# Enhancing Network Intrusion Detection Systems: A Multi-Layer Ensemble Approach to Mitigate Adversarial Attacks

arXiv: https://arxiv.org/abs/2603.10413 · HTML: https://mlsanity.com/paper/2603.10413/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 22 references that are in the map.
- First posted on arXiv 11 Mar 2026.

## Builds on (most cited first, 7 of 7)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors](https://mlsanity.com/paper/2005.07519/) (2020)
- [Adversarial Machine Learning in Network Intrusion Detection Systems](https://mlsanity.com/paper/2004.11898/) (2020)
- [Investigating Resistance of Deep Learning-based IDS against Adversaries using min-max Optimization](https://mlsanity.com/paper/1910.14107/) (2019)
- [Adversarial Machine Learning In Network Intrusion Detection Domain: A Systematic Review](https://mlsanity.com/paper/2112.03315/) (2021)
- [Voting Classifier-based Intrusion Detection for IoT Networks](https://mlsanity.com/paper/2104.10015/) (2021)

## Abstract (arXiv)

Adversarial examples can represent a serious threat to machine learning (ML) algorithms. If used to manipulate the behaviour of ML-based Network Intrusion Detection Systems (NIDS), they can jeopardize network security. In this work, we aim to mitigate such risks by increasing the robustness of NIDS towards adversarial attacks. To that end, we explore two adversarial methods for generating malicious network traffic. The first method is based on Generative Adversarial Networks (GAN) and the second one is the Fast Gradient Sign Method (FGSM). The adversarial examples generated by these methods are then used to evaluate a novel multilayer defense mechanism, specifically designed to mitigate the vulnerability of ML-based NIDS. Our solution consists of one layer of stacking classifiers and a second layer based on an autoencoder. If the incoming network data are classified as benign by the first layer, the second layer is activated to ensure that the decision made by the stacking classifier is correct. We also incorporated adversarial training to further improve the robustness of our solution. Experiments on two datasets, namely UNSW-NB15 and NSL-KDD, demonstrate that the proposed approach increases resilience to adversarial attacks.