Guided Augmentation by Reinforcement Learning for Self-Supervised Intrusion Detection on Internet of Things Traffic

This study examines whether learning augmentation policies-rather than fixing them-can strengthen selfsupervised representations for tabular Network Intrusion Detection Systems (NIDS). We move reinforcement learning (RL) upstream to the augmentation layer of self-supervised learning (SSL) and learn, per sample, which feature-level perturbation (masking, Gaussian, or shuffling) to apply to the second view while keeping the first view unmodified. The pipeline remains fully unlabeled (SSL→RL→SSL) and optimizes one of two label-free rewards: a contrastive gap signal or a CLUB-style mutual information proxy. Under a unified, leakage-aware 5-fold protocol with frozen linear probes on three Internet of Things (IoT) corpora-TON-IoT, Bot-IoT, and CICIoT-2023-RL-guided augmentation consistently outperforms a masking-only SSL baseline. The CLUB-guided policy is most effective overall, yielding higher AUC/F1 and lower false positive rate (FPR) at a fixed cutoff (τ=0.5) with smaller fold-wise variability; the contrastive variant offers corpus-dependent gains. Operationally, fewer false positives at comparable recall reduce benign escalations without additional downstream tuning, making the approach a drop-in enhancement for existing SSL-based NIDS. These results identify what to perturb-learned via mutualinformation objectives-as a high-leverage, label-free control point for robust intrusion detection on tabular network traffic.