Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation
Organizations: Master of Science in Information System Technology, Wilmington University, USA · Master's of Science in Data Analytics, College of Sciences and Technology, University of Houston- Downtown, USA · Master of Science in Information Technology, Washington University of Science and Technology, USA · Department of Electrical Engineering and Computer Science, South Dakota School of Mines & Technology, USA · McComish, Department of Electrical Engineering and Computer Science, South Dakota State University, USA · Ms in Digital Marketing & Information Technology Management, St. Francis College, USA · Master of Business Administration (MBA) in Management, Stanton University, Los Angeles, California
With the increasing complexity of cyber assaults in cloud environments, adaptable security solutions are needed that can support real-time detection and autonomous response. In this paper, we propose a reinforcement learning-based dynamic cyber defense framework. We deploy a Deep Q-Network (DQN) to train effective defensive strategies to counteract the evolving cyberattacks. We leverage the CICIDS2017 dataset for model creation and the UNSW-NB15 dataset for external validation, involving preprocessing of data, feature engineering, and adaptive policy learning. We compare the proposed DQN with decision tree, support vector machine, random forest, XGBoost, and multilayer perceptron models. The proposed DQN achieves an accuracy of 99.72%, a precision of 99.68%, a recall of 99.65%, an F1-score of 99.66%, and an ROC-AUC of 0.999, while the false positive rate is 0.31%, the false negative rate is 0.35%, and the detection latency is 15 ms. The framework achieved 99.54% attack mitigation rate, demonstrating strong adaptive and real-time defensive capabilities. These results demonstrate the potential of reinforcement learning as a powerful and scalable approach for autonomous cybersecurity in modern cloud environments.