Reinforcement Learning-Based Voting for Feature Drift-Aware Intrusion Detection: An Incremental Learning Framework
Methaq A. Shyaa, Noor Farizah Ibrahim, Zurinahni Binti Zainol, Rosni Abdullah, Mohammed Anbar · IEEE Access · 2025
In Intrusion Detection Systems (IDS), stream data classification faces significant challenges due to concept drifts and feature evolution, where traditional methods struggle to maintain accuracy over time. One critical challenge is feature drift, which refers to changes in the relevance of features over time, directly impacting the model’s classification accuracy. This paper introduces the Incremental Feature Drift-Aware Genetic Programming Combiner (IFDA-GPC), which integrates a Voting Enhanced Deep Q-Network Multi-Agent Feature Selection (VE-DQN-MAFS) mechanism to address these challenges. The framework extends the existing IGPC architecture by incorporating dynamic feature selection and employing a multi-agent system with voting-based aggregation. This approach enhances feature selection decisions, especially in cases where agents provide conflicting assessments of feature relevance. By reconciling these variations, the framework ensures consistency and reliability in real-time classification tasks. The framework was evaluated using benchmark datasets, including KDD Cup ’99, CICIDS-2017, HIKARI-2021, and ISCX2012, under both evolving and non-evolving scenarios. Results demonstrate that GPC-KOS-DFS, derived from IFDA-GPC, significantly outperformed existing methods in accuracy, F1-score, recall, and AUC metrics. Notably, it achieved an accuracy of 93% on the CICIDS-2017 dataset, showcasing its effectiveness in handling feature drifts while maintaining high classification performance. These findings establish IFDA-GPC as a robust solution for managing evolving data streams in intrusion detection systems.