Abstract
The article presents an innovative method for detecting and classifying multivector attacks in decentralized Internet of Things (IoT) networks, significantly enhancing information security. The proposed approach combines Generative Adversarial Networks (GAN) to create realistic synthetic anomalous data and Reinforcement Learning (RL) algorithms for adaptive real-time updating of the attack detection model. This integration effectively addresses the shortage of high-quality, balanced data on rare and emerging attack types, as well as the dynamic nature of threats in IoT environments, which traditional methods struggle to handle adequately. The method comprises two key interconnected components: a synthetic anomaly generator that expands the training dataset, and an RL classifier capable of continuous learning on hybrid data that includes both real and generated events. To improve decision-making reliability, a weighted voting mechanism is employed among agents, taking into account the trust levels of each network node. The article provides a detailed description of the RL agent’s neural network architecture, featuring three hidden layers with Batch Normalization and Dropout, along with its training algorithm using Deep Q-Network (DQN) and double Q-learning. Experimental evaluation was conducted on a synthetic dataset simulating real IoT scenarios with various multivector attacks such as trust undermining, behavior manipulation, data leakage, and cooperation disruption. The results demonstrate significant improvements in recall and F1-score metrics compared to classical machine learning methods, including Random Forest and Support Vector Machine, especially when trained on the extended dataset with GAN-generated synthetic data. The method offers high attack detection accuracy while reducing false positives and maintains adaptability to novel, previously unknown threats. This makes the proposed approach a promising solution for next-generation IoT security systems, capable of effectively operating under resource-constrained devices and dynamically changing environments.