SGAN-IDS: Self-Attention-Based Generative Adversarial Network against Intrusion Detection Systems

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Network Intrusion Detection Systems (NIDS) are vital for monitoring network traffic.
• Existing machine learning-based NIDS (ML-NIDS) research often lacks realistic experimental settings.
• Robustness against novel zero-day and adversarial attacks is a critical, under-explored area for NIDS.

Purpose of the Study:

• To develop a framework (SGAN-IDS) for constructing adversarial attack flows.
• To evaluate the effectiveness of these flows against BlackBox ML-based Intrusion Detection Systems (IDS).
• To assess the robustness and applicability of the proposed model in evading NIDS.

Main Methods:

• Developed the SGAN-IDS framework utilizing generative adversarial networks and self-attention mechanisms.
• Generated synthetic adversarial attack flows designed to circumvent ML-based IDS.
• Evaluated SGAN-IDS against five different BlackBox ML-based IDS.

Main Results:

• SGAN-IDS successfully generated adversarial flows for diverse attack types.
• The generated adversarial flows reduced the detection rate of all tested ML-based IDS by an average of 15.93%.
• Demonstrated the model's capability to create resilient and broadly applicable adversarial attacks.

Conclusions:

• The SGAN-IDS framework effectively generates adversarial attack flows that challenge current ML-NIDS.
• Findings highlight the vulnerability of existing ML-NIDS to sophisticated evasion techniques.
• Emphasizes the need for more robust NIDS defenses against adversarial attacks.