# Deep Reinforcement Learning for Cybersecurity Threat Detection and Protection: A Review

arXiv: https://arxiv.org/abs/2206.02733 · HTML: https://mlsanity.com/paper/2206.02733/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 58 references that are in the map.
- First posted on arXiv 6 Jun 2022.

## Builds on (most cited first, 18 of 18)

- [Proximal Policy Optimization Algorithms](https://mlsanity.com/paper/1707.06347/) (2017)
- [Trust Region Policy Optimization](https://mlsanity.com/paper/1502.05477/) (2015)
- [High-Dimensional Continuous Control Using Generalized Advantage Estimation](https://mlsanity.com/paper/1506.02438/) (2015)
- [Deep Reinforcement Learning with Double Q-learning](https://mlsanity.com/paper/1509.06461/) (2015)
- [Dueling Network Architectures for Deep Reinforcement Learning](https://mlsanity.com/paper/1511.06581/) (2015)
- [A Brief Survey of Deep Reinforcement Learning](https://mlsanity.com/paper/1708.05866/) (2017)
- [Deep Reinforcement Learning: An Overview](https://mlsanity.com/paper/1701.07274/) (2017)
- [Deep Reinforcement Learning for Cyber Security](https://mlsanity.com/paper/1906.05799/) (2019)
- [Learn What Not to Learn: Action Elimination with Deep Reinforcement Learning](https://mlsanity.com/paper/1809.02121/) (2018)
- [Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN](https://mlsanity.com/paper/1702.05983/) (2017)
- [IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection](https://mlsanity.com/paper/1809.02077/) (2018)
- [Robust Android Malware Detection System against Adversarial Attacks using Q-Learning](https://mlsanity.com/paper/2101.12031/) (2021)
- [Malware Detection using Machine Learning and Deep Learning](https://mlsanity.com/paper/1904.02441/) (2019)
- [Identification of Significant Permissions for Efficient Android Malware Detection](https://mlsanity.com/paper/2103.00643/) (2021)
- [DOOM: A Novel Adversarial-DRL-Based Op-Code Level Metamorphic Malware Obfuscator for the Enhancement of IDS](https://mlsanity.com/paper/2010.08608/) (2020)
- [Android Malicious Application Classification Using Clustering](https://mlsanity.com/paper/1904.10142/) (2019)
- [Detection of Malicious Android Applications: Classical Machine Learning vs. Deep Neural Network Integrated with Clustering](https://mlsanity.com/paper/2103.00637/) (2021)
- [DRLDO: A novel DRL based De-ObfuscationSystem for Defense against Metamorphic Malware](https://mlsanity.com/paper/2102.00898/) (2021)

## Built on by (most cited first, 4 of 4)

- [Developing Optimal Causal Cyber-Defence Agents via Cyber Security Simulation](https://mlsanity.com/paper/2207.12355/) (2022)
- [Automated Cyber Defence: A Review](https://mlsanity.com/paper/2303.04926/) (2023)
- [AI in Cyberpsychology: A systematic literature review of Cybersecurity enhancement by using AI for analyzing psychology of Victims, Attackers, and Defenders](https://mlsanity.com/paper/2607.13123/) (2026)
- [Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains](https://mlsanity.com/paper/2609.31282/) (2026)

## Abstract (arXiv)

The cybersecurity threat landscape has lately become overly complex. Threat actors leverage weaknesses in the network and endpoint security in a very coordinated manner to perpetuate sophisticated attacks that could bring down the entire network and many critical hosts in the network. Increasingly advanced deep and machine learning-based solutions have been used in threat detection and protection. The application of these techniques has been reviewed well in the scientific literature. Deep Reinforcement Learning has shown great promise in developing AI-based solutions for areas that had earlier required advanced human cognizance. Different techniques and algorithms under deep reinforcement learning have shown great promise in applications ranging from games to industrial processes, where it is claimed to augment systems with general AI capabilities. These algorithms have recently also been used in cybersecurity, especially in threat detection and endpoint protection, where these are showing state-of-the-art results. Unlike supervised machines and deep learning, deep reinforcement learning is used in more diverse ways and is empowering many innovative applications in the threat defense landscape. However, there does not exist any comprehensive review of these unique applications and accomplishments. Therefore, in this paper, we intend to fill this gap and provide a comprehensive review of the different applications of deep reinforcement learning in cybersecurity threat detection and protection.