Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection

Abstract

Adversarial attacks pose a major threat to machine learning and to the systems that rely on it. In the cybersecurity domain, adversarial cyber-attack examples capable of evading detection are especially concerning. Nonetheless, an example generated for a domain with tabular data must be realistic within that domain. This work establishes the fundamental constraint levels required to achieve realism and introduces the Adaptative Perturbation Pattern Method (A2PM) to fulfill these constraints in a gray-box setting. A2PM relies on pattern sequences that are independently adapted to the characteristics of each class to create valid and coherent data perturbations. The proposed method was evaluated in a cybersecurity case study with two scenarios: Enterprise and Internet of Things (IoT) networks. Multilayer Perceptron (MLP) and Random Forest (RF) classifiers were created with regular and adversarial training, using the CIC-IDS2017 and IoT-23 datasets. In each scenario, targeted and untargeted attacks were performed against the classifiers, and the generated examples were compared with the original network traffic flows to assess their realism. The obtained results demonstrate that A2PM provides a scalable generation of realistic adversarial examples, which can be advantageous for both adversarial training and attacks.

arXiv comment18 pages, 6 tables, 10 figures, Future Internet journal

References in corpus (16)

• Explaining and Harnessing Adversarial Examples
• Practical Bayesian Optimization of Machine Learning Algorithms
• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• One pixel attack for fooling deep neural networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Adversarially Robust Generalization Requires More Data
• Houdini: Fooling Deep Structured Prediction Models
• Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Structured Adversarial Attack: Towards General Implementation and Better Interpretability
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Robust Decision Trees Against Adversarial Examples
• Efficient Training of Robust Decision Trees Against Adversarial Examples
• Cost-Aware Robust Tree Ensembles for Security Applications

Cited by in corpus (8)

• Adv-Bot: Realistic Adversarial Botnet Attacks against Network Intrusion Detection Systems
• Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classification
• SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection
• Reliable Feature Selection for Adversarially Robust Cyber-Attack Detection
• An Adversarial Robustness Benchmark for Enterprise Network Intrusion Detection
• Constrained Adversarial Learning for Automated Software Testing: a literature review
• Adversarial Robustness and Feature Impact Analysis for Driver Drowsiness Detection
• Adversarially Robust and Interpretable Magecart Malware Detection