Investigating Adversarial Attacks against Network Intrusion Detection Systems in SDNs

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)
196 Downloads (Pure)

Abstract

Machine-learning based network intrusion detection systems (ML-NIDS) are increasingly popular in the fight against network attacks. In particular, promising detection results have been demonstrated in conjunction with Software-Defined Networks (SDN), in which the logically centralized control plane provides access to data from across the network. However,research into adversarial attacks against machine learning classifiers has highlighted vulnerabilities in a number of fields.These vulnerabilities raise concerns about the implementation of similar classifiers in anomaly-based NIDSs within SDNs. Inthis work, we investigate the viability of adversarial attacks against classifiers in this field. We implement an anomaly-based NIDS, Neptune, as a target platform that utilises a number of different machine learning classifiers and traffic flow features. We develop an adversarial test tool, Hydra, to evaluate the impact of adversarial evasion classifier attacks against Neptune with the goal of lowering the detection rate of malicious network traffic. The results demonstrate that with the perturbation ofa few features, the detection accuracy of a specific SYN flood Distributed Denial of Service (DDoS) attack by Neptune decreases from 100% to 0% across a number of classifiers. Based on these results, recommendations are made as to how to increase the robustness of classifiers against the demonstrated attacks.
Original languageEnglish
Title of host publication IEEE Conference on Network Functions Virtualization and Software Defined Networks 12/11/2019 → 14/11/2019 Dallas, United States
Publisher IEEE
ISBN (Electronic)978-1-7281-4545-7
DOIs
Publication statusPublished - 19 Mar 2020
EventIEEE Conference on Network Functions Virtualization and Software Defined Networks - Dallas, United States
Duration: 12 Nov 201914 Nov 2019
https://nfvsdn2019.ieee-nfvsdn.org/

Conference

ConferenceIEEE Conference on Network Functions Virtualization and Software Defined Networks
Abbreviated titleIEEE NFV-SDN
CountryUnited States
CityDallas
Period12/11/201914/11/2019
Internet address

Fingerprint Dive into the research topics of 'Investigating Adversarial Attacks against Network Intrusion Detection Systems in SDNs'. Together they form a unique fingerprint.

Cite this