Jul 2026· International Journal of Information Security· Vol 25· 0 citations· 43 references
Computer Science
Abstract
Deep learning based network intrusion detection systems (IDS) can achieve strong traffic classification performance, but their resilience to adversarial manipulation remains a critical concern. This study evaluates the adversarial robustness of Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models in a multiclass intrusion detection setting using the Train_Test_Network dataset with ten traffic classes. The models were trained on true sliding flow-window sequences under a unified preprocessing pipeline to support fair comparison. Adversarial robustness was first assessed under a white-box Fast Gradient Sign Method (FGSM) setting and then broadened through additional FGSM and Projected Gradient Descent (PGD) stress testing. SHapley Additive exPlanations (SHAP) were further used to analyse explanation instability under clean and adversarial conditions, and explanation-drift features were evaluated as a secondary adversarial detection signal. Under clean evaluation, both models achieved strong and nearly identical performance, with accuracies of 0.9614 for LSTM and 0.9615 for GRU and weighted F1-scores of 0.9597 and 0.9598, respectively. Under the main FGSM condition, performance declined substantially: the LSTM achieved adversarial accuracy of 0.6094 and weighted F1-score of 0.6290 with an evasion rate of 37.38%, while the GRU achieved adversarial accuracy of 0.5130 and weighted F1-score of 0.5690 with an evasion rate of 47.02%. The broader robustness sweep showed that iterative PGD exposed stronger fragility than FGSM alone. SHAP analysis indicated that adversarial perturbation altered both prediction outcomes and local explanation structure. A learned explanation-driven detector improved over the rule-based baseline, while larger-scale validation confirmed that explanation drift remained informative, though not perfectly separable, at broader scale. Overall, the results show that strong clean performance does not imply adversarial robustness, and that explanation drift provides a useful auxiliary signal for adversarial monitoring in recurrent IDS models.
Network Intrusion Detection Systems (NIDS) play a vital role in modern cybersecurity by leveraging artificial intelligence (AI) in particular deep learning (DL) and machine learning (ML) to detect and mitigate malicious activities. However, these AI-driven systems are highly vulnerable to adversarial attacks, where small, imperceptible perturbations in input data can deceive models and significantly reduce detection accuracy. This raises critical concerns about the security and reliability of intrusion detection, especially in real-world scenarios where attackers exploit adversarial transferability to bypass defenses. This research investigates the threat posed by black-box adversarial attacks via surrogate models, focusing on the ability of adversarial examples to transfer across different architectures. This study simulates real-world adversarial threats, demonstrating how attacks crafted on one model can effectively deceive another, compromising NIDS security. A comparative study is conducted on two widely used AI models: an Artificial Neural Network (ANN) and a Convolutional Neural Network (CNN), both trained on the CICIDS 2019 dataset. The study evaluates the robustness of these models against two gradient-based adversarial attack methods, Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD), to determine their susceptibility under black box adversarial conditions. Experimental results indicate that CNN-based NIDS are more vulnerable to adversarial attacks than ANN-based models, with adversarial examples successfully transferring across architectures. These findings highlight the critical risks associated with adversarial transferability, underscoring the need for enhanced security measures to strengthen AI-driven intrusion detection systems against evolving cyber threats.
Aasim Zafar, Shazra Wali, Sheikh Burhan Ul Haque· International Journal of Inf...· 0 citations
Machine learning-based intrusion detection systems (IDSs) often suffer from class imbalance and vulnerability to adversarial attacks, leading to degraded detection performance and reduced robustness. This study proposes a TabTransformer framework augmented by the Boundary-Seeking Generative Adversarial Network (BGAN) for flow-based intrusion detection using the CICIDS2017 dataset. BGAN serves a dual purpose by generating synthetic minority-class samples to mitigate data imbalance and producing adversarial samples to evaluate model robustness. Experimental results demonstrate that BGAN augmentation improves TabTransformer's Macro-F1 score from 82.96% to 86.50%, with the largest class-wise improvement observed for Web_Attack (F1 score: 0.29 to 0.61). Robustness evaluation shows that all non-augmented models experienced a 100% Performance Drop Rate (PDR) under adversarial testing, whereas all BGAN-augmented models achieved negative PDR values, indicating improved resilience. Furthermore, the augmented TabTransformer maintained stable and low False Triggered Rate (FTR) values (1.51%-2.92%) across all noise levels, compared with the BGAN-augmented Decision Tree, which reached 49.09% under benign perturbations. These findings demonstrate that BGAN consistently enhances both class balance and adversarial robustness, while the proposed BGAN-TabTransformer framework provides an effective and adaptive intrusion detection solution for adversarial network environments.
Raihan Sultan Pasha Basuki, Aliyah Kurniasih· 0 citations
The rise of artificial intelligence (AI) and machine learning (ML) in cybersecurity has made Adversarial Machine Learning (AML) a key field of research. Though ML-based systems are more effective in intrusion detection, malware analysis, spam filtering and authentication, they are also susceptible to adversarial attacks that modify input samples, modify ML models or alter training data. The review explores the key adversarial attack classes: poisoning, evasion, model extraction, model inversion, and membership inference and also white-box, black-box, and grey-box threat models. It also provides an introduction to important defence methods like adversarial training, feature squeezing, defensive distillation, robust optimisation, detection-based methods, and ensemble learning. In addition, robustness evaluation metrics, benchmark datasets and attack assessment techniques to measure model robustness are highlighted. Lastly, the emerging trends are discussed in order to find future research directions in the field of creating trustworthy and resilient AI-based cybersecurity systems, such as Explainable AI, Federated Learning, Large Language Models, Autonomous Cyber defence, and Regulatory structures.
Ujjwal Deshmukh· International Journal of Inn...· 0 citations
Machine learning-based Network Intrusion Detection Systems (ML-based NIDS) have become central to modern cyber defense because they can learn complex traffic patterns and detect evolving malicious behavior beyond predefined signatures. However, their reliance on statistical feature representations also exposes them to adversarial evasion, where malicious traffic is modified at inference time to induce misclassification while preserving its operational intent. In network environments, such attacks are shaped by protocol semantics, feature dependencies, traffic timing, and functionality-preservation constraints, making adversarial evasion in ML-based NIDS distinct from adversarial examples in more continuous domains. This review synthesizes 186 studies published between 2018 and 2026—a fast-growing but fragmented body of work—using a Kitchenham-informed systematic literature review methodology. It introduces a lifecycle-aware, NIDS-specific threat model and organizes the literature into three domains—adversarial generation, robustness evaluation, and defense—developing a hierarchical taxonomy within each and conducting a two-tier critical analysis that separates domain-specific limitations from cross-cutting methodological, empirical, and operational constraints. The synthesis shows that much reported evasion success reflects diagnostic feature-space sensitivity rather than executable, deployable adversarial risk, and that many defenses demonstrate component-level robustness rather than system-level resilience. The review also develops a perturbation-realism taxonomy, ranging from feature-level manipulation to executable packet-level attacks, that clarifies when reported success corresponds to deployable risk. Finally, it derives evidence-grounded lessons learned and a future research roadmap for improving realistic evaluation, reproducible reporting, and deployable robustness in adversarial ML-based NIDS.
Network intrusion detection systems (IDS) trained on fixed traffic snapshots decay silently after deployment as threat distributions shift. Fine-tuning models on new attacks triggers catastrophic forgetting, while retraining from scratch is computationally infeasible. Replay-based continual learning counters this, but existing methods unrealistically confine benign traffic to a single early task and ignore the replay buffer as a potential attack surface. To address this, we present an adaptive IDS framework coupling a tabular transformer encoder with a class balanced experience replay buffer that replays benign traffic at every update to stabilize decision boundaries. We introduce the class-instance incremental (CII) scenario where benign flows reappear alongside new attacks as a more faithful stress test, and probe the buffer with overt label flipping and stealthy backdoor poisoning attacks. On the CICIDS2017 benchmark, our framework achieved 0.9994 accuracy under the traditional class incremental setup and 0.9989 under CII, with negligible forgetting, drastically outperforming sequential fine-tuning (0.0052), EWC (0.0324), LwF (0.0699), and iCaRL (0.8770) baselines. While injecting benign traffic into every experience proves essential for preventing forgetting, the replay buffer introduces critical vulnerabilities. Label-flipping collapses the model entirely (0.0053 accuracy at a 1% budget), and the backdoor maintains 0.97 overall accuracy while driving the attack success rate on trigger flows to 95%, evading standard monitoring. Ultimately, while a modest replay budget recovers near-joint-training performance, ensuring buffer integrity emerges as a strict operational requirement.
Azizi Ariffin, A. Haris, Faiz Zaki et al.· 0 citations
Ensuring the robustness of Network Intrusion Detection Systems (NIDS) against adversarial manipulation is an increasingly important problem in the field of computer network security today. Recent breakthroughs in adversarial machine learning have brought to light the vulnerability of NIDS that rely on deep learning models to carefully crafted perturbations, which could significantly degrade the detection and classification performance. In the present investigation, we carry out a systematic empirical investigation of targeted white box adversarial attacks upon a deep learning based multi-class NIDS. A DNN-based intrusion detection model is first evaluated in benign operational condition and then, is subjected to targeted adversarial perturbations introduced using the Fast Gradient Sign Method. To address the observed vulnerabilities, we follow Adversarial Training as a heuristic defence mechanism. All the experiments made use of a subset of the Canadian Institutes of Cybersecurity Intrusion Detection System benchmark data. The proposed NIDS achieves an accuracy of 97.11% in pre-attack conditions. When the model is fed with targeted adversarial perturbations, the classification accuracy decreases to a large degree to 33.27%, 52.15%, 37.89%, and 29.45% when the Benign, DDoS, DoS-Hulk, and PortScan classes are taken as the target, respectively. Incorporating Adversarial Training improves the robustness and increases the accuracy to 73.83%, 76.82%, 75.71% and 71.96% in respective targeted scenarios, although the recovery still depends on the class. Rather than present new attack or defence, this study presents a detailed empirical assessment of targeted adversarial vulnerability and defensive behaviour in a multi-class NIDS setting. The results highlight long-standing, class-specific, robustness gaps and provide insights that could be used to design more robust intrusion detection systems.