# Deep PackGen: A Deep Reinforcement Learning Framework for Adversarial Network Packet Generation

arXiv: https://arxiv.org/abs/2305.11039 · HTML: https://mlsanity.com/paper/2305.11039/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 64 references that are in the map.
- First posted on arXiv 18 May 2023.

## Builds on (most cited first, 18 of 18)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification](https://mlsanity.com/paper/1502.01852/) (2015)
- [Deep Reinforcement Learning with Double Q-learning](https://mlsanity.com/paper/1509.06461/) (2015)
- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors](https://mlsanity.com/paper/2005.07519/) (2020)
- [Adversarial Machine Learning in Network Intrusion Detection Systems](https://mlsanity.com/paper/2004.11898/) (2020)
- [FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments](https://mlsanity.com/paper/1909.10480/) (2019)
- [IoT Security Techniques Based on Machine Learning](https://mlsanity.com/paper/1801.06275/) (2018)
- [UAV Coverage Path Planning under Varying Power Constraints using Deep Reinforcement Learning](https://mlsanity.com/paper/2003.02609/) (2020)
- [TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack](https://mlsanity.com/paper/2103.06297/) (2021)
- [Adversarial Network Traffic: Towards Evaluating the Robustness of Deep Learning-Based Network Traffic Classification](https://mlsanity.com/paper/2003.01261/) (2020)
- [Deceiving Image-to-Image Translation Networks for Autonomous Driving with Adversarial Perturbations](https://mlsanity.com/paper/2001.01506/) (2020)
- [A Reinforcement Learning Approach for Rebalancing Electric Vehicle Sharing Systems](https://mlsanity.com/paper/2010.02369/) (2020)
- [Improving Network Intrusion Detection Classifiers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach](https://mlsanity.com/paper/1805.02684/) (2018)
- [Packet-Level Adversarial Network Traffic Crafting using Sequence Generative Adversarial Networks](https://mlsanity.com/paper/2103.04794/) (2021)
- [Knowledge-Based Sequential Decision-Making Under Uncertainty](https://mlsanity.com/paper/1905.07030/) (2019)
- [Deep VULMAN: A Deep Reinforcement Learning-Enabled Cyber Vulnerability Management Framework](https://mlsanity.com/paper/2208.02369/) (2022)

## Built on by (most cited first, 6 of 6)

- [Privacy-R1: Privacy-Aware Multi-LLM Agent Collaboration via Reinforcement Learning](https://mlsanity.com/paper/2510.16054/) (2025)
- [SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity](https://mlsanity.com/paper/2602.08690/) (2026)
- [Adversarial Agents: Black-Box Evasion Attacks with Reinforcement Learning](https://mlsanity.com/paper/2503.01734/) (2025)
- [Building Better Environments for Autonomous Cyber Defence](https://mlsanity.com/paper/2604.08805/) (2026)
- [A Synergistic Approach In Network Intrusion Detection By Neurosymbolic AI](https://mlsanity.com/paper/2406.00938/) (2024)
- [A Red Teaming Framework for Evaluating Robustness of AI-enabled Security Orchestration, Automation, and Response Systems](https://mlsanity.com/paper/2605.17075/) (2026)

## Abstract (arXiv)

Recent advancements in artificial intelligence (AI) and machine learning (ML) algorithms, coupled with the availability of faster computing infrastructure, have enhanced the security posture of cybersecurity operations centers (defenders) through the development of ML-aided network intrusion detection systems (NIDS). Concurrently, the abilities of adversaries to evade security have also increased with the support of AI/ML models. Therefore, defenders need to proactively prepare for evasion attacks that exploit the detection mechanisms of NIDS. Recent studies have found that the perturbation of flow-based and packet-based features can deceive ML models, but these approaches have limitations. Perturbations made to the flow-based features are difficult to reverse-engineer, while samples generated with perturbations to the packet-based features are not playable. Our methodological framework, Deep PackGen, employs deep reinforcement learning to generate adversarial packets and aims to overcome the limitations of approaches in the literature. By taking raw malicious network packets as inputs and systematically making perturbations on them, Deep PackGen camouflages them as benign packets while still maintaining their functionality. In our experiments, using publicly available data, Deep PackGen achieved an average adversarial success rate of 66.4% against various ML models and across different attack types. Our investigation also revealed that more than 45% of the successful adversarial samples were out-of-distribution packets that evaded the decision boundaries of the classifiers. The knowledge gained from our study on the adversary's ability to make specific evasive perturbations to different types of malicious packets can help defenders enhance the robustness of their NIDS against evolving adversarial attacks.