Adversarial examples for network intrusion detection systems

Abstract

Machine learning-based network intrusion detection systems have demonstrated state-of-the-art accuracy in flagging malicious traffic. However, machine learning has been shown to be vulnerable to adversarial examples, particularly in domains such as image recognition. In many threat models, the adversary exploits the unconstrained nature of images–the adversary is free to select some arbitrary amount of pixels to perturb. However, it is not clear how these attacks translate to domains such as network intrusion detection as they contain domain constraints, which limit which and how features can be modified by the adversary. In this paper, we explore whether the constrained nature of networks offers additional robustness against adversarial examples versus the unconstrained nature of images. We do this by creating two algorithms: (1) the Adapative-JSMA, an augmented version of the popular JSMA which obeys domain constraints, and (2) the Histogram Sketch Generation which generates adversarial sketches: targeted universal perturbation vectors that encode feature saliency within the envelope of domain constraints. To assess how these algorithms perform, we evaluate them in a constrained network intrusion detection setting and an unconstrained image recognition setting. The results show that our approaches generate misclassification rates in network intrusion detection applications that were comparable to those of image recognition applications (greater than 95%). Our investigation shows that the constrained attack surface exposed by network intrusion detection systems is still sufficiently large to craft successful adversarial examples – and thus, network constraints do not appear to add robustness against adversarial examples. Indeed, even if a defender constrains an adversary to as little as five random features, generating adversarial examples is still possible.

Adversarial machine learning for network intrusion detection: A comparative study

“…In future work, we intend to generate more realistic adversarial attacks that project more easily into the problem space. To do so, we will follow some recommendations found in the literature, [70,65,44], namely i) restrict the space of features to be perturbed, i.e., avoid perturbing non-differentiable features so that the transformation is reversible, and the features directly related to the functionality of the flow so as not to impact it, ii) perform small amplitude perturbations and check that the values of the modified features remain valid (domain constraints), and iii) analyze the consistency of the values taken by the correlated features.…”

Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system

“…All the factors mentioned above raise another question: "Are constraint domains less susceptible to adversaries' generation ?". Sheatsley [50] empirically tested the mentioned hypothesis and experimented with the same over the constraints dataset. The author showed that the misclassification rate is more than 95% with adaptive JSMA and Histogram Sketch Generation (HSG) algorithm when applied to intrusion detection dataset.…”