Multi-agent Reinforcement Learning for Intrusion Detection

Arturo Servin; Daniel Kudenko

doi:10.1007/978-3-540-77949-0_15

Multi-agent Reinforcement Learning for Intrusion Detection

Arturo Servin, Daniel Kudenko

Computer Science

Research output: Contribution to conference › Paper › peer-review

Abstract

Intrusion Detection Systems (IDS) have been investigated for many years and the field has matured. Nevertheless, there are still important challenges, e.g., how an IDS can detect new and complex distributed attacks. To tackle these problems, we propose a distributed Reinforcement Learning (RL) approach in a hierarchical architecture of network sensor agents. Each network sensor agent learns to interpret local state observations, and communicates them to a central agent higher up in the agent hierarchy. These central agents, in turn, learn to send signals up the hierarchy, based on the signals that they receive. Finally, the agent at the top of the hierarchy learns when to signal an intrusion alarm. We evaluate our approach in an abstract network domain.

Original language	Undefined/Unknown
Pages	211-223
DOIs	https://doi.org/10.1007/978-3-540-77949-0_15
Publication status	Published - 2007

Access to Document

10.1007/978-3-540-77949-0_15

http://dx.doi.org/10.1007/978-3-540-77949-0_15

Cite this

@conference{d33507adda5b4b028f8909354281c3d4,

title = "Multi-agent Reinforcement Learning for Intrusion Detection",

abstract = "Intrusion Detection Systems (IDS) have been investigated for many years and the field has matured. Nevertheless, there are still important challenges, e.g., how an IDS can detect new and complex distributed attacks. To tackle these problems, we propose a distributed Reinforcement Learning (RL) approach in a hierarchical architecture of network sensor agents. Each network sensor agent learns to interpret local state observations, and communicates them to a central agent higher up in the agent hierarchy. These central agents, in turn, learn to send signals up the hierarchy, based on the signals that they receive. Finally, the agent at the top of the hierarchy learns when to signal an intrusion alarm. We evaluate our approach in an abstract network domain. ",

author = "Arturo Servin and Daniel Kudenko",

year = "2007",

doi = "10.1007/978-3-540-77949-0_15",

language = "Undefined/Unknown",

pages = "211--223",

}

TY - CONF

T1 - Multi-agent Reinforcement Learning for Intrusion Detection

AU - Servin, Arturo

AU - Kudenko, Daniel

PY - 2007

Y1 - 2007

N2 - Intrusion Detection Systems (IDS) have been investigated for many years and the field has matured. Nevertheless, there are still important challenges, e.g., how an IDS can detect new and complex distributed attacks. To tackle these problems, we propose a distributed Reinforcement Learning (RL) approach in a hierarchical architecture of network sensor agents. Each network sensor agent learns to interpret local state observations, and communicates them to a central agent higher up in the agent hierarchy. These central agents, in turn, learn to send signals up the hierarchy, based on the signals that they receive. Finally, the agent at the top of the hierarchy learns when to signal an intrusion alarm. We evaluate our approach in an abstract network domain.

AB - Intrusion Detection Systems (IDS) have been investigated for many years and the field has matured. Nevertheless, there are still important challenges, e.g., how an IDS can detect new and complex distributed attacks. To tackle these problems, we propose a distributed Reinforcement Learning (RL) approach in a hierarchical architecture of network sensor agents. Each network sensor agent learns to interpret local state observations, and communicates them to a central agent higher up in the agent hierarchy. These central agents, in turn, learn to send signals up the hierarchy, based on the signals that they receive. Finally, the agent at the top of the hierarchy learns when to signal an intrusion alarm. We evaluate our approach in an abstract network domain.

U2 - 10.1007/978-3-540-77949-0_15

DO - 10.1007/978-3-540-77949-0_15

M3 - Paper

SP - 211

EP - 223

ER -