Reinforcement-Learning Based Network Intrusion Detection with Human Interaction in the Loop

Abstract

With the rapid explosion of Internet traffic volume and the continuous evolution of cyber-attack technology, existing network intrusion detection mechanisms are confronted with growing threats of more sophisticated attack traffic. Continuous recognition and modeling of new attack patterns on-the-fly are desired with human-aided automated learning. Numerous learning-based intrusion detection methods have been put forward in recent years, but the traditional data-training-testing-iterating based machine learning procedure really lacks involvement of human intelligence and instant feedbacks when being applied in the ambiguous and volatile network intrusion traffic. This paper proposes a novel approach for learning-based intrusion detection based on interactive reinforcement learning with human experience and interaction in the loop. We first transform the process of intrusion detection into a general Markov Decision Process. Then the interactive human input as manually labeling the observed network traffic occasionally is introduced into the modeling interactions to accelerate the model convergence. We customize a hybrid structure of the Q-network for such interactive network intrusion detection with Long Short-Term Memory incorporated into deep reinforcement learning. Experimental results on the NSL-KDD dataset show that the proposed modeling and detection solution achieves significantly higher precision and recall rates compared with previous learning-based detection mechanisms, with continuous model optimization by human intelligent interactions.