Multi-agent reinforcement learning for intrusion detection

Authors:
Arturo Servin;Daniel Kudenko
Affiliations:
Department of Computer Science, University of York, Heslington, York, United Kingdom;Department of Computer Science, University of York, Heslington, York, United Kingdom
Venue:
ALAMAS'05/ALAMAS'06/ALAMAS'07 Proceedings of the 5th , 6th and 7th European conference on Adaptive and learning agents and multi-agent systems: adaptation and multi-agent learning
Year:
2005

Citing 11
Cited 3

Learning in multiagent systems

Multiagent systems
Intrusion detection systems and multisensor data fusion

Communications of the ACM
Introduction to Reinforcement Learning

Introduction to Reinforcement Learning
A Roadmap of Agent Research and Development

Autonomous Agents and Multi-Agent Systems
Reinforcement Learning for 3 vs. 2 Keepaway

RoboCup 2000: Robot Soccer World Cup IV
Experience with EMERALD to Date

Proceedings of the Workshop on Intrusion Detection and Network Monitoring
Recent Advances in Hierarchical Reinforcement Learning

Discrete Event Dynamic Systems
Towards multisensor data fusion for DoS detection

Proceedings of the 2004 ACM symposium on Applied computing
A taxonomy of DDoS attack and DDoS defense mechanisms

ACM SIGCOMM Computer Communication Review
Cooperative Multi-Agent Learning: The State of the Art

Autonomous Agents and Multi-Agent Systems
Reinforcement learning for agents with many sensors and actuators acting in categorizable environments

Journal of Artificial Intelligence Research

Multi-Agent Reinforcement Learning for Intrusion Detection: A Case Study and Evaluation

MATES '08 Proceedings of the 6th German conference on Multiagent System Technologies
Review: Multi-agent systems for protecting critical infrastructures: A survey

Journal of Network and Computer Applications
An orchestration approach for unwanted Internet traffic identification

Computer Networks: The International Journal of Computer and Telecommunications Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

Intrusion Detection Systems (IDS) have been investigated for many years and the field has matured. Nevertheless, there are still important challenges, e.g., how an IDS can detect new and complex distributed attacks. To tackle these problems, we propose a distributed Reinforcement Learning (RL) approach in a hierarchical architecture of network sensor agents. Each network sensor agent learns to interpret local state observations, and communicates them to a central agent higher up in the agent hierarchy. These central agents, in turn, learn to send signals up the hierarchy, based on the signals that they receive. Finally, the agent at the top of the hierarchy learns when to signal an intrusion alarm. We evaluate our approach in an abstract network domain.