IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection

Zilong Lin; Yong Shi; Zhi Xue

Source-linked AI summary

IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection

Zilong Lin, Yong Shi, Zhi Xue

arXiv:1809.02077v5Sep 6, 2018cs.CRcs.AI

TL;DR

Machine-learning intrusion detection systems remain vulnerable to adversarial examples, motivating attacks that operate without access to IDS internals. IDSGAN combines a generator, a discriminator that learns real-time black-box IDS outputs, and restricted feature modification to preserve attack functionality. It lowers detection rates of adversarial malicious traffic to around 0% across various IDS models and remains robust when fewer features are modified, while the study does not yet experimentally attack running IDS with generated network traffic.

Problem
Machine-learning IDS models are vulnerable to adversarial examples, while GAN-based attacks’ ability to dynamically attack multiple IDS models with preserved functionality remains insufficiently established.
Method
IDSGAN uses a generator to transform malicious traffic, a discriminator trained from queried black-box IDS outputs, and restricted modification of functional features.
Results
IDSGAN lowers detection rates of various IDS models to around 0% and maintains or slightly reduces evasion capacity when the number of modified features is limited.
Takeaways & Limitations
IDSGAN generates adversarial malicious traffic that can evade multiple algorithm-based black-box IDS models while preserving malicious functionalities.
Takeaways & Limitations
The study generates adversarial malicious traffic records but leaves experimentally producing matching malicious network traffic for future work after Ethics Board approval.

Abstract

from arXiv · show

As an essential tool in security, the intrusion detection system bears the responsibility of the defense to network attacks performed by malicious traffic. Nowadays, with the help of machine learning algorithms, intrusion detection systems develop rapidly. However, the robustness of this system is questionable when it faces adversarial attacks. For the robustness of detection systems, more potential attack approaches are under research. In this paper, a framework of the generative adversarial networks, called IDSGAN, is proposed to generate the adversarial malicious traffic records aiming to attack intrusion detection systems by deceiving and evading the detection. Given that the internal structure and parameters of the detection system are unknown to attackers, the adversarial attack examples perform the black-box attacks against the detection system. IDSGAN leverages a generator to transform original malicious traffic records into adversarial malicious ones. A discriminator classifies traffic examples and dynamically learns the real-time black-box detection system. More significantly, the restricted modification mechanism is designed for the adversarial generation to preserve original attack functionalities of adversarial traffic records. The effectiveness of the model is indicated by attacking multiple algorithm-based detection models with different attack categories. The robustness is verified by changing the number of the modified features. A comparative experiment with adversarial attack baselines demonstrates the superiority of our model.

1 Introduction

IDSGAN addresses adversarial vulnerability in machine-learning IDS by generating malicious traffic records that evade black-box detection while preserving attack functionality. It dynamically learns IDS outputs and outperforms adversarial attack baselines.

Machine-learning IDS models are vulnerable to adversarial examples that induce classifier misclassification.
IDSGAN generates adversarial malicious traffic records intended to deceive and bypass black-box intrusion detection systems.
The discriminator learns real-time outputs from black-box IDS models, enabling attacks against updated systems powered by different algorithms.
A restricted modification mechanism preserves the original malicious functionality while generating adversarial traffic.
IDSGAN was evaluated against different IDS variants, with effectiveness measured quantitatively and robustness tested under different numbers of modified features.
IDSGAN outperformed other adversarial attack baselines for intrusion detection.

2 Related Work

Prior work generated adversarial traffic against IDS using white-box and black-box techniques. Existing black-box GAN approaches did not distinguish feature functionality or dynamically learn updated IDS knowledge.

White-box studies used FGSM, JSMA, Targeted FGSM, DeepFool, and CW to craft adversarial traffic with access to victim-model knowledge.
Yang applied zeroth-order optimization and GANs to attack IDS in a black-box setting.
The earlier black-box GAN approach manipulated traffic features without distinguishing their functions, weakening the generated traffic’s attack functionality.
Its pretrained discriminator also lacked dynamic adaptation through querying the latest IDS knowledge.

3 Methodology

IDSGAN uses a generator–discriminator minimax framework to create adversarial malicious traffic that fools black-box IDS models. Training uses NSL-KDD traffic and black-box IDS predictions as discriminator targets.

IDSGAN formulates adversarial traffic generation as a two-player minimax game between a generator and discriminator.
NSL-KDD contains normal traffic and four malicious categories: Probe, DoS, U2R, and R2L.
Each NSL-KDD traffic record is represented by 41 features spanning intrinsic, content, time-based traffic, and host-based traffic sets.
During training, noise-augmented malicious records enter the generator, while the black-box IDS labels adversarial malicious and normal records for discriminator learning.

3.2 Data Preprocessing

IDSGAN preprocesses heterogeneous NSL-KDD features through embedding, numeric conversion, and min-max normalization. Its Wasserstein-GAN-based design restricts modifications to preserve malicious traffic functionality.

Categorical protocol type, service, and flag features are embedded, with protocol values converted into one-hot vectors.
Min-max normalization reduces the effect of differing feature-value ranges before model input.
IDSGAN is based on Wasserstein GAN to address GAN non-convergence and instability.
The generator modifies features under restricted modification so generated adversarial traffic preserves the original malicious functionality.

Restricted modification mechanism

IDSGAN restricts feature modifications so generated adversarial traffic retains the original attack functionality while enabling evasion of IDS detection.

Adversarial generation must retain the original malicious traffic’s attack functionality for real-world reproduction and network attacks.
Table 1 identifies the functional features associated with each NSL-KDD attack category.
Functional features remain unchanged, while nonfunctional features may be fine-tuned or retained during adversarial generation.
The generator produces adversarial malicious traffic records for evasion attacks against IDS.

Generator

The generator transforms original traffic records with noise into adversarial examples using a five-layer neural network and constrained feature processing.

The generator receives the concatenation of an m-dimensional original example vector M and an n-dimensional noise vector N.
A five-layer neural network with ReLU activations in its first four layers outputs adversarial examples with the same m-dimensional size as M.
Output elements are clipped to [0, 1], nonnumeric intrinsic features are not modified, and modified binary features use a 0.5 threshold.
The discriminator is a multilayer network that classifies malicious and normal records while learning and imitating the black-box IDS from queryable real-time results.

Algorithm 1 IDSGAN

Algorithm 1 alternates generator and discriminator updates: the generator creates adversarial malicious records, while the discriminator learns from black-box IDS predictions.

The algorithm initializes the generator G and discriminator D before iterating their respective training steps.
During G-steps, G generates adversarial malicious examples from Sattack and updates its parameters using Equation 1.
During D-steps, the black-box IDS B labels normal and generated adversarial traffic, supplying current predictions for discriminator training.
The discriminator’s loss and detection results provide gradient information that dynamically fine-tunes the generator’s evasion strategy against real-time IDS models.

Training algorithms

Training optimizes separate generator and discriminator objectives, with the discriminator learning black-box IDS labels and RMSProp used as the optimizer.

The generator minimizes LG to optimize adversarial examples for fooling the black-box IDS.
The discriminator trains on adversarial malicious and normal records using labels predicted by the black-box IDS as ground truth.
The discriminator’s objective compares its outputs on normal records with its outputs on adversarial records.
RMSProp optimizes IDSGAN parameters under the Wasserstein GAN formulation.

4 Empirical Evaluation

IDSGAN was evaluated against seven algorithm-based black-box IDS models across DoS, U2R, and R2L attacks. It substantially reduced adversarial detection rates, remained robust when fewer features were modified, and outperformed comparison attack approaches while preserving attack functionality.

Experimental Setup: Seven algorithm-based black-box IDS models were evaluated on NSL-KDD records across DoS, U2R, and R2L attack categories.The evaluation measured detection rate and evasion increase rate, with training and testing procedures separating black-box IDS and discriminator data.
Effectiveness in Different Attack Categories: Around 0 adversarial detection rates across DoS, U2R, and R2L indicate that the tested IDS models were almost incapable of classifying generated adversarial examples.The comparison used original and adversarial detection rates under different IDS algorithms with only functional features unmodified.
Effectiveness in Different Attack Categories: DoS adversarial detection rates fell from around 80% to less than 1%, while each DoS test achieved more than 99.0% evasion and above 99.0% evasion increase rates.Multilayer Perceptrons had the highest DoS adversarial detection rate among the listed IDS models, at 0.72%.
Effectiveness in Different Attack Categories: U2R and R2L adversarial detection rates were equal to or close to 0, with evasion increase rates above 99.5% across the tested IDS algorithms.The low original detection rates for U2R and R2L were attributed to insufficient learning from their small number of training records.
Robustness with Different Numbers of Modified Features: Adding unmodified features caused slight or no decreases in evasion increase rates, supporting strong robustness when fewer features were modified.The effect varied by attack category and IDS algorithm; for example, DoS under K-Nearest Neighbors decreased about 1.00%, while U2R and R2L showed no variation for that algorithm.
Baseline Comparisons: IDSGAN outperformed all baselines by a wide margin while preserving traffic functionality through restricted feature modification and dynamically querying the target IDS.Against the GAN baseline, detection rates rose from 24.34% to 32.45% for DoS and from 2.23% to 3.39% for U2R and R2L when restriction was applied without IDSGAN’s dynamic imitation strategy.

5 Conclusion and Future Work

IDSGAN generates adversarial malicious traffic that evades IDS while preserving attack functionality, and its effectiveness extends across multiple IDS algorithms and attack categories. The paper reports strong robustness under feature-modification limits but leaves real-network traffic generation for future work.

IDSGAN lowers detection rates of adversarial malicious traffic for various IDS models to around 0%.
The restricted modification mechanism preserves malicious traffic functionality while limiting changes during adversarial example generation.
IDSGAN attacks real-time black-box IDS models powered by multiple machine learning algorithms.
Its adversarial examples maintain or slightly reduce evasion capacity when the number of modified features is limited, indicating strong robustness.
The study focuses on generating adversarial malicious traffic records; producing matching malicious network traffic for experiments is identified as future work.