Organizations: Department of Computer Science, New Mexico State University, Las Cruces, NM, USA · University of Hartford, CT, USA · DEVCOM Analysis Center, WSMR, NM, USA
Deep learning (DL)-based Network Intrusion Detection System (NIDS) has demonstrated great promise in detecting malicious network traffic. However, they face significant security risks due to their vulnerability to adversarial examples (AEs). Most existing adversarial attacks maliciously perturb data to maximize misclassification errors. Among AEs, natural adversarial examples (NAEs) are particularly difficult to detect because they closely resemble real data, making them challenging for both humans and machine learning models to distinguish from legitimate inputs. Creating NAEs is crucial for testing and strengthening NIDS defenses. This paper proposes NetDiffuser1, a novel framework for generating NAEs capable of deceiving NIDS. NetDiffuser consists of two novel components. First, a new feature categorization algorithm is designed to identify relatively independent features in network traffic. Perturbing these features minimizes changes while preserving network flow validity. The second component is a novel application of diffusion models to inject semantically consistent perturbations for generating NAEs. NetDiffuser performance was extensively evaluated using three benchmark NIDS datasets across various model architectures and state-of-the-art adversarial detectors. Our experimental results show that NetDiffuser achieves up to a 29.93% higher attack success rate and reduces AE detection performance by at least 0.267 (in some cases up to 0.534) in the Area under the Receiver Operating Characteristic Curve (AUC-ROC) score compared to the baseline attacks.
Figures & tables
Fig. 1 : Overview of a DL-based NIDS.
Fig. 2 : The schematic of NetDiffuser .
Diffusion Model Architecture - # of hidden units of hidden layers
UNSW-NB15 MLP-3L
{256, 512, 256}
CICIDS2017 MLP-2L
{1024, 1024}
CICDDoS2019 MLP-2L
{1024, 1024}
Diffusion Training Time
UNSW-NB15
18m 3s
CICIDS2017
26m 48s
TABLE I : Summary of experimental setup including model architectures, attack configurations, and runtime statistics for training and evaluation.
Attack
UNSW-NB15
CICIDS2017
CICDDoS2019
Artifact
MANDA
Artifact
MANDA
Artifact
MANDA
Target model: MLP-1L
FGSM
0.9985
0.9181
0.9902
0.8898
0.9410
0.9928
ND-FGSM
0.5021
0.7579
0.5254
0.8579
0.6324
0.9221
PGD
0.9996
0.9165
0.9945
0.8991
0.9155
0.9913
ND-PGD
0.4770
0.7578
0.5373
0.8556
0.6662
0.9347
TABLE II : Comparison of AUC-ROC scores (lower is better) for Artifact and MANDA detectors under different adversarial attacks. Lower AUC-ROC values indicate reduced detector performance.
Attack
After-Attack Acc (%)
After-Purif. Acc (%)
ASR (%)
AUC ROC
MLP-1L (Before-Attack Accuracy: 89.12%)
FGSM
16.43
62.23
30.18
0.9181
ND-FGSM
65.71
46.84
47.45
0.7579
PGD
16.43
63.72
28.50
0.9165
ND-PGD
67.48
48.32
45.78
0.7578
ACG
31.35
59.04
33.75
0.9040
TABLE III : Performance evaluation of anomaly detector models using MANDA on UNSW-NB15 . (Lower AUC-ROC is better; higher ASR is better.)
Attack
After-Attack Acc (%)
After-Purif. Acc (%)
ASR (%)
AUC ROC
MLP-1L (Before-Attack Accuracy: 95.30%)
FGSM
5.59
70.96
25.54
0.8898
ND-FGSM
70.10
70.29
26.24
0.8579
PGD
5.59
70.14
26.40
0.8991
ND-PGD
71.98
69.85
26.71
0.8556
ACG
49.58
78.93
17.18
0.9393
TABLE IV : Performance evaluation of anomaly detector models using MANDA on CICIDS2017 dataset. (Lower AUC-ROC is better; higher ASR is better.)
Attack
After-Attack Acc (%)
After-Purif. Acc (%)
ASR (%)
AUC ROC
MLP-1L (Before-Attack Accuracy: 99.77%)
FGSM
1.27
84.19
15.61
0.9928
ND-FGSM
94.91
82.80
17.01
0.9221
PGD
1.27
84.15
15.65
0.9913
ND-PGD
70.51
79.78
20.04
0.9347
ACG
45.04
92.47
7.32
0.9912
TABLE V : Performance evaluation of anomaly detector models using MANDA on CICDDoS2019 . (Lower AUC-ROC is better; higher ASR is better.)
Attack
UNSW-NB15
CICIDS2017
CICDDoS2019
Wass.
MMD
Wass.
MMD
Wass.
MMD
Target model: MLP-1L
FGSM
0.1519
0.4904
0.1466
0.5931
0.1464
0.6319
ND-FGSM
0.0187
0.0043
0.0182
0.0363
0.0291
0.1726
PGD
0.1106
0.4055
0.1357
0.6528
0.1300
0.7588
ND-PGD
0.0170
0.0041
0.0182
0.0330
0.0319
0.1231
TABLE VI : Comparison of Wasserstein and Maximum Mean Discrepancy (MMD) distances (closer to 0 is better) between original and adversarial samples.
Fig. 3 : PCA density plots comparing clean and adversarial samples targeting the MLP-1L model across UNSW-NB15, CICIDS2017, and CICDDoS2019 datasets.
Fig. 4 : The comparison of absolute difference between Pearson’s correlation coefficient computed on original data and adversarial data generated by PGD and NetDiffuser -PGD on MLP-1L. Intense red indicates stronger correlations in the original data; intense blue indicates stronger correlations in the adversarial data. NetDiffuser better preserves the correlation structure, as shown by lighter colors.
Institut national de la recherche scientifique (INRS-EMT), Université du Québec, Montréal, Québec, Canada · INRS-UQO Mixed Research Unit on Cybersecurity, Gatineau, Québec, Canada · Concordia Institute for Information Systems Engineering (CIISE), Concordia University, Montréal, Québec, Canada +2