Exploring transferable adversarial attacks for Deep Learning-based Network Intrusion Detection

Abstract

Network Intrusion Detection Systems (NIDSs) increasingly use Deep Learning (DL) techniques due to their superior performance. However, some studies have shown that attackers can bypass DL-based NIDSs by generating Adversarial Attack Traffic (AAT). To better understand the vulnerabilities of DL-based NIDS, more and more adversarial attacks have been proposed. We observed three problems while studying these attacks: (1) Some attacks need to query the target model to construct AAT or surrogate models, which is not stealthy enough; (2) The generated AAT is impractical due to the lack of constraints when modifying features; and (3) The attack methods are limited in their extensibility. We propose a framework called SPTS to address these problems. SPTS runs in the black-box scenario without access to the target model. To generate the practical AAT, SPTS incorporates feature hierarchization and rectification. The correlations and constraints between features are established by mathematics. In addition, we implement a variety of adversarial attack algorithms within the SPTS framework, illustrating its excellent scalability. The AAT is mapped to practical packets to evaluate its transferability. Furthermore, we discover that enhancing the diversity of gradients can further improve the transferability of AAT. We propose a DGM algorithm based on SPTS, which randomly transforms the inputs to produce more robust gradients. Empirical evaluations on the standard dataset demonstrate the effectiveness and superiority of our SPTS and DGM. Defense methods to mitigate SPTS and DGM are also provided, and their advantages and disadvantages are described based on experimental results. Code is available at https://github.com/maozhongshu1995/TransAdvAttForNIDS.