用强化学习提升入侵检测，准确率达99.68%
Dueling Deep Q-Learning for Intrusion Detection
- 采用双流Q-learning架构，分离价值与优势预测
- 在CIC-IDS2018数据集上平均准确率99.68%
- 结合SHAP实现模型决策可解释性
入侵检测系统（IDS）通常依赖监督学习方法，但难以适应新攻击类型。本文提出一种基于奖励机制的双流深度Q学习模型，用于入侵检测，在包含拒绝服务、僵尸网络和暴力破解等多种攻击类别的真实场景数据集CIC-IDS2018上，实现了平均99.68%的准确率。该模型采用双流网络结构，将预测结果分为价值和优势两个分支，提升了学习效率与稳定性。同时，引入可解释人工智能（XAI）中的SHAP方法，增强模型决策过程的透明度。
原文摘要 · Abstract (English)
Intrusion detection systems (IDS) and automated systems for detecting and reporting cyber threats, are commonly handled via supervised machine learning methods. Though effective, these models struggle to effectively adapt to new attack types. This study proposes a novel approach by employing a reward-based, dueling Q-learning model for IDS, achieving an average accuracy of 99.68% across multiple attack classes. The proposed model has a dueling network architecture which separates its predictions into value and advantage streams. This has the benefit of improving learning efficiency and stability. The model was trained on the CIC-IDS2018, a benchmark dataset based on real-world intrusion detection scenarios, having multiple attack classes such as DDoS, botnets, and brute-force attacks. Furthermore, Explainable AI (XAI), specifically SHAP (SHapley Additive exPlanations), was also integrated into the training and evaluation process to provide interpretability into the model's predictions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。