TEAM: Temporal Adversarial Examples Attack Model against Network Intrusion Detection System Applied to RNN

TL;DR

This paper introduces TEAM, a novel adversarial attack model targeting RNN-based network intrusion detection systems, demonstrating high attack success rates and revealing temporal vulnerabilities in time series data.

Contribution

The paper proposes TEAM, a new adversarial attack framework for RNNs in NIDS, incorporating feature reconstruction and time dilation to enhance attack effectiveness against temporal models.

Findings

TEAM achieves over 96.68% misjudgment rate in attacks.

The attack significantly increases misjudgment of subsequent original samples.

TEAM reveals temporal vulnerabilities in RNN-based NIDS.

Abstract

With the development of artificial intelligence, neural networks play a key role in network intrusion detection systems (NIDS). Despite the tremendous advantages, neural networks are susceptible to adversarial attacks. To improve the reliability of NIDS, many research has been conducted and plenty of solutions have been proposed. However, the existing solutions rarely consider the adversarial attacks against recurrent neural networks (RNN) with time steps, which would greatly affect the application of NIDS in real world. Therefore, we first propose a novel RNN adversarial attack model based on feature reconstruction called \textbf{T}emporal adversarial \textbf{E}xamples \textbf{A}ttack \textbf{M}odel \textbf{(TEAM)}, which applied to time series data and reveals the potential connection between adversarial and time steps in RNN. That is, the past adversarial examples within the same time steps can trigger further attacks on current or future original examples. Moreover, TEAM leverages Time Dilation (TD) to effectively mitigates the effect of temporal among adversarial examples within the same time steps. Experimental results show that in most attack categories, TEAM improves the misjudgment rate of NIDS on both black and white boxes, making the misjudgment rate reach more than 96.68%. Meanwhile, the maximum increase in the misjudgment rate of the NIDS for subsequent original samples exceeds 95.57%.