Indonesian Journal of Cybersecurity and Emerging Risks
Vol. 1 No. 2 (2026): 2026: IJCYBER Volume 1 Issue 2 Year 2026

Beyond DQN: A Comparative Analysis of Advanced Deep Reinforcement Learning Algorithms for Cost-Aware Intrusion Detection

Hina Javed (epartment of Computer Science, Preston University)



Article Info

Publish Date
22 Sep 2026

Abstract

It is a comparative study of six Deep Reinforcement Learning (DRL) algorithms namely Deep Q-Network (DQN), Double Deep Q-Network (DDQN), Dueling Double Deep Q-Network (D3QN), REINFORCE, Advantage Actor-Critic (A2C), Proximal Policy Optimization (PPO), with statistical validation, multi-dataset evaluation and extensive performance analysis in the context of cost-aware intrusion detection in extreme class imbalance. All DRL agents employed a fixed CNN – LSTM feature extractor and prioritized experience replay (PER) in the controlled experimental setup. They tested the three benchmark datasets, CSE-CIC-IDS2018, CIC-IDS2017 and UNSW-NB15. Asymmetric reward function was used to train each DRL agent. There were 10 runs of the simulation with different random seeds, for which Wilcoxon signed-rank tests and McNemar's tests were performed to test the statistical significance. Key performance measures included recall, alerts per million flows (ARMF), Precision-Recall AUC (PR-AUC), training convergence, inference latency, and computational complexity. At 1,247 ARMF, PPO is statistically more successful (p=0.002, Wilcoxon) than baseline DQN+PER with a mean recall of 93.55% (sigma=0.82). The most balanced D3QN solution was found to be 92.80% recall (sigma=0.76) at 1,105 ARMF. For all DRL methods with PER, the number of alerts was reduced by 28-32x compared to supervised baselines. The generalization was confirmed by cross-dataset validation, where PPO achieved 90.20% recall on CIC-IDS2017 and 87.80% on UNSW-NB15. All value-based methods were shown to be statistically significant (p<0.05). The average of the inference latency was still under 2ms per sample. The results provide guidelines for algorithm selection in SOC deployments. The multi-class and zero-day detection scenarios have not been studied. Only 3 data sets and fixed feature backbone are used in the study. This study statistically compares and contrasts six of the most prominent DRL algorithms for cost-aware intrusion detection with confidence intervals, effect sizes and also reproducibility analysis.

Copyrights © 2026






Journal Info

Abbrev

ijcyber

Publisher

Subject

Description

ndonesian Journal of Cybersecurity and Emerging Risks (IJCYBER, Indones. J. Cybersecur. Emerg. Risks, e-ISSN 3164-7782) is a peer-reviewed international journal dedicated to advancing research on theoretical developments and practical implementations in the dynamic fields of cybersecurity, digital ...