Detecting Adversarial Evasion Attacks Against Autoencoder-Based Network Intrusion Detection Systems

Abstract: Evasion attacks deliberately manipulate input to an ML-based system to produce an incorrect prediction while the manipulated input still appears benign. The PANDA framework has demonstrated that adversarial examples developed for the vision domain can be transferred to the network domain by converting packet sequences into invertible grayscale images, enabling gradient-based attacks such as masked FGSM against autoencoder-based network intrusion detection systems (NIDS). These attacks manipulate the NIDS anomaly score without altering the underlying attack semantics, leaving defenders without a straightforward way to distinguish between benign flows and carefully perturbed malicious traffic. In this paper, we propose two complementary detectors: the Residual Localisation Detector (RLD), which tracks the spatial concentration of reconstruction errors in the inter-arrival time feature region in image space; and the Feature-Space Perturbation Consistency (FPC) Detector, which operates directly on packet-level inter-arrival time features in packet-feature space. We evaluate both detectors on benign, malicious, and adversarial traffic from multiple IoT devices in the UQ-IoT dataset. Both detectors achieve near-perfect detection performance (TNR, TPR, precision, recall, and F1-score $\geq 0.99$) against adversarial examples across the evaluated IoT traffic. Our results indicate that integrating reconstruction-based scoring with perturbation consistency checks, in both image space and packet-feature space, offers a practical defence against emerging PANDA-style adversarial attacks on NIDS.

• The paper introduces two complementary detectors, RLD and FPC, that identify adversarial evasion attacks on autoencoder-based NIDS.
• It uses the invertible PANDA framework to convert network packets into image representations, enabling targeted masked FGSM attacks on IAT fields.
• Empirical results on the UQ-IoT-IDS-2021 dataset show high detection accuracy with TPR up to 0.9972 and minimal false positives.

Detecting Adversarial Evasion Attacks on Autoencoder-Based NIDS

Introduction

The paper "Detecting Adversarial Evasion Attacks Against Autoencoder-Based Network Intrusion Detection Systems" (2607.01194) addresses the vulnerability of anomaly-based Network Intrusion Detection Systems (NIDS), specifically those utilizing autoencoder architectures, to adversarial evasion attacks that operate in network traffic’s problem space. Leveraging the invertible packet-to-image framework (PANDA), which maps network sequences to differentiable image representations, it demonstrates the transferability of gradient-based vision adversarial attacks to NIDS. The primary contribution is two complementary adversarial detectors: the Residual Localisation Detector (RLD), which analyzes concentration of autoencoder residuals, and the Feature-Space Perturbation Consistency (FPC) Detector, which inspects perturbed IAT bit sequences directly. Both are rigorously evaluated on the UQ-IoT-IDS-2021 dataset and shown to provide high detection performance.

PANDA Framework and Attack Methodology

The PANDA methodology enables precise adversarial manipulation within realistic network environments. It achieves this through an invertible encoding of network traffic: grouping critical header and timing fields per packet into binary vector form, which are then spatially arranged to constitute a grayscale image in which each row corresponds to a packet and each column to a field bit position. This preserves reversibility, allowing adversarial perturbations constructed in image space to be mapped back to valid network traffic.

Attacks target the anomaly score of a surrogate convolutional autoencoder, trained solely on benign data, by applying a masked FGSM approach constrained to the inter-arrival time (IAT) columns. The perturbation process is formalized as:

$$x_{\text{adv}} = \Pi_{[0,1]}\big(x_0 + \epsilon \cdot \mathrm{sign}(\nabla_{x_0}L(f_\theta(x_0), x_0)) \odot M\big)$$

where $M$ masks non-IAT bits, enforcing functional plausibility. This produces adversarial traces that evade the autoencoder NIDS and remain valid as network traffic.

Residual Localisation Detector (RLD)

The RLD quantifies the spatial concentration of autoencoder reconstruction residuals in the IAT region. RLD processes each packet-image, isolating the IAT-related columns, and computes the ratio of residual energy within this region to the total residual energy. The formal score is:

$$S(x, \hat{x}) = \frac{\sum_{j=0}^{c-1} e_j}{\sum_{j=0}^{W-1} e_j + \varepsilon}$$

A sample is flagged as adversarial if $S(x, \hat{x})$ exceeds a fixed threshold. The rationale is that masked FGSM attacks constrained to IAT create a distinct energy signature peaked in these columns, differentiating adversarial manipulations from benign or generic anomalies.

Figure 1: Residual Localisation Detector (RLD) pipeline.

Empirical visualizations demonstrate the discriminatory localization of residual energy under attack.

Figure 2: Residual heatmaps for clean vs.\ adversarial traffic windows. Adversarial traffic shows strong residual localisation within the IAT feature region.

Feature-Space Perturbation Consistency (FPC) Detector

FPC directly addresses the manipulated feature group. It operates in packet-feature space, extracting sliding windows of IAT bits and applying a shallow, window-based autoencoder trained exclusively on clean data. The window-level reconstruction error serves as an anomaly score:

$$R(X_j) = \frac{1}{d} \sum_{k=1}^{d} \mathrm{BCE}\left(x_{j,k}, \hat{x}_{j,k}\right)$$

Samples exceeding a detection threshold are marked adversarial. The approach is robust against adversarial perturbations that survive round-trip serialization (in-memory tensor to PCAP and back), even though some attack signature is diminished by quantization.

Figure 3: Feature-Space Perturbation Consistency (FPC) detector pipeline.

Attack Surface, Evaluation Methodology, and PCAP Degradation

All experiments are run on UQ-IoT-IDS-2021, providing coverage of realistic IoT device classes and diverse attack types. Notably, adversarial efficacy degrades when adversarial tensors are serialized and re-parsed from PCAP due to timestamp quantization and protocol constraints:

Figure 4: Effectiveness of adversarial perturbation on in-memory tensors vs.\ saved PCAPs. Adv (in-memory) changes the reconstruction error, whereas Adv (saved PCAP) reverts to near the clean value.

RLD thus evaluates attacks at the in-memory stage, while FPC assesses real-world feasibility post-serialization.

Results and Analysis

Thresholds for RLD ($\tau = 0.160$) and FPC ($\tau = 0.36$) are selected based on the distribution of benign samples. Both detectors achieve high TPR and TNR. RLD exhibits almost perfect separation between clean and adversarial windows, with a minute overlap.

Figure 5: RLD scores for clean vs.\ adversarial windows. Clear separation is observed with a global threshold.

For FPC, adversarial windows’ reconstruction errors are consistently above the benign distribution.

Figure 6: FPC reconstruction errors for clean vs.\ adversarial traffic. Adversarial values consistently exceed the threshold.

Aggregate performance metrics:

Detector	Operating Space	TNR	TPR	F1
RLD	Image	0.9999	0.9972	0.9986
FPC	Packet Feature	0.9993	0.986	0.9926

The detectors’ degradation on specific device/attack pairs (e.g., port scanning on Lenovo Bulb) highlights limits when adversarial perturbations closely track naturally high-variability IAT distributions.

FGSM Epsilon Sensitivity

The detection is sensitive to FGSM perturbation magnitude. There is non-monotonicity in reconstruction error versus $\epsilon$; optimal attack transfer occurs at $\epsilon = 0.5$.

Figure 7: FGSM sensitivity to $\epsilon$. Reconstruction error increases from $M$0 to $M$1, then decreases. Optimal: $M$2.

Implications and Future Directions

This work empirically establishes that invertible representations allowing differentiable manipulation enable practical adversarial attacks against autoencoder-based NIDS, even with protocol and semantic correctness constraints. The complementary detectors (RLD/FPC) show that reconstruction-based insights combined with targeted perturbation consistency analysis allow practical, high-precision defense against such attacks.

However, both detectors’ efficacy is dependent on a priori knowledge of the attack surface (here, IAT fields). Attackers generalizing their perturbation to additional fields, or adaptively optimizing to simultaneously evade both NIDS and detectors, may reduce effectiveness. The analysis of PCAP round-trip effects reveals that future adversarial research should pursue perturbation strategies robust to serialization artifacts. Finally, while results are strong across evaluated IoT targets, threshold calibration and distributional shift remain challenges for broad deployment.

Promising research avenues include robustifying detection across compositional feature spaces, adversarial training incorporating adaptive attack strategies, and establishing common benchmarks that consider round-trip transformations and cross-network generalization.

Conclusion

The presented methodology and results concretely demonstrate that anomaly-based, autoencoder NIDS can be systematically evaded in realistic network traffic by leveraging invertible, differentiable packet representations. Nevertheless, by exploiting residual energy localization and consistency checking on targeted features, defenders can reclaim significant detection capacity without inducing high false positive rates. Future work should address robustness against adaptive attackers, feature group generalization, and deployment-scale evaluation.