PaperlayerView exact revision on arXiv

Source-linked AI summary

Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors

Dongqi Han, Zhiliang Wang, Ying Zhong, Wenqi Chen, Jiahai Yang, Shuqiang Lu, Xingang Shi, Xia Yin

arXiv:2005.07519v4cs.CRcs.LGcs.NI

TL;DR

ML-based NIDSs are vulnerable to adversarial attacks, but prior evaluations often assume feature-space access or white-box knowledge. This paper develops gray/black-box traffic-space attacks that preserve malicious functionality and evaluates their robustness across NIDS settings. The attack exceeds 97% evasion in half of Kitsune cases, while the proposed defense reduces evasion by more than 50% in most cases.

  • Problem

    Existing ML-based NIDS attacks largely rely on impractical feature-space or white-box assumptions, leaving practical gray/black-box traffic-space robustness evaluation insufficiently studied.

  • Method

    The paper combines bi-level adversarial optimization, surrogate models and feature extraction, safe traffic mutation, and meta-info vectors to generate functionality-preserving traffic-space attacks.

  • Results

    >97% evasion rate is achieved in half of Kitsune cases, while attack effectiveness remains strong with limited feature knowledge and crafted traffic stays stealthy in most tested cases.

  • Takeaways & Limitations

    Robustness evaluation and feature engineering for ML-based NIDSs should consider anti-evasion robustness alongside detection performance.

Abstract

from arXiv · show

Machine learning (ML), especially deep learning (DL) techniques have been increasingly used in anomaly-based network intrusion detection systems (NIDS). However, ML/DL has shown to be extremely vulnerable to adversarial attacks, especially in such security-sensitive systems. Many adversarial attacks have been proposed to evaluate the robustness of ML-based NIDSs. Unfortunately, existing attacks mostly focused on feature-space and/or white-box attacks, which make impractical assumptions in real-world scenarios, leaving the study on practical gray/black-box attacks largely unexplored. To bridge this gap, we conduct the first systematic study of the gray/black-box traffic-space adversarial attacks to evaluate the robustness of ML-based NIDSs. Our work outperforms previous ones in the following aspects: (i) practical-the proposed attack can automatically mutate original traffic with extremely limited knowledge and affordable overhead while preserving its functionality; (ii) generic-the proposed attack is effective for evaluating the robustness of various NIDSs using diverse ML/DL models and non-payload-based features; (iii) explainable-we propose an explanation method for the fragile robustness of ML-based NIDSs. Based on this, we also propose a defense scheme against adversarial attacks to improve system robustness. We extensively evaluate the robustness of various NIDSs using diverse feature sets and ML/DL models. Experimental results show our attack is effective (e.g., >97% evasion rate in half cases for Kitsune, a state-of-the-art NIDS) with affordable execution cost and the proposed defense method can effectively mitigate such attacks (evasion rate is reduced by >50% in most cases).

I. INTRODUCTION

ML-based NIDSs can detect new attacks but are vulnerable to adversarial manipulation, while existing attacks often rely on impractical feature-space or white-box assumptions. This paper targets practical gray/black-box traffic-space evaluation with constrained, functionality-preserving mutations.

  • ML/DL models are vulnerable to small, well-designed input changes that can significantly alter their outputs, making practical robustness evaluation necessary.
  • Feature-space attacks are impractical for NIDSs because network-traffic feature extraction is neither invertible nor differentiable.
  • Existing traffic-space methods include traditional evasion, benign-traffic imitation or random mutation, and a white-box adversarial attack requiring inaccessible NIDS knowledge.
  • The paper frames practical evaluation around functionality-preserving traffic mutation with extremely limited knowledge and affordable overhead.
  • The proposed attack formulates traffic-space evasion as bi-level optimization: solve adversarial features, then search for a nearby traffic variant with small mutation overhead.
  • A meta-info vector, explanation by feature-manipulation extent, and vulnerable-feature removal support attack construction, interpretation, and robustness improvement.

III. BACKGROUND AND MOTIVATION

The paper studies non-payload-based ML-based NIDSs as pipelines that extract features from captured traffic before classification. It identifies irreversibility, inaccessible model knowledge, and unconstrained mutation as limitations of prior attacks.

  • A. Targeted ML-based NIDSs: ML-based NIDSs capture traffic, engineer and select features, and feed the resulting representation to an ML classifier for training or detection.
  • A. Targeted ML-based NIDSs: The study focuses on NIDSs that do not inspect packet payloads, defining the evaluated systems as non-payload-based.
  • B. Adversarial Attacks: The attack setting represents original and mutated traffic as t and ˆt, extracts feature vectors f and ˆf, and models extraction and classification with E(·) and C(·).
  • C. Formulation and Limitations of Existing Attacks: Prior feature-space attacks directly modify feature values without specifying how to mutate traffic, although NIDS feature extraction is irreversible.
  • C. Formulation and Limitations of Existing Attacks: Existing attacks also assume white-box classifier knowledge or unlimited mutation overhead, both of which conflict with practical attacker constraints.
  • C. Formulation and Limitations of Existing Attacks: The proposed attack relaxes feature-space and white-box assumptions while adding an overhead constraint.

IV. ATTACK METHODOLOGY

The attack methodology targets ML-based NIDSs under practical gray- and black-box constraints by mutating traffic with limited knowledge and affordable overhead. It uses a bi-level optimization that first finds nearby adversarial features and then searches for a corresponding traffic variant.

  • Threat Model: The threat model limits attackers to mutating malicious traffic they control without target-classifier outputs, while considering practical gray-box and black-box settings.Gray-box attacks know the target features; black-box attacks use a surrogate extractor based on domain knowledge.
  • Surrogate Components: The approach trains a substitute probabilistic classifier and surrogate feature extractor, using the exact extractor for practical gray-box attacks and a simulated extractor for black-box attacks.This supports attacks when the target model or its output format is unavailable.
  • Problem Formulation: The attack replaces direct traffic search with a bi-level optimization that minimizes classifier output and feature-space distance subject to safe traffic mutations.The formulation uses a surrogate classifier C′ and extractor E′, with mutation set M_s(t).
  • Two-Step Attack: First, it generates an adversarial feature classified as benign and close to the malicious feature; second, it mutates traffic toward that feature.The two stages address the difficulty of finding low-overhead traffic mutations directly.
  • Two-Step Attack: Feature-space distance is used as a proxy for traffic-mutation overhead, guiding traffic toward low-confidence regions that may otherwise be missed.Without adversarial-feature guidance, mutations may fail to reach or pass through benign regions under limited attacker ability.

2) Solving adversarial features f★:

Adversarial features are generated model-agnostically and efficiently, then used to guide automatic traffic mutation. GANs produce target features, while PSO searches safe traffic-space variants represented as meta-information vectors.

  • Adversarial Features Generation: GANs generate adversarial features by using a discriminator as a substitute classifier and a generator that can efficiently transform malicious features.The approach requires no target-model knowledge and can generate features for many malicious inputs after training.
  • Traffic Representation: Traffic is vectorized into high-dimensional meta-information vectors because raw network traffic is unstructured and unsuitable for direct numerical optimization.The vectorization supports safe mutation operations while retaining a route back to rebuilt traffic.
  • Malicious Traffic Mutation: PSO searches candidate traffic mutants whose extracted features are closest to the generated adversarial feature.Each particle represents a candidate mutant, and predefined safe operators constrain the search.
  • Workflow: The operational workflow first trains a GAN from benign and malicious features, then applies PSO to mutate malicious traffic automatically.The two workflow stages correspond to the two levels of the proposed optimization.

V. GENERATING ADVERSARIAL FEATURES

The method generates adversarial features with an enhanced GAN and constructs functionality-preserving traffic mutations through packet-level operators. These operators target temporal and spatial traffic characteristics while retaining malicious functionality and stealth.

  • GAN Architecture: The enhanced GAN transforms malicious features using a generator and trains a discriminator as a surrogate classifier against benign and generated features.The generator receives a malicious feature and Gaussian noise, while the discriminator distinguishes generated features from benign ones.
  • GAN Training: The generator objective combines adversarial discrimination with a construct-distance term so generated features resemble benign features while remaining near malicious ones.The training process jointly optimizes generator and discriminator until convergence, producing adversarial features.
  • Traffic Mutation Operators: Mutation operators are designed to affect summarized high-level features while preserving traffic functionality and remaining stealthy.The targeted dimensions include temporal features, global spatial features, and limited local spatial features derived from packet headers and selected protocols.
  • Traffic Mutation Operators: The operators modify packet timing and inject or adjust crafted traffic, including changes to protocol-layer count and payload size.Original packet order is preserved and original malicious traffic is not deleted.
  • Crafted Traffic: Crafted packets must use consistent nearby addressing fields and satisfy constraints that prevent compromising the malicious activity or exposing the mutation.The framework therefore combines packet-header construction with functionality and stealth requirements.

B. Meta-information Vectorization

Meta-information vectorization converts traffic into an invertible representation for numerical optimization while encoding original and crafted packets and bounded mutation overhead. PSO then searches these vectors as candidate traffic mutants.

  • Vector Representation: Traffic is vectorized into invertible meta-information vectors, allowing mutated vectors to be rebuilt into traffic unlike non-invertible feature extraction.The vector representation is denoted by x and reflects the traffic mutation operators.
  • Vector Structure: Each vector element represents an original malicious packet together with crafted packets placed immediately before it in time.The original component stores timestamp and crafted-packet count, while each crafted packet stores timing, protocol-layer count, and payload size.
  • Overhead Budget: The overhead budget limits crafted-packet count through l_c and elapsed mutated-traffic time through l_t.Both limits constrain the candidate traffic mutants explored by the attack.
  • PSO Search: PSO treats each particle position as a flattened meta-information vector and initializes particle fields within valid ranges before iterative search.Particle velocities share the position-vector shape, and timestamps are initialized using subdivisions of the permitted interarrival interval.

2) Effectiveness Evaluation:

The attack evaluates candidate traffic mutations by rebuilding traffic, extracting surrogate-model features, and measuring distance to adversarial features. Iterative swarm updates produce the best evasive mutant, while adversarial feature reduction is proposed as a defense.

  • Effectiveness Evaluation: Each candidate particle is evaluated by rebuilding mutated traffic, extracting surrogate features, and computing distance to adversarial features.The evaluation repeats these steps for each particle position.
  • Effectiveness Evaluation: Particle positions are updated using velocity terms that combine inertia, individual best position, and global best position.Weight and random coefficients govern the update, while clipping and discretization keep values valid.
  • Effectiveness Evaluation: After a fixed number of iterations, traffic rebuilt from the global best position becomes the best evasive mutant.The iterative evaluation and update process is controlled by N_iter.
  • Defense Scheme: The defense scheme simulates attacks and removes feature dimensions with low robustness scores.Robustness scores quantify how closely mutated-traffic feature values approach adversarial features relative to original values.

A. Experimental Settings

The evaluation uses multiple traffic datasets, feature extractors, ML/DL classifiers, attack baselines, and metrics to assess evasiveness, detection performance, interpretability, cost, and functionality preservation.

  • Datasets: The study uses Kitsune and CIC-IDS2017 traffic datasets covering six well-known attacks and diverse network settings.Kitsune evaluates attacks in a video-surveillance network, while CIC-IDS2017 covers common attacks in a large-scale testbed.
  • Feature Extractors: AfterImage and CI-CFlowMeter provide packet-based and flow-based feature extraction, respectively.They compute statistics such as packet size, count, jitter, connection size, and duration.
  • ML Classifiers: Six classifiers cover deep, supervised, traditional, and unsupervised ML models, including KitNET, MLP, LR, DT, SVM, and IF.KitNET is an unsupervised ensemble of autoencoders, while MLP represents supervised deep learning.
  • Baseline Attacks: Random-ST and Random-Dup serve as traffic-space random-mutation baselines, while prior signature-based and feature-space attacks are excluded when ineffective or incompatible.Packet injection was also omitted because it had no effect, while deletion or reordering compromised functionality.
  • Metrics: MER, DER, and PDR measure evasive effectiveness, while Precision, Recall, and F1-score measure detection performance.DER additionally considers whether crafted traffic is classified as malicious, and PDR measures decline in malicious probabilities.
  • Interpretability and Evaluation: MMR indicates how closely malicious features approach adversarial features during traffic mutation.The experiments also compare attack effectiveness with baselines and across malicious traffic and NIDS types.

B. Evasive Effectiveness of Different Attacks

The proposed attack generally outperforms random mutations and the white-box TWA baseline across traffic sets, while adversarial features and larger budgets improve evasion. It remains effective across NIDS models and feature extractors, including with limited feature knowledge, at an execution cost tunable through its parameters.

  • Evasive effectiveness comparison: The GAN+PSO attack outperforms random mutations at the same budget and surpasses the white-box TWA attack across the reported comparison.Random mutations are unstable across traffic sets, whereas the proposed attack maintains stronger evasive effectiveness.
  • Impact of adversarial features: Adversarial features usually increase MER/DER by 10-20%, exceeding 90% over PSO alone in Fuzzing.The comparison evaluates GAN+PSO against PSO without adversarial features.
  • Impact of overhead budget: Larger overhead budgets raise MER/DER by 20-30% in most cases for GAN+PSO.The higher budget permits more traffic mutation while relaxing the overhead limitation.
  • Generality across NIDSs: The attack generalizes across ML classifiers and feature extractors, outperforming TWA in all reported cases.Random-RT performs poorly, while Random-Dup succeeds only in a few cases; the authors attribute generality to feature-level mimicking.
  • Limited feature knowledge: Even with no accurate knowledge of target features, PBA(0%) retains strong evasive ability, with PDR dropping within 20% of PGA.PBA(50%) and PBA(75%) achieve PDR similar to PGA.
  • Execution cost and parameters: The parameter setting (3,6,100) approximates TWA execution time while achieving better evasive performance, whereas larger settings trade more time for higher evasion.The authors select (5,10,1000) as their preferred balance for the remaining experiments.

F. Verification of Malicious Functionality

The study verifies that mutated traffic preserves malicious functionality across six traffic sets using attack effect, malicious behavior, and attack efficiency indicators. It also evaluates defenses, finding AFR more effective than adversarial training or feature selection while keeping F1-score changes within ±5%.

  • Functionality verification: Mutation operators are designed not to compromise original malicious functionality, and functionality is verified across all six traffic sets.The experiments replay original and mutated traffic in simulated testbeds and compare the three indicators.
  • Functionality verification: The verification compares original and mutated traffic using attack effect, malicious behavior, and attack efficiency indicators.For Botnet, the example tracks successful device scans, scan counts, and elapsed attack time.
  • Defense evaluation: AFR reduces MER/PDR/MMR more effectively than adversarial training and feature selection in the defense evaluation.Adversarial training is limited and unstable because it does not prevent vulnerable feature dimensions from being exploited.
  • Defense evaluation: F1-score changes remain within ±5% for the evaluated defense methods.The paper uses this change to assess whether defenses compromise original detection performance.
  • Overall findings: The paper reports an attack evasion rate above 97% in half of the cases and effective mitigation by the proposed defense.The conclusion summarizes the systematic evaluation of practical traffic-space attacks.

APPENDIX A CORRELATION TEST BETWEEN OVERHEAD OF

The correlation test examines whether moving farther in feature space requires greater traffic-space mutation overhead. It reports a strong correlation and presents the feature summarization and mutation framework used to affect high-level NIDS features.

  • Definitions: Feature-space distance is defined as Euclidean distance, while traffic-space overhead combines delay overhead and crafted traffic volume overhead.These components correspond to the experimental budgets l_t and l_c.
  • Correlation test: The test samples 100,000 malicious-target feature pairs after extracting 10,000 malicious features and sampling ten targets per feature.Target features are sampled at Euclidean distances ranging from 100 to 1000.
  • Results: The correlation test reports a Pearson Correlation Coefficient of 0.8664 between feature-space distance and traffic-space overhead.The authors characterize this as a strong correlation.
  • Results: The authors conclude that adversarial features can reduce traffic-mutation overhead by shortening the required feature-space movement.The conclusion follows the reported strong correlation between the two distance or overhead measures.
  • Feature summarization: The summarization method organizes NIDS features across packet or session forms, size, count, time, and windowed or statistical processing.The appendix uses this abstraction to design mutation operators affecting high-level features.

APPENDIX C PSO-BASED TRAFFIC MUTATION ALGORITHM

The appendix describes PSO-based traffic mutation and adversarial feature evaluation procedures, then verifies that mutated traffic retains malicious functionality across attack datasets.

  • PSO-based mutation: The PSO mutation algorithm evaluates particle evasiveness, updates individual and global best positions, and then applies cognitive and social forces.Particle velocities use inertia, cognitive, and social terms before positions are updated under overhead constraints.
  • Adversarial feature evaluation: The adversarial feature evaluation algorithm assigns each feature dimension a normalized robustness score between −1 and 1.The score uses MMR-based penalties or rewards depending on whether the original and mutated features cross the anomaly threshold.
  • Adversarial feature evaluation: The evaluation algorithm takes malicious, mutated, adversarial, and benign feature sets plus an anomaly threshold as inputs.It initializes per-dimension scores, computes mutation-related rewards or penalties, and normalizes by the number of feature vectors.
  • Functionality verification: Malicious functionality is verified across all six attack traffic sets by comparing attack effect, malicious behavior, and attack efficiency.The appendix notes that attack effect may be unavailable for some cases but can match malicious behavior when original attempts are preserved.
Loading 2005.07519v4…