Robustifying ML-powered Network Classifiers with PANTS

TL;DR

This paper introduces PANTS, a novel framework combining adversarial ML techniques with SMT solvers to generate adversarial network traffic inputs, significantly improving the robustness of ML-based network classifiers against adversarial attacks.

Contribution

PANTS is a practical white-box framework that effectively generates adversarial inputs for network traffic classifiers, overcoming challenges posed by non-differentiable components and semantics preservation.

Findings

PANTS finds adversarial inputs 70% more often than baselines.

PANTS enhances classifier robustness by 52.7%.

PANTS doubles the likelihood of finding adversarial inputs compared to state-of-the-art methods.

Abstract

Multiple network management tasks, from resource allocation to intrusion detection, rely on some form of ML-based network traffic classification (MNC). Despite their potential, MNCs are vulnerable to adversarial inputs, which can lead to outages, poor decision-making, and security violations, among other issues. The goal of this paper is to help network operators assess and enhance the robustness of their MNC against adversarial inputs. The most critical step for this is generating inputs that can fool the MNC while being realizable under various threat models. Compared to other ML models, finding adversarial inputs against MNCs is more challenging due to the existence of non-differentiable components e.g., traffic engineering and the need to constrain inputs to preserve semantics and ensure reliability. These factors prevent the direct use of well-established gradient-based methods developed in adversarial ML (AML). To address these challenges, we introduce PANTS, a practical white-box framework that uniquely integrates AML techniques with Satisfiability Modulo Theories (SMT) solvers to generate adversarial inputs for MNCs. We also embed PANTS into an iterative adversarial training process that enhances the robustness of MNCs against adversarial inputs. PANTS is 70% and 2x more likely in median to find adversarial inputs against target MNCs compared to state-of-the-art baselines, namely Amoeba and BAP. PANTS improves the robustness of the target MNCs by 52.7% (even against attackers outside of what is considered during robustification) without sacrificing their accuracy.