TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack
Yam Sharon, David Berend, Yang Liu, Asaf Shabtai, Yuval, Elovici

TL;DR
TANTRA is a timing-based adversarial attack that uses LSTM neural networks to modify packet timing in network traffic, successfully evading intrusion detection systems without altering packet content.
Contribution
This work introduces TANTRA, a novel timing-based attack leveraging LSTM to bypass NIDSs by mimicking benign traffic timing, and proposes a mitigation method.
Findings
Achieved 99.99% success rate in evading NIDSs.
Effective across multiple attack types and detection systems.
Introduced a mitigation technique against timing-based evasion.
Abstract
Network intrusion attacks are a known threat. To detect such attacks, network intrusion detection systems (NIDSs) have been developed and deployed. These systems apply machine learning models to high-dimensional vectors of features extracted from network traffic to detect intrusions. Advances in NIDSs have made it challenging for attackers, who must execute attacks without being detected by these systems. Prior research on bypassing NIDSs has mainly focused on perturbing the features extracted from the attack traffic to fool the detection system, however, this may jeopardize the attack's functionality. In this work, we present TANTRA, a novel end-to-end Timing-based Adversarial Network Traffic Reshaping Attack that can bypass a variety of NIDSs. Our evasion attack utilizes a long short-term memory (LSTM) deep neural network (DNN) which is trained to learn the time differences between…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Anomaly Detection Techniques and Applications · Advanced Malware Detection Techniques
MethodsTanh Activation · Sigmoid Activation · Long Short-Term Memory
