The results indicate that explanation-guided feature reweighting can act as a lightweight and auditable robustness mechanism for cloud IDS pipelines, while preserving traceability of the defensive decision logic.
Abstract
Cloud intrusion detection systems increasingly rely on machine learning classifiers trained on flow-level telemetry. Such classifiers can be accurate on clean traffic but fragile under adversarial evasion, because attackers may adjust mutable statistics such as timing, packet counts, or byte rates while preserving malicious functionality. This paper proposes SHAP-RW-AT, an explainable robust intrusion detection framework that combines adversarial augmentation with SHAP-guided feature reweighting. A base detector is first explained with SHAP values to identify decision-dominant features. These explanations are then combined with a domain mutability prior: highly important but easily manipulated flow statistics are attenuated, whereas stable high-importance indicators such as destination-port dispersion, failed-login behavior, and cloud API activity are reinforced. The reweighted representation is trained with diversified evasion examples generated by mean-shift, surrogate-gradient, and SHAP-aware perturbations under semantic constraints. Because public cloud-intrusion datasets could not be redistributed or downloaded inside the execution environment, we evaluate the method on a fully reproducible synthetic cloud-flow benchmark generated by the accompanying code; no result is claimed as a measurement on CICIDS-2017, UNSW-NB15, or CVD. Across three random seeds, SHAP-RW-AT obtains 99.67% clean accuracy and 99.71% average robust accuracy under three evasion strategies, reducing adversarial false negatives from 26.47% for a standard XGBoost detector to 0.18%. The results indicate that explanation-guided feature reweighting can act as a lightweight and auditable robustness mechanism for cloud IDS pipelines, while preserving traceability of the defensive decision logic.
UA-EAD is proposed, an uncertainty-aware evidential adversarial defense that equips the detector with an evidential head yielding calibrated predictive uncertainty in a single forward pass, trains it with an uncertainty-weighted adversarial objective plus a consistency regularizer that concentrates robustness on the most uncertain, near-boundary flows, and uses the resulting uncertainty for selective prediction.
Jiawen Luo, Samuel Price· International Journal of Adv...· 0 citations
Machine learning-based Network Intrusion Detection Systems (ML-based NIDS) have become central to modern cyber defense because they can learn complex traffic patterns and detect evolving malicious behavior beyond predefined signatures. However, their reliance on statistical feature representations also exposes them to adversarial evasion, where malicious traffic is modified at inference time to induce misclassification while preserving its operational intent. In network environments, such attacks are shaped by protocol semantics, feature dependencies, traffic timing, and functionality-preservation constraints, making adversarial evasion in ML-based NIDS distinct from adversarial examples in more continuous domains. This review synthesizes 186 studies published between 2018 and 2026—a fast-growing but fragmented body of work—using a Kitchenham-informed systematic literature review methodology. It introduces a lifecycle-aware, NIDS-specific threat model and organizes the literature into three domains—adversarial generation, robustness evaluation, and defense—developing a hierarchical taxonomy within each and conducting a two-tier critical analysis that separates domain-specific limitations from cross-cutting methodological, empirical, and operational constraints. The synthesis shows that much reported evasion success reflects diagnostic feature-space sensitivity rather than executable, deployable adversarial risk, and that many defenses demonstrate component-level robustness rather than system-level resilience. The review also develops a perturbation-realism taxonomy, ranging from feature-level manipulation to executable packet-level attacks, that clarifies when reported success corresponds to deployable risk. Finally, it derives evidence-grounded lessons learned and a future research roadmap for improving realistic evaluation, reproducible reporting, and deployable robustness in adversarial ML-based NIDS.
Deep learning based network intrusion detection systems (IDS) can achieve strong traffic classification performance, but their resilience to adversarial manipulation remains a critical concern. This study evaluates the adversarial robustness of Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models in a multiclass intrusion detection setting using the Train_Test_Network dataset with ten traffic classes. The models were trained on true sliding flow-window sequences under a unified preprocessing pipeline to support fair comparison. Adversarial robustness was first assessed under a white-box Fast Gradient Sign Method (FGSM) setting and then broadened through additional FGSM and Projected Gradient Descent (PGD) stress testing. SHapley Additive exPlanations (SHAP) were further used to analyse explanation instability under clean and adversarial conditions, and explanation-drift features were evaluated as a secondary adversarial detection signal. Under clean evaluation, both models achieved strong and nearly identical performance, with accuracies of 0.9614 for LSTM and 0.9615 for GRU and weighted F1-scores of 0.9597 and 0.9598, respectively. Under the main FGSM condition, performance declined substantially: the LSTM achieved adversarial accuracy of 0.6094 and weighted F1-score of 0.6290 with an evasion rate of 37.38%, while the GRU achieved adversarial accuracy of 0.5130 and weighted F1-score of 0.5690 with an evasion rate of 47.02%. The broader robustness sweep showed that iterative PGD exposed stronger fragility than FGSM alone. SHAP analysis indicated that adversarial perturbation altered both prediction outcomes and local explanation structure. A learned explanation-driven detector improved over the rule-based baseline, while larger-scale validation confirmed that explanation drift remained informative, though not perfectly separable, at broader scale. Overall, the results show that strong clean performance does not imply adversarial robustness, and that explanation drift provides a useful auxiliary signal for adversarial monitoring in recurrent IDS models.
Elijah M. Maseno, Yanxia Sun, Zenghui Wang· International Journal of Inf...· 0 citations
Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.
T. Divya, Sheik Saidhbi, S. Umarani et al.· 2026 International Conferenc...· 0 citations
The increasing scale, speed, and sophistication of cyberattacks have rendered traditional rule-based intrusion detection systems (IDS) insufficient for modern network environments. While machine learning (ML)-based IDSs have significantly improved detection capabilities, their black-box nature limits trust, interpretability, and practical deployment in real-world security operations. To address this challenge, this paper proposes an explainable machine learning framework for network intrusion detection using the CICIDS2017 dataset. The framework integrates multiple supervised learning models, including baseline and ensemble classifiers, and evaluates them using standard performance metrics such as accuracy, precision, recall, F1-score, and ROC-AUC. To enhance transparency, Shapley Additive exPlanations (SHAP) are employed to quantify feature contributions and provide both global and instance-level interpretability of model predictions. Experimental results demonstrate that ensemble models achieve superior detection performance while maintaining high interpretability. Furthermore, the explainability analysis reveals key traffic characteristics associated with different attack behaviors, providing deeper insight into attack behavior and supporting security analysts in interpreting intrusion alerts. The proposed approach improves detection accuracy, reduces false positives, and supports informed decision-making, thereby enhancing the transparency, trustworthiness, and practical applicability of intrusion detection systems.
Moa’ath Sa’ad Al-A’athal, Q. A. Al-Haija· Recent Progress in Science a...· 0 citations
This work presents an adaptive IDS framework coupling a tabular transformer encoder with a class balanced experience replay buffer that replays benign traffic at every update to stabilize decision boundaries, and investigates the buffer with overt label flipping and stealthy backdoor poisoning attacks.
Azizi Ariffin, A. Haris, Faiz Zaki et al.· 0 citations