# Demystifying the Transferability of Adversarial Attacks in Computer Networks

arXiv: https://arxiv.org/abs/2110.04488 · HTML: https://mlsanity.com/paper/2110.04488/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 31 of its 72 references that are in the map.
- First posted on arXiv 9 Oct 2021.

## Builds on (most cited first, 30 of 31)

- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey](https://mlsanity.com/paper/1801.00553/) (2018)
- [Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples](https://mlsanity.com/paper/1605.07277/) (2016)
- [Adversarial Attacks on Neural Networks for Graph Data](https://mlsanity.com/paper/1805.07984/) (2018)
- [COCO-Text: Dataset and Benchmark for Text Detection and Recognition in Natural Images](https://mlsanity.com/paper/1601.07140/) (2016)
- [The Space of Transferable Adversarial Examples](https://mlsanity.com/paper/1704.03453/) (2017)
- [Admix: Enhancing the Transferability of Adversarial Attacks](https://mlsanity.com/paper/2102.00436/) (2021)
- [Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks](https://mlsanity.com/paper/1803.06975/) (2018)
- [Imitation Attacks and Defenses for Black-box Machine Translation Systems](https://mlsanity.com/paper/2004.15015/) (2020)
- [N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders](https://mlsanity.com/paper/1805.03409/) (2018)
- [Adversarial Examples: Opportunities and Challenges](https://mlsanity.com/paper/1809.04790/) (2018)
- [Understanding and Enhancing the Transferability of Adversarial Examples](https://mlsanity.com/paper/1802.09707/) (2018)
- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Foolbox: A Python toolbox to benchmark the robustness of machine learning models](https://mlsanity.com/paper/1707.04131/) (2017)
- [A Survey of Machine Learning Techniques in Adversarial Image Forensics](https://mlsanity.com/paper/2010.09680/) (2020)
- [On the Transferability of Adversarial Examples Against CNN-Based Image Forensics](https://mlsanity.com/paper/1811.01629/) (2018)
- [Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification](https://mlsanity.com/paper/1901.03398/) (2019)
- [A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions](https://mlsanity.com/paper/2102.06249/) (2021)
- [CNN-Based Detection of Generic Constrast Adjustment with JPEG Post-processing](https://mlsanity.com/paper/1805.11318/) (2018)
- [Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples](https://mlsanity.com/paper/1902.02067/) (2019)
- [Turning Internet of Things(IoT) into Internet of Vulnerabilities (IoV) : IoT Botnets](https://mlsanity.com/paper/1702.03681/) (2017)
- [A Counter-Forensic Method for CNN-Based Camera Model Identification](https://mlsanity.com/paper/1805.02131/) (2018)
- [Who's Afraid of Adversarial Transferability?](https://mlsanity.com/paper/2105.00433/) (2021)
- [Enhancing Cross-task Transferability of Adversarial Examples with Dispersion Reduction](https://mlsanity.com/paper/1905.03333/) (2019)

## Built on by (most cited first, 9 of 9)

- [Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systems](https://mlsanity.com/paper/2311.11796/) (2023)
- [An Adversarial Attack Analysis on Malicious Advertisement URL Detection Framework](https://mlsanity.com/paper/2204.13172/) (2022)
- [Resisting Deep Learning Models Against Adversarial Attack Transferability via Feature Randomization](https://mlsanity.com/paper/2209.04930/) (2022)
- [Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Survey](https://mlsanity.com/paper/2303.06302/) (2023)
- [Employing Deep Ensemble Learning for Improving the Security of Computer Networks against Adversarial Attacks](https://mlsanity.com/paper/2209.12195/) (2022)
- [Using adversarial images to improve outcomes of federated learning for non-IID data](https://mlsanity.com/paper/2206.08124/) (2022)
- [Spritz-PS: Validation of Synthetic Face Images Using a Large Dataset of Printed Documents](https://mlsanity.com/paper/2304.02982/) (2023)
- [Query Efficient Cross-Dataset Transferable Black-Box Attack on Action Recognition](https://mlsanity.com/paper/2211.13171/) (2022)
- [Unscrambling the Rectification of Adversarial Attacks Transferability across Computer Networks](https://mlsanity.com/paper/2311.03373/) (2023)

## Abstract (arXiv)

Convolutional Neural Networks (CNNs) models are one of the most frequently used deep learning networks, and extensively used in both academia and industry. Recent studies demonstrated that adversarial attacks against such models can maintain their effectiveness even when used on models other than the one targeted by the attacker. This major property is known as transferability, and makes CNNs ill-suited for security applications. In this paper, we provide the first comprehensive study which assesses the robustness of CNN-based models for computer networks against adversarial transferability. Furthermore, we investigate whether the transferability property issue holds in computer networks applications. In our experiments, we first consider five different attacks: the Iterative Fast Gradient Method (I-FGSM), the Jacobian-based Saliency Map (JSMA), the Limited-memory Broyden Fletcher Goldfarb Shanno BFGS (L- BFGS), the Projected Gradient Descent (PGD), and the DeepFool attack. Then, we perform these attacks against three well- known datasets: the Network-based Detection of IoT (N-BaIoT) dataset, the Domain Generating Algorithms (DGA) dataset, and the RIPE Atlas dataset. Our experimental results show clearly that the transferability happens in specific use cases for the I- FGSM, the JSMA, and the LBFGS attack. In such scenarios, the attack success rate on the target network range from 63.00% to 100%. Finally, we suggest two shielding strategies to hinder the attack transferability, by considering the Most Powerful Attacks (MPAs), and the mismatch LSTM architecture.