Deep Reinforcement Learning-Based Network Intrusion Prevention in Cloud-Edge Architectures

Cloud-edge architectures enable low-latency distributed data processing but introduce complex attack surfaces that challenge traditional Network Intrusion Detection and Prevention Systems (NIDPS). Conventional systems relying on static signatures and centralized analysis cannot adapt to the dynamic, heterogeneous nature of these environments. This paper proposes a novel Deep Reinforcement Learning (DRL) framework for autonomous network intrusion prevention, deploying intelligent agents at the edge layer capable of real-time network interaction. The agents learn optimal security policies through continuous observation, action, and reward cycles. By analyzing live network traffic, agents classify malicious activities with high accuracy and proactively execute prevention actions including connection blocking and bandwidth throttling. We develop simulated cloud-edge testbed modeling diverse attack scenarios (DDoS, infiltration, data exfiltration) and implement Deep Q-Networks (DQN) and Proximal Policy Optimization (PPO) algorithms. Evaluation using NSL-KDD and CIC-IDS2017 datasets demonstrates significant improvements: 98.7% detection accuracy, 1.8% false positive rate, and sub-20ms response time, providing robust self-adaptive defense for distributed computing infrastructures.