Multi-Agent Reinforcement Learning for Intrusion Detection: A Case Study and Evaluation

Arturo Servin, Daniel Kudenko

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

In this paper we propose a novel approach to train MultiAgent Reinforcement Learning (MARL) agents to cooperate to detect intrusions in the form of normal and abnormal states in the network. We present an architecture of distributed sensor and decision agents that learn how to identify normal and abnormal states of the network using Reinforcement Learning (RL). Sensor agents extract network-state information using tile-coding as a function approximation technique and send communication signals in the form of actions to decision agents. By means of an on line process, sensor and decision agents learn the semantics of the communication actions. In this paper we detail the learning process and the operation of the agent architecture. We also present tests and results of our research work in an intrusion detection case study, using a realistic network simulation where sensor and decision agents learn to identify normal and abnormal states of the network.

Original languageEnglish
Title of host publicationMULTIAGENT SYSTEM TECHNOLOGIES, PROCEEDINGS
EditorsR Bergmann, G Lindemann, S Kirn, M Pechoucek
Place of PublicationBERLIN
PublisherSpringer
Pages159-170
Number of pages12
Volume5244 LNAI
ISBN (Print)978-3-540-87804-9
Publication statusPublished - 2008
Event6th German Conference on Multiagent System Technologies - Kaiserslautern
Duration: 23 Sept 200826 Sept 2008

Conference

Conference6th German Conference on Multiagent System Technologies
CityKaiserslautern
Period23/09/0826/09/08

Keywords

  • ATTACKS

Cite this