Source-linked AI summary
Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems
Giovanni Apruzzese, Mauro Andreolini, Luca Ferretti, Mirco Marchetti, Michele Colajanni
TL;DR
Existing ML-NIDS adversarial-attack research often relies on unrealistic assumptions about attacker knowledge, access, or interaction. The paper models the capabilities and conditions required for feasible attacks, applies that model to prior work, and finds that many published threat models do not fit realistic ML-NIDS environments. It also identifies recent movement toward more realistic scenarios and boundaries that can guide future research and defense.
Problem
Many adversarial-attack studies for ML-NIDS use threat models that assume complete system knowledge or unconstrained interaction, despite the need to assess realistic cyber environments.
Method
The paper defines five target-system elements and models attacker power over them to assess the feasibility of adversarial attacks against ML-NIDS.
Results
Applying the model shows that few studies represent authentic cyber-defensive scenarios, while many published threat models are inapplicable to realistic ML-NIDS and recent work is becoming more realistic.
Takeaways & Limitations
The model can guide researchers toward realistic threat models and help security experts prioritize feasible attack scenarios when hardening ML-based defenses.
Takeaways & Limitations
Realistic attacks are constrained by obstacles such as limited feedback and the difficulty of obtaining access to the detection model or its source code.
Abstract
from arXiv · showhide
The incremental diffusion of machine learning algorithms in supporting cybersecurity is creating novel defensive opportunities but also new types of risks. Multiple researches have shown that machine learning methods are vulnerable to adversarial attacks that create tiny perturbations aimed at decreasing the effectiveness of detecting threats. We observe that existing literature assumes threat models that are inappropriate for realistic cybersecurity scenarios because they consider opponents with complete knowledge about the cyber detector or that can freely interact with the target systems. By focusing on Network Intrusion Detection Systems based on machine learning, we identify and model the real capabilities and circumstances required by attackers to carry out feasible and successful adversarial attacks. We then apply our model to several adversarial attacks proposed in literature and highlight the limits and merits that can result in actual adversarial attacks. The contributions of this paper can help hardening defensive systems by letting cyber defenders address the most critical and real issues, and can benefit researchers by allowing them to devise novel forms of adversarial attacks based on realistic threat models.
1 INTRODUCTION
Adversarial attacks threaten ML-based cybersecurity defenses, but research on ML-NIDS often assumes unrealistic attacker knowledge or access. This paper models feasible attack capabilities, evaluates existing attacks, and identifies implications for researchers and defenders.
- Adversarial attacks exploit machine-learning vulnerabilities by crafting inputs that thwart predictions.
- Most NIDS adversarial-attack studies do not adequately discuss whether their proposed attacks are realistic or feasible.
- Some studies assume attackers know everything about the target system or can conduct arbitrarily many undetected trials.
- The paper models attacker capabilities and conditions across five target-system elements to assess realistic attacks against ML-NIDS.
- Applying the model to existing research shows that few studies represent authentic cyber-defensive environments, although recent work is becoming more realistic.
- The model can help researchers formulate realistic threat models and help security experts prioritize feasible attacker scenarios when hardening ML-NIDS.
2 BACKGROUND
ML-NIDS analyze network data with learned models to identify malicious activity, but their deployment and attack surface constrain realistic adversarial scenarios. Attacks may target training or inference and differ according to attacker knowledge, feedback, and manipulation access.
- 2.1 Network Intrusion Detection Systems based on Machine Learning: Network intrusion detection systems analyze network data and generate alerts to support human defenders handling large event volumes.
- 2.1 Network Intrusion Detection Systems based on Machine Learning: Cybersecurity threat models generally exclude direct attacker access to the NIDS because compromising the defensive infrastructure would make protections bypassable.
- 2.1 Network Intrusion Detection Systems based on Machine Learning: ML-NIDS preprocess network traffic into features or samples that a trained model classifies as legitimate or malicious.
- 2.1 Network Intrusion Detection Systems based on Machine Learning: Third-party ML-NIDS commonly operate as black boxes because organizations lack access to the model’s training data, configuration, and parameters.
- 2.2 Adversarial Attacks against Machine Learning: Poisoning attacks manipulate training data, whereas inference-time evasion attacks seek to have malicious samples classified as legitimate.
- 2.2 Adversarial Attacks against Machine Learning: White-box, black-box, and gray-box attacks differ by the attacker’s knowledge and ability to query or infer the detection mechanism.
3 RELATED WORK
Adversarial machine-learning research has expanded rapidly, but cybersecurity and NIDS remain less represented than image and text classification. This paper focuses on whether proposed NIDS attacks pose realistic threats to modern cyber systems.
- Research on adversarial machine learning has grown rapidly, with most studies targeting image and text classification rather than cybersecurity.
- Cybersecurity studies often report substantial model degradation, raising concerns that adversarial attacks may be overestimated in real environments.
- The paper asks which adversarial attacks proposed in the literature represent real threats to modern cyber systems.
- Earlier NIDS-related research addressed broader adversarial machine-learning or botnet-detection problems without presenting concrete adversarial perturbation use cases against NIDS.
- Existing evidence indicates that organizations recognize adversarial attacks but do not treat them as a top priority because effective real-world defenses are lacking.
4 MODELING OF REALISTIC ADVERSARIAL ATTACKS
The paper models attacker power across five ML-NIDS elements and evaluates which adversarial scenarios are feasible in realistic environments. It finds that realistic attacks generally involve limited knowledge, no NIDS feedback, and direct manipulation of network traffic rather than feature representations.
- Modeling attacker power: The paper defines attacker “power” as control over five ML-NIDS elements, extending existing adversarial-attack taxonomies to model realistic capabilities.The identified elements include training data, feature set, detection model, oracle access, and data-manipulation capabilities.
- Training data: Reliable read or write access to training data is generally unrealistic and is mainly obtainable when the organization manages the NIDS and dataset internally.Third-party provider datasets are typically inaccessible unless the provider’s network is compromised.
- Detection model and feature set: White-box access to the detection model is unlikely because the model requires privileged access, and its source code may be unavailable or separately stored.Attackers can more plausibly infer some feature information from domain expertise than obtain the model’s internal configuration.
- Oracle access: Obtaining oracle power requires both avoiding detection during queries and reliably receiving input-output feedback from the NIDS.Real attackers may obtain limited or uncertain feedback, whereas complete oracle power is feasible mainly for compromised or commercial systems under specific conditions.
- Data manipulation: Problem-space attacks are more realistic than feature-space attacks because manipulating feature representations requires control over the ML component.Problem-space attacks alter real network traffic, while feature-space attacks require manipulating the raw-to-feature conversion process.
- Overall feasibility: Figure 4 ranks forms of attacker power by realistic feasibility and emphasizes that resource-intensive attacks may be possible but less likely to be attempted.The framework is intended to identify which circumstances are most likely in real adversarial attacks against ML-NIDS.
- Overall feasibility: The most realistic attacks manipulate real network traffic with partial feature knowledge, no NIDS feedback, and no access to training data.These scenarios do not require prior compromise of the NIDS or access to proprietary information and may be feasible for average-skilled attackers at low cost.
- Attack phase: Training-phase poisoning requires write access to the training data; without it, attackers are limited to inference-time attacks.Poisoning can be highly powerful but can be avoided by denying attackers power over the training set, whereas inference-time threat models involve more varied attacker powers.
5 REALISTIC EVALUATION OF EXISTING ATTACKS
The paper evaluates existing adversarial attacks against ML-NIDS using feasibility-oriented criteria, including attacker power, preservation of malicious behavior, and realistic data and query constraints. Its case studies show substantial variation in realism, with recent work addressing some practical obstacles but many scenarios remaining difficult to perform in real environments.
- Evaluation criteria: Realistic attacks must preserve the original sample’s malicious logic, feature interdependencies, and physically possible feature values.Examples include TCP packet sizes not exceeding 64 KBytes and flow durations respecting collector thresholds.
- Evaluation criteria: The evaluation surveys existing ML-NIDS attacks by recording attacker power over training data, features, detection models, and oracle interactions.It also records whether perturbations preserve maliciousness and integrity, attack type, and experimental datasets.
- Survey findings: Recent studies increasingly use datasets such as CTU-13, Kitsune, UNSW-NB15, ICSX2016, IDS2017, and CICIDS2018 instead of relying only on KDD99.Multiple and more recent datasets increase experimental value and support evaluation in modern defensive scenarios.
- Survey findings: Only a minority of proposals considers poisoning, whereas most focus on inference-time evasion because attackers face difficulty acquiring power over training data.Unlimited-query oracle assumptions are also realistic only when attackers can obtain a perfect replica, while some recent papers impose query limits.
- Survey findings: Many proposals verify preservation of sample integrity and malicious logic, while few evaluate attacks in the problem space.The paper identifies problem-space attacks as an opportunity for more complex and realistic adversarial samples.
- Case studies: The case studies span attacks with very different feasibility levels, from low-power problem-space evasion to training-data poisoning and unlimited-query oracle attacks.One low-power evasion study reduced detection from a baseline 99.9% to 70%, while other cases assume substantially greater access or feedback.
6 CONCLUSIONS
The paper concludes that many adversarial threat models for ML-NIDS are not applicable to realistic defensive environments. Its power-based analysis identifies feasible attacker circumstances, highlights real obstacles, and supports more representative research and defensive prioritization.
- Conclusions: Many studies assume adversarial threat models that are practically unfeasible for ML-NIDS, while recent work increasingly considers obstacles attackers must overcome.The paper frames this as a gap between academic scenarios and real defensive environments.
- Conclusions: The proposed parameters help distinguish attacks that are more or less likely to result in real adversarial attacks.The analysis is focused on identifying the target-system elements and attacker capabilities relevant to ML-NIDS.
- Conclusions: The framework can guide researchers toward threat models that better represent real defensive settings and help security experts prioritize vulnerabilities for hardening.The paper focuses on NIDS but states that some analyses may extend to phishing and malware detection.