# Adv-Bot: Realistic Adversarial Botnet Attacks against Network Intrusion Detection Systems

arXiv: https://arxiv.org/abs/2303.06664 · HTML: https://mlsanity.com/paper/2303.06664/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 70 references that are in the map.
- First posted on arXiv 12 Mar 2023.

## Builds on (most cited first, 25 of 25)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks](https://mlsanity.com/paper/1511.04508/) (2015)
- [ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models](https://mlsanity.com/paper/1708.03999/) (2017)
- [Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods](https://mlsanity.com/paper/1705.07263/) (2017)
- [On the (Statistical) Detection of Adversarial Examples](https://mlsanity.com/paper/1702.06280/) (2017)
- [SafetyNet: Detecting and Rejecting Adversarial Examples Robustly](https://mlsanity.com/paper/1704.00103/) (2017)
- [Adversarial Examples: Opportunities and Challenges](https://mlsanity.com/paper/1809.04790/) (2018)
- [Defensive Distillation is Not Robust to Adversarial Examples](https://mlsanity.com/paper/1607.04311/) (2016)
- [Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2106.09380/) (2021)
- [Towards a Standard Feature Set for Network Intrusion Detection System Datasets](https://mlsanity.com/paper/2101.11315/) (2021)
- [Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors](https://mlsanity.com/paper/2005.07519/) (2020)
- [Adversarial Feature Selection against Evasion Attacks](https://mlsanity.com/paper/2005.12154/) (2020)
- [Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection](https://mlsanity.com/paper/2203.04234/) (2022)
- [Hardening Random Forest Cyber Detectors Against Adversarial Attacks](https://mlsanity.com/paper/1912.03790/) (2019)
- [Adversarial Network Traffic: Towards Evaluating the Robustness of Deep Learning-Based Network Traffic Classification](https://mlsanity.com/paper/2003.01261/) (2020)
- [When Not to Classify: Anomaly Detection of Attacks (ADA) on DNN Classifiers at Test Time](https://mlsanity.com/paper/1712.06646/) (2017)
- [TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.15700/) (2022)
- [Adversarial Training for Deep Learning-based Intrusion Detection Systems](https://mlsanity.com/paper/2104.09852/) (2021)
- [Detect & Reject for Transferability of Black-box Adversarial Attacks Against Network Intrusion Detection Systems](https://mlsanity.com/paper/2112.12095/) (2021)

## Built on by (most cited first, 14 of 14)

- [Frontier AI's Impact on the Cybersecurity Landscape](https://mlsanity.com/paper/2504.05408/) (2025)
- [Black-box Adversarial Transferability: An Empirical Study in Cybersecurity Perspective](https://mlsanity.com/paper/2404.10796/) (2024)
- [Evasion Adversarial Attacks Remain Impractical Against ML-based Network Intrusion Detection Systems, Especially Dynamic Ones](https://mlsanity.com/paper/2306.05494/) (2023)
- [Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers](https://mlsanity.com/paper/2409.00667/) (2024)
- [Zero-Trust Foundation Models: A New Paradigm for Secure and Collaborative Artificial Intelligence for Internet of Things](https://mlsanity.com/paper/2505.23792/) (2025)
- [A Novel and Practical Universal Adversarial Perturbations against Deep Reinforcement Learning based Intrusion Detection Systems](https://mlsanity.com/paper/2511.18223/) (2025)
- [FRAUD-RLA: A new reinforcement learning adversarial attack against credit card fraud detection](https://mlsanity.com/paper/2502.02290/) (2025)
- [Insights on Adversarial Attacks for Tabular Machine Learning via a Systematic Literature Review](https://mlsanity.com/paper/2506.15506/) (2025)
- [Vulnerability Disclosure through Adaptive Black-Box Adversarial Attacks on NIDS](https://mlsanity.com/paper/2506.20576/) (2025)
- [Behavior-Aware and Generalizable Defense Against Black-Box Adversarial Attacks for ML-Based IDS](https://mlsanity.com/paper/2512.13501/) (2025)
- [Targeted Adversarial Traffic Generation : Black-box Approach to Evade Intrusion Detection Systems in IoT Networks](https://mlsanity.com/paper/2603.23438/) (2026)
- [PLAA: Packet-level Adversarial Attacks in Network Traffic Detection](https://mlsanity.com/paper/2606.28439/) (2026)
- [A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic](https://mlsanity.com/paper/2607.17105/) (2026)
- [Probabilistic Robustness-driven Universal Adversarial Perturbations with Explainability against Deep Reinforcement Learning-based Intrusion Detection System](https://mlsanity.com/paper/2609.30605/) (2026)

## Abstract (arXiv)

Due to the numerous advantages of machine learning (ML) algorithms, many applications now incorporate them. However, many studies in the field of image classification have shown that MLs can be fooled by a variety of adversarial attacks. These attacks take advantage of ML algorithms' inherent vulnerability. This raises many questions in the cybersecurity field, where a growing number of researchers are recently investigating the feasibility of such attacks against machine learning-based security systems, such as intrusion detection systems. The majority of this research demonstrates that it is possible to fool a model using features extracted from a raw data source, but it does not take into account the real implementation of such attacks, i.e., the reverse transformation from theory to practice. The real implementation of these adversarial attacks would be influenced by various constraints that would make their execution more difficult. As a result, the purpose of this study was to investigate the actual feasibility of adversarial attacks, specifically evasion attacks, against network-based intrusion detection systems (NIDS), demonstrating that it is entirely possible to fool these ML-based IDSs using our proposed adversarial algorithm while assuming as many constraints as possible in a black-box setting. In addition, since it is critical to design defense mechanisms to protect ML-based IDSs against such attacks, a defensive scheme is presented. Realistic botnet traffic traces are used to assess this work. Our goal is to create adversarial botnet traffic that can avoid detection while still performing all of its intended malicious functionality.