# Vulnerability Disclosure through Adaptive Black-Box Adversarial Attacks on NIDS

arXiv: https://arxiv.org/abs/2506.20576 · HTML: https://mlsanity.com/paper/2506.20576/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 29 of its 57 references that are in the map.
- First posted on arXiv 25 Jun 2025.

## Builds on (most cited first, 29 of 29)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models](https://mlsanity.com/paper/1708.03999/) (2017)
- [Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models](https://mlsanity.com/paper/1712.04248/) (2017)
- [HopSkipJumpAttack: A Query-Efficient Decision-Based Attack](https://mlsanity.com/paper/1904.02144/) (2019)
- [Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality](https://mlsanity.com/paper/1801.02613/) (2018)
- [On Detecting Adversarial Perturbations](https://mlsanity.com/paper/1702.04267/) (2017)
- [Improving Adversarial Robustness via Promoting Ensemble Diversity](https://mlsanity.com/paper/1901.08846/) (2019)
- [Adversarial Machine Learning -- Industry Perspectives](https://mlsanity.com/paper/2002.05646/) (2020)
- [Sign-OPT: A Query-Efficient Hard-label Adversarial Attack](https://mlsanity.com/paper/1909.10773/) (2019)
- [Deep Isolation Forest for Anomaly Detection](https://mlsanity.com/paper/2206.06602/) (2022)
- [GenAttack: Practical Black-box Attacks with Gradient-Free Optimization](https://mlsanity.com/paper/1805.11090/) (2018)
- [Adversarial Examples: Opportunities and Challenges](https://mlsanity.com/paper/1809.04790/) (2018)
- [IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection](https://mlsanity.com/paper/1809.02077/) (2018)
- [Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2106.09380/) (2021)
- [Adversarial Machine Learning in Network Intrusion Detection Systems](https://mlsanity.com/paper/2004.11898/) (2020)
- [Multiple Change-point Detection: a Selective Overview](https://mlsanity.com/paper/1512.04093/) (2015)
- [Adv-Bot: Realistic Adversarial Botnet Attacks against Network Intrusion Detection Systems](https://mlsanity.com/paper/2303.06664/) (2023)
- [Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection](https://mlsanity.com/paper/2203.04234/) (2022)
- [TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack](https://mlsanity.com/paper/2103.06297/) (2021)
- [Seeded Binary Segmentation: A general methodology for fast and optimal change point detection](https://mlsanity.com/paper/2002.06633/) (2020)
- [Untargeted White-box Adversarial Attack with Heuristic Defence Methods in Real-time Deep Learning based Network Intrusion Detection System](https://mlsanity.com/paper/2310.03334/) (2023)
- [The LogBarrier adversarial attack: making effective use of decision boundary information](https://mlsanity.com/paper/1903.10396/) (2019)
- [Adversarial Challenges in Network Intrusion Detection Systems: Research Insights and Future Prospects](https://mlsanity.com/paper/2409.18736/) (2024)
- [Improving the Robustness of Adversarial Attacks Using an Affine-Invariant Gradient Estimator](https://mlsanity.com/paper/2109.05820/) (2021)
- [Generating Practical Adversarial Network Traffic Flows Using NIDSGAN](https://mlsanity.com/paper/2203.06694/) (2022)
- [Black-box Adversarial Transferability: An Empirical Study in Cybersecurity Perspective](https://mlsanity.com/paper/2404.10796/) (2024)

## Abstract (arXiv)

Adversarial attacks, wherein slight inputs are carefully crafted to mislead intelligent models, have attracted increasing attention. However, a critical gap persists between theoretical advancements and practical application, particularly in structured data like network traffic, where interdependent features complicate effective adversarial manipulations. Moreover, ambiguity in current approaches restricts reproducibility and limits progress in this field. Hence, existing defenses often fail to handle evolving adversarial attacks. This paper proposes a novel approach for black-box adversarial attacks, that addresses these limitations. Unlike prior work, which often assumes system access or relies on repeated probing, our method strictly respect black-box constraints, reducing interaction to avoid detection and better reflect real-world scenarios. We present an adaptive feature selection strategy using change-point detection and causality analysis to identify and target sensitive features to perturbations. This lightweight design ensures low computational cost and high deployability. Our comprehensive experiments show the attack's effectiveness in evading detection with minimal interaction, enhancing its adaptability and applicability in real-world scenarios. By advancing the understanding of adversarial attacks in network traffic, this work lays a foundation for developing robust defenses.