Feature-Constrained Adversarial Robustness Evaluation and Defense for Machine Learning-Based Network Intrusion Detection Systems

doi:10.23940/ijpe.26.11.p1.621632

Abstract

Abstract: Machine learning (ML)-based Network Intrusion Detection Systems (NIDS) remain vulnerable to adversarial perturbations. This study evaluates fixed-mask FGSM and PGD attacks on NSL-KDD using six clean baselines, black-box transferability, category-level analysis, and PGD-based adversarial training. Constrained and unconstrained attacks produced the same aggregate evasion rate at ε=0.1(28.9%), while PGD caused a systematic paired shift relative to clean detection (McNemar χ²=2501.0, p<0.001). Transfer evasion ranged from 0.7% to 14.8%. Category-level evasion ranged from 14.6% for DoS to 100% for R2L/U2R, together with a large zero-perturbation subgroup whose cause remains unresolved. On model-specific eligible sets at ε=0.1, PGD evasion was 28.9% for the undefended model and 7.9% for the defended model. A direct paired common-set comparison using independently generated model-specific PGD attacks also favored the defended model (18.2% vs. 4.4%, McNemar χ²=1012.68, p<0.001), with a 5.1-percentage-point clean-accuracy cost. Under the adopted feature-space setting, freezing categorical and discrete indicator fields did not reduce aggregate evasion, while adversarial training produced a measurable robustness-accuracy trade-off.

Key words: adversarial machine learning, network intrusion detection, NSL-KDD, FGSM, PGD, feature-constrained attacks

Shahad Mnati, Ammar Zakzouk, Hasan Hasan, and Fatima Jasim. Feature-Constrained Adversarial Robustness Evaluation and Defense for Machine Learning-Based Network Intrusion Detection Systems [J]. Int J Performability Eng, 2026, 22(11): 621-632.

Add to citation manager EndNote|Reference Manager|ProCite|BibTeX|RefWorks

References

[1] Tavallaee M., Bagheri E., Lu W., andGhorbani A.A., 2009. A detailed analysis of the KDD CUP 99 data set. In2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp. 1-6.
[2] Goodfellow I.J., Shlens J., andSzegedy C., 2014. Explaining and harnessing adversarial examples.Arxiv Preprint Arxiv:1412.6572.
[3] Szegedy C., Zaremba W., Sutskever I., Bruna J., Erhan D., Goodfellow I., andFergus R., 2013. Intriguing properties of neural networks.Arxiv Preprint Arxiv:1312.6199.
[4] Madry A., Makelov A., Schmidt L., Tsipras D., andVladu A., 2018. Towards deep learning models resistant to adversarial attacks. In Proceedings of the international conference on learning representations.
[5] Moradpoor N., Maglaras L., Abah E. and Robles-Durazno A., 2023. The threat of adversarial attacks against machine learning-based anomaly detection approach in a clean water treatment system. In2023 19th International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT), pp. 453-460.
[6] Sheatsley R., Papernot N., Weisman M.J., Verma G., andMcDaniel P., 2022. Adversarial examples for network intrusion detection systems. Journal of Computer Security,30(5), pp. 727-752.
[7] Sheatsley R., Hoak B., Pauley E., Beugin Y., Weisman M.J., andMcDaniel P., 2021. On the robustness of domain constraints. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 495-515.
[8] Yang K., Liu J., Zhang C., andFang Y., 2018. Adversarial examples against the deep learning based network intrusion detection systems. InMILCOM 2018-2018 IEEE Military Communications Conference (MILCOM), pp. 559-564.
[9] Pawlicki M., Choraś M., andKozik R., 2020. Defending network intrusion detection systems against adversarial evasion attacks.Future Generation Computer Systems, 110, pp. 148-154.
[10] Rigaki M.,2017. Adversarial deep learning against intrusion detection classifiers.
[11] Ennaji S., De Gaspari F., Hitaj D., Kbidi A., andMancini L.V., 2025. Adversarial challenges in network intrusion detection systems: research insights and future prospects.IEEE Access.
[12] Chernikova A., andOprea A., 2022. Fence: feasible evasion attacks on neural networks in constrained environments. ACM Transactions on Privacy and Security,25(4), pp. 1-34.
[13] Alotaibi A., andRassam M.A., 2023. Adversarial machine learning attacks against intrusion detection systems: A survey on strategies and defense.Future Internet, 15(2), 62.
[14] Debicha I., Debatty T., Dricot J.M., andMees W., 2021. Adversarial training for deep learning-based intrusion detection systems.Arxiv Preprint Arxiv:2104.09852.
[15] Rashid M.M., Kamruzzaman J., Hassan M.M., Imam T., Wibowo S., Gordon S., andFortino G., 2022. Adversarial training for deep learning-based cyberattack detection in IoT-based smart city applications.Computers & Security, 120, 102783.
[16] Xiong W.D., Luo K.L., andLi R., 2023. AIDTF: adversarial training framework for network intrusion detection.Computers & Security, 128, 103141.
[17] Apruzzese G., Andreolini M., Colajanni M., andMarchetti M., 2020. Hardening random forest cyber detectors against adversarial attacks. IEEE Transactions on Emerging Topics in Computational Intelligence,4(4), pp. 427-439.
[18] Qiu H., Zeng Y., Zheng Q., Guo S., Zhang T., andLi H., 2021. An efficient preprocessing-based approach to mitigate advanced adversarial attacks. IEEE Transactions on Computers,73(3), pp. 645-655.
[19] Zhang Y., Wu Y., andHuang X., 2024. Toward transferable adversarial attacks against autoencoder-based network intrusion detectors. IEEE Transactions on Industrial Informatics,20(12), pp. 13863-13872.
[20] He K., Kim D.D., andAsghar M.R., 2023. Adversarial machine learning for network intrusion detection systems: A comprehensive survey. IEEE Communications Surveys & Tutorials,25(1), pp. 538-566.
[21] Roshan K., andZafar A., 2024. Black-box adversarial transferability: an empirical study in cybersecurity perspective.Computers & Security, 141, 103853.
[22] Alhussien N., Aleroud A., Melhem A., andKhamaiseh S.Y., 2024. Constraining adversarial attacks on network intrusion detection systems: transferability and defense analysis. IEEE Transactions on Network and Service Management,21(3), pp. 2751-2772.
[23] McNemar Q.,1947. Note on the sampling error of the difference between correlated proportions or percentages. Psychometrika,12(2), pp. 153-157.
[24] Athalye A., Carlini N., andWagner D., 2018. Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. InInternational Conference on Machine Learning, pp. 274-283.