Search papers, labs, and topics across Lattice.
This paper introduces AMDS, an attack-aware multi-stage defense system for network intrusion detection that leverages a weighted combination of ensemble disagreement, predictive uncertainty, and distributional anomaly signals to learn attack-specific detection strategies. AMDS employs a two-stage adaptive weight learning mechanism to dynamically adjust the contribution of each signal based on the detected attack type. Experiments on a benchmark intrusion detection dataset demonstrate that AMDS achieves superior performance compared to adversarially trained ensembles, with a 94.2% AUROC and improved classification accuracy and F1-score, while also exhibiting resilience against adaptive white-box attacks.
Attack-specific detection strategies, learned through a weighted combination of ensemble disagreement, predictive uncertainty, and distributional anomaly signals, significantly boost adversarial robustness in network intrusion detection.
Machine learning based network intrusion detection systems are vulnerable to adversarial attacks that degrade classification performance under both gradient-based and distribution shift threat models. Existing defenses typically apply uniform detection strategies, which may not account for heterogeneous attack characteristics. This paper proposes an attack-aware multi-stage defense framework that learns attack-specific detection strategies through a weighted combination of ensemble disagreement, predictive uncertainty, and distributional anomaly signals. Empirical analysis across seven adversarial attack types reveals distinct detection signatures, enabling a two-stage adaptive detection mechanism. Experimental evaluation on a benchmark intrusion detection dataset indicates that the proposed system attains 94.2% area under the receiver operating characteristic curve and improves classification accuracy by 4.5 percentage points and F1-score by 9.0 points over adversarially trained ensembles. Under adaptive white-box attacks with full architectural knowledge, the system appears to maintain 94.4% accuracy with a 4.2% attack success rate, though this evaluation is limited to two adaptive variants and does not constitute a formal robustness guarantee. Cross-dataset validation further suggests that defense effectiveness depends on baseline classifier competence and may vary with feature dimensionality. These results suggest that attack-specific optimization combined with multi-signal integration can provide a practical approach to improving adversarial robustness in machine learning-based intrusion detection systems.
