Adversarial attacks detection for network intrusion detection systems using outlier-filtered principal component analysis

Abstract

Cybersecurity frameworks are increasingly incorporating machine learning-based Intrusion Detection Systems (IDS) into their security measures. Despite the effectiveness of these systems, they remain susceptible to different forms of attacks that take advantage of their operation; specifically, those that are designed to circumvent their protective mechanisms. For example, modifications made to network traffic can produce “adversarial samples,” which are designed to go undetected. To tackle this issue, two systems based on Principal Component Analysis (PCA) have been proposed for spotting adversarial samples: Standard Principal Component Analysis (SPCA) and Outlier Filtered Principal Component Analysis (OFPCA). SPCA identifies the basic structure of normal network traffic through principal components and detects adversarial attacks by looking at reconstruction errors. A sample is projected onto the principal components and then reconstructed in the original space. The difference between the original and reconstructed features is the reconstruction error. Larger errors can indicate manipulation. OFPCA, on the other hand, is trained only on normal samples after removing outlier data points from the training set. When testing SPCA method using the NSL-KDD dataset, it achieved an AUC-ROC score of 0.97 in detecting FGSM adversarial samples. OFPCA had a higher AUC-ROC score of 0.99 in identifying FGSM adversarial samples. OFPCA performed better than SPCA and other techniques, when tested under different adversarial attacks.