Authors : Bharanidharan Gurumurthy, Nalini Poornima Suresh, Kiran Ravindran, Durga Devi Saravanan, Shital Parag Dongre, Saminathan Karunakaran
DOI : 10.21015/vtse.v14i3.2511
Volume : 14
Issue : 3
Year : 2026
Page No : 628-643
Conventional intrusion detection systems (IDSs) face increasing complexity in network traffic and unpredictable cyberattacks, particularly with fixed supervised classifiers and ambiguous observations. This study introduces DRL-ECTD (Deep Reinforcement Learning-Enhanced Cyber Threat Detector), a hybrid binary IDS that combines probability estimates from Random Forest (RF) and Artificial Neural Network (ANN) classifiers with a cost-sensitive decision-refinement mechanism using Deep Q-Network (DQN). High-confidence predictions are retained, while predictions within a preset uncertainty interval are passed to the DQN for secondary evaluation. Individual NSL-KDD records are treated as independent decision states, with DQN used for reinforcement-based refinement rather than temporal network-state modeling. On the NSL-KDD test set, DRL-ECTD achieved 78.6% accuracy, 80.4% precision, 76.3% recall, 78.3% F1-score, and 0.988 AUC. The ANN baseline achieved slightly higher accuracy (79.2%) and F1 score (79.1%). DRL-ECTD outperforms the other tested models in accuracy and F1-score and the baseline RF and standalone DQN in precision. SHAP was used for feature attribution and model interpretation. A proof-of-concept Flask service interface demonstrated deployment feasibility, although latency, throughput, computational overhead, and resource utilization were not experimentally benchmarked. The results provide initial insights into hybrid confidence-based decision refinement and motivate further experiments with multiple classes, temporal order, and deployment for intrusion detection.