Research And Application Of Deep Reinforcement Learning In Network Traffic Detection

Network intrusion detection system is a network security system that actively defends against attacks.It is an important part of the field of network security research.According to the detection principle,it is divided into abuse detection and anomaly detection.Abuse detection is based on known attacks and lacks adaptability to unknown attacks on the system,resulting in a high false negative rate.Anomaly detection is based on the normal behavior model of the network and system,and the purpose is to reduce the false positive and false negative rate of intrusion detection.There are many methods based on anomaly detection,including statistical analysis,Bayesian network,neural network,data mining,genetic algorithm,etc.The research in this paper is based on anomaly detection.This article provides an introduction to the background of deep reinforcement learning algorithms.Then,the application method of reinforcement learning in network intrusion detection system and the limitation of single-agent reinforcement learning are introduced.Taking this problem as an entry point,this paper proposes a multi-agent collaborative reinforcement learning model,called Major-Minor-RL,to improve detection efficiency.The model consists of a main agent Major Agent)and several minor agents(Minor agent).The role of the primary agent is to predict whether the traffic is normal or not,while the secondary agent plays an auxiliary role to help the primary agent correct the situation where its prediction is wrong.The final prediction result is based on the prediction result of the main agent in most cases,but if the prediction result of the main agent is different from the prediction result of most secondary agents,the final prediction result will be determined by the secondary agent.In order to prove the usability and correctness of the model proposed in this paper,this paper uses the model to train on the NSL-KDD dataset,and compares the trained model with the existing model.The proposed algorithm is more accurate than the baseline algorithm.,F1 value,precision rate and recall rate have been greatly improved.In order to further improve the accuracy of the model and other indicators,this paper conducts an in-depth analysis of the characteristics of the data set,and divides the characteristics into four categories.Based on this,some adjustments and improvements are made to the model to allow Each sub-agent covers a large category of features and discusses them through experiments.Although the training time has increased,various evaluation indicators have been improved.