Multi-critic Deep Reinforcement Learning for Enhanced Alert Prioritization in Intrusion Detection Systems
摘要
Intrusion detection systems (IDSs) are crucial for cybersecurity professionals and organizations as they provide real time detection of malicious activities. However, IDSs like Snort and Suricata generate vast numbers of alerts daily, many of which are false positives. This makes it challenging for security operation centers (SOCs) to quickly investigate critical alerts. Therefore, it is crucial to prioritize these alerts for investigation. Recently, various deep reinforcement learning (DRL) based actor-critic methods, such as deep deterministic policy gradient (DDPG-AP), soft actor-critic (SAC-AP), and twin delayed deep deterministic policy gradient (TD3-AP), have been proposed for alert prioritization. However, all these approaches are susceptible to overestimation bias, which negatively impacts model performance by leading the agent to overvalue certain actions. As a result, the model may select suboptimal actions, leading to inefficient learning. In this paper, we introduce a novel DRL actor-critic approach for efficient alert prioritization called the Multi-critic Delayed Deep Deterministic policy gradient for Alert Prioritization (MD3-AP). By incorporating multiple critic networks, MD3-AP reduces overestimation bias and improves the performance of traditional actor-critic approaches. We evaluate the performance of the proposed approach using two datasets, MQTT-IoT-IDS2020 and CSE-CIC-IDS2018, and compare them with various state-of-the-art methods. The results show that MD3-AP surpasses TD3-AP by 22.56%, SAC-AP by 33.92%, and DDPG-MIX by 35.39%. Furthermore, MD3-AP demonstrates significantly greater improvements compared to traditional alert prioritization methods such as RAP, Fuzmet, Uniform, and Snort.