# Multi-agent Reinforcement Learning-based Network Intrusion Detection System

arXiv: https://arxiv.org/abs/2407.05766 · HTML: https://mlsanity.com/paper/2407.05766/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 23 references that are in the map.
- First posted on arXiv 8 Jul 2024.

## Builds on (most cited first, 6 of 6)

- [Playing Atari with Deep Reinforcement Learning](https://mlsanity.com/paper/1312.5602/) (2013)
- [Game-Theoretic Multiagent Reinforcement Learning](https://mlsanity.com/paper/2011.00583/) (2020)
- [A Hybrid Deep Learning Anomaly Detection Framework for Intrusion Detection](https://mlsanity.com/paper/2212.00966/) (2022)
- [AntibotV: A Multilevel Behaviour-based Framework for Botnets Detection in Vehicular Networks](https://mlsanity.com/paper/2407.03506/) (2024)
- [Intrusion Detection Systems for IoT: opportunities and challenges offered by Edge Computing and Machine Learning](https://mlsanity.com/paper/2012.01174/) (2020)
- [Anomaly-based Framework for Detecting Power Overloading Cyberattacks in Smart Grid AMI](https://mlsanity.com/paper/2407.03264/) (2024)

## Built on by (most cited first, 4 of 4)

- [BARTPredict: Empowering IoT Security with LLM-Driven Cyber Threat Prediction](https://mlsanity.com/paper/2501.01664/) (2025)
- [Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunities](https://mlsanity.com/paper/2509.06921/) (2025)
- [L2M-AID: Autonomous Cyber-Physical Defense by Fusing Semantic Reasoning of Large Language Models with Multi-Agent Reinforcement Learning (Preprint)](https://mlsanity.com/paper/2510.07363/) (2025)
- [Fuse and Federate: Enhancing EV Charging Station Security with Multimodal Fusion and Federated Learning](https://mlsanity.com/paper/2506.06730/) (2025)

## Abstract (arXiv)

Intrusion Detection Systems (IDS) play a crucial role in ensuring the security of computer networks. Machine learning has emerged as a popular approach for intrusion detection due to its ability to analyze and detect patterns in large volumes of data. However, current ML-based IDS solutions often struggle to keep pace with the ever-changing nature of attack patterns and the emergence of new attack types. Additionally, these solutions face challenges related to class imbalance, where the number of instances belonging to different classes (normal and intrusions) is significantly imbalanced, which hinders their ability to effectively detect minor classes. In this paper, we propose a novel multi-agent reinforcement learning (RL) architecture, enabling automatic, efficient, and robust network intrusion detection. To enhance the capabilities of the proposed model, we have improved the DQN algorithm by implementing the weighted mean square loss function and employing cost-sensitive learning techniques. Our solution introduces a resilient architecture designed to accommodate the addition of new attacks and effectively adapt to changes in existing attack patterns. Experimental results realized using CIC-IDS-2017 dataset, demonstrate that our approach can effectively handle the class imbalance problem and provide a fine grained classification of attacks with a very low false positive rate. In comparison to the current state-of-the-art works, our solution demonstrates a significant superiority in both detection rate and false positive rate.