Detect & Reject for Transferability of Black-Box Adversarial Attacks Against Network Intrusion Detection Systems

Abstract

In the last decade, the use of Machine Learning techniques in anomaly-based intrusion detection systems has seen much success. However, recent studies have shown that Machine learning in general and deep learning specifically are vulnerable to adversarial attacks where the attacker attempts to fool models by supplying deceptive input. Research in computer vision, where this vulnerability was first discovered, has shown that adversarial images designed to fool a specific model can deceive other machine learning models. In this paper, we investigate the transferability of adversarial network traffic against multiple machine learning-based intrusion detection systems. Furthermore, we analyze the robustness of the ensemble intrusion detection system, which is notorious for its better accuracy compared to a single model, against the transferability of adversarial attacks. Finally, we examine Detect & Reject as a defensive mechanism to limit the effect of the transferability property of adversarial network traffic against machine learning-based intrusion detection systems.

TAD: Transfer learning-based multi-adversarial detection of evasion attacks against network intrusion detection systems

“…This method proposes that instead of trying to classify the adversarial instance correctly despite the attack, the adversarial instance is detected and dealt with accordingly. Most often, this action consists in rejecting the detected sample and not letting it pass through the system [24,25,26] Many detection methods in the area of adversarial learning have been proposed. In [25], the authors used the neural activation pattern to detect adversarial perturbations in the image classification domain.…”

Adv-Bot: Realistic adversarial botnet attacks against network intrusion detection systems

“…This property was first explored by Goodfellow et al [14], who show that adversarial examples that fool one model can fool other models with a high probability without the need to have the same architecture or be trained on the same dataset. An attacker can exploit the transferability property to launch black-box attacks by creating a surrogate model trained on data following the same distribution as the target model [27]. This can be easily done by sniffing network traffic [28], especially in a botnet scenario where the attacker already has a foothold in the corporate network.…”

“…Instead of trying to correctly classify the adversarial instance into its original class, this strategy recommends detecting the adversarial instance and treating it accordingly. The most common action is to reject the identified adversarial sample and prevent it from passing through the system [45,46,27]. Our proposed defense falls into the category of anomaly detection.…”

“…Goodfellow et al [14] were the first to investigate this property in computer vision, demonstrating that adversarial examples that fool one model can fool other models with a high probability without the need for the models to have the same architecture or be trained on the same dataset. An attacker can use the transferability property to launch black-box attacks by training a surrogate model on the same data distribution as the target model [27]. Sniffing network traffic is a simple way to accomplish this, especially in a botnet scenario where the attacker already has a foothold in the corporate network [28].…”

Defenses for Adversarial attacks in Network Intrusion Detection System – A Survey

“…In Detect & Reject [61] the authors first studied the impact of the transferability of the adversarial attacks on the classifiers and then the performance of ensemble IDS using SVM, DT, Logistic Regression (LR),, RF, and Linear Discriminant Analysis (LDA) using the majority voting rule. FGSM and PGD are used to construct adversarial attacks from NSLKDD data.…”