A hybrid deep reinforcement learning framework for proactive cloud network intrusion detection using spatiotemporal feature learning

Abstract

Traditional signature-based and static machine-learning-based intrusion detection systems (IDSs) have limited ability to adapt to changing traffic characteristics, and dynamic cloud-based infrastructures are increasingly vulnerable to new and zero-day attacks. Given this drawback, this study aims to develop a hybrid deep reinforcement learning framework for proactive cloud-network intrusion detection, called ShieldDRLNet. It employs a convolutional neural network and a long short-term memory encoder to obtain a spatiotemporal traffic representation and uses a Double Deep Q-Network agent for adaptive sequential decision-making. It features a latency-aware reward function that optimizes the detection correctness, reduces false alarms, penalizes for missed attacks and optimizes the response time. Training stability is achieved by using experience replay and target network updates. Experiments conducted at CICIDS2017 demonstrate that the accuracy, precision, recall, and F1-score of ShieldDRLNet are 97.2%, 95.6%, 96.8%, and 96.2%, respectively, with an average end-to-end detection latency of 4.7 ms per traffic window. It achieves better performance than the classical machine-learning, deep-learning, Transformer and reinforcement-learning baselines, following a shared chronological evaluation protocol. The proposed components also contribute to and generalize the results of ablation, sensitivity and statistical analyses, as well as cross-dataset analyses with UNSW-NB15. The results provide an encouraging deployment-oriented solution to low latency and adaptive intrusion detection in dynamic cloud environments for ShieldDRLNet.