A Two-Stage Pareto-Driven Framework for Adaptive Resource Optimization in Lightweight Intrusion Detection Systems

The lack of adequate system resources can significantly affect the safety and security of intrusion detection systems implemented to work within the Internet of Things, edge or fog settings. Deployed devices in these environments should balance the operational and security requirements of the systems. This issue is critical since operational environments are stochastic, and deploying devices that have static configurations or scalarized optimization approaches cannot adequately respond to the changing conditions. This work proposes the use of A2DAPT - A Two-Stage Pareto-Driven Framework for Adaptive Resource Optimization in Lightweight Intrusion Detection Systems. This new scheme divides the proposed framework into an offline and an online stage and adapts the resource utilization of lightweight IDS to resource budget levels. In the offline stage, the exploration of the Non-dominated Sorting Genetic Algorithm II (NSGA-II) is used to determine the Pareto set of optimal IDS settings. In the online stage, A2DAPT enforces a deep reinforcement learning controller based on a Dueling Double Deep Q-Network with Prioritized Experience Replay that adapts the intrusion detection system’s configuration in relation to the non-stationary traffic by taking actions from the Pareto set determined in the offline stage. The use of the Pareto set as an action space ensures the use of safe and interpretable decisions by the intrusion detection system during non-stationary traffic. Therefore, the evaluation of the A2DAPT, in this study, focuses on its runtime behavior while operating in a resource-constrained environment under non-stationary traffic consisting of benign and malicious denial-of-service traffic. The evaluation demonstrated that A2DAPT continuously achieves savings compared to a competitive static baseline with approximately 15 CPU, 10 memory, and 7 bandwidth, all of that without significant degradation of the detection performance. The results confirm that the combination of Pareto optimization solutions with deep reinforcement learning agents enables efficient intrusion detection operation in resource-constrained environments.