Adaptive Defense Zero-Day Attack Detection in NIDS with Deep Reinforcement Learning

Aim:

             Design and deliver a lightweight, adaptive, and high-generalization intrusion detection framework that accurately identifies zero-day and known cyberattacks in network traffic while maintaining efficient real-time performance.

Abstract:

          This work presents a lightweight and adaptive intrusion detection framework designed to identify both zero-day and known cyberattacks in real-time network environments. The system learns temporal behaviors in traffic flows and generalizes effectively to previously unseen threats. Imbalance-aware training and adaptive learning mechanisms improve reliability, especially for rare and evolving attack patterns. Experimental results show strong detection accuracy, reduced false negatives, and efficient performance suitable for modern, dynamic network infrastructures.

Proposed System:

         The proposed system introduces a Temporal Convolutional Network (TCN) encoder combined with a Dueling Double Deep Q-Network to capture sequential patterns in network flows more effectively than the static deep representations. Unlike existing system reliance on distance-based uncertainty learning, the new framework learns temporal dependencies and long-range patterns that enhance zero-day sensitivity. The dueling architecture separates value and advantage estimation, enabling more stable decision-making under noisy or imbalanced conditions. Double Q-learning mitigates overestimation, improving robustness during exploration. The model operates directly on compact feature sets, reducing complexity while retaining strong discriminative power. It dynamically adapts its policy through reinforcement learning, rather than using only supervised or semi-supervised objectives. Overall, the system delivers a more adaptive, sequence-aware, and stable intrusion detection pipeline compared with the existing system methodology.

Advantage:

• The TCN encoder captures temporal dependencies in network traffic, improving the system’s ability to detect unseen attack behaviors more effectively than static feature-based models
• The Dueling Double DQN structure reduces value overestimation and separates state value from action advantages, resulting in more consistent and reliable classification performance.
• The architecture processes compact feature representations and avoids computationally heavy ensembles, enabling real-time intrusion detection with lower resource consumption..
• The reinforcement learning framework continuously refines its policy through interaction-based feedback, providing stronger generalization to evolving cyberattack patterns.