Multi-Agent Reinforcement Learning for Intrusion Detection: A Case Study and Evaluation

TY - GEN

T1 - Multi-Agent Reinforcement Learning for Intrusion Detection: A Case Study and Evaluation

AU - Servin, Arturo

AU - Kudenko, Daniel

PY - 2008

Y1 - 2008

N2 - In this paper we propose a novel approach to train MultiAgent Reinforcement Learning (MARL) agents to cooperate to detect intrusions in the form of normal and abnormal states in the network. We present an architecture of distributed sensor and decision agents that learn how to identify normal and abnormal states of the network using Reinforcement Learning (RL). Sensor agents extract network-state information using tile-coding as a function approximation technique and send communication signals in the form of actions to decision agents. By means of an on line process, sensor and decision agents learn the semantics of the communication actions. In this paper we detail the learning process and the operation of the agent architecture. We also present tests and results of our research work in an intrusion detection case study, using a realistic network simulation where sensor and decision agents learn to identify normal and abnormal states of the network.

AB - In this paper we propose a novel approach to train MultiAgent Reinforcement Learning (MARL) agents to cooperate to detect intrusions in the form of normal and abnormal states in the network. We present an architecture of distributed sensor and decision agents that learn how to identify normal and abnormal states of the network using Reinforcement Learning (RL). Sensor agents extract network-state information using tile-coding as a function approximation technique and send communication signals in the form of actions to decision agents. By means of an on line process, sensor and decision agents learn the semantics of the communication actions. In this paper we detail the learning process and the operation of the agent architecture. We also present tests and results of our research work in an intrusion detection case study, using a realistic network simulation where sensor and decision agents learn to identify normal and abnormal states of the network.

KW - ATTACKS

UR - http://www.scopus.com/inward/record.url?scp=56549099237&partnerID=8YFLogxK

M3 - Conference contribution

SN - 978-3-540-87804-9

VL - 5244 LNAI

SP - 159

EP - 170

BT - MULTIAGENT SYSTEM TECHNOLOGIES, PROCEEDINGS

A2 - Bergmann, R

A2 - Lindemann, G

A2 - Kirn, S

A2 - Pechoucek, M

PB - Springer

CY - BERLIN

T2 - 6th German Conference on Multiagent System Technologies

Y2 - 23 September 2008 through 26 September 2008

ER -