# Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors

arXiv: https://arxiv.org/abs/2005.07519 · HTML: https://mlsanity.com/paper/2005.07519/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 May 2020.

## Built on by (most cited first, 26 of 26)

- [Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2207.06236/) (2022)
- [DeepAID: Interpreting and Improving Deep Learning-based Anomaly Detection in Security Applications](https://mlsanity.com/paper/2109.11495/) (2021)
- [Adv-Bot: Realistic Adversarial Botnet Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2303.06664/) (2023)
- [TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack](https://mlsanity.com/paper/2103.06297/) (2021)
- [TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.15700/) (2022)
- [Semi-WTC: A Practical Semi-supervised Framework for Attack Categorization through Weight-Task Consistency](https://mlsanity.com/paper/2205.09669/) (2022)
- [FedDef: Defense Against Gradient Leakage in Federated Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.04052/) (2022)
- [Deep PackGen: A Deep Reinforcement Learning Framework for Adversarial Network Packet Generation](https://mlsanity.com/paper/2305.11039/) (2023)
- [Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Survey](https://mlsanity.com/paper/2303.06302/) (2023)
- [Review on the Feasibility of Adversarial Evasion Attacks and Defenses for Network Intrusion Detection Systems](https://mlsanity.com/paper/2303.07003/) (2023)
- [Black-box Adversarial Transferability: An Empirical Study in Cybersecurity Perspective](https://mlsanity.com/paper/2404.10796/) (2024)
- [Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers](https://mlsanity.com/paper/2409.00667/) (2024)
- [CARE: Ensemble Adversarial Robustness Evaluation Against Adaptive Attackers for Security Applications](https://mlsanity.com/paper/2401.11126/) (2024)
- [A Novel Perturb-ability Score to Mitigate Evasion Adversarial Attacks on Flow-Based ML-NIDS](https://mlsanity.com/paper/2409.07448/) (2024)
- [Analyzing Consumer IoT Traffic from Security and Privacy Perspectives: a Comprehensive Survey](https://mlsanity.com/paper/2403.16149/) (2024)
- [TEAM: Temporal Adversarial Examples Attack Model against Network Intrusion Detection System Applied to RNN](https://mlsanity.com/paper/2409.12472/) (2024)
- [Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries](https://mlsanity.com/paper/2502.05367/) (2025)
- [Enhancing Network Intrusion Detection Systems: A Multi-Layer Ensemble Approach to Mitigate Adversarial Attacks](https://mlsanity.com/paper/2603.10413/) (2026)
- [Enhancing Adversarial Robustness in Network Intrusion Detection: A Layer-wise Adaptive Regularization Approach](https://mlsanity.com/paper/2605.08910/) (2026)
- [Synthetic Network Packet Generation through Statistical Learning and Genetic Algorithms](https://mlsanity.com/paper/2606.20864/) (2026)
- [Traffic-Aware Randomized Smoothing for LLM-Based Network Intrusion Detection](https://mlsanity.com/paper/2607.13801/) (2026)
- [A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic](https://mlsanity.com/paper/2607.17105/) (2026)
- [First-order Constrained Trilevel Optimization Over Distributed Networks for Robust Coreset Selection](https://mlsanity.com/paper/2607.27632/) (2026)
- [Concept drift mitigation through community and spectral graph analysis for the detection of cyberattacks in network traffic](https://mlsanity.com/paper/2609.09442/) (2026)
- [Robust Conformal Intrusion Detection via Traffic-Aware Calibration and Attack-Orbit Invariance](https://mlsanity.com/paper/2609.19241/) (2026)
- [Out of Sync, Out of Sight: Phantom State Attacks against IIoT Intrusion Detection](https://mlsanity.com/paper/2610.02552/) (2026)

## Abstract (arXiv)

Machine learning (ML), especially deep learning (DL) techniques have been increasingly used in anomaly-based network intrusion detection systems (NIDS). However, ML/DL has shown to be extremely vulnerable to adversarial attacks, especially in such security-sensitive systems. Many adversarial attacks have been proposed to evaluate the robustness of ML-based NIDSs. Unfortunately, existing attacks mostly focused on feature-space and/or white-box attacks, which make impractical assumptions in real-world scenarios, leaving the study on practical gray/black-box attacks largely unexplored. To bridge this gap, we conduct the first systematic study of the gray/black-box traffic-space adversarial attacks to evaluate the robustness of ML-based NIDSs. Our work outperforms previous ones in the following aspects: (i) practical-the proposed attack can automatically mutate original traffic with extremely limited knowledge and affordable overhead while preserving its functionality; (ii) generic-the proposed attack is effective for evaluating the robustness of various NIDSs using diverse ML/DL models and non-payload-based features; (iii) explainable-we propose an explanation method for the fragile robustness of ML-based NIDSs. Based on this, we also propose a defense scheme against adversarial attacks to improve system robustness. We extensively evaluate the robustness of various NIDSs using diverse feature sets and ML/DL models. Experimental results show our attack is effective (e.g., >97% evasion rate in half cases for Kitsune, a state-of-the-art NIDS) with affordable execution cost and the proposed defense method can effectively mitigate such attacks (evasion rate is reduced by >50% in most cases).