Reinforcement Learning-Enhanced Zabbix Agents for Adaptive IoT Network Monitoring Using Proximal Policy Optimization

Traditional Zabbix-based monitoring relies on static thresholds and lacks adaptability to dynamic threats in IoT environments. To address this limitation, we propose an intelligent Zabbix agent enhanced with Proximal Policy Optimization (PPO) based reinforcement learning within a federated learning framework. The agent observes system states including CPU and memory utilization, network traffic, service status, and active alerts and dynamically selects actions such as adaptive polling, monitoring intensity adjustment, anomaly detection, and automated response. The reward function is carefully designed to promote system stability, rapid incident handling, efficient resource consumption, and suppression of false or redundant alerts. Leveraging an Actor-Critic architecture with PPO's clipping mechanism, the agent achieves stable policy learning and enables parallelized training across distributed IoT nodes while preserving data privacy. A lightweight intermediary layer seamlessly integrates the intelligent agent with the standard Zabbix platform, allowing real-time adjustment of polling intervals, context-aware alert triggering, and execution of corrective scripts. Evaluated on real-world IoT network traffic encompassing common cyber attacks including DoS, worms, exploits, reconnaissance, and generic malicious activities the proposed approach significantly outperforms conventional static policies: anomaly detection accuracy improves from ۷۲% to ۸۹%, F۱-score rises from ۰.۷۰ to ۰.۸۸, the false positive rate is reduced by over ۵۰%, and average response time decreases by up to ۲۰%. These results demonstrate that reinforcement learning effectively transforms traditional monitoring into adaptive, efficient, and security-aware supervision for large-scale IoT infrastructures.

کلیدواژه ها:

Zabbix ، Reinforcement Learning ، Proximal Policy Optimization ، Cyber Attack Detection