Skip to content
PK

MEng thesis · Cybersecurity

Adversarial Attacks to Evade ML-based Network Intrusion Detection Systems

Machine-learning intrusion detectors score near-perfectly on benchmark traffic. I attacked two of them with white-, gray- and black-box evasion techniques to see how much of that accuracy holds up against an attacker, and how much survives once the attacker is limited to changes a real network would accept.

Author
Pantelis Karabetsos
Degree
Integrated Master’s (MEng)
Institution
University of West Attica
Date
Sep 2026

>99%

clean detection

57.8–100%

evasion, unconstrained

45.5–78.6%

evasion, realistic

100%

transfer MLP → RF

01Motivation

Benchmarks don’t fight back

ML-based network intrusion detection systems are usually judged on benchmark datasets, where they routinely report accuracy above 99%. Those numbers assume the traffic is what it is: the attacker doesn't know, or care, that a model is watching.

A real attacker can shape their traffic to look benign. The thesis measures how far that gets them, and whether it still works when the changes have to be ones a real network would carry.

  1. RQ1How easily can a detector that scores over 99% on clean traffic be evaded?
  2. RQ2Does evasion survive when the attacker is limited to changes real traffic allows?
  3. RQ3Do adversarial examples crafted against one model fool a different one?

02Threat model

What the attacker knows

White-box

Full access to the model, including its gradients.

  • FGSM
  • PGD

Gray-box

Knows the features and data, but not the target model. Crafts examples on a substitute and transfers them.

  • MLP → RF
  • RF → MLP

Black-box

Can only query the deployed model, seeing either confidence scores or just the final label.

  • ZOO
  • HopSkipJump

more attacker knowledge

03Setup

Two detectors, four attacks

Dataset
CICIDS2017
Models
Multilayer Perceptron (MLP), Random Forest
Clean detection
Over 99% for both models
Tooling
Python, PyTorch, scikit-learn, Adversarial Robustness Toolbox
How an evasion attack works

  1. 1 Input

    Malicious flow

    Labelled attack traffic from CICIDS2017

  2. 2 Attack

    FGSM · PGD · ZOO · HSJ

    Searches for a small change that flips the prediction

  3. 3 Perturbed

    Adversarial flow

    Realistic case: only timing & packet size change

  4. 4 Detector

    MLP / Random Forest

    Same models that score >99% on clean traffic

  5. Result

    “benign”

FGSM

White-box, gradient

Fast Gradient Sign Method: a single-step perturbation along the loss gradient.

PGD

White-box, gradient

Projected Gradient Descent: iterative FGSM, projected back into the allowed perturbation set.

ZOO

Black-box, score-based

Zeroth-Order Optimization: estimates gradients from model confidence scores alone.

HopSkipJump

Black-box, decision-based

Walks the decision boundary using only the final label, no scores or gradients.

04Constraints

Feature space vs. the real network

Feature-space attack

Any feature, any value

The attack edits the model's input vector directly. It finds the easiest path across the decision boundary, even if the resulting values describe traffic that could never exist.

Realistic constraints

Timing and packet size only

Perturbations are limited to features an attacker can actually influence on the wire, such as when packets are sent and how large they are, and evaluated through network traffic simulations.

Constraining the attacker removes the easy paths, so each flow needs a larger change to cross the boundary. Try it below: raise the attack budget, then switch to the realistic setting.

Interactive: how an evasion attack works
classified benignclassified malicioustiming & packet size → (attacker can change)other features → (fixed when realistic)

Evaded

28%

10 of 36 malicious flows

Unconstrained28%
Realistic6%
benignmalicious, detectedmalicious, evadedSynthetic data for illustration, not thesis results.

05Results

How often the attacks got through

Evasion rate by scenario

Share of malicious flows classified as benign. Bars span the lowest to highest rate across attacks.

Evasion rate by scenario
ScenarioConditionEvasion rate
Unconstrained attacksAny feature may be perturbed57.8–100%
Realistic constraintsOnly timing and packet-size features45.5–78.6%
Transfer · MLP → RFUnconstrained MLP-crafted examples100%
Transfer · RF → MLPReverse direction0–39%

Transferability between models

Adversarial examples crafted against one model (unconstrained), replayed against the other.

MLP

neural network

MLP → RF100%
RF → MLP0–39%

RF

tree ensemble

Examples built on the neural network carried over completely; examples built on the tree ensemble mostly did not. A defender can't assume one model's robustness says anything about another's.

06Findings

What it means for defenders

  1. RQ1

    Both detectors reached over 99% detection on clean traffic, yet unconstrained attacks evaded them in 57.8–100% of cases.

  2. RQ2

    Restricting the attacker to realistic timing and packet-size changes lowered evasion, but did not eliminate it.

  3. RQ3

    Transferability was strongly asymmetric: examples crafted on the MLP fooled the Random Forest every time, while the reverse stayed at 0–39%.

  4. →

    Robustness should be evaluated across models and under realistic attacker constraints, not against a single detector.

07Cite

Reference this work

BibTeX
@mastersthesis{karabetsos2026adversarial,
  author = {Karabetsos, Pantelis},
  title  = {Adversarial Attacks to Evade ML-based Network Intrusion Detection Systems},
  school = {University of West Attica},
  type   = {Integrated Master's (MEng) thesis},
  year   = {2026}
}

Stack

  • PyTorch
  • scikit-learn
  • Adversarial Robustness Toolbox
  • NumPy
  • pandas
RésuméAsk me about the thesis