Abstract:Adversarial attacks, widely recognized as significant threats to machine learning (ML) models in computer vision and natural language processing, can have more severe consequences when targeting ML-based Network Intrusion Detection Systems (NIDS). These attacks, characterized by data manipulation, necessitate a focused investigation grounded in the unique attributes of the data and practical constraints inherent to the target scenario, as opposed to indiscriminately applying methodologies borrowed from other domains. Since network traffic is complex unstructured data, ML models are commonly used in existing studies to explore how perturbations can defeat ML-based IDS. However, two challenges persist in the realm of traffic-space adversarial attack generation. First, raw traffic data cannot be directly input into ML models. Second, determining the appropriate perturbation scale and direction is challenging, particularly in the case of multi-class NIDS. In this work, we propose a projection-based adversarial attack generation framework, ProGen, to address these two challenges. ProGen is inspired by two observed characteristics of the NIDS scenario: flexible representation and clear objective. ProGen uses a basic feature sequence (BFS) space to represent network traffic in a way that aligns with realistic requirements. To achieve a clear objective, ProGen utilizes a traffic space generative adversarial network (GAN) to approximate distribution mapping between malicious traffic and benign traffic. To better apply the generative model for adversarial attacks, we further design constraints to preserve the functions of the adversarial traffic. We've successfully demonstrated the effectiveness of ProGen on six common ML models using the CSE-CIC-IDS2018, CIC-IDS-2017, and UNSW-NB15 datasets; however, we're yet to validate these findings in real network environments. We visualize the generated distributions of the BFS elements to illustrate the projecting effect under the designed realistic constraints. The results of attack effectiveness tests show that attacks generated from ProGen can significantly reduce the detection performance across different ML models.

PANTS: Practical Adversarial Network Traffic Samples against ML-powered Networking Classifiers

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

Training NLI Models Through Universal Adversarial Attack

Adversarial Network Traffic: Towards Evaluating the Robustness of Deep Learning-Based Network Traffic Classification

Adversarial Analysis of ML-Based Anomaly Detection in Multi-Layer Network Automation

Self-Taught Black-Box Adversarial Attack to Multilayer Network Automation.

Practical Traffic-space Adversarial Attacks on Learning-based NIDSs.

Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Securing Network Traffic Classification Models against Adversarial Examples Using Derived Variables

Deep PackGen: A Deep Reinforcement Learning Framework for Adversarial Network Packet Generation

RBLJAN: Robust Byte-Label Joint Attention Network for Network Traffic Classification

GPMT: Generating Practical Malicious Traffic Based on Adversarial Attacks with Little Prior Knowledge

Adversarial Attacks Against Deep Learning-Based Network Intrusion Detection Systems and Defense Mechanisms

ProGen: Projection-Based Adversarial Attack Generation Against Network Intrusion Detection

Adversarial Attacks Against Network Intrusion Detection in IoT Systems

Explainable and Transferable Adversarial Attack for ML-Based Network Intrusion Detectors

A P4-Based Adversarial Attack Mitigation on Machine Learning Models in Data Plane Devices

MTDeep: Boosting the Security of Deep Neural Nets Against Adversarial Attacks with Moving Target Defense

MagNet: a Two-Pronged Defense against Adversarial Examples

Improving Adversarial Robustness Requires Revisiting Misclassified Examples.