MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacks

With the continuous development of network technology and the increasing complexity of application scenarios, network attacks have become more diverse and covert, posing significant challenges to system security. Traditional network security measures often struggle to detect and respond to rapidly e...

Full description

Saved in:
Bibliographic Details
Main Authors: Fucai Luo, Tingfa Xu, Jianan Li, Fengxiang Xu
Format: Article
Language:English
Published: Elsevier 2025-07-01
Series:Alexandria Engineering Journal
Subjects:
Online Access:http://www.sciencedirect.com/science/article/pii/S1110016825005885
Tags: Add Tag
No Tags, Be the first to tag this record!
_version_ 1849318281125560320
author Fucai Luo
Tingfa Xu
Jianan Li
Fengxiang Xu
author_facet Fucai Luo
Tingfa Xu
Jianan Li
Fengxiang Xu
author_sort Fucai Luo
collection DOAJ
description With the continuous development of network technology and the increasing complexity of application scenarios, network attacks have become more diverse and covert, posing significant challenges to system security. Traditional network security measures often struggle to detect and respond to rapidly evolving attack patterns in real time. Therefore, there is an urgent need for a new detection technology that can dynamically assess risks and adapt to changing environments. The Markov Decision Process (MDP) offers an effective and interpretable approach to sequential decision-making, providing a novel method for automatic network attack detection. This study proposes an automatic detection model based on MDP, which dynamically analyzes network traffic and system behavior while continuously improving detection accuracy through adaptive learning strategies. To evaluate the model's effectiveness, multiple experiments were conducted in various scenarios, achieving a maximum detection accuracy of 94.3 %. The results demonstrate that the proposed MDP-based detection model offers significant advantages in detection accuracy, response speed, and adaptability to unknown attacks.
format Article
id doaj-art-a2ecd6338f434cfb9b6cff67c925d42c
institution Kabale University
issn 1110-0168
language English
publishDate 2025-07-01
publisher Elsevier
record_format Article
series Alexandria Engineering Journal
spelling doaj-art-a2ecd6338f434cfb9b6cff67c925d42c2025-08-20T03:50:53ZengElsevierAlexandria Engineering Journal1110-01682025-07-0112648049010.1016/j.aej.2025.04.091MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacksFucai Luo0Tingfa Xu1Jianan Li2Fengxiang Xu3Corresponding author.; School of Optoelectronics, Beijing Institute of Technology, Beijing 100081, ChinaSchool of Optoelectronics, Beijing Institute of Technology, Beijing 100081, ChinaSchool of Optoelectronics, Beijing Institute of Technology, Beijing 100081, ChinaSchool of Optoelectronics, Beijing Institute of Technology, Beijing 100081, ChinaWith the continuous development of network technology and the increasing complexity of application scenarios, network attacks have become more diverse and covert, posing significant challenges to system security. Traditional network security measures often struggle to detect and respond to rapidly evolving attack patterns in real time. Therefore, there is an urgent need for a new detection technology that can dynamically assess risks and adapt to changing environments. The Markov Decision Process (MDP) offers an effective and interpretable approach to sequential decision-making, providing a novel method for automatic network attack detection. This study proposes an automatic detection model based on MDP, which dynamically analyzes network traffic and system behavior while continuously improving detection accuracy through adaptive learning strategies. To evaluate the model's effectiveness, multiple experiments were conducted in various scenarios, achieving a maximum detection accuracy of 94.3 %. The results demonstrate that the proposed MDP-based detection model offers significant advantages in detection accuracy, response speed, and adaptability to unknown attacks.http://www.sciencedirect.com/science/article/pii/S1110016825005885Automatic DetectionMarkov Decision ProcessNetwork AttacksReinforcement LearningResource Utilization
spellingShingle Fucai Luo
Tingfa Xu
Jianan Li
Fengxiang Xu
MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacks
Alexandria Engineering Journal
Automatic Detection
Markov Decision Process
Network Attacks
Reinforcement Learning
Resource Utilization
title MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacks
title_full MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacks
title_fullStr MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacks
title_full_unstemmed MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacks
title_short MDP-AD: A Markov decision process-based adaptive framework for real-time detection of evolving and unknown network attacks
title_sort mdp ad a markov decision process based adaptive framework for real time detection of evolving and unknown network attacks
topic Automatic Detection
Markov Decision Process
Network Attacks
Reinforcement Learning
Resource Utilization
url http://www.sciencedirect.com/science/article/pii/S1110016825005885
work_keys_str_mv AT fucailuo mdpadamarkovdecisionprocessbasedadaptiveframeworkforrealtimedetectionofevolvingandunknownnetworkattacks
AT tingfaxu mdpadamarkovdecisionprocessbasedadaptiveframeworkforrealtimedetectionofevolvingandunknownnetworkattacks
AT jiananli mdpadamarkovdecisionprocessbasedadaptiveframeworkforrealtimedetectionofevolvingandunknownnetworkattacks
AT fengxiangxu mdpadamarkovdecisionprocessbasedadaptiveframeworkforrealtimedetectionofevolvingandunknownnetworkattacks