# An Intrusion Response System utilizing Deep Q-Networks and System Partitions

arXiv: https://arxiv.org/abs/2202.08182 · HTML: https://mlsanity.com/paper/2202.08182/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 19 references that are in the map.
- First posted on arXiv 16 Feb 2022.

## Builds on (most cited first, 1 of 1)

- [Playing Atari with Deep Reinforcement Learning](https://mlsanity.com/paper/1312.5602/) (2013)

## Built on by (most cited first, 6 of 6)

- [Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2207.06236/) (2022)
- [Impacts and Risk of Generative AI Technology on Cyber Defense](https://mlsanity.com/paper/2306.13033/) (2023)
- [Tackling Cyberattacks through AI-based Reactive Systems: A Holistic Review and Future Vision](https://mlsanity.com/paper/2312.06229/) (2023)
- [IRSKG: Unified Intrusion Response System Knowledge Graph Ontology for Cyber Defense](https://mlsanity.com/paper/2411.15672/) (2024)
- [REGARD: Rules of EngaGement for Automated cybeR Defense to aid in Intrusion Response](https://mlsanity.com/paper/2305.13967/) (2023)
- [IRSDA: An Agent-Orchestrated Framework for Enterprise Intrusion Response](https://mlsanity.com/paper/2511.19644/) (2025)

## Abstract (arXiv)

Intrusion Response is a relatively new field of research. Recent approaches for the creation of Intrusion Response Systems (IRSs) use Reinforcement Learning (RL) as a primary technique for the optimal or near-optimal selection of the proper countermeasure to take in order to stop or mitigate an ongoing attack. However, most of them do not consider the fact that systems can change over time or, in other words, that systems exhibit a non-stationary behavior. Furthermore, stateful approaches, such as those based on RL, suffer the curse of dimensionality, due to a state space growing exponentially with the size of the protected system. In this paper, we introduce and develop an IRS software prototype, named irs-partition. It leverages the partitioning of the protected system and Deep Q-Networks to address the curse of dimensionality by supporting a multi-agent formulation. Furthermore, it exploits transfer learning to follow the evolution of non-stationary systems.