Efficient Detection of Malicious Traffic Using a Decision Tree-Based Proximal Policy Optimisation Algorithm: A Deep...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Intrusion Detection

Background:

• Cyber attacks pose significant threats to individuals, enterprises, and states.
• The increasing reliance on the internet necessitates advanced network intrusion detection technologies.

Purpose of the Study:

• To construct a malicious traffic detection model.
• To enhance the accuracy and efficiency of network intrusion detection systems.

Main Methods:

• Utilized a decision tree classifier based on information entropy for feature selection.
• Implemented a deep reinforcement learning Proximal Policy Optimization (PPO) algorithm for detection.
• Introduced an entropy regularity term within the PPO algorithm for improved updates.

Main Results:

• The developed model achieved a binary classification accuracy of 99.17% on the CIC-IDS2017 dataset.
• Feature importance scores from the decision tree were used to remove less contributing features.
• Continuous training and parameter updates by the deep reinforcement learning algorithm led to a highly accurate detection model.

Conclusions:

• The integration of decision trees and Proximal Policy Optimization (PPO) offers a powerful approach for malicious traffic detection.
• The proposed model demonstrates superior performance in identifying network intrusions.
• This method significantly advances the field of network security and threat detection.