Adversarial Machine Learning Attacks against Intrusion Detection Systems: A Survey on Strategies and Defense

Abstract

Concerns about cybersecurity and attack methods have risen in the information age. Many techniques are used to detect or deter attacks, such as intrusion detection systems (IDSs), that help achieve security goals, such as detecting malicious attacks before they enter the system and classifying them as malicious activities. However, the IDS approaches have shortcomings in misclassifying novel attacks or adapting to emerging environments, affecting their accuracy and increasing false alarms. To solve this problem, researchers have recommended using machine learning approaches as engines for IDSs to increase their efficacy. Machine-learning techniques are supposed to automatically detect the main distinctions between normal and malicious data, even novel attacks, with high accuracy. However, carefully designed adversarial input perturbations during the training or testing phases can significantly affect their predictions and classifications. Adversarial machine learning (AML) poses many cybersecurity threats in numerous sectors that use machine-learning-based classification systems, such as deceiving IDS to misclassify network packets. Thus, this paper presents a survey of adversarial machine-learning strategies and defenses. It starts by highlighting various types of adversarial attacks that can affect the IDS and then presents the defense strategies to decrease or eliminate the influence of these attacks. Finally, the gaps in the existing literature and future research directions are presented.

A hybrid deep learning approach for enhanced network intrusion detection

“…The objective is to overwhelm the resources of the target, causing disruption and making services inaccessible to authorized users. DDoS attacks are challenging to mitigate because they exploit the distributed nature of the assault, making it difficult to trace and block the multitude of sources simultaneously [22]. Attackers leverage diverse techniques, including amplification, reflection, and application-layer exploits, to maximize the impact.…”

Augmenting SQL Injection Attack Detection via Deep Convolutional Neural Network

“…Based on recognized attack patterns, WAFs examine incoming tra c and apply predetermined rules to deny or permit requests. [22] • Attackers can use zeroday assaults or evasion strategies to get around WAFs.…”

Using Information Technology to Quantitatively Evaluate and Prevent Cybersecurity Threats in a Hierarchical Manner

“…Attack Severity Classification is a critical concept in cybersecurity that refers to the process of categorizing attacks based on their severity. This concept is essential for organizations to develop appropriate responses and strategies to prevent or mitigate attacks [6]. Attack severity classification helps organizations to understand the potential impact of an attack, including its scope, duration, and level of damage.…”

“…1, April 2023, pp. 01-10 ISSN 2776-8007 2 risks and vulnerabilities present in a network, enabling organizations to take a more targeted and effective approach to cybersecurity [6].…”