# Cybersecurity Anomaly Detection in Adversarial Environments

arXiv: https://arxiv.org/abs/2105.06742 · HTML: https://mlsanity.com/paper/2105.06742/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 24 references that are in the map.
- First posted on arXiv 14 May 2021.

## Builds on (most cited first, 7 of 7)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams](https://mlsanity.com/paper/1911.04464/) (2019)
- [Adversarial Machine Learning in Network Intrusion Detection Systems](https://mlsanity.com/paper/2004.11898/) (2020)
- [Scalable and Interpretable One-class SVMs with Deep Learning and Random Fourier features](https://mlsanity.com/paper/1804.04888/) (2018)
- [Advancing the Research and Development of Assured Artificial Intelligence and Machine Learning Capabilities](https://mlsanity.com/paper/2009.13250/) (2020)
- [Techniques for Adversarial Examples Threatening the Safety of Artificial Intelligence Based Systems](https://mlsanity.com/paper/1910.06907/) (2019)

## Built on by (most cited first, 4 of 4)

- [A Hypergraph-Based Machine Learning Ensemble Network Intrusion Detection System](https://mlsanity.com/paper/2211.03933/) (2022)
- [Detecting Unknown Attacks in IoT Environments: An Open Set Classifier for Enhanced Network Intrusion Detection](https://mlsanity.com/paper/2309.07461/) (2023)
- [A Synergistic Approach In Network Intrusion Detection By Neurosymbolic AI](https://mlsanity.com/paper/2406.00938/) (2024)
- [ByteStack-ID: Integrated Stacked Model Leveraging Payload Byte Frequency for Grayscale Image-based Network Intrusion Detection](https://mlsanity.com/paper/2310.09298/) (2023)

## Abstract (arXiv)

The proliferation of interconnected battlefield information-sharing devices, known as the Internet of Battlefield Things (IoBT), introduced several security challenges. Inherent to the IoBT operating environment is the practice of adversarial machine learning, which attempts to circumvent machine learning models. This work examines the feasibility of cost-effective unsupervised learning and graph-based methods for anomaly detection in the network intrusion detection system setting, and also leverages an ensemble approach to supervised learning of the anomaly detection problem. We incorporate a realistic adversarial training mechanism when training supervised models to enable strong classification performance in adversarial environments. The results indicate that the unsupervised and graph-based methods were outperformed in detecting anomalies (malicious activity) by the supervised stacking ensemble method with two levels. This model consists of three different classifiers in the first level, followed by either a Naive Bayes or Decision Tree classifier for the second level. The model maintains an F1-score above 0.97 for malicious samples across all tested level two classifiers. Notably, Naive Bayes is the fastest level two classifier averaging 1.12 seconds while Decision Tree maintains the highest AUC score of 0.98.