Adversarial Asymmetric Agents for Network Intrusion Detection Using Deep Reinforcement Learning

Abstract

Machine learning-based network intrusion detection systems (NIDS) increasingly operate in environments where adversaries can adapt their behavior in response to deployed defenses. However, most empirical IDS studies evaluate defenders against static, dataset-defined attack distributions and do not explicitly model an adaptive attacker with a distinct learning strategy or action space. This study proposes an adversarial asymmetric learning framework for intrusion detection in which an attacker agent dynamically selects network attacks while a defender agent classifies observed network flows. We evaluate three attacker–defender pairings derived from supervised deep neural network (DNN) and Deep Q-Network (DQN) agent types. We report accuracy, precision, recall, F1-score, and G-Mean under stratified 10-fold cross validation across traditional local area network, industrial control system (ICS)/supervisory control and data acquisition (SCADA), and internet-of-things (IoT) networking environments. Empirically, the network-flow classifier performs best when paired with an intelligent attacker using reinforcement learning, even when the defender itself is not reinforcement-learning based. Overall, the results show that learning asymmetry and multiagent interaction can substantially alter measured detection outcomes and that supervised defenders remain highly competitive in the presence of intelligent adversarial agents.