Jul 2026· International Journal of Advanced Engineering and Technology Research· 0 citations· 33 references
TL;DR
UA-EAD is proposed, an uncertainty-aware evidential adversarial defense that equips the detector with an evidential head yielding calibrated predictive uncertainty in a single forward pass, trains it with an uncertainty-weighted adversarial objective plus a consistency regularizer that concentrates robustness on the most uncertain, near-boundary flows, and uses the resulting uncertainty for selective prediction.
Abstract
Cloud intrusion detection systems (IDSs) increasingly depend on deep neural classifiers, which are vulnerable to adversarial evasion attacks—including realistic, GAN-crafted traffic—that flip malicious flows to benign with near-imperceptible, functionally consistent perturbations. Adversarial training (AT) hardens the decision boundary but yields overconfident point predictions: a hardened detector still cannot signal when an input is suspicious, and Bayesian or ensemble uncertainty estimators that could do so require many forward passes, which is impractical at cloud line rate. We propose UA-EAD, an uncertainty-aware evidential adversarial defense that (i) equips the detector with an evidential (Dirichlet) head yielding calibrated predictive uncertainty in a single forward pass, (ii) trains it with an uncertainty-weighted adversarial objective plus a consistency regularizer that concentrates robustness on the most uncertain, near-boundary flows, and (iii) uses the resulting uncertainty for selective prediction, abstaining on inputs it cannot confidently classify. On NSL-KDD under FGSM, BIM, PGD, C&W, and a black-box WGAN-GP transfer attack, UA-EAD matches the strongest AT baselines in robust accuracy (97.4%) while attaining the highest clean accuracy (98.1%). Its single-pass evidential uncertainty equals maximum-softmax-probability and surpasses Monte-Carlo Dropout for adversarial detection at 21x lower inference cost, and yields the best adversarial-detection AUROC among robust models. Selective prediction lifts accuracy on 17 novel (out-of-distribution) attack types from 76.9% to 87.0% at 70% coverage. We further report an empirical robustness–detectability trade-off that clarifies why hardening alone is insufficient for trustworthy cloud IDS.
Machine learning-based Network Intrusion Detection Systems (ML-based NIDS) have become central to modern cyber defense because they can learn complex traffic patterns and detect evolving malicious behavior beyond predefined signatures. However, their reliance on statistical feature representations also exposes them to adversarial evasion, where malicious traffic is modified at inference time to induce misclassification while preserving its operational intent. In network environments, such attacks are shaped by protocol semantics, feature dependencies, traffic timing, and functionality-preservation constraints, making adversarial evasion in ML-based NIDS distinct from adversarial examples in more continuous domains. This review synthesizes 186 studies published between 2018 and 2026—a fast-growing but fragmented body of work—using a Kitchenham-informed systematic literature review methodology. It introduces a lifecycle-aware, NIDS-specific threat model and organizes the literature into three domains—adversarial generation, robustness evaluation, and defense—developing a hierarchical taxonomy within each and conducting a two-tier critical analysis that separates domain-specific limitations from cross-cutting methodological, empirical, and operational constraints. The synthesis shows that much reported evasion success reflects diagnostic feature-space sensitivity rather than executable, deployable adversarial risk, and that many defenses demonstrate component-level robustness rather than system-level resilience. The review also develops a perturbation-realism taxonomy, ranging from feature-level manipulation to executable packet-level attacks, that clarifies when reported success corresponds to deployable risk. Finally, it derives evidence-grounded lessons learned and a future research roadmap for improving realistic evaluation, reproducible reporting, and deployable robustness in adversarial ML-based NIDS.
Deep learning based network intrusion detection systems (IDS) can achieve strong traffic classification performance, but their resilience to adversarial manipulation remains a critical concern. This study evaluates the adversarial robustness of Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models in a multiclass intrusion detection setting using the Train_Test_Network dataset with ten traffic classes. The models were trained on true sliding flow-window sequences under a unified preprocessing pipeline to support fair comparison. Adversarial robustness was first assessed under a white-box Fast Gradient Sign Method (FGSM) setting and then broadened through additional FGSM and Projected Gradient Descent (PGD) stress testing. SHapley Additive exPlanations (SHAP) were further used to analyse explanation instability under clean and adversarial conditions, and explanation-drift features were evaluated as a secondary adversarial detection signal. Under clean evaluation, both models achieved strong and nearly identical performance, with accuracies of 0.9614 for LSTM and 0.9615 for GRU and weighted F1-scores of 0.9597 and 0.9598, respectively. Under the main FGSM condition, performance declined substantially: the LSTM achieved adversarial accuracy of 0.6094 and weighted F1-score of 0.6290 with an evasion rate of 37.38%, while the GRU achieved adversarial accuracy of 0.5130 and weighted F1-score of 0.5690 with an evasion rate of 47.02%. The broader robustness sweep showed that iterative PGD exposed stronger fragility than FGSM alone. SHAP analysis indicated that adversarial perturbation altered both prediction outcomes and local explanation structure. A learned explanation-driven detector improved over the rule-based baseline, while larger-scale validation confirmed that explanation drift remained informative, though not perfectly separable, at broader scale. Overall, the results show that strong clean performance does not imply adversarial robustness, and that explanation drift provides a useful auxiliary signal for adversarial monitoring in recurrent IDS models.
Elijah M. Maseno, Yanxia Sun, Zenghui Wang· International Journal of Inf...· 0 citations
The results indicate that explanation-guided feature reweighting can act as a lightweight and auditable robustness mechanism for cloud IDS pipelines, while preserving traceability of the defensive decision logic.
Hugo Laurent, Paula Silva· Computer Life· 0 citations
A detailed overview of the security risks associated with adversarial attacks is offered, including evasion attacks carried out at inference time, data poisoning that corrupts the training process, backdoor insertion that hides dormant triggers inside a model, and model inversion that leaks private information back out of a trained system.
Harsh Verma· International Journal of Sci...· 0 citations
Two complementary detectors are proposed: the Residual Localisation Detector (RLD), which tracks the spatial concentration of reconstruction errors in the inter-arrival time feature region in image space; and the Feature-Space Perturbation Consistency (FPC) Detector, which operates directly on packet-level inter-arrival time features in packet-feature space.
Federated Learning-Adaptive Gated Recurrent Unit is suggested, a Federated approach that combines a lightweight Gated Recurrent Unit (GRU) classifier with alternating adversarial fine-tuning on each client using FGSM and PGD, without any communication overhead, guaranteeing data-locality privacy through exchange of only model weights.