A Hybrid Deep Reinforcement Learning Framework for Enhanced Cyber Threat Detection Using Supervised Ensemble Decision Fusion

Abstract

Conventional intrusion detection systems (IDSs) face increasing complexity in network traffic and unpredictable cyberattacks, particularly with fixed supervised classifiers and ambiguous observations. This study introduces DRL-ECTD (Deep Reinforcement Learning-Enhanced Cyber Threat Detector), a hybrid binary IDS that combines probability estimates from Random Forest (RF) and Artificial Neural Network (ANN) classifiers with a cost-sensitive decision-refinement mechanism using Deep Q-Network (DQN). High-confidence predictions are retained, while predictions within a preset uncertainty interval are passed to the DQN for secondary evaluation. Individual NSL-KDD records are treated as independent decision states, with DQN used for reinforcement-based refinement rather than temporal network-state modeling. On the NSL-KDD test set, DRL-ECTD achieved 78.6% accuracy, 80.4% precision, 76.3% recall, 78.3% F1-score, and 0.988 AUC. The ANN baseline achieved slightly higher accuracy (79.2%) and F1 score (79.1%). DRL-ECTD outperforms the other tested models in accuracy and F1-score and the baseline RF and standalone DQN in precision. SHAP was used for feature attribution and model interpretation. A proof-of-concept Flask service interface demonstrated deployment feasibility, although latency, throughput, computational overhead, and resource utilization were not experimentally benchmarked. The results provide initial insights into hybrid confidence-based decision refinement and motivate further experiments with multiple classes, temporal order, and deployment for intrusion detection.