A Survey for Deep Reinforcement Learning Based Network Intrusion Detection

Abstract

Cyber-attacks are gradually becoming more sophisticated and highly frequent nowadays, and the significance of network intrusion detection systems has become more pronounced. This paper investigates the prospects and challenges of employing deep reinforcement learning technologies in network intrusion detection. It begins with an introduction to the fundamental theories and technological frameworks of deep reinforcement learning including classic deep Q-network and actor-critic algorithms, followed by a review of essential research that has leveraged deep reinforcement learning for network intrusion detection in recent years. This research assesses these challenges and efforts in terms of model training efficiency, the detection capabilities for minority and unknown class attacks, improved network feature selection and unbalanced dataset issues. Performances of deep reinforcement learning models are comprehensively investigated. The findings reveal that although deep reinforcement learning shows promise in network intrusion detection, many of the latest deep reinforcement learning technologies are yet to be fully explored. Some deep reinforcement learning based models can achieve state-of-the-art results in some public datasets, in some cases, even better than traditional deep learning methods. The paper concludes with recommendations for the enhanced deployment and testing of deep reinforcement learning technologies in real-world network scenarios to further improve their application. Special emphasis is placed on the Internet of Things intrusion detection. We offer discussions on recently proposed deep architectures, revealing possible future policy functions used for deep reinforcement learning based network intrusion detection. In the end, we propose integrating deep reinforcement learning and broader generative methods and models to assist and further improve their performance. These advancements aim to address the current gaps and facilitate more robust and adaptive network intrusion detection systems.