AnomalyDetectionRL

Overview

Using Reinforcement Learning in order to detect anomalies and maybe a future response The dataset used is NSL-KDD with data of multiple anomalies

Using deep Q-Learning with keras/tensorflow to generate the network

Simple anomaly detection

Detects normal or anomaly
Train set in: AD.py
Test set in: test.py

Multiple anomaly detection (37+1 labels)

Detects each attack in the dataset
Train set in: multiAD.py
Test set in: multi_test.py

Type anomaly detection (4+1 labels)

Detects only the attack type between normal, DoS, Probe, R2L, U2R
Train set in: typeAD.py
Test set in: type_test.py
Train Dueling DDQN (tensorflow) in typeAD_tf.py

Adversarial/Multi Agent RL(AE-RL)

Try to improve the inequality of attacks to produce better training
Train set in: adversarialAD.py
Test set in: adversarial_test.py

A3C

Train-Test in: A3CtypeAD.py
Summary in tensorboard: tensorboard --logdir=tmp

Notebooks

NSL-KDD adaption: AE_RL_NSL-KDD.ipnb
AWID adaption: AE_RL_awid.ipnb