LLM-Orchestrated Evasion of Tabular NIDS and GAN Augmentation for Multimodal Detection

Abstract

Network Intrusion Detection Systems (NIDSs) based on machine learning have demonstrated strong performance against known attack patterns. However, their robustness against adaptive evasion strategies orchestrated by modern Large Language Models (LLMs) remains largely unexplored. This study presents a reproducible framework for evaluating traffic-space evasion of a tabular network intrusion detection baseline by an instruction-constrained open-weight LLM and separately examines the effect of GAN-based augmentation on a multimodal detector’s clean-traffic performance. The proposed methodology employs an open-weight language model, constrained at the prompt and decoding levels to a bounded action space of protocol-legal transformations, to generate evasive variants of known attacks that are realized as network traffic. Two defensive configurations are compared on clean traffic using detection rate, F1-score, AUC-ROC, and false-positive rate, while evasion success rate is measured against the tabular baseline. Across five training seeds per configuration, GAN-based enrichment produced no detectable improvement in the multimodal detector, with differences between configurations being several times smaller than the variation across training seeds. Synthetic flows inherit their payload and packet-sequence modalities from real donor flows, so the augmentation acts on the flow-statistics branch alone. An adversary given repeated rounds of score feedback achieved no evasion of the tabular baseline under Configuration (i), the only configuration attacked, across any seed attack and did not outperform a random-mutation attacker operating over the same action space and query budget. All results are obtained on a single dataset, CIC-IDS2017, with sixteen seed attacks and five implemented transformation operators, where the conclusions are stated within those limits. These findings show that apparent gains from synthetic augmentation may be dominated by training variability and that LLM-guided search does not necessarily provide an advantage over simpler search strategies within a bounded, protocol-legal transformation space.