# TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems

arXiv: https://arxiv.org/abs/2210.15700 · HTML: https://mlsanity.com/paper/2210.15700/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 43 references that are in the map.
- First posted on arXiv 27 Oct 2022.

## Builds on (most cited first, 21 of 21)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Learning without Forgetting](https://mlsanity.com/paper/1606.09282/) (2016)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks](https://mlsanity.com/paper/1511.04508/) (2015)
- [Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods](https://mlsanity.com/paper/1705.07263/) (2017)
- [On Detecting Adversarial Perturbations](https://mlsanity.com/paper/1702.04267/) (2017)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [SafetyNet: Detecting and Rejecting Adversarial Examples Robustly](https://mlsanity.com/paper/1704.00103/) (2017)
- [Defensive Distillation is Not Robust to Adversarial Examples](https://mlsanity.com/paper/1607.04311/) (2016)
- [Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2106.09380/) (2021)
- [Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors](https://mlsanity.com/paper/2005.07519/) (2020)
- [Adversarial Feature Selection against Evasion Attacks](https://mlsanity.com/paper/2005.12154/) (2020)
- [Hardening Random Forest Cyber Detectors Against Adversarial Attacks](https://mlsanity.com/paper/1912.03790/) (2019)
- [Rallying Adversarial Techniques against Deep Learning for Network Security](https://mlsanity.com/paper/1903.11688/) (2019)
- [When Not to Classify: Anomaly Detection of Attacks (ADA) on DNN Classifiers at Test Time](https://mlsanity.com/paper/1712.06646/) (2017)
- [Evaluation of Adversarial Training on Different Types of Neural Networks in Deep Learning-based IDSs](https://mlsanity.com/paper/2007.04472/) (2020)
- [Adversarial Training for Deep Learning-based Intrusion Detection Systems](https://mlsanity.com/paper/2104.09852/) (2021)
- [Detect & Reject for Transferability of Black-box Adversarial Attacks Against Network Intrusion Detection Systems](https://mlsanity.com/paper/2112.12095/) (2021)

## Built on by (most cited first, 7 of 7)

- [Adv-Bot: Realistic Adversarial Botnet Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2303.06664/) (2023)
- [Review on the Feasibility of Adversarial Evasion Attacks and Defenses for Network Intrusion Detection Systems](https://mlsanity.com/paper/2303.07003/) (2023)
- [Black-box Adversarial Transferability: An Empirical Study in Cybersecurity Perspective](https://mlsanity.com/paper/2404.10796/) (2024)
- [Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers](https://mlsanity.com/paper/2409.00667/) (2024)
- [Redefining DDoS Attack Detection Using A Dual-Space Prototypical Network-Based Approach](https://mlsanity.com/paper/2406.02632/) (2024)
- [Targeted Adversarial Traffic Generation : Black-box Approach to Evade Intrusion Detection Systems in IoT Networks](https://mlsanity.com/paper/2603.23438/) (2026)
- [A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic](https://mlsanity.com/paper/2607.17105/) (2026)

## Abstract (arXiv)

Nowadays, intrusion detection systems based on deep learning deliver state-of-the-art performance. However, recent research has shown that specially crafted perturbations, called adversarial examples, are capable of significantly reducing the performance of these intrusion detection systems. The objective of this paper is to design an efficient transfer learning-based adversarial detector and then to assess the effectiveness of using multiple strategically placed adversarial detectors compared to a single adversarial detector for intrusion detection systems. In our experiments, we implement existing state-of-the-art models for intrusion detection. We then attack those models with a set of chosen evasion attacks. In an attempt to detect those adversarial attacks, we design and implement multiple transfer learning-based adversarial detectors, each receiving a subset of the information passed through the IDS. By combining their respective decisions, we illustrate that combining multiple detectors can further improve the detectability of adversarial traffic compared to a single detector in the case of a parallel IDS design.