🤖 AI Summary
This study addresses the challenge of complex and evolving cyberattacks in cloud environments by proposing an adaptive dynamic defense framework based on reinforcement learning. The work introduces, for the first time, a Deep Q-Network (DQN) into cloud security to establish an end-to-end intelligent intrusion detection and automated response loop. Leveraging feature engineering and data preprocessing, the model is trained on the CICIDS2017 dataset and validated on UNSW-NB15. Experimental results demonstrate that the system achieves 99.72% accuracy, a 99.66% F1-score, and a 0.999 ROC-AUC under previously unseen and evolving attacks, with a false positive rate of only 0.31%, an average detection latency of 15 ms, and an attack mitigation rate of 99.54%, thereby significantly enhancing real-time performance and generalization capability.
📝 Abstract
With the increasing complexity of cyber assaults in cloud environments, adaptable security solutions are needed that can support real-time detection and autonomous response. In this paper, we propose a reinforcement learning-based dynamic cyber defense framework. We deploy a Deep Q-Network (DQN) to train effective defensive strategies to counteract the evolving cyberattacks. We leverage the CICIDS2017 dataset for model creation and the UNSW-NB15 dataset for external validation, involving preprocessing of data, feature engineering, and adaptive policy learning. We compare the proposed DQN with decision tree, support vector machine, random forest, XGBoost, and multilayer perceptron models. The proposed DQN achieves an accuracy of 99.72%, a precision of 99.68%, a recall of 99.65%, an F1-score of 99.66%, and an ROC-AUC of 0.999, while the false positive rate is 0.31%, the false negative rate is 0.35%, and the detection latency is 15 ms. The framework achieved 99.54% attack mitigation rate, demonstrating strong adaptive and real-time defensive capabilities. These results demonstrate the potential of reinforcement learning as a powerful and scalable approach for autonomous cybersecurity in modern cloud environments.