Pith. sign in

REVIEW 3 major objections 5 minor 59 references

A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic

T0 review · 3 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Stacking an adversarially trained model with a Gaussian-augmented model restores NIDS accuracy to 96.57% under FGSM and 89.20% under C&W attacks.

desk verdict A clearly written but empirically circular defense paper: the headline robustness numbers are in-distribution fits to pre-generated attacks, not results against an adaptive adversary. read the letter →

arxiv 2607.17105 v1 pith:5PP2B3GM submitted 2026-07-19 cs.CR cs.LG

Khushnaseeb Roshan This is my paper · ORCID
classification cs.CRcs.LG
keywords adversarialmachinelearningnetworkintrusiondetectionwhite-boxattackFGSMandC&WattackstrainingGaussiandataaugmentationstackingmeta-classifierCICIDS-2017
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Network intrusion detection systems (NIDS) can be fooled by small adversarial perturbations that make benign traffic look malicious. This paper tries to show that a hybrid defense—combining Adversarial Training (AT_NIDS) and Gaussian Data Augmentation (GDA_NIDS) through a stacking meta-classifier—can bring a vulnerable deep-learning NIDS back to near pre-attack performance. In the author's experiments on CICIDS-2017, FGSM at epsilon 0.0009 collapses accuracy from about 99.3% to 26.49%, and C&W at confidence 0.0009 drops it to 49.61%; the hybrid defense restores accuracy to 96.57% and 89.20%, respectively. The claim matters because a single heuristic defense tends to be narrow, while this design is meant to combine targeted robustness with multi-directional smoothing. The paper also reports that the improvement holds across all tested epsilon/confidence values from 0.0001 to 0.0009.

What carries the argument

The central object is the stacking integration method (the Hybrid_NIDS meta-classifier). It takes the output predictions of two frozen base models—AT_NIDS and GDA_NIDS—concatenates them, and trains a dense meta-learner to make the final decision. The mechanism carries the argument by showing that a learned combination of targeted adversarial training and multi-directional Gaussian augmentation can recover classification performance that either approach alone would not guarantee.

What would settle it

Generate FGSM and C&W perturbations by attacking the completed Hybrid_NIDS (using gradients or confidence scores of the stacked model) rather than the original NIDS, then measure post-defense accuracy on those adaptive examples. If accuracy falls back toward the undefended post-attack levels (for example, below ~50%), the central claim is false. A weaker check: train on one set of epsilon/confidence values and test on a disjoint set of values, or re-seed the attacks, and see whether the reported margins persist.

Watch

Extended reading notes

Core claim

The author's central claim is that the stacked model, not either defense alone, is what makes the NIDS resilient. AT_NIDS is trained on FGSM- and C&W-perturbed inputs so it knows specific attack directions; GDA_NIDS is trained with Gaussian noise so it does not become overconfident in any direction. Their predictions are frozen and concatenated, then a small dense meta-classifier (60 ReLU units, sigmoid output) learns the right combination. On the post-defense test split, accuracy and F1 stay above 96% for FGSM and above 89% for C&W across the entire noise range. The paper reads this as evidence that a stacking-based hybrid is a practical way to harden NIDS against white-box evasion.

Load-bearing premise

The load-bearing premise is that adversarial examples generated against the original, undefended NIDS are a sufficient test of the defense: Algorithm 2 trains the meta-classifier on an 80% random split of those predictions and reports accuracy on the remaining 20% of the same pool, so the numbers measure fit to pre-generated attacks, not robustness against an adversary who adapts to the hybrid model.

Editorial extensions

If this is right

  • If correct, a NIDS can be hardened without retraining its core detector: the two defensive models are frozen and only the small meta-classifier is trained on top of their predictions.
  • Post-defense performance is stable over a wide perturbation range: accuracy stays above 96% for FGSM and above 89% for C&W for every epsilon/confidence from 0.0001 to 0.0009.
  • The recovery is not just accuracy: F1-score rises from 0.2563 to 0.9655 under the strongest FGSM attack and from 0.4593 to 0.8895 under the strongest C&W attack, indicating fewer missed attacks and fewer false alarms.
  • The combination is intended to be complementary: AT_NIDS resists known perturbation directions while GDA_NIDS smooths the decision surface in all directions, so their stacked predictions should be harder to evade than either defense's output alone.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The evaluation protocol is in-distribution: the meta-classifier is trained and tested on random 80/20 splits of the same adversarial pool generated against the original NIDS. An adaptive adversary who crafts FGSM or C&W examples against Hybrid_NIDS itself would likely produce larger accuracy drops than the reported 96.57%/89.20%.
  • Because the method consumes only predictions, the same stacking recipe could be applied to other security models (e.g., malware or phishing detectors) or to non-security tabular classifiers; the testable question is whether base models with complementary failure modes are needed for the gain to appear.
  • Section 7's stated limitations—only two attack types, a static CICIDS-2017 snapshot, and white-box-only evaluation—suggest that the defense's real-world value should be tested on a live or evolving traffic stream, where new attack families and black-box transfer attacks are common.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a hybrid defense for a deep-learning NIDS against white-box FGSM and C&W adversarial attacks on the CICIDS-2017 dataset. The defense combines adversarial training (AT_NIDS) and Gaussian data augmentation (GDA_NIDS) and integrates them via a stacking meta-classifier. The authors report that the original NIDS accuracy degrades to 26.49% under FGSM and 49.61% under C&W, and that the hybrid defense restores accuracy to 96.57% and 89.20%, respectively, across epsilon/confidence values from 0.0001 to 0.0009. The paper includes detailed algorithms, experimental setup, and comparisons with prior work.

Significance. If the reported robustness results were valid, the proposed hybrid defense would be a practically useful contribution to adversarial machine learning for network intrusion detection. The paper makes several positive aspects explicit: it provides step-by-step algorithms (Algorithm 1 and 2), uses a widely accepted benchmark (CICIDS-2017), and leverages standard tools (ART, Keras, scikit-learn) for reproducibility. The idea of combining two heuristic defenses through a stacking meta-learner is reasonable and worth investigating. However, the central claim of effective mitigation is not supported by the presented evaluation, which measures in-distribution fit to pre-generated attacks rather than robustness against an adaptive white-box adversary. The significance of the contribution therefore depends on whether the authors can supply a properly designed robustness evaluation.

major comments (3)
  1. [Algorithm 2, Steps 4-6] The meta-classifier (stacked_model) is trained on the predictions of AT_NIDS and GDA_NIDS over D_FGSM and D_CW, and then evaluated on a random 20% holdout of the same concatenated dataset. This is an in-distribution evaluation: the meta-learner is fit to the exact attack algorithms, perturbation magnitudes, and base-model prediction patterns it is tested on. Consequently, the post-defense accuracies in Tables 8 and 9 measure generalization over pre-generated adversarial examples, not robustness against an adversary who adapts to the hybrid model. This is the load-bearing issue for the paper's central claim of 'effective mitigation'.
  2. [Section 4.2 / Section 4.3.3] The adversarial examples are generated against the original NIDS (Algorithm 1 uses the original NIDS model), and the hybrid defense is never evaluated under an adaptive white-box attack. A white-box adversary who knows the full stacked model (AT_NIDS + GDA_NIDS + meta-classifier) would compute gradients through the entire ensemble to craft new perturbations. The paper does not test this scenario, so the claimed white-box robustness is not established. The limitations section acknowledges only 'black-box' and 'other attack types' as missing, but does not acknowledge this non-adaptive evaluation gap.
  3. [Section 4.3.1 / Section 6.3] The manuscript states that AT_NIDS is trained on adversarial examples generated with FGSM and C&W, but it does not specify whether those examples are drawn from the same D_FGSM/D_CW used for evaluation in Algorithm 2. If the same pre-generated adversarial examples are used for both training AT_NIDS and evaluating the hybrid model, the reported post-defense accuracy partly reflects memorization rather than generalization. The paper also does not provide an ablation (e.g., AT alone, GDA alone, or a no-meta-classifier baseline) to isolate the contribution of the stacking component. These missing controls are necessary to support the claim that the hybrid approach is superior to its components.
minor comments (5)
  1. [Tables 6 and 7] The FN and FP columns appear to be swapped in several rows; the reader's report notes this is correctable. Please verify the confusion-matrix convention used and ensure consistency across all tables.
  2. [Table 11] The consolidated comparison reports 'Post Hybrid Defense: 96.95% (FGSM), 90.12% (C&W)', which does not match the values in Tables 8 and 9 (96.57% and 89.20%). The averaging procedure should be clarified.
  3. [Introduction, Section 2.3] There is a stray 'u' in the sentence about deep heterogeneous stacking integration (end of first paragraph of the introduction). Also, 'demographic representation' (e.g., in Figure 5 and Figure 9 captions) should likely be 'diagrammatic representation' or 'schematic representation'.
  4. [Section 4.3.1, Eq. (4)] The adversarial training objective mixes the original model f(x) and the new model g(x) with a coefficient α. The notation is confusing because it is not clear whether L(f(x), y) is computed with the original model's parameters or with the same θ_g being optimized. Please clarify.
  5. [Section 7] The limitations section omits the non-adaptive evaluation issue and the potential overlap between AT training data and evaluation adversarial examples. Adding these would give readers a more accurate picture of the claims' validity.

Circularity Check

1 steps flagged · score 6.0 of 10

Post-defense accuracy is reported on full adversarial datasets despite the algorithm's 20% holdout, making the robustness claim an in-sample fit rather than a prediction.

  1. fitted input called prediction [Algorithm 2 Steps 4-6; Section 6.3 Tables 8 and 9; Section 3 Table 2]
    "Step 5: Fit the stacking model using the concatenated dataset ... X_train, X_test, y_train, y_test = train_test_split(concatenated_dataset, y, test_size=0.2, random_state=42) ... Step 6: Evaluate the Hybrid_NIDS model on D_FGSM and D_CW. y_pred = stacked_model.predict([X_test.iloc[:, :2], X_test.iloc[:, 2:]]) ... Testing instance count 102217 ... For example, with an epsilon of 0.0009, accuracy increased to 0.9657 ... Table 8: 45681 53027 2983 526"

    The stacked meta-classifier is fit to predictions of AT_NIDS and GDA_NIDS over D_FGSM/D_CW. The algorithm claims a 20% test split, but the reported per-epsilon confusion matrices each sum to the full test-set size: Table 2 gives Testing instance count 102217, and Table 8 (epsilon=0.0009) sums 45681+53027+2983+526 = 102217; Table 9 (confidence=0.0009) sums 37912+53269+10752+284 = 102217. Thus the headline 'post-defense accuracy' (96.57% and 89.20%) is not computed on the stated 20% holdout but is consistent with scoring the model on the full adversarial prediction pool used to train it. The central robustness claim therefore reduces to in-sample fit over pre-generated attacks rather than an out-of-sample prediction; no adaptive white-box attack against the hybrid model is generated.

full rationale

The paper's equations are standard and not intrinsically circular: FGSM/C&W follow Goodfellow and Carlini, AT/GDA objectives follow the cited heuristic-defense literature, and stacking is a normal ensemble construction. The operative circularity is in the evaluation protocol. Algorithm 2 states an 80/20 train/test split of the concatenated predictions, but the confusion matrices in Tables 8 and 9 have row totals of 102,217 per epsilon, matching the full testing-set count from Table 2 rather than a 20% holdout of roughly 20,443 rows. The reported per-epsilon metrics are therefore consistent with evaluating the stacked model on the full adversarial pool that includes the samples used to fit it—or at least are not the declared holdout evaluation. Consequently, the abstract's headline post-defense numbers report in-sample classification on pre-generated FGSM/C&W examples rather than a held-out robustness prediction. Additionally, D_FGSM/D_CW were generated against the original NIDS (Algorithm 1), so no attack is mounted against the hybrid model; this is an external-validity gap, and Section 7 lists only missing attack types, static dataset, and black-box settings, not this adaptive-attack limitation. Self-citations to prior Roshan/Zafar work concern feature selection and inspiration rather than the load-bearing conclusion, so no separate self-citation circularity is scored.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central claim rests on an empirical evaluation; no mathematical derivation is provided. The effective free parameters are the unreported alpha and sigma, the hand-chosen epsilon/confidence grid, and the fixed split. Key domain assumptions are that the CICIDS-2017 subset is representative and that feature-space attacks are a valid threat model.

free parameters (5)
  • adversarial training mixing coefficient alpha
    Equation (4) defines alpha but no value is reported; it controls the balance of clean vs. adversarial loss for AT_NIDS.
  • Gaussian noise variance sigma^2
    Equation (5) defines sigma^2 but the GDA_NIDS training uses an unreported noise level.
  • epsilon/confidence range = 0.0001 to 0.0009
    Hand-selected perturbation range; no rationale or sensitivity analysis outside this band.
  • random_state 42 split = 42
    Fixed split used in both dataset and meta-learner train/test splitting; no seed variability reported.
  • meta-learner architecture = Dense(60), 50 epochs, Adam
    Chosen without ablation; could affect post-defense accuracy.
assumptions (3)
  • domain assumption CICIDS-2017 subset is representative of real network traffic
    Dataset described in Section 3; no validation on live traffic or other datasets.
  • domain assumption Feature-space FGSM/C&W perturbations preserve realistic network traffic
    Attacks are applied directly to normalized feature vectors via ART; no syntactic or semantic validity check as in Merzouk et al. [34].
  • ad hoc to paper White-box attacks against the original NIDS are a sufficient robustness benchmark
    The defense is never attacked itself; Section 6.3 evaluates pre-generated adversarial examples only.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic." pith.science (2026). https://pith.science/paper/5PP2B3GM

@misc{pith2026260717105,
  author       = {Pith},
  title        = {Pith review of: A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5PP2B3GM}},
  note         = {Machine review of arXiv:2607.17105}
}
read the original abstract

It is crucial to safeguard computer networks from evolving network security threats and unknown cyberattacks. An essential tool for protecting computer networks against unknown cyber threats is Network Intrusion Detection System (NIDS). However, NIDS faces a major security concern due to its susceptibility to adversarial attacks. Adversarial attacks aim to deceive NIDS by crafting and injecting adversarial examples into the system. These adversarial inputs can deceive the NIDS into misclassifying benign network traffic as malicious. We developed a resilient hybrid defense mechanism aimed to mitigate the impact of two potent adversarial attacks: Fast Gradient Sign Method (FGSM) and Carlini & Wagner (C&W) attack. Our hybrid defense approach leverages the combined strength of two heuristic defense methods: Adversarial Training (AT) and Gaussian Data Augmentation (GDA). GDA provides multi-directional defense, while AT enhances NIDS robustness against specific adversarial vectors. Under pre-attack scenarios, NIDS demonstrated good accuracy and f1-score. However, in the post-attack scenario, its accuracy significantly dropped under FGSM and C&W attacks (0.2649 and 0.4961, respectively). Our proposed hybrid defense method effectively mitigated these adversarial threats, with post-defense accuracy of 96.57% and 89.20% for FGSM and C&W attacks. We evaluated the defense strategy across a range of epsilon and confidence noise factor values (ranging from 0.0001 to 0.0009). This research provides a good direction for future researchers in the emerging area of adversarial machine learning from a security perspective.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 13 canonical work pages

  1. [1]

    A holistic review of Network Anomaly Detection Systems: A comprehensive survey,

    N. Moustafa, J. Hu, and J. Slay, “A holistic review of Network Anomaly Detection Systems: A comprehensive survey,” J. Netw. Comput. Appl., vol. 128, pp. 33–55, Feb. 2019, doi: 10.1016/j.jnca.2018.12.006

    work page doi:10.1016/j.jnca.2018.12.006 2019

  2. [2]

    DI-NIDS: Domain invariant network intrusion detection system,

    S. Layeghy, M. Baktashmotlagh, and M. Portmann, “DI-NIDS: Domain invariant network intrusion detection system,” Knowledge-Based Syst., vol. 273, p. 110626, 2023, doi: 10.1016/j.knosys.2023.110626

    arXiv 2023

  3. [3]

    It, serves as a standard benchmark for evaluating network intrusion detection systems

    Dataset Description The CICIDS-2017 dataset, developed by the Canadian Institute for Cybersecurity. It, serves as a standard benchmark for evaluating network intrusion detection systems. It is freely accessible for research purposes and comprises traffic data captured in a testbed designed to mimic real - world network conditions and cyberattacks. Althoug...

    2017

  4. [4]

    We start by constructing the NIDS model

    Methodology This section describes our methodology for enhancing the resilience and robustness of NIDS through the proposed hybrid defense approach. We start by constructing the NIDS model. Then, we generate adversarial attacks using FGSM and C&W techniques, evaluating NIDS vulnerability. Post-attack, we assess NIDS performance. Our hybrid defense combine...

    2017

  5. [5]

    It is well -suited for deep learning tasks

    Experimental Setup The experiment is carried out on Google Colab, a cloud platform that offers complimentary access to GPU and TPU hardware. It is well -suited for deep learning tasks. It integrates with Google Drive and Jupyter Notebook. It allows to run Python program efficiently. The other supportive libraries required for experimentation are Keras, Te...

    2017

  6. [6]

    Each scenario highlights the model’s performance, adaptability, and robustness when subjected to adversarial attacks, specifically FGSM and C&W methods

    Findings and Discussion We described a detailed evaluation of the NIDS model across three different scenarios: pre - attack, post -attack, and post -defense. Each scenario highlights the model’s performance, adaptability, and robustness when subjected to adversarial attacks, specifically FGSM and C&W methods. Figure 6(a) and Figure 6(b) illustrate the NID...

    2017

  7. [7]

    • Adversarial Attacks: The research investigated two widely known adversarial attack methods, FGSM and C&W

    Limitations and Future Scope Some of the constraints and potential research directions for new researchers interested in cybersecurity and adversarial machine learning. • Adversarial Attacks: The research investigated two widely known adversarial attack methods, FGSM and C&W. However, adversarial threats is rapidly evolving with diverse adversarial attack...

    2017

  8. [8]

    The critical vulnerability is exposed when evaluating NIDS to adversarial attacks, specifically FGSM and C&W

    Conclusion The proposed research rigorously investigates the vulnerabilities of NIDS against evolving adversarial attacks. The critical vulnerability is exposed when evaluating NIDS to adversarial attacks, specifically FGSM and C&W. These attacks significantly compromised the NIDS performance such as classification report and confusion matrix, particularl...

Show all 59 references
  1. [9]

    A Stacking Ensemble for Network Intrusion Detection Using Heterogeneous Datasets,

    S. Rajagopal, P. P. Kundapur, and K. S. Hareesha, “A Stacking Ensemble for Network Intrusion Detection Using Heterogeneous Datasets,” Secur. Commun. Networks, vol. 2020, pp. 1–9, Jan. 2020, doi: 10.1155/2020/4586875

    2020 doi

  2. [10]

    Ensemble deep learning: A review,

    M. A. Ganaie, M. Hu, A. K. Malik, M. Tanveer, and P. N. Suganthan, “Ensemble deep learning: A review,” Eng. Appl. Artif. Intell., vol. 115, p. 105151, Oct. 2022, doi: 10.1016/J.ENGAPPAI.2022.105151

    2022

  3. [11]

    Ensemble based collaborative and distributed intrusion detection systems: A survey,

    G. Folino and P. Sabatino, “Ensemble based collaborative and distributed intrusion detection systems: A survey,” Journal of Network and Computer Applications, vol. 66. Academic Press, pp. 1–16, May 01, 2016, doi: 10.1016/j.jnca.2016.03.011

    2016 doi

  4. [12]

    Towards a machine learning-based framework for DDOS attack detection in software-defined IoT (SD-IoT) networks,

    J. Bhayo, S. Attique Shah, S. Hameed, A. Ahmed, J. Nasir, and D. Draheim, “Towards a machine learning-based framework for DDOS attack detection in software-defined IoT (SD-IoT) networks,” Eng. Appl. Artif. Intell., vol. 123, p. 106432, 2023, doi: 10.1016/j.engappai.2023.106432

    2023

  5. [13]

    A Systematic Review of Deep Learning Approaches for Computer Network and Information Security,

    K. Roshan and A. Zafar, “A Systematic Review of Deep Learning Approaches for Computer Network and Information Security,” in Lecture Notes in Electrical Engineering, 2022, vol. 853, pp. 345–356, doi: 10.1007/978-981-16-9885-9_29

    2022 doi

  6. [14]

    Deep Learning Approaches for Anomaly and Intrusion Detection in Computer Network: A Review,

    K. Roshan and A. Zafar, “Deep Learning Approaches for Anomaly and Intrusion Detection in Computer Network: A Review,” in Lecture Notes on Data Engineering and Communications Technologies, vol. 73, 2022, pp. 551–563

    2022

  7. [15]

    An Optimized Auto-Encoder based Approach for Detecting Zero-Day Cyber-Attacks in Computer Network,

    K. Roshan and A. Zafar, “An Optimized Auto-Encoder based Approach for Detecting Zero-Day Cyber-Attacks in Computer Network,” in 2021 5th International Conference on Information Systems and Computer Networks (ISCON), Oct. 2021, pp. 1–6, doi: 10.1109/ISCON52037.2021.9702437

    2021

  8. [16]

    Adversarial Attacks and Defenses in Deep Learning,

    K. Ren, T. Zheng, Z. Qin, and X. Liu, “Adversarial Attacks and Defenses in Deep Learning,” Engineering, vol. 6, no. 3, pp. 346–360, Mar. 2020, doi: 10.1016/j.eng.2019.12.012

    2020 doi

  9. [17]

    Deep stacking network for intrusion detection,

    Y. Tang, L. Gu, and L. Wang, “Deep stacking network for intrusion detection,” Sensors, vol. 22, no. 1, p. 25, Dec. 2022, doi: 10.3390/s22010025

    2022 doi

  10. [18]

    Adversarial Machine Learning In Network Intrusion Detection Domain: A Systematic Review,

    H. A. Alatwi and C. Morisset, “Adversarial Machine Learning In Network Intrusion Detection Domain: A Systematic Review,” Dec. 2021, Accessed: Aug. 05, 2022. [Online]. Available: http://arxiv.org/abs/2112.03315

    2021 arXiv

  11. [19]

    Adversarial Machine Learning: a taxonomy and terminology of attacks and mitigations,

    A. Oprea and A. Vassilev, “Adversarial Machine Learning: a taxonomy and terminology of attacks and mitigations,” 2023. Accessed: May 16, 2023. [Online]. Available: https://csrc.nist.gov/publications/detail/white-paper/2023/03/08/adversarial-machine- learning-taxonomy-and-termi...

    2023

  12. [20]

    Efficient defenses against adversarial atacks,

    V. Zantedeschi, M. I. Nicolae, and A. Rawat, “Efficient defenses against adversarial atacks,” in AISec 2017 - Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, co-located with CCS 2017, 2017, pp. 39–49, doi: 10.1145/3128572.3140449

    2017

  13. [21]

    Ensemble adaptive online machine learning in data stream: a case study in cyber intrusion detection system,

    K. Roshan and A. Zafar, “Ensemble adaptive online machine learning in data stream: a case study in cyber intrusion detection system,” Int. J. Inf. Technol., pp. 1–14, Feb. 2024, doi: 10.1007/s41870-024-01727-y

    2024 doi

  14. [22]

    AE-Integrated: Real-time network intrusion detection with Apache Kafka and autoencoder,

    K. Roshan and A. Zafar, “AE-Integrated: Real-time network intrusion detection with Apache Kafka and autoencoder,” Concurr. Comput. Pract. Exp., p. e8034, Jan. 2024, doi: 10.1002/cpe.8034

    2024 doi

  15. [23]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” Dec. 2015, Accessed: Sep. 19, 2022. [Online]. Available: http://arxiv.org/abs/1412.6572

    2015 arXiv

  16. [24]

    Towards Evaluating the Robustness of Neural Networks,

    N. Carlini and D. Wagner, “Towards Evaluating the Robustness of Neural Networks,” in Proceedings - IEEE Symposium on Security and Privacy, 2017, pp. 39–57, doi: 10.1109/SP.2017.49

    2017 doi

  17. [25]

    Network Anomaly Detection: Methods, Systems and Tools,

    M. H. Bhuyan, D. K. Bhattacharyya, and J. K. Kalita, “Network Anomaly Detection: Methods, Systems and Tools,” IEEE Commun. Surv. Tutorials, vol. 16, no. 1, pp. 303– 336, 2014, doi: 10.1109/SURV.2013.052213.00046

    2014

  18. [26]

    A detailed investigation and analysis of using machine learning techniques for intrusion detection,

    P. Mishra, V. Varadharajan, U. Tupakula, and E. S. Pilli, “A detailed investigation and analysis of using machine learning techniques for intrusion detection,” IEEE Commun. Surv. Tutorials, vol. 21, no. 1, pp. 686–728, 2019, doi: 10.1109/COMST.2018.2847722

    2019

  19. [27]

    A complete list of all (arxiv) adversarial example papers.,

    N. Carlini, “A complete list of all (arxiv) adversarial example papers.,” arxiv, 2019, Accessed: Oct. 04, 2023. [Online]. Available: https://nicholas.carlini.com/writing/2019/all-adversarial-example-papers.html

    2019

  20. [28]

    Black-box adversarial transferability: An empirical study in cybersecurity perspective,

    K. Roshan and A. Zafar, “Black-box adversarial transferability: An empirical study in cybersecurity perspective,” Comput. Secur., vol. 141, p. 103853, Apr. 2024, doi: 10.1016/j.cose.2024.103853

    2024

  21. [29]

    Boosting robustness of network intrusion detection systems: A novel two phase defense strategy against untargeted white-box optimization adversarial attack,

    M. K. Roshan and A. Zafar, “Boosting robustness of network intrusion detection systems: A novel two phase defense strategy against untargeted white-box optimization adversarial attack,” Expert Syst. Appl., vol. 249, p. 123567, Sep. 2024, doi: 10.1016/j.eswa.2024.123567

    2024

  22. [30]

    Adversarial classification,

    N. Dalvi, P. Domingos, Mausam, S. Sanghai, and D. Verma, “Adversarial classification,” in KDD-2004 - Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2004, pp. 99–108, doi: 10.1145/1014052.1014066

    2004

  23. [31]

    Adversarial learning,

    D. Lowd and C. Meek, “Adversarial learning,” in Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , 2005, pp. 641–647, doi: 10.1145/1081870.1081950

    2005

  24. [32]

    Can machine learning be secure?,

    M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, “Can machine learning be secure?,” in Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security, ASIACCS ’06, 2006, vol. 2006, pp. 16–25, doi: 10.1145/1128817.1128824

    2006

  25. [33]

    (2023) DNN NSL- KDD, CICIDS 2017, FGSM, JSMA, PGD, DeepFool (WB) Transefer Learning Pre Attack :A :98% Defense Detection Rate : 89% - Designed transfer learning-based adversarial detectors - Combined multiple detectors for improved attack detection - Evaluated on state- of-the...

    2023

  26. [34]

    Intriguing properties of neural networks,

    C. Szegedy et al., “Intriguing properties of neural networks,” 2nd Int. Conf. Learn. Represent. ICLR 2014 - Conf. Track Proc., pp. 1–10, Dec. 2013, [Online]. Available: http://arxiv.org/abs/1312.6199

    2014 arXiv

  27. [35]

    Deep learning,

    I. Goodfellow, Y. Bengio, A. Courville, and Y. Bengio, “Deep learning,” 2016, doi: 10.4258/hir.2016.22.4.351

    2016 doi

  28. [36]

    [37] (2021) CNN, DNN, KNN, RNN, C4.5 SCX- VPN- NON- VPN, NIMS DeepFool, PGD, Zoo (WB, BB ) NA Pre Attack F1: 97%, Post Attack F1 (Min):8% - Compared ML vs

    (2021) SVM, MLP, IF, KitNET, LR, DT, Kitsune Dataset, CICIDS- 2017 Traffic Mutation (BB GB) Adversari al feature reduction Detection :97%, Evasion (MER):97 % Detection: 97% - Explored GA, and GANs for generating adversarial examples - Demonstrated high evasion rates on NSL-KDD...

    2021

  29. [37]

    Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples,

    N. Papernot, P. McDaniel, and I. Goodfellow, “Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples,” May 2016, Accessed: Sep. 18, 2023. [Online]. Available: http://arxiv.org/abs/1605.07277

    2016 arXiv

  30. [38]

    Adversarial machine learning in Network Intrusion Detection Systems,

    E. Alhajjar, P. Maxwell, and N. Bastian, “Adversarial machine learning in Network Intrusion Detection Systems,” Expert Syst. Appl., vol. 186, p. 115782, Dec. 2021, doi: 10.1016/j.eswa.2021.115782

    2021

  31. [39]

    (2020) RF, AdaBoost, QDA, GNB, KNN NSL- KDD, UNSW- NB15, AWID JSMA (WB) DAE Post Defense: A 80.05%, , AUC:80.01 % - Proposed context- adaptive IDS using distributed DRL agents - Achieved better accuracy and lower FPR on NSL-KDD, UNSW-NB15, and AWID - Improved robustness with d...

    2020

  32. [40]

    RAIDS: Robust autoencoder -based intrusion detection system model against adversarial attacks,

    A. Sarıkaya, B. G. Kılıç, and M. Demirci, “RAIDS: Robust autoencoder -based intrusion detection system model against adversarial attacks,” Comput. Secur., vol. 135, p. 103483, Dec. 2023, doi: 10.1016/j.cose.2023.103483

    2023

  33. [41]

    Adv -Bot: Realistic adversarial botnet attacks against network intrusion detection systems,

    I. Debicha, B. Cochez, T. Kenaza, T. Debatty, J. M. Dricot, and W. Mees, “Adv -Bot: Realistic adversarial botnet attacks against network intrusion detection systems,” Comput. Secur., vol. 129, p. 103176, Jun. 2023, doi: 10.1016/j.cose.2023.103176

    2023

  34. [42]

    Defending against adversarial machine learning attacks using hierarchical learning: A case study on network traffic attack classification,

    A. McCarthy, E. Ghadafi, P. Andriotis, and P. Legg, “Defending against adversarial machine learning attacks using hierarchical learning: A case study on network traffic attack classification,” J. Inf. Secur. Appl., vol. 72, p. 103398, Feb. 2023, doi: 10.1016/j.jisa.2022.103398

    2023

  35. [43]

    TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems,

    I. Debicha, R. Bauwens, T. Debatty, J.-M. Dricot, T. Kenaza, and W. Mees, “TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems,” Futur. Gener. Comput. Syst., vol. 138, pp. 185–197, Oct. 2022, doi: 10.1016/j.fu...

    2022 doi

  36. [44]

    Investigating the practicality of adversarial evasion attacks on network intrusion detection,

    M. A. Merzouk, F. Cuppens, N. Boulahia-Cuppens, and R. Yaich, “Investigating the practicality of adversarial evasion attacks on network intrusion detection,” Ann. Telecommun., vol. 77, no. 11–12, pp. 763–775, Dec. 2022, doi: 10.1007/s12243-022- 00910-1

    2022 doi

  37. [45]

    Adversarial Attacks Against Deep Learning- Based Network Intrusion Detection Systems and Defense Mechanisms,

    C. Zhang, X. Costa-Perez, and P. Patras, “Adversarial Attacks Against Deep Learning- Based Network Intrusion Detection Systems and Defense Mechanisms,” IEEE/ACM Trans. Netw., vol. 30, no. 3, pp. 1294–1311, Jun. 2022, doi: 10.1109/TNET.2021.3137084

    2022

  38. [46]

    Evaluating and Improving Adversarial Robustness of Machine Learning - Based Network Intrusion Detectors,

    D. Han et al., “Evaluating and Improving Adversarial Robustness of Machine Learning - Based Network Intrusion Detectors,” IEEE J. Sel. Areas Commun., vol. 39, no. 8, pp. 2632–2647, 2021, doi: 10.1109/JSAC.2021.3087242

    2021

  39. [47]

    Evaluating Resilience of Encrypted Traffic Classification against Adversarial Evasion Attacks,

    R. Maarouf, D. Sattar, and A. Matrawy, “Evaluating Resilience of Encrypted Traffic Classification against Adversarial Evasion Attacks,” in Proceedings - IEEE Symposium on Computers and Communications, Sep. 2021, vol. 2021-Septe, pp. 1–6, doi: 10.1109/ISCC53001.2021.9631407

    2021

  40. [48]

    A context -aware robust intrusion detection system: a reinforcement learning-based approach,

    K. Sethi, · E Sai Rupesh, R. Kumar, P. Bera, and · Y Venu Madhav, “A context -aware robust intrusion detection system: a reinforcement learning-based approach,” Int. J. Inf. Secur., vol. 19, pp. 657–678, 2020, doi: 10.1007/s10207-019-00482-7

    2020 doi

  41. [49]

    Defending network intrusion detection systems against adversarial evasion attacks,

    M. Pawlicki, M. Choraś, and R. Kozik, “Defending network intrusion detection systems against adversarial evasion attacks,” Futur. Gener. Comput. Syst., vol. 110, pp. 148–154, Sep. 2020, doi: 10.1016/j.future.2020.04.013

    2020 doi

  42. [50]

    Generative Adversarial Networks For Launching and Thwarting Adversarial Attacks on Network Intrusion Detection Systems,

    M. Usama, M. Asim, S. Latif, J. Qadir, and Ala-Al-Fuqaha, “Generative Adversarial Networks For Launching and Thwarting Adversarial Attacks on Network Intrusion Detection Systems,” in 2019 15th International Wireless Communications & Mobile Computing Conference (IWCMC), Jun. 20...

    2019

  43. [51]

    Toward generating a new intrusion detection dataset and intrusion traffic characterization,

    I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in ICISSP 2018 - Proceedings of the 4th International Conference on Information Systems Security and Privacy , 2018, vol. 2018-Janu...

    2018 doi

  44. [52]

    A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems,

    R. Panigrahi and S. Borah, “A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems,” Int. J. Eng. Technol., vol. 7, no. 3.24 Special Issue 24, pp. 479–482, Aug. 2018, doi: 10.14419/ijet.v7i3.24.22797

    2018 doi

  45. [53]

    Using Kernel SHAP XAI Method to Optimize the Network Anomaly Detection Model,

    K. Roshan and A. Zafar, “Using Kernel SHAP XAI Method to Optimize the Network Anomaly Detection Model,” in Proceedings of the 2022 9th International Conference on Computing for Sustainable Global Development, INDIACom 2022 , Mar. 2022, pp. 74–80, doi: 10.23919/INDIACom54597.20...

    2022

  46. [54]

    Utilizing Xai Technique to Improve Autoencoder Based Model for Computer Network Anomaly Detection with Shapley Additive Explanation(SHAP),

    K. Roshan and A. Zafar, “Utilizing Xai Technique to Improve Autoencoder Based Model for Computer Network Anomaly Detection with Shapley Additive Explanation(SHAP),” Int. J. Comput. Networks Commun., vol. 13, no. 6, pp. 109–128, 2021, doi: 10.5121/ijcnc.2021.13607

    2021

  47. [55]

    Explainable Artificial Intelligence for Tabular Data: A Survey,

    M. Sahakyan, Z. Aung, and T. Rahwan, “Explainable Artificial Intelligence for Tabular Data: A Survey,” IEEE Access, vol. 9, pp. 135392–135422, 2021, doi: 10.1109/ACCESS.2021.3116481

    2021

  48. [56]

    Peeking Inside the Black-Box: A Survey on Explainable Artificial Intelligence (XAI),

    A. Adadi and M. Berrada, “Peeking Inside the Black-Box: A Survey on Explainable Artificial Intelligence (XAI),” IEEE Access, vol. 6, pp. 52138–52160, 2018, doi: 10.1109/ACCESS.2018.2870052

    2018

  49. [57]

    Enhancing Robustness Against Adversarial Examples in Network Intrusion Detection Systems,

    M. J. Hashemi and E. Keller, “Enhancing Robustness Against Adversarial Examples in Network Intrusion Detection Systems,” in 2020 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Nov. 2020, pp. 37–43, doi: 10.1109/NFV-SDN50289.2020.9289869

    2020

  50. [58]

    Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system,

    K. Roshan, A. Zafar, and S. B. Ul Haque, “Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system,” Comput. Commun., vol. 218, pp. 97–113, Oct. 2024, doi: 10.1016/j.comcom.2023.09.030

    2024 doi

  51. [59]

    Security Vulnerability in Face Mask Monitoring System,

    S. B. U. Haque, A. Zafar, and K. Roshan, “Security Vulnerability in Face Mask Monitoring System,” in Proceedings of the 17th INDIACom; 2023 10th International Conference on Computing for Sustainable Global Development, INDIACom 2023 , 2023, pp. 231–237, Accessed: Jan. 11, 2024...

    2023

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.