applied convolutional neural networks. In addition, packets embedded in images are arranged in time order. In this way, it can integrate flow statistics with packet information and convert intrusion detection tasks to image-associated tasks. In this experiment, a Deep Q-Learning algorithm was selected for the ensemble with 1D-CNN and CNN and designed a training module and an interaction module. Experiments results indicate that the proposed RL-image-based approach can attain high performance on raw DDoS traffic provided by DDoS2019 and outperforms other traditional deep learning approaches.