MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacks

Abstract

With the continuous development of network technology and the increasing complexity of application scenarios, network attacks have become more diverse and covert, posing significant challenges to system security. Traditional network security measures often struggle to detect and respond to rapidly evolving attack patterns in real time. Therefore, there is an urgent need for a new detection technology that can dynamically assess risks and adapt to changing environments. The Markov Decision Process (MDP) offers an effective and interpretable approach to sequential decision-making, providing a novel method for automatic network attack detection. This study proposes an automatic detection model based on MDP, which dynamically analyzes network traffic and system behavior while continuously improving detection accuracy through adaptive learning strategies. To evaluate the model's effectiveness, multiple experiments were conducted in various scenarios, achieving a maximum detection accuracy of 94.3 %. The results demonstrate that the proposed MDP-based detection model offers significant advantages in detection accuracy, response speed, and adaptability to unknown attacks.