Modern intrusion detection systems face a critical paradox: high detection sensitivity generates excessive false alarms, causing debilitating alert fatigue in Security Operations Centers (SOCs). This paper introduces ULTIMATE , a Multi-Agent Deep Reinforcement Learning (MA-DRL) framework that resolves this precision–recall trade-off through topology-aware agent decomposition. Three specialized DRL agents deployed at strategic network chokepoints (Core Router, Cloud Gateway, IoT Segment) develop complementary expertise with a false-positive-constrained optimization that imposes asymmetric penalties ( − 10 per false alarm) and dynamic threshold adaptation. Evaluated on the IoT Network Intrusion Dataset, ULTIMATE achieves 90.7% accuracy, 94.6% recall, and a low 13.3% false positive rate—an 86.7% reduction versus unoptimized baselines. Cross-dataset validation on 5G mobile and enterprise networks confirms robust generalization with only 6.5% performance variance (F1-scores: 89.8% and 96.3%). Zero-shot evaluation across six attack scenarios (DDoS, port scanning, data exfiltration, malware C2, IoT compromise, zero-day) demonstrates consistent performance (80.8%–92.0% F1) with sub-5ms latency and 72K flows/sec throughput. ULTIMATE outperforms state-of-the-art methods, delivering +6.2% F1 improvement over single-agent DRL and -24.0% false positive rate reduction versus transformer-based architectures. By transforming the precision–recall trade-off from a fixed constraint into an adaptive optimization space, ULTIMATE enables enterprise-grade protection that is both highly effective and operationally sustainable.
Saidane et al. (Fri,) studied this question.