Deep reinforcement learning for cyber security
Open accessAbstract
The scale of Internet-connected systems has increased considerably, and these systems are being exposed to cyberattacks more than ever. The complexity and dynamics of cyberattacks require protecting mechanisms to be responsive, adaptive, and scalable. Machine learning, or more specifically deep reinforcement learning (DRL), methods have been proposed widely to address these issues. By incorporating deep learning into traditional RL, DRL is highly capable of solving complex, dynamic, and especially high-dimensional cyber defense problems. This article presents a survey of DRL approaches developed for cyber security. We touch on different vital aspects, including DRL-based security methods for cyber-physical systems, autonomous intrusion detection techniques, and multiagent DRL-based game theory simulations for defense strategies against cyberattacks. Extensive discussions and future research directions on DRL-based cyber security are also given. We expect that this comprehensive review provides the foundations for and facilitates future studies on exploring the potential of emerging DRL to cope with increasingly complex cyber security problems.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
These elaborate ML techniques are ineffective in performing dynamic responses for IoT.
“These elaborate techniques are ineffective, however, in performing dynamic responses as far as the IoT is concerned [131,132,133,134].”
From Security and Trust Management in the Internet of Vehicles (IoV): Challenges and Machine Learning Solutions (2024) · cites this paper as [134]
Cites
Hochreiter, S., & Schmidhuber, J. (1997) · Neural Computation · doi:10.1162/neco.1997.9.8.1735 · Cited by 102,318 · see citing works
Proximal Policy Optimization Algorithms
Schulman, J., Wolski, F., Dhariwal, P., Radford, A., & Klimov, O. (2017) · arXiv · doi:10.48550/arxiv.1707.06347 · Cited by 10,625 · see citing works
Playing Atari with Deep Reinforcement Learning
Mnih, V., Kavukcuoglu, K., Silver, D., Graves, A., Antonoglou, I., Wierstra, D., & Riedmiller, M. (2013) · arXiv · doi:10.48550/arxiv.1312.5602 · Cited by 9,471 · see citing works
Edge computing: Vision and challenges
Shi, W., Cao, J., Zhang, Q., Li, Y., & Xu, L. (2016) · IEEE Internet of Things Journal · doi:10.1109/jiot.2016.2579198 · Cited by 8,733 · see citing works
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332 · see citing works
Deep Reinforcement Learning with Double Q-Learning
Van Hasselt, H., Guez, A., & Silver, D. (2016) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v30i1.10295 · Cited by 3,318 · see citing works
Deep Reinforcement Learning for Mobile Edge Caching: Review, New Features, and Open Issues
Zhu, H., Cao, Y., Wang, W., Jiang, T., & Jin, S. (2018) · IEEE Network · doi:10.1109/mnet.2018.1800109 · Cited by 153 · cited 1× · see citing works
“Mobile edge caching [47] Maximize offloading traffic.”
Flagged first, then by citations
Cited by
Sorted by citations
Artificial intelligence, cyber-threats and industry 4.0: challenges and opportunities
Bécue, A., Praça, I., & Gama, J. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-020-09942-2 · Cited by 368 · see citing works
The ai-based cyber threat landscape: A survey
Kaloudi, N., & Li, J. (2021) · ACM Computing Surveys · doi:10.1145/3372823 · Cited by 310 · see citing works
Moustafa, N., Koroniotis, N., Keshk, M., Zomaya, A. Y., & Tari, Z. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3280465 · Cited by 266 · see citing works
Reinforcement learning for iot security: A comprehensive survey
Uprety, A., & Rawat, D. B. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3040957 · Cited by 214 · see citing works
Alalwany, E., & Mahgoub, I. (2024) · Sensors · doi:10.3390/s24020368 · Cited by 130 · see citing works
Deep Reinforcement Adversarial Learning Against Botnet Evasion Attacks
Apruzzese, G., Andreolini, M., Marchetti, M., Venturi, A., & Colajanni, M. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3031843 · Cited by 117 · see citing works
Machine Learning for Security in Vehicular Networks: A Comprehensive Survey
Talpur, A., & Gurusamy, M. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3129079 · Cited by 107 · see citing works
ADT: Time series anomaly detection for cyber-physical systems via deep reinforcement learning
Yang, X., Howley, E., & Schukat, M. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103825 · Cited by 47 · see citing works
A Novel Framework for Enhancing Decision-Making in Autonomous Cyber Defense Through Graph Embedding
Wang, Z., Wang, Y., Xiong, X., Ren, Q., & Huang, J. (2025) · Entropy · doi:10.3390/e27060622 · Cited by 7 · see citing works
Mohamed, A. S., Fritz, C., Saber, A. M., Ma, Y., Kaur, R., Al-Darwbi, M., Friedrich, D., & Kundur, D. (2026) · arXiv · doi:10.48550/arxiv.2609.00171
“Finally, in the absence of real attacker engagement, Rein-forcement Learning (RL) can be used to simulate sophisticated attack behaviors within simulation environments and digital twin testbeds [215]–[217].”
- Authors
- Nguyen, T. T., & Reddi, V. J.
- Affiliations
- Deakin University (AU)
- Harvard University (US)
- Venue
- IEEE Transactions on Neural Networks and Learning Systems
- Published
- 2023-08
- Volume
- 34
- Issue
- 8
- Pages
- 3779-3795
- ISSN
- 2162-237X (ISSN-L)
- 2162-2388
- OpenAlex
- W2952298682
- Cited by
- 620
- References
- 7
- Citations by year
- 2026: 117 · 2025: 165 · 2024: 127 · 2023: 95 · 2022: 57 · 2021: 30 · 2020: 27 · 2019: 2
- FWCI
- 34.65
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Transactions on Neural Networks and Learning Systems (publishedVersion)
- PubMed (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Deakin Research Online (Deakin University) (submittedVersion)
- Figshare (submittedVersion, cc-by)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- deep reinforcement learning, cybersecurity, cyber defense, cyber-physical security, intrusion detection, multi-agent reinforcement learning, game theory
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
