Intrusion Detection Systems (IDS) increasingly leverage machine learning (ML) to enhance the detection of zero-day attacks. As operational complexities increase, enterprises are turning to Intrusion Detection as a Service (IDaS), requiring advanced solutions for efficient ML model selection and resource allocation. Existing research often focuses primarily on accuracy and computational efficiency, leaving a gap in solutions that can dynamically adapt. This study introduces a novel integrated solution, Auto-IDaS, which employs advanced Reinforcement Learning (RL) techniques for real-time, adaptive management of IDS. Auto-IDaS uses the Deep Q-Network (DQN) algorithm for dynamic ML model selection, automatically adjusting configurations of IDaS in response to fluctuating network traffic conditions. Simultaneously, it utilizes the Twin Delayed Deep Deterministic (TD3) algorithm for optimizing capacity allocation, aiming to minimize computational costs while maintaining service quality. This dual approach is innovative in its use of RL to address both selection and allocation challenges within IDaS frameworks. The effectiveness of TD3 is compared against Simulated Annealing (SA), a traditional optimization technique. The results demonstrate that utilizing DQN to dynamically select the model significantly improves the reward by 0.29% to 27.04%, effectively balancing detection performance (F1 score), detection time, and computation cost. Regarding capacity allocation, TD3 accelerates decision times approximately times faster than SA while retaining decision quality within a 10% range comparable to SA’s performance.

中文翻译：

---

用于基于人工智能的入侵检测即服务的人工智能：用于配置模型、任务和容量的强化学习


入侵检测系统 (IDS) 越来越多地利用机器学习 (ML) 来增强对零日攻击的检测。随着运营复杂性的增加，企业开始转向入侵检测即服务 (IDaS)，需要先进的解决方案来实现高效的 ML 模型选择和资源分配。现有的研究通常主要关注准确性和计算效率，在能够动态适应的解决方案方面留下了空白。本研究介绍了一种新颖的集成解决方案 Auto-IDaS，它采用先进的强化学习 (RL) 技术来实现 IDS 的实时、自适应管理。 Auto-IDaS 使用 Deep Q-Network (DQN) 算法进行动态 ML 模型选择，自动调整 IDaS 的配置以响应波动的网络流量状况。同时，它利用双延迟深度确定性（TD3）算法来优化容量分配，旨在在保持服务质量的同时最大限度地减少计算成本。这种双重方法的创新之处在于它使用强化学习来解决 IDaS 框架内的选择和分配挑战。将 TD3 的有效性与传统优化技术模拟退火 (SA) 进行比较。结果表明，利用 DQN 动态选择模型将奖励显着提高了 0.29% 至 27.04%，有效平衡了检测性能（F1 分数）、检测时间和计算成本。在容量分配方面，TD3 的决策速度大约比 SA 快一倍，同时将决策质量保持在与 SA 性能相当的 10% 范围内。