Detecting Network Intrusions Using a Confidence-Based Reward System

Abstract

Combining multiple intrusion detection technologies into a hybrid system has been recently proposed to improve the comprehensive intrusion detection capability. However, such a hybrid system is not always stronger than its component detectors. Getting different detection technologies to interoperate effectively and efficiently has become a major challenge when building operational intrusion detection systems (IDS's). In this paper, we propose a novel reward system model in order to increase the accuracy and reliability of hybrid IDS's. In particular, the proposed confidence-based reward system built within a reinforcement learning algorithm includes three components. Namely, a relative discount factor, a confidence extraction technique, and a unique reward computing algorithm. The preliminary case studies show that the proposed reward system has a potential to improve the anomaly detection accuracy, decrease false alarm rate, and improve adaptability to new network traffic.