Knowledge Empowered Deep Reinforcement Learning to Prioritize Alerts Generated by Intrusion Detection Systems

Intrusion detection systems (IDS) produce a vast number of alerts, many of which are false positives. Hence prioritizing these alerts for investigation is essential. It is also crucial to consider the different levels of knowledge of the defender (who prioritize alerts) about the system for developing effective defense strategies in the context of cybersecurity. Recognizing the importance of varying knowledge levels for defenders, this paper introduces KNowledge empowered deep reinforcement learning for Alert Prioritization (KNAP). We propose three novel knowledge empowered DRL approaches by integrating KNAP with three actor-critic methods: (i) deep deterministic policy gradient based KNAP (D-KNAP), (ii) soft actor-critic based KNAP (S-KNAP), and (iii) twin delayed deep deterministic policy gradient based KNAP (T-KNAP). The interaction between DRL based attacker and defender is framed as a zero-sum game and the double oracle approach is used to obtain the mixed strategy Nash equilibrium (MSNE). As a key performance metric, we consider the defender’s loss i.e., the incapability of the defender in investigating the alerts generated by attacks. We present the performance of the proposed approaches across different levels of defender’s knowledge utilizing MQTT-IoT-IDS2020 and CSE-CIC-IDS2018 dataset along with Snort IDS. Our results show that T-KNAP reduces defender’s loss by 19.59% and 36.84% compared to S-KNAP and D-KNAP, respectively for the MQTT-IoT-IDS2020 dataset. Furthermore, for the CSE-CIC-IDS2018 dataset, it reduces defender’s loss by 33.87% compared to S-KNAP and by 35.17% compared to D-KNAP. Moreover, there is a substantial improvement in the results when compared with traditional alert prioritization techniques like Uniform and Snort.