A deep reinforcement based echo state network for network intrusion classification

Khorshed Alam; Mahbubul Haq Bhuiyan; Dewan Md. Farid

doi:10.1371/journal.pone.0333038

Peer Review History

Original SubmissionSeptember 8, 2025
8 Jan 2026 Decision Letter - Kamran Siddique, Editor Dear Dr. Farid, Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process. Please submit your revised manuscript by Feb 22 2026 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file.. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file.. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file.. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file. A letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'. A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'. An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'. If you would like to make changes to your financial disclosure, please include your updated statement in your cover letter. Guidelines for resubmitting your figure files are available below the reviewer comments at the end of this letter. If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: https://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols. Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at . Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at . Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at . Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols.... We look forward to receiving your revised manuscript. Kind regards, Kamran Siddique Academic Editor PLOS One Journal Requirements: When submitting your revision, we need you to address these additional requirements. 1. Please ensure that your manuscript meets PLOS ONE's style requirements, including those for file naming. The PLOS ONE style templates can be found at https://journals.plos.org/plosone/s/file?id=wjVg/PLOSOne_formatting_sample_main_body.pdf and https://journals.plos.org/plosone/s/file?id=ba62/PLOSOne_formatting_sample_title_authors_affiliations.pdf 2. Please update your submission to use the PLOS LaTeX template. The template and more information on our requirements for LaTeX submissions can be found at http://journals.plos.org/plosone/s/latex. 3. When completing the data availability statement of the submission form, you indicated that you will make your data available on acceptance. We strongly recommend all authors decide on a data sharing plan before acceptance, as the process can be lengthy and hold up publication timelines. Please note that, though access restrictions are acceptable now, your entire data will need to be made freely accessible if your manuscript is accepted for publication. This policy applies to all data except where public deposition would breach compliance with the protocol approved by your research ethics board. If you are unable to adhere to our open data policy, please kindly revise your statement to explain your reasoning and we will seek the editor's input on an exemption. Please be assured that, once you have provided your new statement, the assessment of your exemption will not hold up the peer review process. 4. We note that Figure 1 in your submission contain copyrighted images. All PLOS content is published under the Creative Commons Attribution License (CC BY 4.0), which means that the manuscript, images, and Supporting Information files will be freely available online, and any third party is permitted to access, download, copy, distribute, and use these materials in any way, even commercially, with proper attribution. For more information, see our copyright guidelines: http://journals.plos.org/plosone/s/licenses-and-copyright. We require you to either (1) present written permission from the copyright holder to publish these figures specifically under the CC BY 4.0 license, or (2) remove the figures from your submission: 1) You may seek permission from the original copyright holder of Figure 1 to publish the content specifically under the CC BY 4.0 license. We recommend that you contact the original copyright holder with the Content Permission Form (http://journals.plos.org/plosone/s/file?id=7c09/content-permission-form.pdf) and the following text: “I request permission for the open-access journal PLOS ONE to publish XXX under the Creative Commons Attribution License (CCAL) CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). Please be aware that this license allows unrestricted use and distribution, even commercially, by third parties. Please reply and provide explicit written permission to publish XXX under a CC BY license and complete the attached form.” Please upload the completed Content Permission Form or other proof of granted permissions as an ""Other"" file with your submission. In the figure caption of the copyrighted figure, please include the following text: “Reprinted from [ref] under a CC BY license, with permission from [name of publisher], original copyright [original copyright year].” 2) If you are unable to obtain permission from the original copyright holder to publish these figures under the CC BY 4.0 license or if the copyright holder’s requirements are incompatible with the CC BY 4.0 license, please either i) remove the figure or ii) supply a replacement figure that complies with the CC BY 4.0 license. Please check copyright information on all replacement figures and update the figure caption with source information. If applicable, please specify in the figure caption text when a figure is similar but not identical to the original image and is therefore for illustrative purposes only. 5. We notice that your supplementary information is included in the manuscript file. Please remove them and upload them with the file type 'Supporting Information'. Please ensure that each Supporting Information file has a legend listed in the manuscript after the references list. 6. If the reviewer comments include a recommendation to cite specific previously published works, please review and evaluate these publications to determine whether they are relevant and should be cited. There is no requirement to cite these works unless the editor has indicated otherwise. Additional Editor Comments: Based on the reviewers’ comments, the manuscript cannot be accepted in its current form. However, I invite the authors to submit a major revision that carefully and comprehensively addresses all reviewer concerns. Reviewers' comments: Reviewer's Responses to Questions Comments to the Author 1. Is the manuscript technically sound, and do the data support the conclusions? Reviewer #1: Yes Reviewer #2: Partly ******** 2. Has the statistical analysis been performed appropriately and rigorously? -->?> Reviewer #1: Yes Reviewer #2: Yes ****** 3. Have the authors made all data underlying the findings in their manuscript fully available??> The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified.requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified.--> Reviewer #1: Yes Reviewer #2: Yes ****** 4. Is the manuscript presented in an intelligible fashion and written in standard English??> Reviewer #1: Yes Reviewer #2: No ****** Reviewer #1: Major Concerns 1. Novelty and Contribution (Critical) ESN integration lacks theoretical justification over LSTM/GRU Limited explanation of why ESN is "highly underexplored" in NIDS Contribution claims overlap with existing DRL-based IDS work [14, 15, 20] 2. Experimental Design (Critical) Zero-day attack evaluation (Table 3) is unclear—how does excluding DoS from training prove adaptive modeling when other DoS variants exist? No computational complexity analysis despite claiming ESN is "lightweight" Missing real-time latency measurements Statistical significance tests absent for performance comparisons 3. Methodological Issues (Major) Reward mechanism (+1/-1) overly simplistic—no justification Hyperparameter selection (γ=0.96, ϵ=0.07) not explained Table 7: K-means SMOTE comparison lacks confidence intervals DRL training convergence criteria vague 4. Presentation Quality (Major) Excessive background material (Section 2, 3) Grammatical errors throughout Algorithm pseudocode formatting inconsistent Repetitive statements about DRL advantages Minor Issues Table 9: Unfair comparison (different training protocols unclear) LIME analysis (Fig 2) superficial—lacks actionable insights Missing ablation studies on ESN layer contribution Related work section too lengthy Reviewer #2: 1) Based on the results reported in Table 1, the proposed method does not demonstrate a clear improvement over the approaches presented in [15] and [19]. The authors are encouraged to more clearly highlight the novelty and advantages of their method compared to these existing works. 2) The manuscript appears to be excessively long relative to the level of technical novelty it offers. A substantial portion of the paper is devoted to revisiting fundamental concepts of Deep Reinforcement Learning (DRL), which would be more appropriate for a technical report or tutorial-style paper rather than a research-oriented scientific article. The authors are advised to significantly streamline the background section and focus more on the original contributions. 3) One of the major challenges in DRL is the trade-off between exploration and exploitation. The current manuscript does not adequately address how this challenge is handled within the proposed method. A clearer explanation or discussion of this aspect is necessary to strengthen the methodological contribution. 4) To improve the reproducibility of the proposed approach, the authors are strongly encouraged to include a detailed description of the DRL network architecture employed in the study, such as the network structure, key hyperparameters, and training configuration. 5) The authors should ensure that all abbreviations and acronyms are clearly defined upon their first occurrence in the manuscript. Several abbreviations, including NID, AI, and DRL, are used without prior explanation, which may hinder readability for a broader audience. ****** what does this mean?). If published, this will include your full peer review and any attached files.). If published, this will include your full peer review and any attached files.). If published, this will include your full peer review and any attached files.). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review? For information about this choice, including consent withdrawal, please see our For information about this choice, including consent withdrawal, please see our For information about this choice, including consent withdrawal, please see our For information about this choice, including consent withdrawal, please see our Privacy Policy..--> Reviewer #1: Yes: Md Mehedi HasanMd Mehedi HasanMd Mehedi HasanMd Mehedi Hasan Reviewer #2: No ******** [NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.] To ensure your figures meet our technical requirements, please review our figure guidelines: https://journals.plos.org/plosone/s/figures You may also use PLOS’s free figure tool, NAAS, to help you prepare publication quality figures: https://journals.plos.org/plosone/s/figures#loc-tools-for-figure-preparation. NAAS will assess whether your figures meet our technical requirements by comparing each figure against our figure specifications. https://doi.org/10.1371/journal.pone.0333038.r001
Revision 1
23 Feb 2026 Author Response Editor’s Comments: 1. Please ensure that your manuscript meets PLOS ONE's style requirements, including those for file naming. The PLOS ONE style templates can be found at https://journals.plos.org/plosone/s/file?id=wjVg/PLOSOne_formatting_sample_main_body.pdf and https://journals.plos.org/plosone/s/file?id=ba62/PLOSOne_formatting_sample_title_authors_affili ations.pdf 2. Please update your submission to use the PLOS LaTeX template. The template and more information on our requirements for LaTeX submissions can be found at http://journals.plos.org/plosone/s/latex. Author’s response: We have used the template based on the links you provided. 3. When completing the data availability statement of the submission form, you indicated that you will make your data available on acceptance. We strongly recommend all authors decide on a data sharing plan before acceptance, as the process can be lengthy and hold up publication timelines. Please note that, though access restrictions are acceptable now, your entire data will need to be made freely accessible if your manuscript is accepted for publication. This policy applies to all data except where public deposition would breach compliance with the protocol approved by your research ethics board. If you are unable to adhere to our open data policy, please kindly revise your statement to explain your reasoning and we will seek the editor's input on an exemption. Please be assured that, once you have provided your new statement, the assessment of your exemption will not hold up the peer review process. Author’s response: We have added the source of the dataset in a separate new section named “Data Source”. Previously, we have added the references of the dataset, which is why it was kept unchanged. 4. We note that Figure 1 in your submission contain copyrighted images. All PLOS content is published under the Creative Commons Attribution License (CC BY 4.0), which means that the manuscript, images, and Supporting Information files will be freely available online, and any third party is permitted to access, download, copy, distribute, and use these materials in any way, even commercially, with proper attribution. For more information, see our copyright guidelines: http://journals.plos.org/plosone/s/licenses-and-copyright. We require you to either (1) present written permission from the copyright holder to publish these figures specifically under the CC BY 4.0 license, or (2) remove the figures from your submission. Author’s response: We have removed the figure 1 as due to submitting revised manuscript time constraints, we are unable to reach the Flaticon. However, our methodology is written in such a way readers will not require a high level methodology figure. Reviewer #1: Major Concerns 1. Novelty and Contribution (Critical) ESN integration lacks theoretical justification over LSTM/GRU Contribution claims overlap with existing DRL-based IDS work [14, 15, 20] Author’s response: We included theoretical justification of using ESN in Section 4.3.3. Regarding the contribution claim, the author acknowledges DRL based IDS work in [14,15,20] contains similar contributions. However, we proposed a lightweight DRL agent which can predict unseen attacks shown in section 5. Yes, benchmark models like LSTM can be more accurate than proposed ESN, but LSTM does require huge computational overhead. Our goal was to reach similar LSTM level performance by considering less computational units. 2. Zero-day attack evaluation (Table 3) is unclear—how does excluding DoS from training prove adaptive modeling when other DoS variants exist? No computational complexity analysis despite claiming ESN is "lightweight" Missing real-time latency measurements. Author response: Our evaluation in Table 3 is a targeted simulation of real-world zero-day conditions, designed to test the model's ability to recognize novel attack variants, not merely unfamiliar categories. By training on a subset of DoS behaviors (e.g., DDoS) and testing on withheld DoS subtypes (e.g., GoldenEye), we force the model to learn the fundamental, transferable features of an attack class rather than overfitting to specific signatures. This intra-category generalization is a stricter and more meaningful test for a zero-day classifier: if a model cannot recognize a new variant of a known threat type (e.g., a novel DoS technique), it will certainly fail against entirely novel threat categories. Therefore, this split strategy directly evaluates the adaptive, feature-based reasoning essential for detecting true zero-day attacks in evolving network environments. Thank you for the valuable feedback regarding computational complexity. You are correct that a thorough analysis strengthens the claim of being "lightweight." While real-time latency can vary significantly based on hardware, software stack, and system load making cross-study comparisons difficult, we have provided a more standardized and hardware-agnostic metric: FLOPs (Floating Point Operations) in table 10. 3. Reward mechanism (+1/-1) overly simplistic—no justification Author response: The core contribution of our work is the novel application of an RL-driven model adaptation framework to the zero-day IDS problem. The simple reward function allows us to isolate and demonstrate the efficacy of this framework itself, without conflating results with the effects of a highly tuned reward signal. The strong performance achieved (as shown in our results) validates that this simple signal is sufficient for the agent to learn an effective policy for our task. 4. DRL training convergence criteria vague. Author's response: Thank you for your insightful comment regarding the need for explicit convergence criteria. In response to your feedback, we have added a dedicated subsection in the methodology that details the empirical basis for our training duration and convergence assessment. Our DRL agent was trained for a fixed number of episodes (EPISODES = 31), a value determined through careful observation of training dynamics, where both reward signals and validation accuracy consistently plateaued after approximately 15–20 episodes with negligible subsequent improvement. This conservative episode limit ensures stable convergence while highlighting the sample efficiency of our ESN-enhanced architecture, which achieves robust policy optimization rapidly. We believe this clarification strengthens the reproducibility and methodological transparency of our work. Reviewer #2: 1. Based on the results reported in Table 1, the proposed method does not demonstrate a clear improvement over the approaches presented in [15] and [19]. The authors are encouraged to more clearly highlight the novelty and advantages of their method compared to these existing works. Author response: Regarding the contribution claim, the author acknowledges DRL based IDS work in [15,19] contains similar contributions. However, we proposed a lightweight DRL agent which can predict unseen attacks shown in section 5. Yes, benchmark models like LSTM can be more accurate than proposed ESN, but LSTM does require huge computational overhead. Our goal was to reach similar LSTM level performance by considering less computational units. We have added FLOPs score table and provided an explanation to how our proposed model is better in terms of accuracy-computational efficiency trade off. 2. The manuscript appears to be excessively long relative to the level of technical novelty it offers. A substantial portion of the paper is devoted to revisiting fundamental concepts of Deep Reinforcement Learning (DRL), which would be more appropriate for a technical report or tutorial-style paper rather than a research-oriented scientific article. The authors are advised to significantly streamline the background section and focus more on the original contributions. Author response: Our writing style was intentionally tailored to align with the multidisciplinary and accessibility-focused ethos of PLOS ONE, which explicitly encourages manuscripts to be understandable to researchers across fields. Given that our work sits at the intersection of network security, machine learning, and reinforcement learning, we included a thorough yet concise background on DRL to ensure that readers from any of these disciplines can fully engage with our contributions without needing to consult external tutorials. That said, we recognize the importance of conciseness in research articles. We made changes according to the reviewer's feedback. We believe the adjustments preserve the manuscript’s clarity for a broad audience. 3. To improve the reproducibility of the proposed approach, the authors are strongly encouraged to include a detailed description of the DRL network architecture employed in the study, such as the network structure, key hyperparameters, and training configuration. Author response: Thank you for emphasizing the importance of reproducibility. We appreciate your feedback and would like to clarify that the detailed description of the DRL network architecture, including the network structure, key hyperparameters, and training configuration, was already provided in Sections 4 of the submitted manuscript. Attachments Attachment Submitted filename: Response to Reviewers - PONE-D-25-48877.pdf https://doi.org/10.1371/journal.pone.0333038.r002
13 Mar 2026 Decision Letter - Kamran Siddique, Editor A Deep Reinforcement Based Echo State Network for Network Intrusion Classification PONE-D-25-48877R1 Dear Dr. Farid, We’re pleased to inform you that your manuscript has been judged scientifically suitable for publication and will be formally accepted for publication once it meets all outstanding technical requirements. Within one week, you’ll receive an e-mail detailing the required amendments. When these have been addressed, you’ll receive a formal acceptance letter and your manuscript will be scheduled for publication. An invoice will be generated when your article is formally accepted. Please note, if your institution has a publishing partnership with PLOS and your article meets the relevant criteria, all or part of your publication costs will be covered. Please make sure your user information is up-to-date by logging into Editorial Manager at Editorial Manager® and clicking the ‘Update My Information' link at the top of the page. For questions related to billing, please contact and clicking the ‘Update My Information' link at the top of the page. For questions related to billing, please contact and clicking the ‘Update My Information' link at the top of the page. For questions related to billing, please contact and clicking the ‘Update My Information' link at the top of the page. For questions related to billing, please contact billing support.... If your institution or institutions have a press office, please notify them about your upcoming paper to help maximize its impact. If they’ll be preparing press materials, please inform our press team as soon as possible -- no later than 48 hours after receiving the formal acceptance. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information, please contact onepress@plos.org. Kind regards, Kamran Siddique Academic Editor PLOS One Additional Editor Comments (optional): Reviewers' comments: Reviewer's Responses to Questions Comments to the Author Reviewer #1: All comments have been addressed Reviewer #2: All comments have been addressed ******** 2. Is the manuscript technically sound, and do the data support the conclusions??> Reviewer #1: Yes Reviewer #2: Yes ****** 3. Has the statistical analysis been performed appropriately and rigorously? -->?> Reviewer #1: Yes Reviewer #2: Yes ****** 4. Have the authors made all data underlying the findings in their manuscript fully available??> The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified.requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified.--> Reviewer #1: Yes Reviewer #2: Yes ****** 5. Is the manuscript presented in an intelligible fashion and written in standard English??> Reviewer #1: Yes Reviewer #2: Yes ****** Reviewer #1: author address all of the major concern. i am pleased to accept this manuscript to publish. Before submitting final. author needs to check grammatical errors. Reviewer #2: The authors addressed all my comments. I don't have any further comments on the paper. ****** what does this mean?). If published, this will include your full peer review and any attached files.). If published, this will include your full peer review and any attached files.). If published, this will include your full peer review and any attached files.). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review? For information about this choice, including consent withdrawal, please see our For information about this choice, including consent withdrawal, please see our For information about this choice, including consent withdrawal, please see our For information about this choice, including consent withdrawal, please see our Privacy Policy..--> Reviewer #1: No Reviewer #2: No ******** https://doi.org/10.1371/journal.pone.0333038.r003
Formally Accepted
Acceptance Letter - Kamran Siddique, Editor PONE-D-25-48877R1 PLOS One Dear Dr. Farid, I'm pleased to inform you that your manuscript has been deemed suitable for publication in PLOS One. Congratulations! Your manuscript is now being handed over to our production team. At this stage, our production department will prepare your paper for publication. This includes ensuring the following: * All references, tables, and figures are properly cited * All relevant supporting information is included in the manuscript submission, * There are no issues that prevent the paper from being properly typeset You will receive further instructions from the production team, including instructions on how to review your proof when it is ready. Please keep in mind that we are working through a large volume of accepted articles, so please give us a few days to review your paper and let you know the next and final steps. Lastly, if your institution or institutions have a press office, please let them know about your upcoming paper now to help maximize its impact. If they'll be preparing press materials, please inform our press team within the next 48 hours. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information, please contact onepress@plos.org. You will receive an invoice from PLOS for your publication fee after your manuscript has reached the completed accept phase. If you receive an email requesting payment before acceptance or for any other service, this may be a phishing scheme. Learn how to identify phishing emails and protect your accounts at https://explore.plos.org/phishing. If we can help with anything else, please email us at customercare@plos.org. Thank you for submitting your work to PLOS ONE and supporting open access. Kind regards, PLOS ONE Editorial Office Staff on behalf of Dr. Kamran Siddique Academic Editor PLOS One https://doi.org/10.1371/journal.pone.0333038.r004

Open letter on the publication of peer review reports

PLOS recognizes the benefits of transparency in the peer review process. Therefore, we enable the publication of all of the content of peer review and author responses alongside final, published articles. Reviewers remain anonymous, unless they choose to reveal their names.

We encourage other journals to join us in this initiative. We hope that our action inspires the community, including researchers, research funders, and research institutions, to recognize the benefits of published peer review reports for all parts of the research system.

Learn more at ASAPbio .