AMDS: Attack-Aware Multi-Stage Defense System for Network Intrusion Detection with Two-Stage Adaptive Weight Learning

Oluseyi Olukola; Nick Rahimi

cs.CRMar 1, 2026

AMDS: Attack-Aware Multi-Stage Defense System for Network Intrusion Detection with Two-Stage Adaptive Weight Learning

Authors: Oluseyi Olukola, Nick Rahimi

Organizations: School of Computing Sciences and Computer Engineering, University of Southern Mississippi, Hattiesburg, MS, USA

Abstract

Machine learning based network intrusion detection systems are vulnerable to adversarial attacks that degrade classification performance under both gradient-based and distribution shift threat models. Existing defenses typically apply uniform detection strategies, which may not account for heterogeneous attack characteristics. This paper proposes an attack-aware multi-stage defense framework that learns attack-specific detection strategies through a weighted combination of ensemble disagreement, predictive uncertainty, and distributional anomaly signals. Empirical analysis across seven adversarial attack types reveals distinct detection signatures, enabling a two-stage adaptive detection mechanism. Experimental evaluation on a benchmark intrusion detection dataset indicates that the proposed system attains 94.2% area under the receiver operating characteristic curve and improves classification accuracy by 4.5 percentage points and F1-score by 9.0 points over adversarially trained ensembles. Under adaptive white-box attacks with full architectural knowledge, the system appears to maintain 94.4% accuracy with a 4.2% attack success rate, though this evaluation is limited to two adaptive variants and does not constitute a formal robustness guarantee. Cross-dataset validation further suggests that defense effectiveness depends on baseline classifier competence and may vary with feature dimensionality. These results suggest that attack-specific optimization combined with multi-signal integration can provide a practical approach to improving adversarial robustness in machine learning-based intrusion detection systems.

Figures & tables

Fig. 1: AMDS system architecture. Network traffic is processed through four components: ensemble prediction with disagreement computation, cascade routing for efficiency-aware triage, two-stage adaptive detection with category-specific refinement, and attack-adaptive model weighting, producing dual outputs for adversarial detection and attack classification.

Attack	Category	$\alpha$	$\beta$	$\gamma$	AUC	Dominant
		(Entropy)	(Disagree)	(Anomaly)		Signal
FGSM	Gradient	0.260	0.528	0.212	0.743	Disagreement
PGD-L ∞	Gradient	0.269	0.465	0.267	0.759	Disagreement
C&W	Gradient	0.306	0.434	0.261	0.748	Disagreement
SPSA	Gradient	0.293	0.448	0.259	0.758	Disagreement
Injection	Distribution	0.433	0.360	0.207	0.896	Entropy

TABLE I: Attack-Specific Learned Weights and Detection Performance

Attack	Generic-Only	Attack-Specific	Two-Stage	$\Delta$ vs Generic	$\Delta$ vs Specific
FGSM	0.545	0.743	0.943	+0.398	+0.200
PGD-L ∞	0.552	0.759	0.943	+0.391	+0.184
PGD-L 2	0.218	0.502	0.885	+0.666	+0.383
C&W	0.565	0.748	0.945	+0.379	+0.197
SPSA	0.551	0.758	0.943	+0.392	+0.185
Injection	0.652	0.896	0.966	+0.313	+0.070

TABLE II: Two-Stage Detection Comparison (AUC)

Routing Distribution:
Metric	Baseline	Cascade	Ratio
	(Full AMDS)	(Adaptive)
Throughput (samples/sec)	6,172	4,989	0.81 $\times$
Latency (ms/sample)	0.16	0.20	+0.04
Overall Accuracy	84.9%	84.9%	0.0 pp
Clean Accuracy	96.3%	96.3%	0.0 pp

TABLE III: Cascade Router Performance and Efficiency

Gradient-Based Attacks
Attack	Cat.	Standard	AT	AMDS	$\Delta$ vs Std	$\Delta$ vs AT	Std F1	AT F1	AMDS F1
FGSM	G	95.9%	95.3%	94.7%	$-1.2$ pp	$-0.6$ pp	88.3%	87.1%	87.4%
PGD-L ∞	G	95.9%	96.5%	94.2%	$-1.7$ pp	$-2.3$ pp	88.0%	89.4%	86.1%
PGD-L 2	G	82.6%	84.1%	79.4%	$-3.2$ pp	$-4.7$ pp	63.0%	67.8%	55.3%
C&W	G	92.6%	92.6%	91.6%	$-1.0$ pp	$-1.0$ pp	79.3%	79.5%	80.3%
SPSA	G	95.7%	91.4%	95.0%	$-0.7$ pp	$+3.6$ pp	87.6%	81.1%	87.0%

TABLE IV: Comprehensive Baseline Comparison on CSE-CIC-IDS2018

Fig. 2: Per-attack performance comparison on CSE-CIC-IDS2018. AMDS achieves substantial improvements on distribution shift attacks (+29.3 pp Injection, +6.1 pp Morphing vs Standard), with small regression on gradient attacks ( $-1.6$ pp average). Adversarial training appears to provide minimal benefit over standard training.

Configuration	Overall	Overall	Clean
	Accuracy	F1	Accuracy
Full AMDS	84.9%	73.0%	96.3%
Ablated Configurations:
Generic weights only	81.4%	63.2%	98.1%
Component contribution	$-3.5$ pp	$-9.8$ pp	$+1.8$ pp
Uniform model voting	81.1%	61.0%	99.5%

TABLE V: Ablation Study: Component Contribution Analysis

Dataset Characteristics
Metric	CSE-CIC-IDS2018	UNSW-NB15	$\Delta$	Explanation
Features	77	190	+113	2.47 $\times$ more dimensions
Attack Budget ( $\epsilon$ )	0.02	0.02	0.0	Same nominal budget
Effective Attack Strength	1.0 $\times$	${\sim}1.57\times$	+0.57 $\times$	Scales with $\sqrt{d}$
Baseline Performance
Baseline Accuracy	80.7%	52.9%	$-27.8$ pp	Attack strength exceeds baseline capacity

TABLE VI: Cross-Dataset Generalization: CSE-CIC-IDS2018 vs. UNSW-NB15

Standard Attacks (Non-Adaptive)
Attack Type	Standard	AMDS	Detection
	Ensemble	Accuracy	Rate (ADS)
FGSM	95.1%	94.6%	2.4%
PGD-L ∞	95.5%	93.4%	1.8%
PGD-L 2	83.4%	80.5%	14.0%
Adaptive Attacks (ADS-Aware)

TABLE VII: Robustness Against Adaptive Adversaries

Network Intrusion Detection

Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.

See all 165 papers

Categorical Robustness Assessment for Machine Learning based Network Intrusion Detection Systems
Jun 10, 2026Mayank Raj, Nathaniel D. Bastian, Lance Fiondella +1IoT Intrusion Detection Adversarial Attacks
University of Massachusetts Dartmouth, Dartmouth, MA 02747 USA · United States Military Academy, West Point, NY 10996 USA
Enhancing Network Intrusion Detection Systems: A Multi-Layer Ensemble Approach to Mitigate Adversarial Attacks
Mar 11, 2026Nasim Soltani, Shayan Nejadshamsi, Zakaria Abou El Houda +4Network Intrusion Detection Adversarial Robustness
Institut national de la recherche scientifique (INRS-EMT), Université du Québec, Montréal, Québec, Canada · INRS-UQO Mixed Research Unit on Cybersecurity, Gatineau, Québec, Canada · Concordia Institute for Information Systems Engineering (CIISE), Concordia University, Montréal, Québec, Canada +2
Enhancing Adversarial Robustness in Network Intrusion Detection: A Layer-wise Adaptive Regularization Approach
May 9, 2026Hira Nasir, Eiman Javed, Balawal Shabir +2Adversarial Training Network Intrusion Detection
National Cyber Security Academy (NCSA), Air University, Islamabad, Pakistan. · School of Science, Edith Cowan University, Australia.

Jun 10, 2026J/K move · Enter open · S save

Categorical Robustness Assessment for Machine Learning based Network Intrusion Detection Systems

Mayank Raj, Nathaniel D. Bastian, Lance Fiondella, Gokhan Kul

University of Massachusetts Dartmouth, Dartmouth, MA 02747 USA · United States Military Academy, West Point, NY 10996 USA

IoT Intrusion Detection Adversarial Attacks Network Intrusion Detection Adversarial Robustness Convolutional Neural Networks

Open paper AskPDF arXiv

Network Intrusion Detection Systems (NIDS) heavily utlize Machine Learning (ML) but ML models can be manipulated via adversarial attacks. These attacks add carefully crafted perturbations to network traffic data that leads to misclassifications. While prior work has demonstrated adversarial vulnerabilities in isolated settings, systematic cross-architecture as well as class and category of attack based comparisons under controlled attack conditions remain limited, leaving practitioners without clear guidance on which models to deploy in adversarial environments. This paper asks a simple question: what type of classifier architectures actually hold up when attackers try to manipulate the systems? We put three popular architectures through their paces: a 1D Convolutional Neural Network, a Long Short-Term Memory (LSTM) network, and a Random Forest (RF) ensemble. Using the ACI-IoT-2023 dataset (over 1.2 million samples spanning 12 attack types), we subject each model with FGSM and PGD adversarial attacks, which apply gradient-based perturbations in normalized feature space consistent with established adversarial ML evaluation protocols, at perturbation budgets ranging from

ε=0.01

ε=0.1

. Surprisingly, Random Forest achieved near-perfect baseline accuracy (99.98%), yet collapsed catastrophically under attack, dropping 73 percentage points at the smallest perturbation we tested. CNN, on the other hand, retained 95.5% accuracy at

ε=0.01

and degraded gracefully as perturbations increased. LSTM fell somewhere in between. These findings flip the conventional wisdom where high baseline accuracy means nothing if a model shatters at the first sign of adversarial pressure. For practitioners deploying intrusion detection in adversarial environments, we recommend CNN-based architectures and provide scenario-specific deployment guidance.

Abstract

Network Intrusion Detection

Explore similar work

Categorical Robustness Assessment for Machine Learning based Network Intrusion Detection Systems

Enhancing Network Intrusion Detection Systems: A Multi-Layer Ensemble Approach to Mitigate Adversarial Attacks

Enhancing Adversarial Robustness in Network Intrusion Detection: A Layer-wise Adaptive Regularization Approach