TransfficFormer: A novel Transformer-based framework to generate evasive malicious traffic

Abstract

Machine learning (ML) and deep learning (DL) have significantly improved the detection accuracy of contemporary Network Intrusion Detection Systems (NIDS), yet they remain susceptible to adversarial attacks. Current attacks against ML/DL-based NIDS primarily focus on altering feature vectors, thereby overlooking the discrete and irreversible nature of network traffic packets, which significantly limits its practical applicability. To address these challenges, we propose TransfficFormer to generate adversarial attack traffic that combines heuristic algorithm and transformer. We train a Transformer-based generator by transforming source-space features into discrete sequence autoregressive models. The three-layer particle swarm optimization algorithm with random and perception factor is utilized to optimize the generation of adversarial mutation malicious traffic with reversible metadata feature vectors. Furthermore, the discriminator feedback probability is fine-tuned using reinforcement learning strategies, ensuring the preservation of both malicious intent and normal communication functionality within the generated traffic. Comprehensive experiments demonstrate that Transfficformer can autonomously generate mutant malicious traffic, effectively evading various ML/DL-based NIDS with minimal overhead. The practicality of the generated mutant traffic is validated in the NSFOCUS cyber range.