AGONI: Adversarial Generation Of Network Intrusions

AGONI: Adversarial Generation Of Network Intrusions

Thomas, Wessel (TU Delft Electrical Engineering, Mathematics and Computer Science)

Verwer, S.E. (mentor)
Panichella, A. (graduation committee)

Delft University of Technology

Computer Science | Cyber Security

2023-06-07

Network Intrusion Detection Systems (NIDSs) defend our computer networks against malicious network attacks. Anomaly-based NIDSs use machine learning classifiers to categorise incoming traffic. Research has shown that classifiers are vulnerable to adversarial examples, perturbed inputs that lead the classifier into misclassifying the input. Existing work has shown weaknesses in classifiers for classifying network traffic, but none have shown the possibility of automatically recreating network attacks that can bypass existing anomaly-based NIDSs. Regular methods for generating black-box adversarial examples create packets that are invalid. We present AGONI, a Multi-Objective Genetic Algorithm for
generating network packets that are both valid packets and adversarial examples for NIDSs. AGONI can successfully generate valid adversarial examples in multiple attack scenarios. Against the NIDS Suricata, 99.93% of the generated adversarial examples can successfully bypass the defence. We compare the performance of AGONI against randomly generating network packets, the Boundary Attack and an adjusted version of the Boundary Attack which can better create valid adversarial examples. Only AGONI consistently generates valid adversarial examples when compared to the Random Attack (82%), the Boundary Attack (0%) and the Networking Boundary Attack (74%).

Adversarial Examples
Anomaly Detection
Network Security

http://resolver.tudelft.nl/uuid:d31dcfab-aad4-4032-85ba-a60c723ea15e

Student theses

master thesis

© 2023 Wessel Thomas