Maximum Entropy Inverse RL for Cyber Attack Detection in IoT Networks

Authors:
Open Access
Publisher website
Google Scholar
Abstract
The proliferation of Internet of Things (IoT) devices has significantly expanded the attack surface for cyber threats, making effective intrusion detection systems (IDS) critical for network security. Traditional anomaly detection methods often struggle with high-dimensional network traffic data and evolving attack patterns. This paper presents a novel approach for cyber attack detection using Maximum Entropy Inverse Reinforcement Learning (MaxEnt IRL). The proposed method learns reward functions from normal network traffic patterns, enabling the identification of anomalous behaviors that deviate from expected normal operations. By leveraging the maximum entropy principle, the approach captures the underlying distribution of normal traffic states without requiring labeled attack samples during training. The study evaluates the performance with multiple attack types, including Distributed Denial of Service (DDoS), Address Resolution Protocol (ARP) poisoning, and Message Queue Telemetry Transport (MQTT) based attacks. Comprehensive experiments demonstrate that the proposed method achieves 91.18% accuracy, outperforming traditional machine learning approaches, deep learning methods, and other RL attack detection techniques. The results highlight the potential of MaxEnt IRL for robust and adaptive cyber attack detection in IoT environments. All the related codes and datasets publicly available at: https://github.com/Mmassaoudi-cell/maxent-irl-iot-ids.
Funding Information
  • Qatar National Library through the Open Access Funding

This publication has 50 references indexed in Scilit: