Powered by OpenAIRE graph
Found an issue? Give us feedback
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/ ZENODOarrow_drop_down
image/svg+xml art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos Open Access logo, converted into svg, designed by PLoS. This version with transparent background. http://commons.wikimedia.org/wiki/File:Open_Access_logo_PLoS_white.svg art designer at PLoS, modified by Wikipedia users Nina, Beao, JakobVoss, and AnonMoos http://www.plos.org/
ZENODO
Article
Data sources: ZENODO
addClaim

DEEP REINFORCEMENT LEARNING FOR PROACTIVE CYBERSECURITY THREAT DETECTION

Authors: DR. NAIM SHAIKH, DR. VIVEK VEERAIAH, DR. A.PANKAJAM, DR. TARUN DALAL, DR. MAMATHA G, DR. G. NAGESWARA RAO, DR. VINOD MOTIRAM RATHOD, DR. TRIPTI SHARMA;

DEEP REINFORCEMENT LEARNING FOR PROACTIVE CYBERSECURITY THREAT DETECTION

Abstract

The proliferation of interconnected ecosystems, encompassing cloud infrastructures, IoT networks, and 5G platforms, has facilitated the execution of cyberattacks. Consequently, systems are increasingly susceptible to intricate, adaptive attacks. Reactive security measures, such as signature-based IDS and conventional machine learning models, are ineffective until an attack has already occurred. This deficiency stems from their inability to predict and mitigate threats characterised by aggressive evasion, cognitive wander, and evolving assault methodologies. Furthermore, the expansion of digitally linked systems has exacerbated vulnerabilities to sophisticated cyberattacks. Traditional cybersecurity protocols typically identify threats only post-incident. In the field of cybersecurity, a shift towards proactive and adaptive approaches is necessary due to AI's limitations, even if AI enhances pattern recognition. In contrast to conventional reactive methods, this research demonstrates the potential of DRL to build a proactive system for danger identification that can adapt in real-time to new threats. To tackle these issues, we provide DRL-PRoTECT, a new proactive cybersecurity approach that combines deep reinforcement learning with existing methods. The system is able to autonomously detect and mitigate threats in real-time thanks to its hierarchical DRL decision engine, predictive anomaly scoring, and self-supervised representation learning. Results on enterprise-scale systems, NSL-KDD, and UNSW-NB15 show that DRL-PRoTECT outperforms traditional IDS, ML/DL benchmarks, and virtual testbeds. With an F1 score of 94.5%, a false positive rate of 2.8%, and a recall rate of 93.7%, the framework accomplished its goals. The technology also reduced the time needed to identify threats by half. Its ability to adapt allowed it to keep working well despite changing priorities, new types of attacks, and attempts to bypass it. Analysts found that including a human-in-the-loop orchestrator made it easier and less demanding to stay alert. This led to better understanding, compliance, and trust. The results suggest that DRL-PRoTECT could help move cybersecurity defences from a detection-focused approach to a more proactive, self-sufficient, and resilient one. In response to changing threats, this article presents a proactive and scalable cybersecurity model that automatically shifts from detection to defense.

Powered by OpenAIRE graph
Found an issue? Give us feedback