Pith. sign in

REVIEW 5 major objections 5 minor 57 references

Vulnerability Disclosure through Adaptive Black-Box Adversarial Attacks on NIDS

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A black-box attacker can cut a Random Forest NIDS's accuracy from 99.25% to 48% using only CPU, memory, and timing side channels, while an Isolation Forest detector misses 84% of the perturbed traffic.

desk verdict Clever combination of change-point detection and Granger causality, but the attack is not black-box: it assumes host-level CPU/memory measurements that an external adversary cannot get. read the letter →

arxiv 2506.20576 v1 pith:VJ4ULHCJ submitted 2025-06-25 cs.CR cs.AI

Sabrine Ennaji , Elhadj Benkhelifa , Luigi V. Mancini This is my paper
classification cs.CRcs.AI
keywords black-boxadversarialattacknetworkintrusiondetectionsystemside-channelanalysischange-pointGrangercausalityrandomforestIsolationfeatureselection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a realistic black-box adversary, one who never queries the NIDS and never sees its internals, training data, or gradients, can still learn which traffic features the model relies on. The attacker watches indirect system reactions such as response time, CPU usage, memory, packet drop rate, and processing delay to small random-walk traffic perturbations, then uses change-point detection and causality analysis to single out sensitive features and perturb them directly. On a Random Forest NIDS trained on CSE-CIC-IDS2018, the reported result is a drop in accuracy from 99.25% to 48%, with precision, recall, and F1 all falling by about half. When an Isolation Forest anomaly detector is trained on the same side-channel and feature data, it reaches only 56% accuracy and 16% recall, meaning 84% of the adversarial samples evade it. The paper argues that such silent probing can cancel a NIDS's detection capability while remaining invisible to a standard anomaly detector, which matters because real-world deployments currently assume black-box attackers need many queries.

What carries the argument

The load-bearing mechanism is a blind, adaptive feature-selection loop that turns side-channel observations into targeted perturbations. It works in four stages: traffic feature collection via sniffing, limited to metadata such as packet length, ports, timestamps, and protocol; random-walk perturbation of those features at small magnitudes to probe the system without triggering alarms; monitoring the NIDS's response time, CPU usage, memory usage, packet drop rate, and processing delay, then applying Binary Segmentation change-point detection to find where those indicators shift; and causal analysis using Granger causality, ordinary least squares regression, and a Variance Inflation Factor filter to identify which perturbed features are statistically significant drivers of the side-channel shifts. Those identified sensitive features are then perturbed directly, with magnitudes kept within normal traffic ranges. The mechanism's defining property is that the attacker never sees model outputs, gradients, or training data; the side-channel indicators are the only feedback signal, and the statistical tests supply the mapping from traffic feature to system reaction.

What would settle it

Run the attack in a lab where the attacker's vantage point is restricted to the network alone, with no access to CPU, memory, or processing-delay readings, and check whether the change-point and causality pipeline still identifies the same sensitive features and still produces the 99.25% to 48% accuracy drop; if it does not, the side-channel observability assumption is falsified.

Watch

Extended reading notes

Core claim

In the paper's own terms, the central discovery is that a fully black-box attacker can perform vulnerability assessment of a NIDS without query-based interaction or surrogate models. The attack pipeline collects only network metadata, perturbs it in small random-walk steps at an epsilon of 0.01, and treats the target's response time, CPU usage, memory usage, packet drop rate, and processing delay as side-channel evidence of which features matter. Binary segmentation change-point detection locates moments where these indicators shift, and Granger causality, applied through ordinary least squares regression with variance-inflation-factor filtering, attributes those shifts to the traffic features Duration, BytesPerSec, PktsPerSec, and TotPkts. Directly perturbing these features with an epsilon of 0.15 over 75 steps reduces the Random Forest NIDS accuracy from 99.25% to 48%, precision from 97% to 48%, recall from 97% to 44%, and F1 from 97% to 46%. The paper reports that an Isolation Forest anomaly detector trained on the side-channel indicators and sensitive features only reaches 56% accuracy, 54% precision, 16% recall, 27% F1, and a ROC-AUC of 48%, which it interprets as validating the attack's undetectability.

Load-bearing premise

The load-bearing premise is that an external attacker can observe the target NIDS's CPU usage, memory consumption, response time, packet drop rate, and processing delay, and that changes in those metrics can be attributed to specific perturbed traffic features; if system-level performance counters are not visible from the attacker's vantage point, the feature-selection pipeline has no input and the attack cannot be calibrated.

Editorial extensions

If this is right

  • If the central claim holds, a NIDS can be reduced to near-random classification without the attacker ever submitting a single query to the model's prediction interface, so query-logging defenses will not catch this attack.
  • The identified sensitive features, Duration, BytesPerSec, PktsPerSec, and TotPkts, become concrete targets for defenders: monitoring or protecting these features would be a more direct countermeasure than generic anomaly detection.
  • Because the Isolation Forest detector fails to separate benign from adversarial traffic, reaching 16% recall and a 48% ROC-AUC, the paper's results imply that standard statistical anomaly detectors are not sufficient defense against side-channel-guided adversarial perturbations.
  • The low computational cost and minimal interaction of the proposed pipeline suggest that the same attack procedure could be run repeatedly or against multiple NIDS deployments without substantially increasing detection risk.
  • The paper's comparison with query-based, decision-boundary, transferability, and random or gradient-free attacks implies that those families are not the only feasible black-box strategies; side-channel probing is an additional, arguably more realistic, threat model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper leaves implicit is to apply the same side-channel pipeline to other machine-learning services that expose timing or resource signals, such as cloud-hosted classifiers, where CPU and memory counters might be visible through performance-monitoring interfaces or container metrics.
  • Because Granger causality establishes predictive association rather than genuine causation, the selected features could shift when other traffic covariates change; a stability check across different traffic mixes or background loads would show whether the identified sensitive features remain consistent or merely reflect the probing window.
  • The attack's success depends on the side-channel indicators being externally visible; if a deployment hides CPU, memory, and processing-delay metrics behind virtualization or managed services, the attacker would need an alternative feedback signal, and the method's portability would be the first thing to test.
  • A concrete experimental step beyond the paper would be to run the same attack against a gradient-boosting or deep-learning NIDS on the same dataset, to see whether the change-point and causality feature-selection stage transfers or needs re-tuning per architecture.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes an adaptive black-box adversarial attack against a Random Forest NIDS. The attacker sniffs packet metadata, perturbs it via a random walk, observes 'side-channel' indicators of the NIDS host (response time, CPU usage, memory usage, packet drop, processing delay), and uses change-point detection plus causal analysis to select sensitive flow features (Duration, BytesPerSec, PktsPerSec, TotPkts). Perturbing these features is claimed to reduce IDS accuracy from 99.25% to 48%, while an Isolation Forest detector trained on benign and adversarial traffic achieves only 56% accuracy. The paper positions the method as 'silent probing' that strictly respects black-box constraints.

Significance. If substantiated, the work would address a genuine gap: most black-box NIDS attacks rely on repeated model queries or surrogate models, while this approach proposes passive side-channel observation. The comparison with query-based, transfer-based, decision-boundary, and randomized attacks (Table VI) is useful framing. However, the central feasibility claim depends on an unverified measurement capability, the feature-selection methodology is incompletely specified, and the experimental evaluation is not statistically grounded; in its current form the paper does not provide reliable evidence for its headline claims.

major comments (5)
  1. [IV.D, Algorithm 3] Algorithm 3 requires the attacker to measure latency(p), drop(p), CPU(p), memory(p), and processing delay(p) for every injected packet. CPU and memory usage are host-level metrics that are not visible on the network path, and measuring per-packet processing delay and drop rate requires either control of both endpoints, precise clock synchronization, or access to host counters, none of which is described. This contradicts the paper's own black-box definition in Section II.A, where the attacker 'can only access its outputs.' Since Algorithm 3 is the sole input to Algorithm 4, the proposed feature-selection phase, and therefore the reported accuracy drop, rests on an unsubstantiated and likely impossible capability for an external adversary.
  2. [IV.C and V.C (feature mapping)] The traffic collection and perturbation stages (Algorithms 1 and 2) operate on packet-level metadata (packet length, ports, timestamps, protocol), while the target NIDS is a flow-based Random Forest trained on CSE-CIC-IDS2018 flow features such as Duration, BytesPerSec, PktsPerSec, and TotPkts. The paper never specifies how packet-level modifications are aggregated into these flow-level features, nor does it validate that the resulting flows remain within the training distribution. Without this mapping, the accuracy drop in Table IV cannot be attributed to the attack procedure that is actually described.
  3. [V.C, Tables IV and V] The experimental evaluation reports single-point metrics with no error bars, no number of independent runs, and no description of the train/test split, making the claimed 99.25% to 48% drop impossible to assess for statistical significance. In addition, the Isolation Forest in Table V is explicitly 'trained on both benign and adversarial traffic' using the extracted sensitive features, which means the detector is given knowledge of the attack class that a deployed anomaly detector would not have; this setup does not demonstrate undetectability and instead measures separability of the already-known attack distribution.
  4. [IV.E and V.B] The methodology in Algorithm 4 describes OLS regression with VIF filtering and p-value thresholds, but Section V.B states that 'we used Granger causality tests for causal analysis' and reports interval-wise p-values. Granger causality is a time-series procedure that requires a lag structure and stationarity assumptions; the paper never defines the lag order, the segmentation is not aligned with the Granger test, and the connection between the OLS equations in Algorithm 4 and the reported Granger causality results is left unexplained.
  5. [V.A and V.C (parameters)] The perturbation parameters are inconsistent and unjustified: Section V.A reports epsilon=0.01 for random-walk perturbations, while Section V.C uses epsilon=0.15 and num_steps=75 for the direct attack; the p-value threshold, VIF threshold, and the choice of rbf versus l2 change-point models are never motivated, and no sensitivity analysis is provided. As a result, the feature-selection stage has multiple free parameters whose influence on the final 48% accuracy is unknown.
minor comments (5)
  1. [II.B] There is a typo in 'aimimg' (should be 'aiming'), and the taxonomy diagram in Figure 1 has formatting issues that make it hard to read.
  2. [V.C] There are empty citation placeholders in the sentences 'which often do not present realistic scenarios []' and 'Instead of direct gradient-based techniques []'.
  3. [V.B] The figure references appear out of order ('figures 5, 7, 8, 6, and 9'), and the figures themselves are not described in the surrounding text.
  4. [IV.A] The training protocol does not state the dataset split, the number of trees or hyperparameters found by grid search, or how class balance was achieved, which is necessary for interpreting the 99.25% pre-attack accuracy.
  5. [Algorithm 2] The perturbation in Algorithm 2 is drawn from a normal distribution and added directly to packet length, but packet lengths are integers; no rounding or validation step is described.

Circularity Check

1 steps flagged · score 6.0 of 10

Undetectability claim is circular: the Isolation Forest detector is trained on adversarial traffic, so low detection performance is built in; the accuracy-drop result is independent.

  1. self definitional [Section V.C, paragraph introducing the Isolation Forest validation (around Table V)]
    "For our experiments, we trained the IF on both benign and adversarial traffic using the side-channel indicators (response time, CPU usage, memory usage, packet drop, and processing delay) along with the extracted sensitive features from causal analysis (”Duration”, ”BytesPerSec”, and ”PktsPerSec”). If our silent probing attack was truly undetectable, this defense strategy should fail to differentiate between benign traffic and adversarially perturbed one."

    The undetectability claim is validated with an Isolation Forest whose training set includes the adversarial traffic itself. An anomaly detector trained on the attack class will treat those samples as in-distribution, so its failure to flag them is a consequence of the training protocol rather than evidence of stealth. The reported low detection accuracy (56%), recall (16%), and ROC-AUC (48%) are therefore produced by construction: the detector is asked to isolate samples that it has already been shown as normal. The concluding statement that the Isolation Forest 'validate[s] the undetectability of the proposed attack' reduces to the experimental setup, not to an independent test.

full rationale

The paper's central accuracy-drop claim is not circular: a Random Forest NIDS is trained on CSE-CIC-IDS2018, the attack perturbs selected features, and the resulting accuracy falls from 99.25% to 48%. That evaluation is self-contained and does not rely on fitting the same data that is later predicted. The adaptive feature-selection pipeline, while dependent on the contested assumption that an external attacker can observe CPU, memory, and processing delay, is an empirical causal-analysis procedure rather than a circular reduction of the prediction to its inputs. The one genuine circular step is the undetectability validation: the Isolation Forest is trained on both benign and adversarial traffic, making the adversarial samples part of the training distribution, so its inability to distinguish them is definitional. This affects one of the two headline claims, namely 'undetectability,' and therefore warrants a score of 6. The self-citation to the authors' prior work [7] for the limitations of existing NIDS adversarial research is not load-bearing for the main derivation and does not raise the score further.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central method depends on multiple free parameters chosen by hand and on several strong domain assumptions about attacker capabilities. The most significant is the assumption that an external adversary can measure the NIDS's system-level resource usage. No new physical or mathematical entities are introduced.

free parameters (6)
  • Random walk epsilon = 0.01
    Perturbation size for the random walk probing phase; chosen by hand without sensitivity analysis.
  • Attack epsilon = 0.15
    Perturbation size for the direct adversarial attack; chosen by hand and increased progressively.
  • Number of steps = 75
    Number of perturbation steps in the direct attack; selected without justification.
  • Significance threshold = 0.05
    p-value threshold for Granger causality; standard but no sensitivity analysis is provided.
  • VIF threshold
    Threshold for variance inflation factor filtering is mentioned but never given numerically.
  • Change-point detection models = rbf, l2
    Choice of radial basis function and L2 norm models for different side-channel indicators; presented as a design decision without evaluation of alternatives.
assumptions (4)
  • domain assumption The attacker can observe the NIDS's CPU usage, memory usage, and processing delay from an external vantage point.
    Algorithm 3 in Section IV.D assumes these metrics are measurable by the attacker, but no mechanism for obtaining them is described.
  • standard math Granger causality results imply genuine causal relationships between traffic features and side-channel changes.
    Granger causality is a statistical tool for predictive causality, not a guarantee of true causal mechanism; the paper interprets it as causal evidence.
  • domain assumption The Random Forest trained on CSE-CIC-IDS2018 is representative of real-world NIDS.
    The paper evaluates only on this single model and dataset, but generalizes to real-world NIDS in its conclusions.
  • domain assumption Side-channel indicators are observable in a black-box setting.
    The paper claims access to response time, CPU, memory, packet drop, and processing delay, which are system-level metrics not typically available to external attackers.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Vulnerability Disclosure through Adaptive Black-Box Adversarial Attacks on NIDS." pith.science (2026). https://pith.science/paper/VJ4ULHCJ

@misc{pith2026250620576,
  author       = {Pith},
  title        = {Pith review of: Vulnerability Disclosure through Adaptive Black-Box Adversarial Attacks on NIDS},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VJ4ULHCJ}},
  note         = {Machine review of arXiv:2506.20576}
}
read the original abstract

Adversarial attacks, wherein slight inputs are carefully crafted to mislead intelligent models, have attracted increasing attention. However, a critical gap persists between theoretical advancements and practical application, particularly in structured data like network traffic, where interdependent features complicate effective adversarial manipulations. Moreover, ambiguity in current approaches restricts reproducibility and limits progress in this field. Hence, existing defenses often fail to handle evolving adversarial attacks. This paper proposes a novel approach for black-box adversarial attacks, that addresses these limitations. Unlike prior work, which often assumes system access or relies on repeated probing, our method strictly respect black-box constraints, reducing interaction to avoid detection and better reflect real-world scenarios. We present an adaptive feature selection strategy using change-point detection and causality analysis to identify and target sensitive features to perturbations. This lightweight design ensures low computational cost and high deployability. Our comprehensive experiments show the attack's effectiveness in evading detection with minimal interaction, enhancing its adaptability and applicability in real-world scenarios. By advancing the understanding of adversarial attacks in network traffic, this work lays a foundation for developing robust defenses.

Figures

Figures reproduced from arXiv: 2506.20576 by the authors.

Figure 1
Figure 1. 1) Adversary timing: Adversarial manipulations can occur during training or testing. Training-time attacks, known as poisoning attacks, degrade the learning process of the model by injecting malicious data. In contrast, testing￾time attacks, known as evasion attacks, target a fully trained model by manipulating specific inputs to force incorrect predictions. 2) Adversary goal: Adversarial attacks can be targeted or … view at source ↗
Figure 1
Figure 1. Adversarial Machine Learning Taxonomy The inner maximization finds the highest-impact per￾turbation δ within the allowed range ϵ, and the outer minimization adjusts model parameters θ to minimize this loss. • Model Architecture Reinforcement: This refers to im￾proving the structure and inherent robustness of the model to make it more resilient to adversarial attacks, reducing reliance on adversarial training and hel… view at source ↗
Figure 2
Figure 2. Adversarial Machine Learning Growth Over Years [31] [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figures from the paper (8 more)
Figure 3
Figure 3. Figure 3: Proposed Black-Box Adversarial Vulnerability Assessment [PITH_FULL_IMAGE:figures/full_fig_p009_3.png]
Figure 4
Figure 4. Figure 4: Change-Point Detection in Side-Channel Indicators [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Granger Causality Results for Response Time [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: Granger Causality Results for CPU Usage the observed variations in side-channel behaviors (processing delay, response time, etc.). To boost attack effectiveness while avoiding detection by anomaly-based defenses, we progres￾sively increased the perturbation intensity (…
Figure 7
Figure 7. Figure 7: Granger Causality Results for Memory Usage [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: Granger Causality Results for Packet Drop [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]
Figure 9
Figure 9. Figure 9: Granger Causality Results for Processing Delay [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]
Figure 10
Figure 10. Figure 10: Impact of Adversarial Attack on the Orginal Performance of the IDS [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

57 extracted references · 41 canonical work pages

  1. [1]

    A comprehen- sive systematic literature review on intrusion detection systems,

    M. Ozkan-Okay, R. Samet, ¨O. Aslan, and D. Gupta, “A comprehen- sive systematic literature review on intrusion detection systems,” IEEE Access, vol. 9, pp. 157 727–157 760, 2021

    work page 2021

  2. [2]

    A survey on data-driven network intrusion detection,

    D. Chou and M. Jiang, “A survey on data-driven network intrusion detection,” ACM Computing Surveys (CSUR) , vol. 54, no. 9, pp. 1–36, 2021

    work page 2021

  3. [3]

    Generative adversarial attacks against intrusion detection systems using active learning,

    D. Shu, N. O. Leslie, C. A. Kamhoua, and C. S. Tucker, “Generative adversarial attacks against intrusion detection systems using active learning,” in Proceedings of the 2nd ACM workshop on wireless security and machine learning , 2020, pp. 1–6

    work page 2020

  4. [4]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    arXiv 2014

  5. [5]

    Adversarial examples: Opportunities and chal- lenges,

    J. Zhang and C. Li, “Adversarial examples: Opportunities and chal- lenges,” IEEE transactions on neural networks and learning systems , vol. 31, no. 7, pp. 2578–2593, 2019

    2019

  6. [6]

    Bringing a gan to a knife-fight: Adapting malware communication to avoid detection,

    M. Rigaki and S. Garcia, “Bringing a gan to a knife-fight: Adapting malware communication to avoid detection,” in 2018 IEEE Security and Privacy Workshops (SPW). IEEE, 2018, pp. 70–75

    work page 2018

  7. [7]

    Adversarial challenges in network intrusion detection systems: Research insights and future prospects,

    S. Ennaji, F. De Gaspari, D. Hitaj, L. V . Mancini et al. , “Adversarial challenges in network intrusion detection systems: Research insights and future prospects,” arXiv preprint arXiv:2409.18736 , 2024

    arXiv 2024

  8. [8]

    Modeling realistic adversarial attacks against network intrusion detection systems,

    G. Apruzzese, M. Andreolini, L. Ferretti, M. Marchetti, and M. Cola- janni, “Modeling realistic adversarial attacks against network intrusion detection systems,” Digital Threats: Research and Practice (DTRAP) , vol. 3, no. 3, pp. 1–19, 2022

    work page 2022

Show all 57 references
  1. [9]

    A gradient- based approach for adversarial attack on deep learning-based network intrusion detection systems,

    H. Mohammadian, A. A. Ghorbani, and A. H. Lashkari, “A gradient- based approach for adversarial attack on deep learning-based network intrusion detection systems,” Applied Soft Computing , vol. 137, p. 110173, 2023

    2023

  2. [10]

    Adversarial machine learning in network intrusion detection systems,

    E. Alhajjar, P. Maxwell, and N. Bastian, “Adversarial machine learning in network intrusion detection systems,” Expert Systems with Applica- tions, vol. 186, p. 115782, 2021

    2021

  3. [11]

    Adversarial examples for network intrusion detection systems,

    R. Sheatsley, N. Papernot, M. J. Weisman, G. Verma, and P. McDaniel, “Adversarial examples for network intrusion detection systems,” Journal of Computer Security , vol. 30, no. 5, pp. 727–752, 2022

    2022

  4. [12]

    Adaptative perturbation patterns: Realistic adversarial learning for robust intrusion detection,

    J. Vitorino, N. Oliveira, and I. Prac ¸a, “Adaptative perturbation patterns: Realistic adversarial learning for robust intrusion detection,” Future Internet, vol. 14, no. 4, p. 108, 2022

    2022

  5. [13]

    Adversarial machine learning- industry perspectives,

    R. S. S. Kumar, M. Nystr ¨om, J. Lambert, A. Marshall, M. Goertzel, A. Comissoneru, M. Swann, and S. Xia, “Adversarial machine learning- industry perspectives,” in 2020 IEEE security and privacy workshops (SPW). IEEE, 2020, pp. 69–75

    2020

  6. [14]

    Survey on intrusion detection systems based on machine learning techniques for the protection of critical infrastructure,

    A. Pinto, L.-C. Herrera, Y . Donoso, and J. A. Gutierrez, “Survey on intrusion detection systems based on machine learning techniques for the protection of critical infrastructure,” Sensors, vol. 23, no. 5, p. 2415, 2023

    2023

  7. [15]

    Adversarial machine learning attacks against intrusion detection systems: A survey on strategies and defense,

    A. Alotaibi and M. A. Rassam, “Adversarial machine learning attacks against intrusion detection systems: A survey on strategies and defense,” Future Internet, vol. 15, no. 2, p. 62, 2023

    2023

  8. [16]

    Adversarial machine learning applied to intrusion and malware scenarios: a systematic review,

    N. Martins, J. M. Cruz, T. Cruz, and P. H. Abreu, “Adversarial machine learning applied to intrusion and malware scenarios: a systematic review,” IEEE Access, vol. 8, pp. 35 403–35 419, 2020

    2020

  9. [17]

    A survey on the vulnerability of deep neural networks against adversarial attacks,

    A. Michel, S. K. Jha, and R. Ewetz, “A survey on the vulnerability of deep neural networks against adversarial attacks,” Progress in Artificial Intelligence, vol. 11, no. 2, pp. 131–141, 2022

    2022

  10. [18]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in 2016 IEEE European symposium on security and privacy (EuroS&P) . IEEE, 2016, pp. 372–387

    2016

  11. [19]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,

    P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” in Proceedings of the 10th ACM workshop on artificial intelligence and security , 2017, pp. 15–26

    2017

  12. [20]

    Hopskipjumpattack: A query-efficient decision-based attack,

    J. Chen, M. I. Jordan, and M. J. Wainwright, “Hopskipjumpattack: A query-efficient decision-based attack,” in 2020 ieee symposium on security and privacy (sp) . IEEE, 2020, pp. 1277–1294

    2020

  13. [21]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083 , 2017

    2017 arXiv

  14. [22]

    Improving adversarial ro- bustness via promoting ensemble diversity,

    T. Pang, K. Xu, C. Du, N. Chen, and J. Zhu, “Improving adversarial ro- bustness via promoting ensemble diversity,” in International Conference on Machine Learning . PMLR, 2019, pp. 4970–4979

    2019

  15. [23]

    On detecting adversarial perturbations,

    J. H. Metzen, T. Genewein, V . Fischer, and B. Bischoff, “On detecting adversarial perturbations,” arXiv preprint arXiv:1702.04267 , 2017

    2017 arXiv

  16. [24]

    Evaluating adversarial robustness of secret key-based defenses,

    Z. T. M. Ali, A. Mohammed, and I. Ahmad, “Evaluating adversarial robustness of secret key-based defenses,” IEEE Access , vol. 10, pp. 34 872–34 882, 2022

    2022

  17. [25]

    Adversarial attacks and defenses in image classification: A practical perspective,

    Y . Chen, M. Zhang, J. Li, and X. Kuang, “Adversarial attacks and defenses in image classification: A practical perspective,” in 2022 7th International Conference on Image, Vision and Computing (ICIVC) . IEEE, 2022, pp. 424–430

    2022

  18. [26]

    Characterizing adversar- ial subspaces using local intrinsic dimensionality,

    X. Ma, B. Li, Y . Wang, S. M. Erfani, S. Wijewickrema, G. Schoenebeck, D. Song, M. E. Houle, and J. Bailey, “Characterizing adversar- ial subspaces using local intrinsic dimensionality,” arXiv preprint arXiv:1801.02613, 2018

    2018 arXiv

  19. [27]

    Query efficient black- box adversarial attack on deep neural networks,

    Y . Bai, Y . Wang, Y . Zeng, Y . Jiang, and S.-T. Xia, “Query efficient black- box adversarial attack on deep neural networks,” Pattern Recognition, vol. 133, p. 109037, 2023

    2023

  20. [28]

    The logbarrier adversarial attack: making effective use of decision boundary information,

    C. Finlay, A.-A. Pooladian, and A. Oberman, “The logbarrier adversarial attack: making effective use of decision boundary information,” in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 4862–4870

    2019

  21. [29]

    Improving the robust- ness of adversarial attacks using an affine-invariant gradient estimator,

    W. Xiang, H. Su, C. Liu, Y . Guo, and S. Zheng, “Improving the robust- ness of adversarial attacks using an affine-invariant gradient estimator,” Computer Vision and Image Understanding , vol. 229, p. 103647, 2023

    2023

  22. [30]

    Towards transferable targeted adversarial examples,

    Z. Wang, H. Yang, Y . Feng, P. Sun, H. Guo, Z. Zhang, and K. Ren, “Towards transferable targeted adversarial examples,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2023, pp. 20 534–20 543

    2023

  23. [31]

    A complete list of all (arxiv) adversarial example papers,

    N. Carlini, “A complete list of all (arxiv) adversarial example papers,” URL: https://nicholas.carlini.com/writing/2019/all-adversarial-example- papers.html (accessed: 26.05.2023) , 2019

    2019

  24. [32]

    Adver- sarial attacks on machine learning cybersecurity defences in industrial control systems,

    E. Anthi, L. Williams, M. Rhode, P. Burnap, and A. Wedgbury, “Adver- sarial attacks on machine learning cybersecurity defences in industrial control systems,” Journal of Information Security and Applications , vol. 58, p. 102717, 2021

    2021

  25. [33]

    Untargeted white-box adver- sarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system,

    K. Roshan, A. Zafar, and S. B. U. Haque, “Untargeted white-box adver- sarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system,” Computer Communications, vol. 218, pp. 97–113, 2024

    2024

  26. [34]

    Boosting robustness of network intrusion detection systems: A novel two phase defense strategy against untar- geted white-box optimization adversarial attack,

    M. K. Roshan and A. Zafar, “Boosting robustness of network intrusion detection systems: A novel two phase defense strategy against untar- geted white-box optimization adversarial attack,” Expert Systems with Applications, vol. 249, p. 123567, 2024. 19

    2024

  27. [35]

    Defending network intrusion detection systems against adversarial evasion attacks,

    M. Pawlicki, M. Chora ´s, and R. Kozik, “Defending network intrusion detection systems against adversarial evasion attacks,” Future Genera- tion Computer Systems , vol. 110, pp. 148–154, 2020

    2020

  28. [36]

    Argan-ids: Adversarial resistant intrusion detection systems using generative adversarial networks,

    J. Costa, F. Apolin ´ario, and C. Ribeiro, “Argan-ids: Adversarial resistant intrusion detection systems using generative adversarial networks,” in Proceedings of the 19th International Conference on Availability, Reli- ability and Security , 2024, pp. 1–10

    2024

  29. [37]

    Adversarial attacks against deep learning-based network intrusion detection systems and defense mechanisms,

    C. Zhang, X. Costa-Perez, and P. Patras, “Adversarial attacks against deep learning-based network intrusion detection systems and defense mechanisms,” IEEE/ACM Transactions on Networking , vol. 30, no. 3, pp. 1294–1311, 2022

    2022

  30. [38]

    Adversarial attack against dos intrusion detection: An improved boundary-based method,

    X. Peng, W. Huang, and Z. Shi, “Adversarial attack against dos intrusion detection: An improved boundary-based method,” in 2019 IEEE 31st International Conference on Tools with Artificial Intelligence (ICTAI) . IEEE, 2019, pp. 1288–1295

    2019

  31. [39]

    Evading machine learning botnet detection models via deep reinforcement learning,

    D. Wu, B. Fang, J. Wang, Q. Liu, and X. Cui, “Evading machine learning botnet detection models via deep reinforcement learning,” in ICC 2019- 2019 IEEE International Conference on Communications (ICC). IEEE, 2019, pp. 1–6

    2019

  32. [40]

    Tantra: Timing-based adversarial network traffic reshaping attack,

    Y . Sharon, D. Berend, Y . Liu, A. Shabtai, and Y . Elovici, “Tantra: Timing-based adversarial network traffic reshaping attack,” IEEE Trans- actions on Information Forensics and Security , vol. 17, pp. 3225–3237, 2022

    2022

  33. [41]

    Adv-bot: Realistic adversarial botnet attacks against network intrusion detection systems,

    I. Debicha, B. Cochez, T. Kenaza, T. Debatty, J.-M. Dricot, and W. Mees, “Adv-bot: Realistic adversarial botnet attacks against network intrusion detection systems,” Computers & Security , vol. 129, p. 103176, 2023

    2023

  34. [42]

    Idsgan: Generative adversarial networks for attack generation against intrusion detection,

    Z. Lin, Y . Shi, and Z. Xue, “Idsgan: Generative adversarial networks for attack generation against intrusion detection,” in Pacific-asia conference on knowledge discovery and data mining . Springer, 2022, pp. 79–91

    2022

  35. [43]

    Black-box adversarial transferability: An empirical study in cybersecurity perspective,

    K. Roshan and A. Zafar, “Black-box adversarial transferability: An empirical study in cybersecurity perspective,” Computers & Security , vol. 141, p. 103853, 2024

    2024

  36. [44]

    Toward transferable adversarial attacks against autoencoder-based network intrusion detectors,

    Y . Zhang, Y . Wu, and X. Huang, “Toward transferable adversarial attacks against autoencoder-based network intrusion detectors,” IEEE Transactions on Industrial Informatics , 2024

    2024

  37. [45]

    Nids-vis: Improving the gen- eralized adversarial robustness of network intrusion detection system,

    K. He, D. D. Kim, and M. R. Asghar, “Nids-vis: Improving the gen- eralized adversarial robustness of network intrusion detection system,” Computers & Security , vol. 145, p. 104028, 2024

    2024

  38. [46]

    Generating practical adversarial network traffic flows using nidsgan,

    B.-E. Zolbayar, R. Sheatsley, P. McDaniel, M. J. Weisman, S. Zhu, S. Zhu, and S. Krishnamurthy, “Generating practical adversarial network traffic flows using nidsgan,” arXiv preprint arXiv:2203.06694 , 2022

    2022 arXiv

  39. [47]

    Multiple change-point detection: a selective overview,

    Y . S. Niu, N. Hao, and H. Zhang, “Multiple change-point detection: a selective overview,” Statistical Science, pp. 611–623, 2016

    2016

  40. [48]

    Seeded binary segmenta- tion: a general methodology for fast and optimal changepoint detection,

    S. Kov ´acs, P. B¨uhlmann, H. Li, and A. Munk, “Seeded binary segmenta- tion: a general methodology for fast and optimal changepoint detection,” Biometrika, vol. 110, no. 1, pp. 249–256, 2023

    2023

  41. [49]

    Causal inference for time series,

    J. Runge, A. Gerhardus, G. Varando, V . Eyring, and G. Camps-Valls, “Causal inference for time series,”Nature Reviews Earth & Environment, vol. 4, no. 7, pp. 487–505, 2023

    2023

  42. [50]

    Ordinary least-squares (ols) model,

    B. Zdaniuk, “Ordinary least-squares (ols) model,” in Encyclopedia of quality of life and well-being research. Springer, 2024, pp. 4867–4869

    2024

  43. [51]

    Extracting the variance inflation factor and other multicollinearity diagnostics from typical regression results,

    C. G. Thompson, R. S. Kim, A. M. Aloe, and B. J. Becker, “Extracting the variance inflation factor and other multicollinearity diagnostics from typical regression results,” Basic and Applied Social Psychology, vol. 39, no. 2, pp. 81–90, 2017

    2017

  44. [52]

    Deep isolation forest for anomaly detection,

    H. Xu, G. Pang, Y . Wang, and Y . Wang, “Deep isolation forest for anomaly detection,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 12, pp. 12 591–12 604, 2023

    2023

  45. [53]

    Sign- opt: A query-efficient hard-label adversarial attack,

    M. Cheng, S. Singh, P. Chen, P.-Y . Chen, S. Liu, and C.-J. Hsieh, “Sign- opt: A query-efficient hard-label adversarial attack,” arXiv preprint arXiv:1909.10773, 2019

    1909 arXiv

  46. [54]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp) . Ieee, 2017, pp. 39–57

    2017

  47. [55]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,

    W. Brendel, J. Rauber, and M. Bethge, “Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,” arXiv preprint arXiv:1712.04248 , 2017

    2017 arXiv

  48. [56]

    Genattack: Practical black-box attacks with gradient- free optimization,

    M. Alzantot, Y . Sharma, S. Chakraborty, H. Zhang, C.-J. Hsieh, and M. B. Srivastava, “Genattack: Practical black-box attacks with gradient- free optimization,” in Proceedings of the genetic and evolutionary computation conference, 2019, pp. 1111–1119

    2019

  49. [57]

    Evolu- tionary algorithms,

    T. Bartz-Beielstein, J. Branke, J. Mehnen, and O. Mersmann, “Evolu- tionary algorithms,” Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, vol. 4, no. 3, pp. 178–195, 2014

    2014

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.