Repository for "RRIoT: Recurrent Reinforcement Learning for Cyber Threat Detection on IoT Devices" published in the journal Computers & Security.

This repository hosts code associated for the RRIoT model from the manuscript titled "RRIoT: Recurrent Reinforcment Learning for Cyber Threat Detection on IoT Devices." The code from this repository is adapted from the code found in this repository: https://github.com/gcamfer/Anomaly-ReactionRL. Major contributions compared to the previous repository include:

1. Applying the models on IoT telemetry data
2. Incorporating the Deep Deterministic Policy Gradient model as part of the RIoT model
3. Applying SAGE to determine global feature importance

For source data of the TON-IoT telemetry dataset, please visit: https://research.unsw.edu.au/projects/toniot-datasets. For more information about SAGE, please visit: https://iancovert.com/blog/understanding-shap-sage/.

If you like and use this code, please consider citing our work: Rookard, C., & Khojandi, A. (2024). RRIoT: Recurrent reinforcement learning for cyber threat detection on IoT devices. Computers & Security, 140, 103786.

@article{rookard2024rriot,
  title={RRIoT: Recurrent reinforcement learning for cyber threat detection on IoT devices},
  author={Rookard, Curtis and Khojandi, Anahita},
  journal={Computers & Security},
  volume={140},
  pages={103786},
  year={2024},
  publisher={Elsevier}
}