Loading
Initializing quantum state...
Initializing quantum state...
Constrained adversarial example generation against ML-based Network Intrusion Detection Systems — demonstrating that 99%+ accuracy classifiers can be evaded at 87% success rate, and what it takes to defend them.
All attacks operate under network semantic constraints — generated adversarial flows must remain functional as attacks.
Iterative gradient ascent on the loss surface, projected back onto the semantic constraint set after each step. Strongest practical white-box attack.
Constrained optimisation minimising perturbation magnitude while achieving misclassification. Highest success rate; slower than PGD.
Targets a small subset of high-influence features using the forward derivative. Minimal perturbation; good for sparse feature manipulation.
Train a substitute DNN via Jacobian-guided query augmentation. Generate adversarial examples against the substitute — they transfer to the target RF model at 73.2% success rate.
Adversarial accuracy (% of attack traffic correctly detected) under constrained PGD-40 (ε=0.05).
Four evaluated defences with clean accuracy preservation and adversarial robustness trade-offs.
| Defence | Clean Acc. | Adv. Acc. | Cost | Recommendation |
|---|---|---|---|---|
| Adversarial Training (25% ratio) | 98.1% | 56.3% | Low | Recommended baseline defence |
| Adversarial Training (50% ratio) | 97.4% | 74.8% | Medium | For high-security deployments |
| Timing Feature Removal | 97.8% | 48.3% (limited attack surface) | None | Remove 12 timing features; halves attack surface |
| Ensemble (RF + DNN + LSTM) | 99.1% | 78.6% (transfer: 21.4% evasion) | 3× inference cost | Highest robustness against transfer attacks |
Not all network flow features can be manipulated. The constraint taxonomy defines what's mutable without breaking the attack.
No semantic coupling — changes don't affect attack functionality
Adjustable within functional bounds; too extreme breaks the connection
Changing these changes the attack itself — not mutable
Mutability depends on the specific attack class being disguised
This project accompanies a research paper documenting the full experimental methodology, dataset construction, and countermeasure analysis. The paper is available in the Moddux Research Papers section.