# Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT

arXiv: https://arxiv.org/abs/2104.12426 · HTML: https://mlsanity.com/paper/2104.12426/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 49 references that are in the map.
- First posted on arXiv 26 Apr 2021.

## Builds on (most cited first, 12 of 12)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [Stronger Data Poisoning Attacks Break Data Sanitization Defenses](https://mlsanity.com/paper/1811.00741/) (2018)
- [Technical Report on the CleverHans v2.1.0 Adversarial Examples Library](https://mlsanity.com/paper/1610.00768/) (2016)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [Maximal Jacobian-based Saliency Map Attack](https://mlsanity.com/paper/1808.07945/) (2018)
- [On Defending Against Label Flipping Attacks on Malware Detection Systems](https://mlsanity.com/paper/1908.04473/) (2019)
- [Analyzing Adversarial Attacks Against Deep Learning for Intrusion Detection in IoT Networks](https://mlsanity.com/paper/1905.05137/) (2019)
- [LuNet: A Deep Neural Network for Network Intrusion Detection](https://mlsanity.com/paper/1909.10031/) (2019)
- [A Robust Comparison of the KDDCup99 and NSL-KDD IoT Network Intrusion Detection Datasets Through Various Machine Learning Algorithms](https://mlsanity.com/paper/1912.13204/) (2019)

## Built on by (most cited first, 9 of 9)

- [Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review](https://mlsanity.com/paper/2304.10550/) (2023)
- [Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classification](https://mlsanity.com/paper/2301.13122/) (2023)
- [SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detection](https://mlsanity.com/paper/2308.06819/) (2023)
- [Untargeted White-box Adversarial Attack with Heuristic Defence Methods in Real-time Deep Learning based Network Intrusion Detection System](https://mlsanity.com/paper/2310.03334/) (2023)
- [Poisoning Network Flow Classifiers](https://mlsanity.com/paper/2306.01655/) (2023)
- [Hack The Box: Fooling Deep Learning Abstraction-Based Monitors](https://mlsanity.com/paper/2107.04764/) (2021)
- [Statistical Detection of Adversarial examples in Blockchain-based Federated Forest In-vehicle Network Intrusion Detection Systems](https://mlsanity.com/paper/2207.04843/) (2022)
- [Problem space structural adversarial attacks for Network Intrusion Detection Systems based on Graph Neural Networks](https://mlsanity.com/paper/2403.11830/) (2024)
- [Model-agnostic clean-label backdoor mitigation in cybersecurity environments](https://mlsanity.com/paper/2407.08159/) (2024)

## Abstract (arXiv)

As the internet continues to be populated with new devices and emerging technologies, the attack surface grows exponentially. Technology is shifting towards a profit-driven Internet of Things market where security is an afterthought. Traditional defending approaches are no longer sufficient to detect both known and unknown attacks to high accuracy. Machine learning intrusion detection systems have proven their success in identifying unknown attacks with high precision. Nevertheless, machine learning models are also vulnerable to attacks. Adversarial examples can be used to evaluate the robustness of a designed model before it is deployed. Further, using adversarial examples is critical to creating a robust model designed for an adversarial environment. Our work evaluates both traditional machine learning and deep learning models' robustness using the Bot-IoT dataset. Our methodology included two main approaches. First, label poisoning, used to cause incorrect classification by the model. Second, the fast gradient sign method, used to evade detection measures. The experiments demonstrated that an attacker could manipulate or circumvent detection with significant probability.