Open Access

REVIEW

A State-of-the-Art Survey of Adversarial Reinforcement Learning for IoT Intrusion Detection

Qasem Abu Al-Haija^1,*, Shahad Al Tamimi²

1 Department of Cybersecurity, Faculty of Computer & Information Technology, Jordan University of Science and Technology, P.O. Box 3030, Irbid, 22110, Jordan
2 Department of Cybersecurity, King Hussein School of Computing Sciences, Princess Sumaya University for Technology, P.O. Box 1438, Amman, 11941, Jordan

* Corresponding Author: Qasem Abu Al-Haija. Email:

(This article belongs to the Special Issue: Advances in IoT Security: Challenges, Solutions, and Future Applications)

Computers, Materials & Continua 2026, 87(1), 2 https://doi.org/10.32604/cmc.2025.073540

Received 20 September 2025; Accepted 25 November 2025; Issue published 10 February 2026

Abstract

Adversarial Reinforcement Learning (ARL) models for intelligent devices and Network Intrusion Detection Systems (NIDS) improve system resilience against sophisticated cyber-attacks. As a core component of ARL, Adversarial Training (AT) enables NIDS agents to discover and prevent new attack paths by exposing them to competing examples, thereby increasing detection accuracy, reducing False Positives (FPs), and enhancing network security. To develop robust decision-making capabilities for real-world network disruptions and hostile activity, NIDS agents are trained in adversarial scenarios to monitor the current state and notify management of any abnormal or malicious activity. The accuracy and timeliness of the IDS were crucial to the network’s availability and reliability at this time. This paper analyzes ARL applications in NIDS, revealing State-of-The-Art (SoTA) methodology, issues, and future research prospects. This includes Reinforcement Machine Learning (RML)-based NIDS, which enables an agent to interact with the environment to achieve a goal, and Deep Reinforcement Learning (DRL)-based NIDS, which can solve complex decision-making problems. Additionally, this survey study addresses cybersecurity adversarial circumstances and their importance for ARL and NIDS. Architectural design, RL algorithms, feature representation, and training methodologies are examined in the ARL-NIDS study. This comprehensive study evaluates ARL for intelligent NIDS research, benefiting cybersecurity researchers, practitioners, and policymakers. The report promotes cybersecurity defense research and innovation.

---

Keywords

---