Analyzing and Mitigating Poisoning Attacks on Flow-Based Intrusion Detection

I. INTRODUCTION

• The proposed diagnostic-first methodology localizes trigger-relevant features through constrained perturbation analysis and comparative model diagnostics.It targets post-training analysis in high-dimensional tabular IDS settings, unlike prior work focused on image domains or training-time defenses.Source: §I · p. 1
• 0.001% training-data poisoning can implant effective backdoors in flow-based IDS models without degrading clean-data performance.The paper uses open-source benchmarks such as CSE-CIC-IDS2018.Source: §I · p. 1
• Timing-based and combined feature manipulations are particularly susceptible to backdoor implantation.The paper analyzes both single- and multi-feature attacks.Source: §I · p. 1
• The methodology supports targeted backdoor mitigation under realistic operational constraints.The paper identifies this as a principal contribution.Source: §I · p. 1

II. RELATED WORK

• Backdoor attacks can preserve standard performance while embedding covert attacker-controlled behavior, and prior studies suggest minimal poisoning budgets can suffice,,.Earlier work showed poisoning could degrade classifier accuracy.Source: §II · p. 2
• Prior packet-level IDS studies report poisoning vulnerability and up to 99% recovery after correct trigger identification.Directly transferring an image-classification trigger-reversal framework to IDSs is ineffective without substantial modification.Source: §II · p. 2
• CSE-CIC-IDS2018 is a standard IDS benchmark,, but its high-dimensional feature space is largely overlooked as a source of persistent backdoors.Existing dataset defenses focus mainly on training-time robustness, including federated settings,.Source: §II · p. 2
• Federated-learning approaches address training-time poisoning, whereas this work studies post-training flow-based IDS analysis with feature-level attribution and targeted mitigation [13], [14].Source: §II · p. 2

III. METHODOLOGY

• Comparison with a distilled baseline yields feature-salience rankings that guide poisoned-sample removal or targeted architectural refinement.Fig. 1 presents the data-centric sanitization and model-centric neuron-pruning paths.Source: §III · p. 2, Figure 1 · p. 2

1) Trigger Search and Attack Success Rate (ASR):

• Feature-level analysis identifies potential triggers and characterizes sensitivity to individual feature manipulations.The phase also quantifies resultant ASR.Source: 1) Trigger Search and Attack Success… · p. 2
• The search evaluates each feature independently with a scalar perturbation, avoiding joint optimization across heterogeneous flow features.This univariate formulation seeks a perturbation that induces misclassification into a target class.Source: 1) Trigger Search and Attack Success… · p. 2
• A feature-only perturbation is assessed by whether its target-class prediction rate reaches the minimum ASR threshold; the benign class is selected as the target, though other targets are supported.The threshold may be fixed, relative to baseline misclassification, or tuned to operational false-activation tolerances.Source: 1) Trigger Search and Attack Success… · p. 2
• The method evaluates three perturbation modes and uses subsampling, early termination, parallelization, and feature prioritization to reduce search costs.Sampling models imitation of representative values from the target-class feature distribution.Source: 1) Trigger Search and Attack Success… · pp. 2–3
• The search records feature, target class, perturbation mode, and minimal perturbation achieving the ASR threshold.The algorithm tests candidate perturbations and retains the smallest-magnitude successful one.Source: 1) Trigger Search and Attack Success… · p. 3

2) Model Comparison and Feature Ranking:

• High ASR or low perturbation magnitude alone cannot establish poisoning, because clean-model sensitivities vary and distributed triggers can dilute individual-feature signals.The ambiguity can reflect architectural biases, data imbalance, or feature correlations.Source: 2) Model Comparison and Feature Ranking · p. 3
• A distilled same-architecture model trained on a curated subset with assumed integrity serves as a proxy for clean behavior.The feature-identification procedure runs independently on both models, and matched perturbations reveal feature-wise deviations.Source: 2) Model Comparison and Feature Ranking · p. 3
• Structural drift measures the change in minimum perturbation magnitude needed to induce misclassification, while behavioral drift compares maximum ASR across Shift, Override, and Sampling modes.The behavioral comparison indicates how much more or less reliably a feature induces the target class relative to the baseline.Source: 2) Model Comparison and Feature Ranking · p. 3
• Normalized structural and behavioral drift are combined into a feature score that ranks flow attributes most divergent from nominal expectations for sanitization or neuron pruning.The measures are normalized against their observed maxima to support comparisons across features with heterogeneous scales.Source: 2) Model Comparison and Feature Ranking · p. 3

3) Backdoor Mitigation:

• The mitigation workflow considers data sanitization and neuron pruning, with both strategies culminating in retraining.The workflow is depicted in Fig. 1.Source: 3) Backdoor Mitigation · p. 3
• Data sanitization removes or corrects training samples matching high-ranking trigger-feature patterns, then trains a new model on the cleaned dataset.Its feasibility depends on access to the original training data and the computational overhead of full-model retraining.Source: 3) Backdoor Mitigation · pp. 3–4
• Neuron pruning requires no training-dataset modification: it ranks neurons by trigger-associated activation variance and ASR contribution, then iteratively prunes until ASR falls below a threshold while preserving nominal classification performance.The pruned model is fine-tuned on a small validation set of previously unseen clean data to restore generalization and compensate for reduced capacity.Source: 3) Backdoor Mitigation · p. 4

A. Model Configuration

• The DNN has five fully connected hidden layers of 512, 256, 128, 64, and 32 ReLU neurons, with batch normalization and decreasing dropout rates from 0.3 to 0.1.A Softmax output layer produces class probabilities.Source: A. Model Configuration · p. 4
• Model training uses Adam with a 0.001 learning rate and sparse categorical crossentropy, processing batches of 512 for up to 50 epochs.Data preprocessing includes numerical label encoding.Source: A. Model Configuration · p. 4
• Fig. 3 reports ASR for selected flow features acting as triggers across poisoning percentages from 0.0005% to 1%.Source: Figure 3 · p. 4
• An 80/20 stratified train-test split, early stopping, and validation-plateau learning-rate scheduling support training and evaluation with accuracy, precision, recall, F1 score, and confusion matrices.Source: A. Model Configuration · p. 4

B. Impact of Poisoning

• The clean baseline has near-perfect precision and recall for benign flows and high-volume attacks, but retains reciprocal DoS–BruteForce confusions and some attacks misclassified as benign.The evaluated attack classes are Botnet, BruteForce, DoS, and DDoS.Source: B. Impact of Poisoning · p. 4
• Temporal features reach near-maximal average ASR at minimal poisoning levels, whereas rate-based features generally require higher poisoning levels for comparable efficacy.The results identify timing-related attributes as particularly vulnerable to low-rate manipulation.Source: B. Impact of Poisoning · pp. 4–5
• Univariate poisoning can implant effective, stealthy backdoors without observable nominal-performance degradation on standard evaluation metrics.This motivates targeted diagnostics beyond those standard metrics.Source: B. Impact of Poisoning · p. 5
• Poisoned features produce higher average drift scores than unperturbed features, and Flow Duration reaches 1.070 as the sole plausible trigger feature in its scenario.The differential diagnostic is motivated by clean models' intrinsic sensitivity, which makes raw perturbation magnitude or ASR ambiguous on its own.Source: B. Impact of Poisoning · p. 5
• At the backdoor saturation threshold of 0.005% poisoning, fine-pruning leaves residual ASR of approximately 0.25 rather than near-complete suppression.This is a notable exception to the near-zero ASR observed in most configurations.Source: B. Impact of Poisoning · p. 5
• Fine-pruning reduces backdoor effectiveness by up to 99% while preserving nominal classification performance, though it does not guarantee total removal.The procedure identifies backdoor-relevant neurons through feature activation analysis, prunes them, and fine-tunes on clean, previously unseen data.Source: B. Impact of Poisoning · p. 5, Table IV · p. 5
• Combined poisoning of Flow Duration and Fwd IAT Tot reaches average ASR 0.8 at 0.002% for BruteForce and 1.0 at 0.005% for DDoS and Botnet, with nominal accuracy approximately 0.97.The poisoning ratio is the aggregate fraction of modified training samples distributed across the targeted features.Source: B. Impact of Poisoning · pp. 5–6, Figure 4 · p. 5
• Joint poisoning of Fwd Pkts/s and Flow Pkts/s drives average ASR across attacks rapidly toward 1.0 even at the lowest evaluated poisoning levels.The authors attribute this pattern to a synergistic effect between features that are individually less dominant.Source: B. Impact of Poisoning · p. 6, Figure 5 · p. 6

• Modifying as little as 0.001% of training data implants effective, stealthy backdoors without degrading clean-data performance.Source: §V · p. 6
• Comparing a potentially poisoned model with a distilled baseline detects feature-level backdoors through behavioral drift.Source: §V · p. 6
• Feature localization and ranking support fine-pruning that can substantially reduce backdoor effectiveness without original training data, though complete removal is not guaranteed.Source: §V · p. 6
• Diagnostics add computational cost and were evaluated on one dataset and model family; broader evaluation across datasets, architectures, and attack classes remains future work.Source: §V · p. 6