Functionality-Preserving Adversarial Machine Learning for Robust Classification in Cybersecurity and Intrusion Detection Domains: A Survey

Abstract

Machine learning has become widely adopted as a strategy for dealing with a variety of cybersecurity issues, ranging from insider threat detection to intrusion and malware detection. However, by their very nature, machine learning systems can introduce vulnerabilities to a security defence whereby a learnt model is unaware of so-called adversarial examples that may intentionally result in mis-classification and therefore bypass a system. Adversarial machine learning has been a research topic for over a decade and is now an accepted but open problem. Much of the early research on adversarial examples has addressed issues related to computer vision, yet as machine learning continues to be adopted in other domains, then likewise it is important to assess the potential vulnerabilities that may occur. A key part of transferring to new domains relates to functionality-preservation, such that any crafted attack can still execute the original intended functionality when inspected by a human and/or a machine. In this literature survey, our main objective is to address the domain of adversarial machine learning attacks and examine the robustness of machine learning models in the cybersecurity and intrusion detection domains. We identify the key trends in current work observed in the literature, and explore how these relate to the research challenges that remain open for future works. Inclusion criteria were: articles related to functionality-preservation in adversarial machine learning for cybersecurity or intrusion detection with insight into robust classification. Generally, we excluded works that are not yet peer-reviewed; however, we included some significant papers that make a clear contribution to the domain. There is a risk of subjective bias in the selection of non-peer reviewed articles; however, this was mitigated by co-author review. We selected the following databases with a sizeable computer science element to search and retrieve literature: IEEE Xplore, ACM Digital Library, ScienceDirect, Scopus, SpringerLink, and Google Scholar. The literature search was conducted up to January 2022. We have striven to ensure a comprehensive coverage of the domain to the best of our knowledge. We have performed systematic searches of the literature, noting our search terms and results, and following up on all materials that appear relevant and fit within the topic domains of this review. This research was funded by the Partnership PhD scheme at the University of the West of England in collaboration with Techmodal Ltd.

DDoS attack detection in SDN: Enhancing entropy‐based detection with machine learning

“…The proposed ML‐Entropy, along with the competing solutions, are evaluated using two distinct network traffic datasets: ($$$ i $$$) the DARPA2009 dataset, 23 a well‐known dataset that has been used in the context of ML application in cybersecurity and IoT 36,37 ; and ($$$ ii $$$) a dataset from a large corporation, hereafter denoted as RealCorp dataset.…”

i-2NIDS Novel Intelligent Intrusion Detection Approach for a Strong Network Security

“…In addition, the proposed approach performs well on imbalanced data and has a better ability to identify different cyberattacks as it has been mentioned in the previous sub-sections. Therefore, RF-2NIDS can be considered as a robust model against adversarial attacks, whereby the only purpose is to trick the learnt model to make incorrect results (McCarthy et al, 2022;Sauka et al, 2022;Zhao et al, 2022). This will be proven in the next contribution.…”

A Multi-Agent Intrusion Detection System Optimized by a Deep Reinforcement Learning Approach with a Dataset Enlarged Using a Generative Model to Reduce the Bias Effect

“…In this section, we will review existing research that uses GAN to address the issue of unbalanced data in detecting cyberattacks using reinforcement learning (RL) models. The literature in the field of cyberattack detection suggests that recurrent neural network (RNN) and RL approaches are not yet fully explored [12]. Our paper will specifically focus on insider threat detection (ITD) as a type of cyberattack detection.…”