Adversarial machine learning for network intrusion detection: a comparative study - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue Computer Networks Année : 2022

Adversarial machine learning for network intrusion detection: a comparative study

Résumé

Intrusion detection is a key topic in cybersecurity. It aims to protect computer systems and networks from intruders and malicious attacks. Traditional intrusion detection systems (IDS) follow a signature-based approach, but in the last two decades, various machine learning (ML) techniques have been strongly proposed and proven to be effective. However, ML faces several challenges, one of the most interesting being the emergence of adversarial attacks to fool the classifiers. Addressing this vulnerability is critical to prevent cybercriminals from exploiting ML flaws to bypass IDS and damage data and systems. Some research papers have studied the vulnerability of ML based IDS to adversarial attacks, however most of them focused on deep learning based classifiers. Unlike them, this paper pays more attention to shallow classifiers that are still widely used in ML-based IDS due to their maturity and simplicity of implementation. In more detail, we evaluate the robustness of 7 shallow ML-based NIDS including Adaboost, Bagging, Gradient boosting (GB), Logistic Regression (LR), Decision Tree (DT), Random Forest (RF), Support Vector Classifier (SVC) and also a Deep Learning Network, against several adversarial attacks widely used in the state of the art (SOA). In addition, we apply a Gaussian data augmentation defense technique and measure its contribution to improving classifier robustness [1]. We conduct extensive experiments in different scenarios using the NSL-KDD benchmark dataset [2] and the UNSW-NB 15 dataset [3]. The results show that attacks do not have the same impact on all classifiers and that the robustness of a classifier depends on the attack and that a trade-off between performance and robustness must be considered depending on the network intrusion detection scenario.
Fichier principal
Vignette du fichier
Adversarial Machine Learning for Network intrusion Detection A.pdf (2.9 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Licence : CC BY NC - Paternité - Pas d'utilisation commerciale

Dates et versions

hal-03726213 , version 1 (11-01-2024)

Identifiants

Citer

Houda Jmila, Mohamed Ibn Khedher. Adversarial machine learning for network intrusion detection: a comparative study. Computer Networks, 2022, 214, pp.109073:1-109073:14. ⟨10.1016/j.comnet.2022.109073⟩. ⟨hal-03726213⟩
56 Consultations
55 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More