Constructing Adversarial Network Attacks in Realistic Network Environments

In recent years, the rapid advancements in deep learning techniques have revolutionized the deployment of Deep Neural Networks (DNNs) in Network Intrusion Detection Systems (NIDS), significantly enhancing the detection of malicious network traffic. Despite these achievements, it’s critical to acknowledge the inherent vulnerability of DNN models to adversarial attacks originating from within the network itself. Traditional adversarial attack methods often focus on directly modifying network traffic packet features or perturbing temporal features to craft meaningful network traffic. However, these techniques frequently produce network traffic of limited practical relevance, particularly in the face of real-world challenges like network congestion, packet loss, and retransmission, which can greatly diminish the effectiveness of these adversarial perturbations. To tackle these challenges and create adversarial network traffic that holds practical significance, we introduce a groundbreaking generative approach, RNTGAN. This method first generates adversarial network flow data, which is subsequently optimized by the MOSA optimizer. This optimization process meticulously guides the infusion of adversarial perturbations into the network flow within a real network setting. We undertake a thorough evaluation of our methodology in real network environments, employing both cutting-edge NIDS and widely used models, utilizing the CIC-IDS2017 and Kitsune Dataset datasets for our analysis. The results of our comprehensive assessments reveal a significant reduction in NIDS detection capabilities, with an average performance decrease of 86% under adversarial attacks and an impressive maximum evasion rate of 95.32% in scenarios featuring realistic network perturbations. Moreover, we propose an innovative defense strategy designed specifically to counteract these adversarial attack techniques. Our research not only highlights the vulnerabilities of current NIDS to adversarial threats but also sets a new benchmark for the development of more robust network security mechanisms.