Efficient Detection of Malicious Traffic Using a Decision Tree-Based Proximal Policy Optimisation Algorithm: A Deep Reinforcement Learning Malicious Traffic Detection Model Incorporating Entropy

• Published in: Entropy (Basel, Switzerland) Vol. 26; no. 8; p. 648
• Main Authors: Zhao, Yuntao, Ma, Deao, Liu, Wei
• Format: Journal Article
• Language: English
• Published: Switzerland MDPI AG 30.07.2024; MDPI
• Subjects: Accuracy; Algorithms; Classification; Cybersecurity; Cyberterrorism; Data mining; Datasets; Decision making; decision tree proximal policy optimisation; Decision trees; Deep learning; deep reinforcement learning; Denial of service attacks; Efficiency; Entropy; Entropy (Information theory); False alarms; Feature selection; Internet; Intrusion detection systems; Machine learning; malicious traffic detection; Malware; Mathematical optimization; network security; Neural networks; Optimization; Safety and security measures; Support vector machines; entropy; deep reinforcement learning; network security; malicious traffic detection; decision tree proximal policy optimisation
• ISSN: 1099-4300; 1099-4300
• DOI: 10.3390/e26080648

With the popularity of the Internet and the increase in the level of information technology, cyber attacks have become an increasingly serious problem. They pose a great threat to the security of individuals, enterprises, and the state. This has made network intrusion detection technology critically important. In this paper, a malicious traffic detection model is constructed based on a decision tree classifier of entropy and a proximal policy optimisation algorithm (PPO) of deep reinforcement learning. Firstly, the decision tree idea in machine learning is used to make a preliminary classification judgement on the dataset based on the information entropy. The importance score of each feature in the classification work is calculated and the features with lower contributions are removed. Then, it is handed over to the PPO algorithm model for detection. An entropy regularity term is introduced in the process of the PPO algorithm update. Finally, the deep reinforcement learning algorithm is used to continuously train and update the parameters during the detection process, and finally, the detection model with higher accuracy is obtained. Experiments show that the binary classification accuracy of the malicious traffic detection model based on the deep reinforcement learning PPO algorithm can reach 99.17% under the CIC-IDS2017 dataset used in this paper.