💻 computer science

Adversarial Attack on Deep Learning Based Network Intrusion Detection Systems: An Empirical Analysis across Datasets and Features

This paper empirically demonstrates that deep learning-based network intrusion detection systems are highly vulnerable to adversarial evasion attacks across different datasets and feature sets, revealing that vulnerability is an inherent property of the learned decision surface rather than a dataset-specific issue, and proposing a Feature Vulnerability Index to identify which input features are most susceptible to perturbation.

Original authors: Gundapu Thirupathi, V Thirupathi

Published 2026-10-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Gundapu Thirupathi, V Thirupathi

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, network intrusion detection systems act as the silent sentinels of our connected infrastructure. They constantly watch the flow of data, looking for the subtle signs of a break-in, a theft, or a malicious flood of traffic. For years, these systems relied on fixed rules and known patterns, much like a security guard checking a list of wanted faces. However, as cyber threats have grown more complex and elusive, researchers have turned to deep learning, a form of artificial intelligence that learns to recognize patterns by studying vast amounts of data rather than following a rigid checklist. These systems can spot anomalies with remarkable speed and accuracy, often identifying threats that traditional methods miss. Yet, this reliance on learning machines has opened a new and unsettling door. Just as a human can be tricked by a clever disguise, these intelligent systems can be fooled by tiny, carefully crafted changes to the data they receive. A malicious actor does not need to break the system; they only need to nudge the data just enough to make the machine see a harmless packet as a threat, or worse, see a dangerous attack as perfectly safe.

Two researchers from SR University in India, Gundapu Thirupathi and Dr. V. Thirupathi, set out to understand just how fragile these digital sentinels truly are. They did not look at a single, isolated case but instead tested their theory across two very different worlds of network data. One dataset, known as KDD Cup 1999, is a classic collection of simulated network traffic from the late 1990s, while the other, CICIDS2017, is a modern record of real enterprise network activity from nearly two decades later. By training their artificial intelligence models on both, they ensured that their findings would not be a fluke of one specific dataset but a reflection of how these systems behave in general. They subjected their models to three different types of digital attacks, ranging from a single, quick push to a sustained, iterative effort designed to find the weakest point in the system's logic. They also tested these attacks with varying levels of intensity, from barely noticeable nudges to significant distortions of the data.

The results were stark and deeply concerning. On clean, unaltered data, the artificial intelligence models performed with the high confidence one would expect from modern technology, correctly identifying normal traffic and attacks with accuracy rates of 94.4% and 97.8% respectively. However, when the researchers applied the strongest version of their attack, the performance of these systems collapsed almost entirely. The accuracy of the model trained on the older data plummeted to just 5.6%, while the model trained on the modern data fell even further to 2.3%. This was not a case of the system becoming slightly confused or making a few random mistakes. The researchers found that the attacks did not merely degrade the system's performance; they completely inverted its understanding of reality. In a disturbing twist, the system began to confidently flag harmless traffic as dangerous while simultaneously ignoring actual attacks, treating them as if they were perfectly normal. It was as if the security guard, after being tricked by a disguise, started arresting innocent citizens while letting the thieves walk right past.

To understand why this happened, the researchers looked deeper than just the final numbers. They developed a new way to measure which specific pieces of information the attackers were exploiting. They found that the vulnerability was not spread evenly across all the data the system received. Instead, the attacks consistently targeted specific characteristics related to the timing of the data and the size of the packets, such as how many packets arrived per second or the variation in their lengths. These subtle, continuous details proved to be the Achilles' heel of the system, whereas the sheer volume of traffic or the count of connections was far less critical to the deception. This suggests that the weakness is not a flaw in the specific data sets used, but rather an inherent property of how these deep learning models process information. The very mathematical structure that allows them to learn so quickly and accurately also makes them susceptible to being pushed off course by tiny, calculated changes.

The study concludes that the high accuracy numbers often touted for these systems can be dangerously misleading if they are not tested against such adversarial conditions. A system that is 97% accurate on clean data can be rendered almost useless by an attacker who knows how to exploit its specific weaknesses. The researchers argue that for these technologies to be safe in critical security scenarios, we must move beyond simply measuring how well they perform on standard tests. We must also understand which parts of the data they rely on most and how those parts can be shielded. The findings serve as a sobering reminder that in the arms race of cybersecurity, the intelligence of the defender is only as strong as its ability to withstand the ingenuity of the attacker, and in this case, the current generation of deep learning defenders is far more fragile than it appears.

Technical Summary: Adversarial Attack on Deep Learning Based Network Intrusion Detection Systems

Problem Statement
Deep Learning (DL) based Network Intrusion Detection Systems (NIDS) have demonstrated high accuracy in detecting malicious traffic, often exceeding 95% on benchmark datasets. However, these models are susceptible to adversarial evasion attacks, where an adversary introduces small, imperceptible perturbations to input data to force misclassification. In the context of NIDS, this vulnerability is critical: an attacker can manipulate network traffic features (e.g., packet timing, byte counts) to bypass detection, allowing active attacks like DoS floods or data exfiltration to proceed undetected.

Existing literature suffers from three primary limitations:

Dataset Specificity: Most studies evaluate vulnerability on a single dataset (typically KDD Cup 99 or CICIDS2017), making it unclear if vulnerabilities are general properties of DL-based NIDS or artifacts of specific data distributions.
Attack Strength: Many evaluations rely solely on the single-step Fast Gradient Sign Method (FGSM), which often underestimates model vulnerability compared to iterative attacks.
Lack of Feature-Level Diagnostics: Robustness is usually reported as aggregate accuracy drops without identifying which specific input features are most exploited by attackers.

Methodology
The authors conducted a cross-dataset empirical analysis using two distinct datasets: the classical KDD Cup 1999 (simulated 1998 military traffic) and the modern CICIDS2017 (real enterprise traffic).

Preprocessing: Both datasets underwent deduplication (removing ~70% of KDD Cup 99 duplicates) and min-max normalization to a [0, 1] range. Multi-class labels were binarized (Benign vs. Attack).
Victim Model: A consistent Deep Neural Network (DNN) architecture was trained on both datasets to ensure comparability. The model consists of three fully connected hidden layers (128, 64, 32 units) with ReLU activation, batch normalization, and dropout (0.3). It uses a softmax output layer and is trained with the Adam optimizer and early stopping.
Threat Model: A white-box, untargeted evasion scenario was assumed. The adversary has full access to the model parameters and gradients.
Attacks: Three gradient-based attacks were applied with perturbation budgets ( $\epsilon$ $ϵ$ ) ranging from 0.01 to 0.3:
- FGSM: Single-step attack.
- BIM (Basic Iterative Method): Multi-step iterative attack.
- PGD (Projected Gradient Descent): Multi-step attack with random restarts ( $r=3$ ) to find the worst-case perturbation.
Evaluation Metrics: Standard metrics (Accuracy, Precision, Recall, F1) and a novel Feature Vulnerability Index (FVI) were used. FVI quantifies the average perturbation size required per feature across all attack configurations to identify which features are most consistently exploited.

Key Results

Catastrophic Accuracy Drop: While the models achieved high clean-data accuracy (94.4% on KDD Cup 99 and 97.8% on CICIDS2017), they suffered severe degradation under strong attacks. Under PGD with $\epsilon=0.3$ , accuracy dropped to 5.6% (KDD) and 2.3% (CICIDS2017), representing relative drops of 94.1% and 97.7%, respectively.
Iterative vs. Single-Step: Iterative attacks (BIM and PGD) significantly outperformed FGSM. Notably, FGSM showed non-monotonic behavior on CICIDS2017 (accuracy plateauing around 37-40% for higher $\epsilon$ ), whereas iterative attacks drove accuracy below 6%.
Prediction Inversion: Confusion matrix analysis revealed that the accuracy collapse was not due to random noise but a systematic, near-total inversion of the decision boundary. Under PGD ( $\epsilon=0.3$ ), approximately 98% of benign samples were misclassified as attacks, and ~88-96% of actual attacks were misclassified as benign. This creates a "double-failure" mode where the system generates massive false alarms while missing real threats.
Feature Vulnerability Index (FVI):
- CICIDS2017: The most vulnerable features were exclusively related to flow timing and packet shape statistics (e.g., Flow Packets/s, Fwd IAT Max, Packet Length Variance). Volume-based features showed significantly lower vulnerability.
- KDD Cup 99: Vulnerable features included a mix of connection statistics and one-hot encoded service/flag indicators, though the ranking was partially confounded by the discrete nature of one-hot features.
Generalizability: The severity of the vulnerability was consistent across both datasets despite their differences in era, origin, and feature schema, suggesting the fragility is an architectural property of gradient-based DNNs rather than a dataset-specific artifact.

Significance and Claims
The paper claims that the adversarial vulnerability of DL-based NIDS is a fundamental architectural property, not an anomaly of specific datasets. The findings challenge the reliance on clean-data accuracy as a proxy for deployment readiness, demonstrating that high accuracy does not correlate with robustness.

The study highlights that under realistic white-box attacks, NIDS models do not merely degrade; they invert, leading to a state where the system is operationally useless (failing to detect attacks while flooding the system with false positives). Furthermore, the introduction of the FVI suggests that defensive strategies (such as adversarial training or input sanitization) should not treat all features equally but should specifically target the vulnerability of flow timing and packet shape statistics. The authors conclude that current DL-based NIDS require rigorous adversarial evaluation before deployment in critical security scenarios.

Technical Summary: Adversarial Attack on Deep Learning Based Network Intrusion Detection Systems

More like this