Implementation of an intelligent multi-cyber threat detection model based on double-deep Q-networks and CNN

Cybersecurity threats continuously evolve, presenting significant risks to corporations, governments, and individuals worldwide. Traditional detection methods rely on static rules and fail against adversaries' dynamic tactics. Recognizing cyber threats, known for their adaptability, challenges organizations and individuals. Conventional methods increasingly lack effectiveness against sophisticated strategies utilized by today’s attackers. This situation requires developing more advanced cybersecurity systems with autonomous agents capable of learning and making independent decisions. This paper explores applying Reinforcement Learning techniques to demonstrate ongoing auto-learning capability within network configurations. It utilizes double deep Q-network (DDQN) architecture with a convolution neural network (CNN) for feature extraction and implements multithreading to enhance experience replay during training. The proposed model, intelligent multi-cyber threat detection model based on double deep Q-networks (MTDDQN), aims to automate network threat detection through a trial-and-error approach, progressively improving its accuracy. Based on extensive experimentation with the NSL-KDD dataset, this research provides a rich array of labeled data for training and evaluation. The results show the MTDDQN model excels compared to similar machine learning methods in identifying diverse threats. These methodologies synthesize features to create a robust model that recognizes and categorizes threats into 31 distinct families. Threat classification effectiveness is assessed by identifying unique families and monitoring detection accuracy, which reached an impressive 98.57%.