Search papers, labs, and topics across Lattice.
This paper addresses the vulnerability of autoencoder-based network intrusion detection systems (NIDS) to adversarial evasion attacks by introducing two novel detection mechanisms: the Residual Localisation Detector (RLD) and the Feature-Space Perturbation Consistency (FPC) Detector. By leveraging the PANDA framework, which translates network packet sequences into invertible grayscale images, the authors demonstrate that adversarial examples can effectively evade detection while maintaining benign appearances. Both proposed detectors achieve exceptional performance metrics (TNR, TPR, precision, recall, and F1-score ≥ 0.99) against adversarial examples across various IoT traffic, highlighting a robust defense strategy against these sophisticated attacks.
Adversarial evasion attacks can be effectively countered with near-perfect detection rates by integrating reconstruction error tracking and perturbation consistency checks in both image and packet-feature spaces.
Evasion attacks deliberately manipulate input to an ML-based system to produce an incorrect prediction while the manipulated input still appears benign. The PANDA framework has demonstrated that adversarial examples developed for the vision domain can be transferred to the network domain by converting packet sequences into invertible grayscale images, enabling gradient-based attacks such as masked FGSM against autoencoder-based network intrusion detection systems (NIDS). These attacks manipulate the NIDS anomaly score without altering the underlying attack semantics, leaving defenders without a straightforward way to distinguish between benign flows and carefully perturbed malicious traffic. In this paper, we propose two complementary detectors: the Residual Localisation Detector (RLD), which tracks the spatial concentration of reconstruction errors in the inter-arrival time feature region in image space; and the Feature-Space Perturbation Consistency (FPC) Detector, which operates directly on packet-level inter-arrival time features in packet-feature space. We evaluate both detectors on benign, malicious, and adversarial traffic from multiple IoT devices in the UQ-IoT dataset. Both detectors achieve near-perfect detection performance (TNR, TPR, precision, recall, and F1-score $\geq 0.99$) against adversarial examples across the evaluated IoT traffic. Our results indicate that integrating reconstruction-based scoring with perturbation consistency checks, in both image space and packet-feature space, offers a practical defence against emerging PANDA-style adversarial attacks on NIDS.
