Zero-day attacks exploit vulnerabilities that have not been detected before and therefore do not pose a problem for existing signature-based intrusion detection systems, as they lack established attack patterns. Although machine learning-based detection has improved, current methods are not flexible enough to handle new threats and have high false-positive rates. In this paper, a Deep Reinforcement Learning (DRL) framework is proposed to design a zero-day attack detection system as a Markov Decision Process (MDP) that supports adaptive learning without using any attack signatures. We apply and compare three DRL algorithms, Deep Q-Network (DQN), Proximal Policy Optimization (PPO), and Advantage Actor-Critic (A2C), with a new feature engineering method that combines Principal Component Analysis with Information Gain selection. The framework is tested on various benchmark datasets (NSL-KDD, CICIDS2017, CIC-AndMal2017) and a specially created dataset of zero-day attacks in the context of the present research. Most experimental findings show that the DQN model attains 91.7% accuracy and 83.4% detection rate over previously unseen attacks, 14.7% and 8.9% better than traditional machine learning and deep learning baselines, respectively. A study of ablation indicates that the exploration strategy plays a critical role in zero-day detection, with its removal resulting in a 10.2% reduction in detection rates. The suggested framework offers greater flexibility against different types of attacks while maintaining a lower false-positive rate (8.2%) than traditional methods. The work contributes to the development of cybersecurity defense functions by demonstrating that DRL is a useful paradigm for detecting unknown threats in dynamic network settings.
原文链接
分享
引用
