FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments
Open accessAbstract
As advances in Deep Neural Networks (DNNs) demonstrate unprecedented levels of performance in many critical applications, their vulnerability to attacks is still an open question. We consider evasion attacks at testing time against Deep Learning in constrained environments, in which dependencies between features need to be satisfied. These situations may arise naturally in tabular data or may be the result of feature engineering in specific application domains, such as threat detection in cyber security. We propose a general iterative gradient-based framework called FENCE for crafting evasion attacks that take into consideration the specifics of constrained domains and application requirements. We apply it against Feed-Forward Neural Networks trained for two cyber security applications: network traffic botnet classification and malicious domain classification, to generate feasible adversarial examples. We extensively evaluate the success rate and performance of our attacks, compare their improvement over several baselines, and analyze factors that impact the attack success rate, including the optimization objective and the data imbalance. We show that with minimal effort (e.g., generating 12 additional network connections), an attacker can change the model’s prediction from the Malicious class to Benign and evade the classifier. We show that models trained on datasets with higher imbalance are more vulnerable to our FENCE attacks. Finally, we demonstrate the potential of performing adversarial training in constrained domains to increase the model resilience against these evasion attacks.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Advanced detection methods mainly rely on DNN-based binary classification models, which are known to be vulnerable to adversarial examples.
“the advanced detection methods mainly rely on DNN-based binary classiication models, which are known to be vulnerable to adversarial examples”
From DEEPFAKER: A Unified Evaluation Platform for Facial Deepfake and Detection Models (2024) · cites this paper as [9]
The Introduction states that DNNs are vulnerable to adversarial attacks, and §2.1 describes a DNN-based binary classifier. Sections 4.1–4.2 apply classification to threat detection, but the paper does not establish that advanced detection methods mainly rely on DNN-based binary models. (LLM, conf=0.85)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Explaining and Harnessing Adversarial Examples
Goodfellow, I. J., Shlens, J., & Szegedy, C. (2014) · arXiv · doi:10.48550/arxiv.1412.6572 · Cited by 10,381 · see citing works
Towards Evaluating the Robustness of Neural Networks
Carlini, N., & Wagner, D. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.49 · Cited by 8,859 · see citing works
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works
Towards Deep Learning Models Resistant to Adversarial Attacks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017) · arXiv · doi:10.48550/arxiv.1706.06083 · Cited by 6,602 · see citing works
Adversarial examples in the physical world
Kurakin, A., Goodfellow, I. J., & Bengio, S. (2018) · Artificial Intelligence Safety and Security · doi:10.1201/9781351251389-8 · Cited by 5,375 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
Practical Black-Box Attacks against Machine Learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495 · see citing works
Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures
Fredrikson, M., Jha, S., & Ristenpart, T. (2015) · Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2810103.2813677 · Cited by 2,961 · see citing works
Robust physical-world attacks on deep learning visual classification
Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., & Song, D. (2018) · 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2018.00175 · Cited by 2,173 · see citing works
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Athalye, A., Carlini, N., & Wagner, D. (2018) · arXiv · doi:10.48550/arxiv.1802.00420 · Cited by 2,172 · see citing works
Evasion attacks against machine learning at test time
Biggio, B., Corona, I., Maiorca, D., Nelson, B. A., Srndic, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Cited by 1,622 · see citing works
Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition
Sharif, M., Bhagavatula, S., Bauer, L., & Reiter, M. K. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978392 · Cited by 1,530 · see citing works
Poisoning Attacks against Support Vector Machines
Biggio, B., Nelson, B., & Laskov, P. (2012) · arXiv · doi:10.48550/arxiv.1206.6389 · Cited by 1,331 · see citing works
Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
Papernot, N., McDaniel, P., & Goodfellow, I. (2016) · arXiv · doi:10.48550/arxiv.1605.07277 · Cited by 1,326 · see citing works
Delving into Transferable Adversarial Examples and Black-box Attacks
Liu, Y., Chen, X., Liu, C., & Song, D. (2016) · arXiv · doi:10.48550/arxiv.1611.02770 · Cited by 1,310 · see citing works
Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I. P., & Tygar, J. D. (2011) · Proceedings of the 4th ACM workshop on Security and artificial intelligence · doi:10.1145/2046684.2046692 · Cited by 1,194 · see citing works
Audio Adversarial Examples: Targeted Attacks on Speech-to-Text
Carlini, N., & Wagner, D. (2018) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00009 · Cited by 1,071 · see citing works
An empirical comparison of botnet detection methods
García, S., Grill, M., Stiborek, J., & Zunino, A. (2014) · Computers & Security · doi:10.1016/j.cose.2014.05.011 · Cited by 962 · see citing works
HotFlip: White-Box Adversarial Examples for Text Classification
Ebrahimi, J., Rao, A., Lowd, D., & Dou, D. (2018) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/p18-2006 · Cited by 948 · see citing works
Generating Natural Language Adversarial Examples
Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M. B., & Chang, K.-W. (2018) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/d18-1316 · Cited by 895 · see citing works
Evasion Attacks against Machine Learning at Test Time
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., & Roli, F. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-40994-3_25 · Cited by 890 · see citing works
Ma, J. H., Saul, L. K., Savage, S., & Voelker, G. M. (2009) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/1557019.1557153 · Cited by 813 · see citing works
Black-Box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers
Gao, J., Lanchantin, J., Soffa, M. L., & Qi, Y. (2018) · 2018 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00016 · Cited by 693 · see citing works
The Space of Transferable Adversarial ExamplesPreprint
Tramèr, F., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2017) · arXiv.org · doi:10.48550/arxiv.1704.03453 · Cited by 649 · see citing works
Zhang, G., Yan, C., Ji, X., Zhang, T., Zhang, T., & Xu, W. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134052 · Cited by 570 · see citing works
On the (Statistical) Detection of Adversarial ExamplesPreprint
Grosse, K., Manoharan, P., Papernot, N., Michael Backes, A., & McDaniel, P. D. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1702.06280 · Cited by 546 · see citing works
On Adaptive Attacks to Adversarial Example Defenses
Tramer, F., Carlini, N., Brendel, W., & Madry, A. (2020) · arXiv · doi:10.48550/arxiv.2002.08347 · Cited by 486 · see citing works
EXPOSURE : Finding malicious domains using passive DNS analysis
Bilge, L. (2011) · Cited by 482 · see citing works
Crafting adversarial input sequences for recurrent neural networks
Papernot, N., McDaniel, P. D., Swami, A., & Harang, R. (2016) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2016.7795300 · Cited by 439 · see citing works
Deep Text Classification Can be Fooled
Liang, B., Li, H., Su, M., Bian, P., Li, X., & Shi, W. (2018) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2018/585 · Cited by 392 · see citing works
Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables
Kolosnjaji, B., Demontis, A., Biggio, B., Maiorca, D., Giacinto, G., Eckert, C. M., & Roli, F. (2018) · European Signal Processing Conference (EUSIPCO) · doi:10.23919/eusipco.2018.8553214 · Cited by 363 · see citing works
Practical Evasion of a Learning-Based Classifier: A Case Study
Šrndić, N., & Laskov, P. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.20 · Cited by 351 · see citing works
IDSGAN: Generative Adversarial Networks for Attack Generation Against Intrusion Detection
Lin, Z., Shi, Y., & Xue, Z. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-05981-0_7 · Cited by 347 · see citing works
Adversarial Perturbations Against Deep Neural Networks for Malware ClassificationPreprint
Grosse, K., Papernot, N., Manoharan, P., Michael Backes, A., & McDaniel, P. D. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1606.04435 · Cited by 315 · see citing works
Intriguing Properties of Adversarial ML Attacks in the Problem Space
Pierazzi, F., Pendlebury, F., Cortellazzi, J., & Cavallaro, L. (2020) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40000.2020.00073 · Cited by 315 · see citing works
Is feature selection secure against training data poisoning?Preprint
Huang, X. X., Biggio, B., Gavin Brown, B., Fumera, G., Eckert, C. M., & Roli, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1804.07933 · Cited by 310 · see citing works
Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech RecognitionPreprint
Qin, Y., Carlini, N., Goodfellow, I., Cottrell, G. W., & Raffel, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.10346 · Cited by 292 · see citing works
Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection
Mirsky, Y., Doitshman, T., Elovici, Y., & Shabtai, A. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23204 · Cited by 292 · see citing works
Deep Learning-Based Intrusion Detection With Adversaries
Wang, Z. (2018) · IEEE Access · doi:10.1109/access.2018.2854599 · Cited by 272 · see citing works
Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hiding
Schönherr, L., Kohls, K. S., Zeiler, S., Holz, T., & Kolossa, D. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23288 · Cited by 270 · see citing works
Adversarial machine learning in Network Intrusion Detection Systems
Alhajjar, E., Maxwell, P., & Bastian, N. D. (2021) · Expert Systems with Applications · doi:10.1016/j.eswa.2021.115782 · Cited by 255 · see citing works
Exploring Adversarial Examples in Malware Detection
Suciu, O., Coull, S. E., & Johns, J. M. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00015 · Cited by 225 · see citing works
Automatically Evading Classifiers: A Case Study on PDF Malware Classifiers
Xu, W., Qi, Y., & Evans, D. (2016) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23115 · Cited by 221 · see citing works
Houdini: Fooling Deep Structured Prediction ModelsPreprint
Cissé, M., Adi, Y., Neverova, N., & Keshet, J. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1707.05373 · Cited by 213 · see citing works
A general framework for adversarial examples with objectives
Sharif, M., Bhagavatula, S., Bauer, L., & Reiter, M. K. (2019) · ACM Transactions on Privacy and Security · doi:10.1145/3317611 · Cited by 200 · see citing works
Robust Audio Adversarial Example for a Physical Attack
Yakura, H., & Sakuma, J. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/741 · Cited by 182 · see citing works
Learning to Evade Static PE Machine Learning Malware Models via Reinforcement LearningPreprint
Anderson, H. S., Kharkar, A., Filar, B., Evans, D., & Roth, P. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1801.08917 · Cited by 181 · see citing works
Sparse Adversarial Perturbations for Videos
Wei, X., Zhu, J., Yuan, S., & Su, H. (2019) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v33i01.33018973 · Cited by 151 · see citing works
Adversarial Examples Against the Deep Learning Based Network Intrusion Detection Systems
Yang, K., Liu, J., Zhang, C., & Fang, Y. M. (2018) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2018.8599759 · Cited by 137 · see citing works
Generating Natural Language Adversarial ExamplesPreprint
Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M. B., & Chang, K.-W. (2018) · arXiv (Cornell University) · doi:10.4230/oasics.saia.2024.12 · Cited by 130 · see citing works
Sadeghzadeh, A. M., Shiravi, S., & Jalili, R. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3052888 · Cited by 127 · see citing works
Characterizing Audio Adversarial Examples Using Temporal DependencyPreprint
Yang, Z., Li, B., Chen, P., & Song, D. X. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.10875 · Cited by 122 · see citing works
The Odds are Odd: A Statistical Test for Detecting Adversarial ExamplesPreprint
Roth, K., Kilcher, Y., & Hofmann, T. (2019) · arXiv (Cornell University) · doi:10.3929/ethz-b-000391937 · Cited by 122 · see citing works
Evading Classifiers by Morphing in the Dark
Dang, H., Huang, Y., & Chang, E.-C. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3133978 · Cited by 110 · see citing works
Adversarial Machine Learning in Malware Detection: Arms Race between Evasion Attack and Defense
Chen, L., Ye, Y., & Bourlai, T. (2017) · European Intelligence and Security Informatics Conference · doi:10.1109/eisic.2017.21 · Cited by 109 · see citing works
Deceiving End-to-End Deep Learning Malware Detectors using Adversarial ExamplesPreprint
Kreuk, F., Barak, A., Aviv-Reuven, S., Baruch, M., Benny Pinkas, B., & Keshet, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.04528 · Cited by 106 · see citing works
Crafting Adversarial Examples For Speech Paralinguistics ApplicationsPreprint
Gong, Y., & Poellabauer, C. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.03280 · Cited by 94 · see citing works
Chen, J., Gao, X., Deng, R., He, Y., Fang, C., & Cheng, P. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3037500 · Cited by 94 · see citing works
Automatically synthesizing DoS attack traces using generative adversarial networks
Yan, Q., Wang, M., Huang, W., Luo, X., & Yu, F. R. (2019) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-019-00925-6 · Cited by 79 · see citing works
Evading Machine Learning Botnet Detection Models via Deep Reinforcement Learning
Wu, D., Fang, B., Wang, J., Liu, Q., & Cui, X. (2019) · International Conference on Communications · doi:10.1109/icc.2019.8761337 · Cited by 70 · see citing works
A New Defense Against Adversarial Images: Turning a Weakness into a StrengthPreprint
Yu, T., Hu, S., Guo, C., Chao, W., & Weinberger, K. Q. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1910.07629 · Cited by 66 · see citing works
Oprea, A., Li, Z., Norris, R., & Bowers, K. D. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274710 · Cited by 64 · see citing works
Self-citationRallying Adversarial Techniques against Deep Learning for Network Security
Clements, J., Yang, Y., Sharma, A. A., Hu, H., & Lao, Y. (2021) · IEEE Symposium Series on Computational Intelligence (SSCI) · doi:10.1109/ssci50451.2021.9660011 · Cited by 63 · see citing works
Evading Botnet Detectors Based on Flows and Random Forest with Adversarial Samples
Apruzzese, G., & Colajanni, M. (2018) · IEEE International Symposium on Network Computing and Applications (NCA) · doi:10.1109/nca.2018.8548327 · Cited by 53 · see citing works
MANDA: On Adversarial Example Detection for Network Intrusion Detection System
Wang, N., Chen, Y., Hu, Y., Lou, W., & Hou, Y. T. (2021) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom42981.2021.9488874 · Cited by 46 · see citing works
Inaudible Voice CommandsPreprint
Song, L., & Mittal, P. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1708.07238 · Cited by 35 · see citing works
Enhancing Robustness Against Adversarial Examples in Network Intrusion Detection Systems
Hashemi, M., & Keller, E. R. (2020) · IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN) · doi:10.1109/nfv-sdn50289.2020.9289869 · Cited by 35 · see citing works
BAYWATCH: Robust Beaconing Detection to Identify Infected Hosts in Large-Scale Enterprise Networks
Hu, X., Jang, J., Stoecklin, M. P., Wang, T., Schales, D. L., Kirat, D., & Rao, J. R. (2016) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2016.50 · Cited by 34 · see citing works
Attacking Automatic Video Analysis Algorithms
Hosseini, H., Xiao, B., Clark, A., & Poovendran, R. (2017) · doi:10.1145/3137616.3137618 · Cited by 28 · see citing works
Analyzing the Footprint of Classifiers in Adversarial Denial of Service Contexts
Martins, N., Cruz, J. M., Cruz, T., & Abreu, P. H. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30244-3_22 · Cited by 28 · see citing works
Examining the Robustness of Learning-Based DDoS Detection in Software Defined Networks
Abusnaina, A., Khormali, A., Nyang, D., Yüksel, M., & Mohaisen, A. (2019) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/dsc47296.2019.8937669 · Cited by 25 · see citing works
Practical Traffic-space Adversarial Attacks on Learning-based NIDSs.Preprint
Han, D., Wang, Z., Zhong, Y. C., Chen, W., Yang, J., Lu, S., Shi, X., & Xia, Y. Y. (2020) · arXiv (Cornell University) · Cited by 20 · see citing works
Evading classifiers in discrete domains with provable optimality guaranteesPreprint
Kulynych, B., Hayes, J., Samarin, N., & Troncoso, C. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.10939 · Cited by 18 · see citing works
Adversarial Machine Learning for Cyber Security
Lucia, M. J. D., & Cotton, C. (2019) · Journal of Information Systems Applied Research and Analytics · Cited by 18 · see citing works
Adversarial Machine Learning in Cybersecurity
Thomas, T., Vijayaraghavan, A. P., & Emmanuel, S. (2019) · Springer eBooks · doi:10.1007/978-981-15-1706-8_10 · Cited by 17 · see citing works
On Designing Machine Learning Models for Malicious Network Traffic ClassificationPreprint
Ongun, T., Sakharaov, T., Boboila, S., Oprea, A., & Eliassi‐Rad, T. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.04846 · Cited by 17 · see citing works
Self-citationIntriguing Properties of Adversarial ML Attacks in the Problem Space [Extended Version]
Cortellazzi, J., Quiring, E., Arp, D., Pendlebury, F., Pierazzi, F., & Cavallaro, L. (2025) · ACM Transactions on Privacy and Security · doi:10.1145/3742895 · Cited by 11 · see citing works
Adversarial Example Detection and Classification With Asymmetrical Adversarial TrainingPreprint
Yin, X., Kolouri, S., & Rohde, G. K. (2019) · arXiv (Cornell University) · Cited by 9 · see citing works
A Realistic Approach for Network Traffic Obfuscation Using Adversarial Machine Learning
Granados, A., Miah, M. S., Ortiz, A., & Kiekintveld, C. D. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-64793-3_3 · Cited by 9 · see citing works
Flagged first, then by citations
6 of the 86 references couldn’t be matched to a known paper.
Research works printed but not linked: 9
- Karel Bartos, Michal Sofka, and Vojtech Franc. 2016. Optimized Invariant Representation of Network Traffic for Detecting Unseen Malware Variants. In 25th USENIX Security Symposium (USENIX Security 16). USENIX Association, 807-822.
- Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. 2019. Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks. In 28th USENIX Security Symposium (USENIX Security 19). 321-338.
- Shasha Li, Ajaya Neupane, Sujoy Paul, Chengyu Song, Srikanth V Krishnamurthy, Amit K Roy-Chowdhury, and Ananthram Swami. 2019. Stealthy Adversarial Perturbations Against Real-Time Video Classification Systems.. In NDSS.
- Yingzhen Li, John Bradshaw, and Yash Sharma. 2019. Are generative classifiers more robust to adversarial attacks?. In International Conference on Machine Learning. PMLR, 3804-3814.
- Alina Oprea, Zhou Li, Robin Norris, and Kevin Bowers. 2018. MADE: Security Analytics for Enterprise Threat Detection. In Proceedings of the 34th Annual Computer Security Applications Conference. ACM, 124-136.
- Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017. Membership Inference Attacks against Machine Learning Models. In Proc. IEEE Security and Privacy Symposium (S&P).
- Octavian Suciu, Radu Marginean, Yigitcan Kaya, Hal Daume III, and Tudor Dumitras. 2018. When does machine learning {𝐹𝐴𝐼 𝐿}? generalized transferability for evasion and poisoning attacks. In 27th USENIX Security Symposium (USENIX Security 18). 1299-1316.
- Liang Tong, Bo Li, Chen Hajaj, Chaowei Xiao, Ning Zhang, and Yevgeniy Vorobeychik. 2019. Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features. In 28th USENIX Security Sympo- sium (USENIX Security 19). USENIX Association, Santa Clara, CA, 285-302. https://www.usenix.org/conference/ usenixsecurity19/presentation/tong
- Weilin Xu, Yanjun Qi, and David Evans. 2016. Automatically evading classifiers. In Proceedings of the 2016 Network and Distributed Systems Symposium. 21-24.
Cited by
Sorted by citations
Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems
Apruzzese, G., Andreolini, M., Ferretti, L., Marchetti, M., & Colajanni, M. (2021) · Digital Threats Research and Practice · doi:10.1145/3469659 · Cited by 208 · see citing works
Adversarial machine learning :
Vassilev, A., Oprea, A., Fordyce, A. J., & Anderson, H. S. (2024) · doi:10.6028/nist.ai.100-2e2023 · Cited by 193 · see citing works
Self-citationDeep Reinforcement Adversarial Learning Against Botnet Evasion Attacks
Apruzzese, G., Andreolini, M., Marchetti, M., Venturi, A., & Colajanni, M. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3031843 · Cited by 117 · see citing works
Evasion Attack and Defense on Machine Learning Models in Cyber-Physical Systems: A Survey
Wang, S., Ko, R. K. L., Bai, G., Dong, N., Choi, T., & Zhang, Y. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3344808 · Cited by 55 · see citing works
Deep PackGen: A Deep Reinforcement Learning Framework for Adversarial Network Packet Generation
Hore, S., Ghadermazi, J., Paudel, D., Shah, A., Das, T. K., & Bastian, N. D. (2025) · ACM Transactions on Privacy and Security · doi:10.1145/3712307 · Cited by 42 · see citing works
Alhussien, N., AlEroud, A. F., Melhem, A., & Khamaiseh, S. Y. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3357316 · Cited by 38 · see citing works
ProGen: Projection-Based Adversarial Attack Generation Against Network Intrusion Detection
Wang, M., Yang, N., Forcade-Perkins, N. J., & Weng, N. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3402155 · Cited by 38 · see citing works
Duy, P. T., Khoa, N. H., Hien, D. T. T., Hoang, H. D., & Pham, V.-H. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103472 · Cited by 37 · see citing works
Venkatesan, S., Sikka, H., Izmailov, R., Chadha, R., Oprea, A., & Lucia, M. J. D. (2021) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom52596.2021.9652916 · Cited by 29 · see citing works
Self-citationSun, P.-S., Li, S.-H., Xie, J., Xu, H.-B., Cheng, Z.-Y., & Yang, R. (2023) · Computers & security · doi:10.1016/j.cose.2023.103257 · Cited by 19 · see citing works
A Unified Framework for Adversarial Attack and Defense in Constrained Feature Space
Simonetto, T., Dyrmishi, S., Ghamizi, S., Cordy, M., & Traon, Y. L. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/183 · Cited by 23 · see citing works
Rao, H., & Miao, C. (2022) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2022/180 · Cited by 20 · see citing works
Chalé, M. W., Cox, B. A., Weir, J. D., & Bastian, N. D. (2023) · Optimization Letters · doi:10.1007/s11590-023-02007-7 · Cited by 20 · see citing works
Evaluating Model Robustness to Adversarial Samples in Network Intrusion Detection
Schneider, M., Aspinall, D., & Bastian, N. D. (2021) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata52589.2021.9671580 · Cited by 17 · see citing works
Yao, W., Peng, H., Li, Q., & Shen, X. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3568503 · Cited by 15 · see citing works
Security and Privacy Challenges of AIGC in Metaverse: A Comprehensive Survey
Zhang, S., Li, H., Sun, K., Chen, H., Wang, Y., & Li, S. (2025) · ACM Computing Surveys · doi:10.1145/3729419 · Cited by 16 · see citing works
Dyrmishi, S., Ghamizi, S., Simonetto, T., Traon, Y. L., & Cordy, M. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179316 · Cited by 12 · see citing works
DEEPFAKER: A Unified Evaluation Platform for Facial Deepfake and Detection Models
Wang, L., Meng, X., Li, D., Zhang, X., Ji, S., & Guo, S. (2024) · ACM Transactions on Privacy and Security · doi:10.1145/3634914 · Cited by 11 · see citing works
IDS-GAN: Adversarial Attack against Intrusion Detection Based on Generative Adversarial Networks
Wang, D., Wang, X., & Fei, J. (2024) · International Conference on Computer Vision, Image and Deep Learning (CVIDL) · doi:10.1109/cvidl62147.2024.10603582 · Cited by 11 · see citing works
Poisoning Network Flow Classifiers
Severi, G., Boboila, S., Oprea, A., Holodnak, J. T., Kratkiewicz, K., & Matterer, J. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627123 · Cited by 9 · see citing works
Self-citationInvestigating imperceptibility of adversarial attacks on tabular data: An empirical analysis
He, Z., Ouyang, C., Alzubaidi, L., Barros, A., & Moreira, C. (2024) · Intelligent Systems with Applications · doi:10.1016/j.iswa.2024.200461 · Cited by 10 · see citing works
Understanding the adversary: A survey of adversarial machine learning in network intrusion detection
Espindola, A. D. S., Santin, A. O., Casimiro, A., Ferreira, P. M., & Viegas, E. K. (2026) · Computer Science Review · doi:10.1016/j.cosrev.2026.100995 · Cited by 9 · see citing works
Learning Location From Shared Elevation Profiles in Fitness Apps: A Privacy Perspective
Meteriz-Yıldıran, Ü., Yıldıran, N. F., Kim, J., & Mohaisen, A. (2022) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2022.3218148 · Cited by 8 · see citing works
On the feasibility of adversarial machine learning in malware and network intrusion detection
Venturi, A., & Zanasi, C. (2021) · IEEE International Symposium on Network Computing and Applications (NCA) · doi:10.1109/nca53618.2021.9685709 · Cited by 8 · see citing works
AdverSPAM: Adversarial SPam Account Manipulation in Online Social Networks
Concone, F., Gaglio, S., Giammanco, A., Re, G. L., & Morana, M. (2024) · ACM Transactions on Privacy and Security · doi:10.1145/3643563 · Cited by 7 · see citing works
TabAttackBench: A benchmark for adversarial attacks on tabular data
He, Z., Ouyang, C., Wen, L., Liu, C., & Moreira, C. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.130491 · Cited by 6 · see citing works
Combinatorial Boosting of Classifiers for Moving Target Defense Against Adversarial Evasion Attacks
Izmailov, R., Lin, P., Venkatesan, S., & Sugrim, S. (2021) · ACM Workshop on Moving Target Defense (MTD) · doi:10.1145/3474370.3485661 · Cited by 6 · see citing works
GAN-Based Adversarial Patch for Malware C2 Traffic to Bypass DL Detector
Wang, J., Liu, Q., Liu, C., & Yin, J. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-86890-1_5 · Cited by 5 · see citing works
Constrained adversarial learning for automated software testing: a literature review
Vitorino, J., Dias, T., Fonseca, T., Maia, E., & Praça, I. (2025) · Discover Applied Sciences · doi:10.1007/s42452-025-07073-3 · Cited by 5 · see citing works
Perturbation-Resilient for Temporal-Camouflaged IoT Attacks
Li, X., Li, Y., Zhong, Z., Tan, L., Wang, J., & Liu, J. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3582147 · Cited by 4 · see citing works
Adversarial Text Perturbation Generation and Analysis
Guerrero, J., Liang, G., & Alsmadi, I. M. (2023) · Intelligent Cybersecurity Conference (ICSC) · doi:10.1109/icsc60084.2023.10349981 · Cited by 4 · see citing works
Bostani, H., Zhao, Z., Liu, Z., & Moonsamy, V. (2025) · ACM Transactions on Privacy and Security · doi:10.1145/3711899 · Cited by 4 · see citing works
Vulnerabilities in Machine Learning for cybersecurity: Current trends and future research directions
Pal, S., Yadav, G., Jadidi, Z., Habib, A., Uddin, M. P., Karmakar, C. K., & Shukla, S. K. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104269 · Cited by 5 · see citing works
Artificial Intelligence and Machine Learning for Network Security: Quo Vadis?
Lucia, M. J. D., & Srinivasan, A. (2024) · Advances in information security · doi:10.1007/978-3-031-53510-9_3 · Cited by 3 · see citing works
CWSOGG: Catching Web Shell Obfuscation Based on Genetic Algorithm and Generative Adversarial Network
Pang, B., Liang, G., Yang, J., Chen, Y., Wang, X., & He, W. (2022) · The Computer Journal · doi:10.1093/comjnl/bxac040 · Cited by 3 · see citing works
Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDSPreprint
de Witt, C. S., Huang, Y., Torr, P. H. S., & Strohmeier, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.12197 · Cited by 3 · see citing works
Augmented Tabular Adversarial Evasion Attacks with Constraint Satisfaction Guarantees
Alhussien, N., Agrawal, G., & AlEroud, A. F. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-00627-1_18 · Cited by 1 · see citing works
Brockmann, D., Lanfer, E., Wintering, N., & Aschenbruck, N. (2025) · Conference on Local Computer Networks · doi:10.1109/lcn65610.2025.11146065 · Cited by 1 · see citing works
Electricity Theft Detection Scheme Based on CNN-AE-LSTM Hybrid Model Against Evasion Attacks
Xia, Z., Lin, X., Zhou, K., & Tan, J. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11227935 · Cited by 1 · see citing works
NI-Diff: Zero-Day and Adversarial Network Intrusion Detection with Diffusion Models
Zhang, M., Lucia, M. D., Swami, A., Ashdown, J., Bastian, N. D., & Restuccia, F. (2025) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom64451.2025.11309356 · Cited by 1 · see citing works
CPAD: Constraint-Projected Adversarial Attack for Dependable Network Intrusion Detection
Koungni, M. K. N., Siracusa, D., & Doriguzzi-Corin, R. (2025) · International Conference on Foundation and Large Language Models (FLLM) · doi:10.1109/fllm67465.2025.11391031 · Cited by 1 · see citing works
Fast and Robust Detection of Adversarial Attacks in the Problem Space using Machine LearningPreprint
Naseem, M. L., & Sehar, U. (2022) · Research Square · doi:10.21203/rs.3.rs-1311205/v1
Data-Driven Constraint Mining for Realizable Adversarial Samples
Rosenfeld, B., Venkatesan, S., Izmailov, R., Yudin, M., Serban, C., & Chadha, R. (2023) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom58377.2023.10356250
Towards resilient cyber networks against adversarial attacks
Chernikova, A. (2024) · doi:10.17760/d20652999
Self-citationStudy of the current state and prospects of artificial intelligence in cybersecurity
Golikov, Y. L. (2025) · Radiotekhnika · doi:10.30837/rt.2025.1.220.03
Crafting imperceptible on-manifold adversarial attacks for tabular data
He, Z., Stevens, A., Ouyang, C., Smedt, J. D., Barros, A., & Moreira, C. (2025) · Applied Soft Computing · doi:10.1016/j.asoc.2025.114286
Machine Learning for Threat Detection and Intrusion Prevention
Faisal, M., Widia, I. D. M., Anwar, N., Rahman, T. K. A., Rahman, A. B. A., Paliling, A., Iswahyudi, R. T., & Sharma, A. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-3576-6.ch001
Adversarial traffic generation with legality preservation: A hybrid policy-based framework
Huang, Y., Li, X., Geng, J., Zhu, X., & Chen, Y. (2026) · Computer Networks · doi:10.1016/j.comnet.2026.112376
Adaptive Randomized Smoothing with Certified Robustness for Mitigating Tabular Adversarial Attacks
Alhussien, N., Boswell, B., Agrawal, G., AlEroud, A. F., & Dorai, G. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-32578-5_6
Winanto, E. A., Idris, M. Y., Pahlevi, R., Sandra, D., & Ramadhanti, F. T. (2026) · High-Confidence Computing · doi:10.1016/j.hcc.2026.100426
Alsaadi, M. S., Imran, M., Fadhel, N., AL-Essa, M., Munteanu, I. S., & Ali, W. A. (2026) · Technologies · doi:10.3390/technologies14100647
- Authors
- Chernikova, A., & Oprea, A.
- Affiliations
- Northeastern University (US)
- Venue
- ACM Transactions on Privacy and Security
- Published
- 2022-07-21
- Volume
- 25
- Issue
- 4
- Pages
- 1-34
- ISSN
- 2471-2566 (ISSN-L)
- 2471-2574
- OpenAlex
- W3102844060
- Cited by
- 52
- References
- 86
- Citations by year
- 2026: 5 · 2025: 16 · 2024: 8 · 2023: 10 · 2022: 5 · 2021: 7 · 2020: 1
- FWCI
- 3.21
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- ACM Transactions on Privacy and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- NSF (CNS-1717634)
- Google Security and Privacy Award
- U.S. Army Combat Capabilities Development Command Army Research Laboratory under Cooperative Agreement (W911NF-13-2-0045)
- U.S. Army Contracting Command - Aberdeen Proving Ground (ACC-APG) and the Defense Advanced Research Projects Agency (W911NF-18-C0019)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- evasion attacks, adversarial examples, neural network security, constrained environments, feature dependencies, tabular data, network traffic classification, class imbalance, adversarial training
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
