Network Anomaly Detection Using Suricata and Deep Reinforcement Learning with Telegram Bot Interface

Taufiqur Rahman; Muhammad Naufal Azzahri; Yudha Nurdin; Roslidar; Yunida; Teuku Yuliar Arif

doi:10.1109/COSITE68330.2025.11414232

Network Anomaly Detection Using Suricata and Deep Reinforcement Learning with Telegram Bot Interface

Closed

Taufiqur Rahman, Muhammad Naufal Azzahri, Yudha Nurdin, Roslidar, Yunida, Teuku Yuliar Arif

2025 Proceeding - 2025 International Conference on Computer System, Information Technology, and Electrical Engineering, COSITE 2025 Conference paper Cited by 0

Abstract

The increasing sophistication of cyber-attack challenges traditional, signature-based intrusion detection systems. This study proposes a prototype net- work anomaly detection system that integrates Suricata, an open-source intrusion detection system, with a deep reinforcement learning (DRL) agent. The system trans- forms Suricata’s structured logs into feature vectors for the DRL agent, which uses the proximal policy optimization (PPO) algorithm to classify traffic. A Telegram bot enables real-time interaction, allowing for automated or human-in-the-loop responses. Evaluated in a controlled VMware environment against benign traffic and various attacks (e.g., port scanning and SSH brute-force), the system demonstrated high accuracy and a strong F1-score. The results indicate that this integration provides adaptive detection, expedites incident response, and minimizes false positives. ©2025 IEEE.

Affiliations

Department of Electrical and Computer Engineering, Universitas Syiah Kuala, Banda Aceh, Indonesia

View full text (DOI) →

Research at a Glance

Research at a Glance

Topics & SDG Alignment

Collaboration

Author Profile (Selected)

References Overview

Journal & Source

Metadata & Integrity