MANDA: On Adversarial Example Detection for Network Intrusion Detection System
MANDA: On Adversarial Example Detection for Network Intrusion Detection System
复制标题
DOI：
10.1109/tdsc.2022.3148990
复制
发表时间：
2023-03
影响因子：
7.3
通讯作者：
Ning Wang;Yimin Chen;Yang Xiao-;Yang Hu;W. Lou;Y. T. Hou
中科院分区：
文献类型：
--
作者：
Ning Wang;Yimin Chen;Yang Xiao-;Yang Hu;W. Lou;Y. T. Hou
随着机器学习技术的迅速发展，基于机器学习的入侵检测系统（IDS）被广泛部署，以保护网络免受各种攻击。最大的挑战之一是基于ML的IDS遭受对抗性示例（AE）攻击。通过施加小的扰动（例如，稍微增加的数据包到达间隔时间），AE攻击可以翻转训练有素的IDS的预测。我们解决这个挑战，提出MANDA，一个流形和决策边界为基础的AE检测系统。通过分析AE攻击，我们注意到：1）AE倾向于接近其原始流形（即，在其原始类别中的样本簇），而不管其被错误分类到哪个类别;以及2）AE倾向于接近决策边界以最小化扰动尺度。基于这两个观察，我们设计MANDA准确的AE检测利用流形评估和IDS模型推理和评估模型的不确定性小扰动之间的不一致。我们在三种最先进的AE攻击下，在两个数据集（NSL-KDD和CICIDS）上评估了二进制IDS和多类IDS上的MANDA。我们的实验结果表明，MANDA实现了高的真阳性率（98.41%）与5%的假阳性率。
With the rapid advancement in machine learning (ML), ML-based Intrusion Detection Systems (IDSs) are widely deployed to protect networks from various attacks. One of the biggest challenges is that ML-based IDSs suffer from adversarial example (AE) attacks. By applying small perturbations (e.g., slightly increasing packet inter-arrival time) to the intrusion traffic, an AE attack can flip the prediction of a well-trained IDS. We address this challenge by proposing MANDA, a MANifold and Decision boundary-based AE detection system. Through analyzing AE attacks, we notice that 1) an AE tends to be close to its original manifold (i.e., the cluster of samples in its original class) regardless of which class it is misclassified into; and 2) AEs tend to be close to the decision boundary to minimize the perturbation scale. Based on the two observations, we design MANDA for accurate AE detection by exploiting inconsistency between manifold evaluation and IDS model inference and evaluating model uncertainty on small perturbations. We evaluate MANDA on both binary IDS and multi-class IDS on two datasets (NSL-KDD and CICIDS) under three state-of-the-art AE attacks. Our experimental results show that MANDA achieves high true-positive rate (98.41%) with a 5% false-positive rate.