Towards an Unsupervised Reward Function for a Deep Reinforcement Learning Based Intrusion Detection System

Intrusion detection systems (IDS) based on deep learning have proven successful, but struggle to learn continuously and detect new attacks over time due to a supervised label-based reward function. In this article, we introduce an unsupervised Deep Double Q Learning (DDQL) method that aims to detect attacks and learn new behaviors through an unsupervised reward function leveraging a normality score inspired by car traffic anomaly detection.