Abstract Deep Reinforcement Learning (DRL) has demonstrated significant potential in autonomous network defense; however, existing models frequently suffer from "Recall Collapse" when faced with concept drift or the "Information Poverty" of resource-constrained edge devices. This paper proposes REACT-D3QN (Resilient Adaptive Concept-drift-aware Dueling Double Deep Q-Network), a framework designed to maintain operationally relevant detection integrity during cross-dataset migration. By integrating a Dueling architecture, the framework decouples state-value estimation from action advantages, allowing the agent to recognize the "intrinsic risk" of network states even under extreme feature pruning. A core innovation of this work is the REACT reward engine, which utilizes a 10:1 asymmetric penalty ratio to establish a "Recall Floor", prioritizing the detection of drifted attack signatures over simple accuracy. Evaluated through a zero-base transfer learning transition from CIC-IDS2017 to CIC-IDS2018 traffic patterns, REACT-D3QN achieved a 99.85% Recall while operating on an 84.4% reduced feature set (5 features). These results prove that architectural resilience can compensate for significant signal loss, providing a robust pathway for deploying high-performance Intrusion Detection Systems (IDS) on low-power edge infrastructure and setting the stage for decentralized, blockchain-verified autonomous defense.
Haddane et al. (Sat,) studied this question.