FlowUAP: Evading Network Intrusion Detection Systems With Type-Specific Universal Adversarial Perturbations

Abstract

Adversarial attacks pose a significant threat to machine learning-based network intrusion detection systems (NIDS) by injecting crafted perturbations into malicious traffic to evade detection. However, many existing attacks rely on per-flow optimization after observing complete flows, which incurs high computational cost and limits online attack execution. Moreover, perturbations generated without domain constraints may correspond to unrealistic or invalid traffic. In this paper, we propose FlowUAP, a type-specific universal adversarial perturbation framework against flow-based NIDS. FlowUAP precomputes transferable perturbations for different attack types using a conditional GAN and constrains them within a traffic-aware feature space, reducing the need for online per-flow optimization. It further maps feature-space perturbations to packet-level operations on outbound traffic. Extensive experiments on CIC-IDS2018 and ToN-IoT show that FlowUAP achieves strong attack effectiveness against diverse NIDS models and remains competitive against optimization-based, generative, and recent transferability-based baselines. Additional analyses under varying attack assumptions and defensive settings characterize the robustness of FlowUAP, while packet-level validation of reconstructed adversarial traffic provides further evidence of its traffic-space realizability.