A reinforcement learning-based intrusion detection system for internet of things with zero-day resilience

Abstract

The conventional intrusion detection systems (IDS) are often found to be ineffective when faced with zero-day attacks that are novel compared to previously learned behavior patterns. This paper presents the development of a robust and adaptive IDS for the internet of things (IoT) using a deep Q-network (DQN) agent. A custom environment is designed in which state abstraction is applied to convert high-dimensional feature vectors into discrete state spaces. The proposed agent model is trained to detect normal and malicious traffic using a reward and penalty mechanism to encourage the agent to take correct decisions. The validation of the proposed methodology is carried out using the UNSW-NB15 dataset under both known attack and zero-day attack scenarios. The results showed detection accuracies of 99.56% for known attacks and 99.11% for zero-day attacks.