Organizations: Department of Computer Science, New Mexico State University, Las Cruces, NM, USA · University of Hartford, CT, USA · DEVCOM Analysis Center, WSMR, NM, USA
Deep learning (DL)-based Network Intrusion Detection System (NIDS) has demonstrated great promise in detecting malicious network traffic. However, they face significant security risks due to their vulnerability to adversarial examples (AEs). Most existing adversarial attacks maliciously perturb data to maximize misclassification errors. Among AEs, natural adversarial examples (NAEs) are particularly difficult to detect because they closely resemble real data, making them challenging for both humans and machine learning models to distinguish from legitimate inputs. Creating NAEs is crucial for testing and strengthening NIDS defenses. This paper proposes NetDiffuser1, a novel framework for generating NAEs capable of deceiving NIDS. NetDiffuser consists of two novel components. First, a new feature categorization algorithm is designed to identify relatively independent features in network traffic. Perturbing these features minimizes changes while preserving network flow validity. The second component is a novel application of diffusion models to inject semantically consistent perturbations for generating NAEs. NetDiffuser performance was extensively evaluated using three benchmark NIDS datasets across various model architectures and state-of-the-art adversarial detectors. Our experimental results show that NetDiffuser achieves up to a 29.93% higher attack success rate and reduces AE detection performance by at least 0.267 (in some cases up to 0.534) in the Area under the Receiver Operating Characteristic Curve (AUC-ROC) score compared to the baseline attacks.
Figures & tables
Fig. 1 : Overview of a DL-based NIDS.
Fig. 2 : The schematic of NetDiffuser .
Diffusion Model Architecture - # of hidden units of hidden layers
UNSW-NB15 MLP-3L
{256, 512, 256}
CICIDS2017 MLP-2L
{1024, 1024}
CICDDoS2019 MLP-2L
{1024, 1024}
Diffusion Training Time
UNSW-NB15
18m 3s
CICIDS2017
26m 48s
TABLE I : Summary of experimental setup including model architectures, attack configurations, and runtime statistics for training and evaluation.
Attack
UNSW-NB15
CICIDS2017
CICDDoS2019
Artifact
MANDA
Artifact
MANDA
Artifact
MANDA
Target model: MLP-1L
FGSM
0.9985
0.9181
0.9902
0.8898
0.9410
0.9928
ND-FGSM
0.5021
0.7579
0.5254
0.8579
0.6324
0.9221
PGD
0.9996
0.9165
0.9945
0.8991
0.9155
0.9913
ND-PGD
0.4770
0.7578
0.5373
0.8556
0.6662
0.9347
TABLE II : Comparison of AUC-ROC scores (lower is better) for Artifact and MANDA detectors under different adversarial attacks. Lower AUC-ROC values indicate reduced detector performance.
Attack
After-Attack Acc (%)
After-Purif. Acc (%)
ASR (%)
AUC ROC
MLP-1L (Before-Attack Accuracy: 89.12%)
FGSM
16.43
62.23
30.18
0.9181
ND-FGSM
65.71
46.84
47.45
0.7579
PGD
16.43
63.72
28.50
0.9165
ND-PGD
67.48
48.32
45.78
0.7578
ACG
31.35
59.04
33.75
0.9040
TABLE III : Performance evaluation of anomaly detector models using MANDA on UNSW-NB15 . (Lower AUC-ROC is better; higher ASR is better.)
Attack
After-Attack Acc (%)
After-Purif. Acc (%)
ASR (%)
AUC ROC
MLP-1L (Before-Attack Accuracy: 95.30%)
FGSM
5.59
70.96
25.54
0.8898
ND-FGSM
70.10
70.29
26.24
0.8579
PGD
5.59
70.14
26.40
0.8991
ND-PGD
71.98
69.85
26.71
0.8556
ACG
49.58
78.93
17.18
0.9393
TABLE IV : Performance evaluation of anomaly detector models using MANDA on CICIDS2017 dataset. (Lower AUC-ROC is better; higher ASR is better.)
Attack
After-Attack Acc (%)
After-Purif. Acc (%)
ASR (%)
AUC ROC
MLP-1L (Before-Attack Accuracy: 99.77%)
FGSM
1.27
84.19
15.61
0.9928
ND-FGSM
94.91
82.80
17.01
0.9221
PGD
1.27
84.15
15.65
0.9913
ND-PGD
70.51
79.78
20.04
0.9347
ACG
45.04
92.47
7.32
0.9912
TABLE V : Performance evaluation of anomaly detector models using MANDA on CICDDoS2019 . (Lower AUC-ROC is better; higher ASR is better.)
Attack
UNSW-NB15
CICIDS2017
CICDDoS2019
Wass.
MMD
Wass.
MMD
Wass.
MMD
Target model: MLP-1L
FGSM
0.1519
0.4904
0.1466
0.5931
0.1464
0.6319
ND-FGSM
0.0187
0.0043
0.0182
0.0363
0.0291
0.1726
PGD
0.1106
0.4055
0.1357
0.6528
0.1300
0.7588
ND-PGD
0.0170
0.0041
0.0182
0.0330
0.0319
0.1231
TABLE VI : Comparison of Wasserstein and Maximum Mean Discrepancy (MMD) distances (closer to 0 is better) between original and adversarial samples.
Fig. 3 : PCA density plots comparing clean and adversarial samples targeting the MLP-1L model across UNSW-NB15, CICIDS2017, and CICDDoS2019 datasets.
Fig. 4 : The comparison of absolute difference between Pearson’s correlation coefficient computed on original data and adversarial data generated by PGD and NetDiffuser -PGD on MLP-1L. Intense red indicates stronger correlations in the original data; intense blue indicates stronger correlations in the adversarial data. NetDiffuser better preserves the correlation structure, as shown by lighter colors.
Deep neural networks (DNNs) are widely applied in Network-based Intrusion Detection System (NIDS) due to their high accuracy. However, DNNs are highly susceptible to adversarial attacks, which generate malicious traffic to evade NIDS detection. Existing approaches often adapt adversarial attacks from computer vision (CV) tasks to the NIDS domain, overlooking the fundamental differences between CV and NIDS. This results in two major issues: 1) The generated network traffic may become invalid, 2) The generated traffic may lose its original attack semantics. To address these issues, this paper proposes an adversarial attack specifically designed for NIDS. Instead of directly generating flow-level features, our approach incrementally generates packet-level features to construct adversarial traffic. During the generation process, the semantic integrity of the traffic is monitored at each stage, effectively avoiding the issues of invalid traffic and semantic loss observed in existing methods. We evaluate our attack algorithm against current NIDS models using the CIC-UNSW-NB15, CIC-DDoS2019, and CIC-IDS-2017 datasets. The proposed method achieves an average evasion success rate of 92.78%, while ensuring that the generated adversarial traffic remains semantically consistent with the original malicious traffic.
Jinhao You, Zan Zhou, Shujie Yang +3
Beijing University of Posts and Telecommunications · Zhongguancun Laboratory
Adversarial examples can represent a serious threat to machine learning (ML) algorithms. If used to manipulate the behaviour of ML-based Network Intrusion Detection Systems (NIDS), they can jeopardize network security. In this work, we aim to mitigate such risks by increasing the robustness of NIDS towards adversarial attacks. To that end, we explore two adversarial methods for generating malicious network traffic. The first method is based on Generative Adversarial Networks (GAN) and the second one is the Fast Gradient Sign Method (FGSM). The adversarial examples generated by these methods are then used to evaluate a novel multilayer defense mechanism, specifically designed to mitigate the vulnerability of ML-based NIDS. Our solution consists of one layer of stacking classifiers and a second layer based on an autoencoder. If the incoming network data are classified as benign by the first layer, the second layer is activated to ensure that the decision made by the stacking classifier is correct. We also incorporated adversarial training to further improve the robustness of our solution. Experiments on two datasets, namely UNSW-NB15 and NSL-KDD, demonstrate that the proposed approach increases resilience to adversarial attacks.
Nasim Soltani, Shayan Nejadshamsi, Zakaria Abou El Houda +4
Institut national de la recherche scientifique (INRS-EMT), Université du Québec, Montréal, Québec, Canada · INRS-UQO Mixed Research Unit on Cybersecurity, Gatineau, Québec, Canada · Concordia Institute for Information Systems Engineering (CIISE), Concordia University, Montréal, Québec, Canada +2
The new wave of adversarial attacks that utilize gradient-related vulnerabilities in neural network-based classifiers makes Network Intrusion Detection Systems more open to such threats. Although state-of-the-art adversarial training methods have shown promising results in producing more robust classifiers, their interpretability and defense ability are limited due to their lack of understanding of how adversarial attacks propagate in different layers of network classifiers. In this paper, we present an insightful approach, called LARAR (Layer-wise Adversarial Robustness using Adaptive Regularization), that incorporates additional layer-wise vulnerability analysis and adaptive weighting in conventional adversarial training methods. Additionally, we utilize 'Auxiliary Classifiers' in our approach. LARAR provides interpretable layer-wise vulnerability scores, achieves a clean accuracy of 95.01%, and provides better robustness against adversarial attacks (FGSM, PGD, and transfer attacks) on the UNSW-NB15 dataset. Through the identification of vulnerable layers, the proposed framework reduces computational complexity and enables the early detection of adversarial samples, thus enhancing the effectiveness and interpretability of adversarial defense mechanisms in NIDS.
Hira Nasir, Eiman Javed, Balawal Shabir +2
National Cyber Security Academy (NCSA), Air University, Islamabad, Pakistan. · School of Science, Edith Cowan University, Australia.