{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,30]],"date-time":"2026-03-30T23:28:22Z","timestamp":1774913302805,"version":"3.50.1"},"reference-count":38,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,5,4]],"date-time":"2024-05-04T00:00:00Z","timestamp":1714780800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,5,4]],"date-time":"2024-05-04T00:00:00Z","timestamp":1714780800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Wireless Com Network"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>The increasing prevalence of Internet of Things (IoT) systems has made them attractive targets for malicious actors. To address the evolving threats and the growing complexity of detection, there is a critical need to search for and develop new algorithms that are fast and robust in detecting and classifying dangerous network traffic. In this context, deep reinforcement learning (DRL) is gaining recognition as a prospective solution in numerous fields as it enables autonomous agents to cooperate with their environment for decision-making without relying on human experts. This article presents an innovative approach to intrusion detection in IoT systems using an adversarial reinforcement learning (RL) algorithm known for its exceptional predictive capabilities. The predictive process relies on a classifier, implemented as a streamlined and highly efficient neural network. Embedded within this classifier is a policy function meticulously trained using an innovative RL model. Importantly, this model ensures that the environment\u2019s behavior is dynamically fine-tuned simultaneously with the learning process, improving the overall effectiveness of the intrusion detection approach. The efficiency of our proposal was assessed using the Bot-IoT database, consisting of a mixture of legitimate IoT network traffic and simulated attack scenarios. Our scheme shows superior performance compared to existing ones. Therefore, our approach to IoT intrusion detection can be considered a valuable alternative to existing methods, capable of significantly improving the IoT systems\u2019 security.<\/jats:p>","DOI":"10.1186\/s13638-024-02348-6","type":"journal-article","created":{"date-parts":[[2024,5,3]],"date-time":"2024-05-03T23:27:37Z","timestamp":1714778857000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":23,"title":["An adversarial environment reinforcement learning-driven intrusion detection algorithm for Internet of Things"],"prefix":"10.1186","volume":"2024","author":[{"given":"Chahira","family":"Mahjoub","sequence":"first","affiliation":[]},{"given":"Monia","family":"Hamdi","sequence":"additional","affiliation":[]},{"given":"Reem Ibrahim","family":"Alkanhel","sequence":"additional","affiliation":[]},{"given":"Safa","family":"Mohamed","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8148-1621","authenticated-orcid":false,"given":"Ridha","family":"Ejbali","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,5,4]]},"reference":[{"key":"2348_CR1","doi-asserted-by":"publisher","unstructured":"N. Moustafa, B. Turnbull, K. K. R. Choo, Towards Automation of Vulnerability and Exploitation Identification in IIoT Networks. Proc. - 2018 IEEE Int. Conf. Ind. Internet, ICII 2018, no. Icii, pp. 139\u2013145, 2018, doi: https:\/\/doi.org\/10.1109\/ICII.2018.00023","DOI":"10.1109\/ICII.2018.00023"},{"issue":"3","key":"2348_CR2","doi-asserted-by":"publisher","first-page":"4815","DOI":"10.1109\/JIOT.2018.2871719","volume":"6","author":"N Moustafa","year":"2019","unstructured":"N. Moustafa, B. Turnbull, K.K.R. Choo, An ensemble intrusion detection technique based on proposed statistical flow features for protecting network traffic of Internet of Things. IEEE Internet Things J. 6(3), 4815\u20134830 (2019). https:\/\/doi.org\/10.1109\/JIOT.2018.2871719","journal-title":"IEEE Internet Things J."},{"issue":"7","key":"2348_CR3","doi-asserted-by":"publisher","first-page":"80","DOI":"10.1109\/MC.2017.201","volume":"50","author":"C Kolias","year":"2017","unstructured":"C. Kolias, G. Kambourakis, A. Stavrou, J. Voas, DDoS in the IoT: Mirai and Other Botnets. Computer 50(7), 80\u201384 (2017)","journal-title":"Computer"},{"issue":"1","key":"2348_CR4","doi-asserted-by":"publisher","first-page":"303","DOI":"10.1109\/SURV.2013.052213.00046","volume":"16","author":"MH Bhuyan","year":"2014","unstructured":"M.H. Bhuyan, D.K. Bhattacharyya, J.K. Kalita, Network anomaly detection: methods, systems and tools. IEEE Commun. Surv. Tutorials 16(1), 303\u2013336 (2014). https:\/\/doi.org\/10.1109\/SURV.2013.052213.00046","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"2348_CR5","doi-asserted-by":"publisher","first-page":"13129","DOI":"10.1109\/ACCESS.2017.2789329","volume":"6","author":"JJPC Rodrigues","year":"2018","unstructured":"J.J.P.C. Rodrigues et al., Enabling technologies for the internet of health things. IEEE Access 6, 13129\u201313141 (2018). https:\/\/doi.org\/10.1109\/ACCESS.2017.2789329","journal-title":"IEEE Access"},{"key":"2348_CR6","doi-asserted-by":"publisher","first-page":"147","DOI":"10.1016\/j.comnet.2019.01.023","volume":"151","author":"KAP da Costa","year":"2019","unstructured":"K.A.P. da Costa, J.P. Papa, C.O. Lisboa, R. Munoz, V.H.C. de Albuquerque, Internet of Things: a survey on machine learning-based intrusion detection approaches. Comput. Netw. 151, 147\u2013157 (2019). https:\/\/doi.org\/10.1016\/j.comnet.2019.01.023","journal-title":"Comput. Netw."},{"key":"2348_CR7","doi-asserted-by":"publisher","first-page":"31950","DOI":"10.1109\/ACCESS.2018.2845399","volume":"6","author":"MME Mahmoud","year":"2018","unstructured":"M.M.E. Mahmoud et al., Enabling technologies on cloud of things for smart healthcare. IEEE Access 6, 31950\u201331967 (2018). https:\/\/doi.org\/10.1109\/ACCESS.2018.2845399","journal-title":"IEEE Access"},{"issue":"6","key":"2348_CR8","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1109\/MSP.2017.2743240","volume":"34","author":"K Arulkumaran","year":"2017","unstructured":"K. Arulkumaran, M.P. Deisenroth, M. Brundage, A.A. Bharath, Deep reinforcement learning: a brief survey. IEEE Signal Process. Mag. 34(6), 26\u201338 (2017)","journal-title":"IEEE Signal Process. Mag."},{"issue":"2","key":"2348_CR9","first-page":"229","volume":"17","author":"RS Sutton","year":"1999","unstructured":"R.S. Sutton, A.G. Barto, Reinforcement learning: An introduction. Robotica 17(2), 229\u2013235 (1999)","journal-title":"Robotica"},{"key":"2348_CR10","doi-asserted-by":"publisher","first-page":"96","DOI":"10.1016\/j.comnet.2019.05.013","volume":"159","author":"G Caminero","year":"2019","unstructured":"G. Caminero, M. Lopez-Martin, B. Carro, Adversarial environment reinforcement learning algorithm for intrusion detection. Comput. Networks 159, 96\u2013109 (2019). https:\/\/doi.org\/10.1016\/j.comnet.2019.05.013","journal-title":"Comput. Networks"},{"issue":"11","key":"2348_CR11","doi-asserted-by":"publisher","first-page":"1328","DOI":"10.1016\/j.comcom.2011.01.012","volume":"34","author":"PA Raj Kumar","year":"2011","unstructured":"P.A. Raj Kumar, S. Selvakumar, Distributed denial of service attack detection using an ensemble of neural classifier. Comput. Commun. 34(11), 1328\u20131341 (2011). https:\/\/doi.org\/10.1016\/j.comcom.2011.01.012","journal-title":"Comput. Commun."},{"key":"2348_CR12","doi-asserted-by":"publisher","unstructured":"M. Al-Zewairi, S. Almajali, A. Awajan. Experimental evaluation of a multi-layer feed-forward artificial neural network classifier for network intrusion detection system. Proc. - 2017 Int. Conf. New Trends Comput. Sci. ICTCS 2017, vol. 2018-January, pp. 167\u2013172, 2017, doi: https:\/\/doi.org\/10.1109\/ICTCS.2017.29","DOI":"10.1109\/ICTCS.2017.29"},{"issue":"1\u20133","key":"2348_CR13","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1080\/19393555.2015.1125974","volume":"25","author":"N Moustafa","year":"2016","unstructured":"N. Moustafa, J. Slay, The evaluation of network anomaly detection systems: statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set. Inf. Secur. J. 25(1\u20133), 18\u201331 (2016). https:\/\/doi.org\/10.1080\/19393555.2015.1125974","journal-title":"Inf. Secur. J."},{"key":"2348_CR14","doi-asserted-by":"publisher","first-page":"294","DOI":"10.1016\/j.neucom.2019.02.047","volume":"340","author":"BA Bhuvaneswari","year":"2019","unstructured":"B.A. Bhuvaneswari, S. Selvakumar, Deep radial intelligence with cumulative incarnation approach for detecting denial of service attacks. Neurocomputing 340, 294\u2013308 (2019). https:\/\/doi.org\/10.1016\/j.neucom.2019.02.047","journal-title":"Neurocomputing"},{"key":"2348_CR15","doi-asserted-by":"crossref","unstructured":"M. Tavallaee, E. Bagheri, W. Lu, A. A. Ghorbani. A detailed analysis of the KDD CUP 99 data set. in IEEE Symposium on Computational Intelligence for Security and Defense Applications, 2009, pp. 1\u20136","DOI":"10.1109\/CISDA.2009.5356528"},{"issue":"1","key":"2348_CR16","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1109\/TETCI.2017.2772792","volume":"2","author":"N Shone","year":"2018","unstructured":"N. Shone, T.N. Ngoc, V.D. Phai, Q. Shi, A deep learning approach to network intrusion detection. IEEE Trans. Emerg. Top. Comput. Intell. 2(1), 41\u201350 (2018). https:\/\/doi.org\/10.1109\/TETCI.2017.2772792","journal-title":"IEEE Trans. Emerg. Top. Comput. Intell."},{"key":"2348_CR17","volume-title":"Multi-agent reinforcement learning for intrusion detection","author":"A Servin","year":"2009","unstructured":"A. Servin, D. Kudenko, Multi-agent reinforcement learning for intrusion detection (University of York, 2009)"},{"key":"2348_CR18","volume-title":"Distributed Reinforcement Learning for Network Intrusion Response","author":"K Malialis","year":"2014","unstructured":"K. Malialis, Distributed Reinforcement Learning for Network Intrusion Response (University of York, 2014)"},{"key":"2348_CR19","doi-asserted-by":"crossref","unstructured":"X. H. Quah, C. Q. G. Leedham, Pattern classification using fuzzy adaptive learning control network and reinforcement learning. in Proceedings of the 9th International Conference on Neural Information Processing, vol. 3, pp. 1439\u20131443","DOI":"10.1109\/ICONIP.2002.1202858"},{"key":"2348_CR20","unstructured":"S. Huang, N. Papernot, I. Goodfellow, Y. Duan, P. Abbeel, Adversarial attacks on neural network policies. in 5th International Conference on Learning Representations, ICLR 2017, (2017)"},{"issue":"10","key":"2348_CR21","doi-asserted-by":"publisher","first-page":"2772","DOI":"10.1109\/LCOMM.2023.330231","volume":"27","author":"T Liu","year":"2023","unstructured":"T. Liu, H. Jiang, Z. Chen, H. Zhang, X. Yang, F. Shu, Nonlinear channel estimation and signal detection for quantized OFDM System. IEEE Commun. Lett. 27(10), 2772\u20132776 (2023). https:\/\/doi.org\/10.1109\/LCOMM.2023.330231","journal-title":"IEEE Commun. Lett."},{"key":"2348_CR22","doi-asserted-by":"publisher","unstructured":"M. S. Frikha, S. M. Gammar, A. Lahmadi, Multi-attribute monitoring for anomaly detection: a reinforcement learning approach based on unsupervised reward. in 2021 10th IFIP International Conference on Performance Evaluation and Modeling in Wireless and Wired Networks (PEMWN), Ottawa, ON, Canada, 2021, pp. 1\u20136, doi: https:\/\/doi.org\/10.23919\/PEMWN53042.2021.9664667","DOI":"10.23919\/PEMWN53042.2021.9664667"},{"issue":"10","key":"2348_CR23","doi-asserted-by":"publisher","first-page":"6853","DOI":"10.1109\/TWC.2023.3246264","volume":"22","author":"J Chen","year":"2023","unstructured":"J. Chen, Y.-C. Liang, H.V. Cheng, W. Yu, Channel estimation for reconfigurable intelligent surface aided multi-user mmWave MIMO systems. IEEE Trans. Wireless Commun. 22(10), 6853\u20136869 (2023). https:\/\/doi.org\/10.1109\/TWC.2023.3246264","journal-title":"IEEE Trans. Wireless Commun."},{"key":"2348_CR24","doi-asserted-by":"publisher","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","volume":"100","author":"N Koroniotis","year":"2019","unstructured":"N. Koroniotis, N. Moustafa, E. Sitnikova, B. Turnbull, Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset. Futur. Gener. Comput. Syst. 100, 779\u2013796 (2019). https:\/\/doi.org\/10.1016\/j.future.2019.05.041","journal-title":"Futur. Gener. Comput. Syst."},{"issue":"2","key":"2348_CR25","doi-asserted-by":"publisher","first-page":"169","DOI":"10.1109\/MCOM.2018.1700332","volume":"56","author":"A Abeshu","year":"2018","unstructured":"A. Abeshu, N. Chilamkurti, Deep learning: the frontier for distributed attack detection in fog-to-things computing. IEEE Commun. Mag. 56(2), 169\u2013175 (2018). https:\/\/doi.org\/10.1109\/MCOM.2018.1700332","journal-title":"IEEE Commun. Mag."},{"key":"2348_CR26","doi-asserted-by":"publisher","DOI":"10.3390\/s19091977","author":"G Thamilarasu","year":"2019","unstructured":"G. Thamilarasu, S. Chawla, Towards deep-learning-driven intrusion detection for the Internet of Things. Sensors (2019). https:\/\/doi.org\/10.3390\/s19091977","journal-title":"Sensors"},{"key":"2348_CR27","doi-asserted-by":"publisher","first-page":"31711","DOI":"10.1109\/ACCESS.2019.2903723","volume":"7","author":"Y Zhang","year":"2019","unstructured":"Y. Zhang, P. Li, X. Wang, Intrusion detection for IoT based on improved genetic algorithm and deep belief network. IEEE Access 7, 31711\u201331722 (2019). https:\/\/doi.org\/10.1109\/ACCESS.2019.2903723","journal-title":"IEEE Access"},{"issue":"4","key":"2348_CR28","doi-asserted-by":"publisher","first-page":"262","DOI":"10.1145\/382912.382923","volume":"3","author":"J Mchugh","year":"2000","unstructured":"J. Mchugh, Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by lincoln laboratory. ACM Trans. Inf. Syst. Secur. 3(4), 262\u2013294 (2000). https:\/\/doi.org\/10.1145\/382912.382923","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"2348_CR29","doi-asserted-by":"publisher","first-page":"198","DOI":"10.1016\/j.future.2019.08.007","volume":"102","author":"ZA Baig","year":"2020","unstructured":"Z.A. Baig, S. Sanguanpong, S.N. Firdous, N. Van Vo, T.G. Nguyen, C. So-In, Averaged dependence estimators for DoS attack detection in IoT networks. Futur. Gener. Comput. Syst. 102, 198\u2013209 (2020)","journal-title":"Futur. Gener. Comput. Syst."},{"key":"2348_CR30","doi-asserted-by":"publisher","first-page":"119330","DOI":"10.1016\/j.eswa.2022.119330","volume":"215","author":"SA Khanday","year":"2023","unstructured":"S.A. Khanday, H. Fatima, N. Rakesh, Implementation of intrusion detection model for DDoS attacks in lightweight IoT networks. Expert Syst. Appl. 215, 119330 (2023). https:\/\/doi.org\/10.1016\/j.eswa.2022.119330","journal-title":"Expert Syst. Appl."},{"key":"2348_CR31","unstructured":"V. Mnih et al., Playing Atari with deep reinforcement learning. arXiv:1312.5602v1 [cs.LG], pp. 1\u20139, 2013, [Online]. Available: http:\/\/arxiv.org\/abs\/1312.5602"},{"key":"2348_CR32","doi-asserted-by":"publisher","unstructured":"H. Van Hasselt, A. Guez, D. Silver. Deep reinforcement learning with double Q-Learning. arXiv:1509.06461v3 [cs.LG], pp. 2094\u20132100, 2016, doi: https:\/\/doi.org\/10.1609\/aaai.v30i1.10295.","DOI":"10.1609\/aaai.v30i1.10295"},{"issue":"3","key":"2348_CR33","first-page":"23","volume":"1","author":"D Meyer","year":"2001","unstructured":"D. Meyer, F. Wien, Support vector machines. R News 1(3), 23\u201326 (2001)","journal-title":"R News"},{"key":"2348_CR34","doi-asserted-by":"crossref","unstructured":"J. R. Brzezinski, G. J. Knafl, Logistic regression modeling for context-based classification. in Proceedings of the Tenth International Workshop on Database and Expert Systems Applications (DEXA 99), pp. 755\u2013759, 1999","DOI":"10.1109\/DEXA.1999.795279"},{"key":"2348_CR35","doi-asserted-by":"crossref","unstructured":"M. J. Islam, Q. M. Jonathan Wu, M. Ahmadi, M. A. Sid-Ahmed, Investigating the performance of Naive-Bayes classifiers and K-nearest neighbor classifiers. in 2007 International Conference on Convergence Information Technology (ICCIT 2007), pp. 1541\u20131546, 2007","DOI":"10.1109\/ICCIT.2007.148"},{"issue":"2","key":"2348_CR36","doi-asserted-by":"publisher","first-page":"88","DOI":"10.18201\/ijisae.2019252786","volume":"7","author":"MM Saritas","year":"2019","unstructured":"M.M. Saritas, A. Yasar, Performance analysis of ANN and Naive Bayes classification algorithm for data classification. Int. J. Intell. Syst. Appl. Eng. 7(2), 88\u201391 (2019). https:\/\/doi.org\/10.18201\/ijisae.2019252786","journal-title":"Int. J. Intell. Syst. Appl. Eng."},{"issue":"2","key":"2348_CR37","doi-asserted-by":"publisher","first-page":"1888","DOI":"10.4249\/scholarpedia.1888","volume":"8","author":"S Grossberg","year":"2013","unstructured":"S. Grossberg, Recurrent neural networks. Scholarpedia 8(2), 1888 (2013)","journal-title":"Scholarpedia"},{"issue":"10","key":"2348_CR38","doi-asserted-by":"publisher","first-page":"2222","DOI":"10.1109\/TNNLS.2016.2582924","volume":"28","author":"K Greff","year":"2017","unstructured":"K. Greff, R.K. Srivastava, J. Koutn\u00edk, B.R. Steunebrink, J. Schmidhuber, LSTM: a search space odyssey. IEEE Trans. Neural Netw. Learn. Syst. 28(10), 2222\u20132232 (2017)","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."}],"container-title":["EURASIP Journal on Wireless Communications and Networking"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13638-024-02348-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s13638-024-02348-6\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13638-024-02348-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,17]],"date-time":"2024-11-17T20:09:53Z","timestamp":1731874193000},"score":1,"resource":{"primary":{"URL":"https:\/\/jwcn-eurasipjournals.springeropen.com\/articles\/10.1186\/s13638-024-02348-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,4]]},"references-count":38,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["2348"],"URL":"https:\/\/doi.org\/10.1186\/s13638-024-02348-6","relation":{"has-preprint":[{"id-type":"doi","id":"10.21203\/rs.3.rs-3427876\/v1","asserted-by":"object"}]},"ISSN":["1687-1499"],"issn-type":[{"value":"1687-1499","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,5,4]]},"assertion":[{"value":"11 October 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 April 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 May 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"21"}}