[Paper Review] Adversarial Examples for Deep Learning Cyber Security Analytics.

Alesia Chernikova, Alina Oprea|arXiv (Cornell University)|Sep 23, 2019

Adversarial Robustness in Machine Learning74 references4 citations

TL;DR

This paper proposes a novel framework for generating adversarial examples in deep learning-based cyber security analytics that respect feature constraints and physical application requirements. By modeling mathematical and domain-specific dependencies in intermediate features, the method produces feasible adversarial inputs—such as 12 malicious network connections—capable of flipping model predictions from malicious to benign with minimal perturbation.

ABSTRACT

As advances in Deep Neural Networks demonstrate unprecedented levels of performance in many critical applications, their vulnerability to attacks is still an open question. Adversarial examples are small modifications of legitimate data points, resulting in mis-classification at testing time. As Deep Neural Networks found a wide range of applications to cyber security analytics, it becomes important to study the robustness of these models in this setting. We consider adversarial testing-time attacks against Deep Learning models designed for cyber security applications. In security applications, machine learning models are not typically trained directly on the raw network traffic or security logs, but on intermediate features defined by domain experts. Existing attacks applied directly to the intermediate feature representation result in violation of feature constraints, leading to invalid adversarial examples. We propose a general framework for crafting adversarial attacks that takes into consideration the mathematical dependencies between intermediate features in model input vector, as well as physical constraints imposed by the applications. We apply our methods on two security applications, a malicious connection and a malicious domain classifier, to generate feasible adversarial examples in these domains. We show that with minimal effort (e.g., generating 12 network connections), an attacker can change the prediction of a model from Malicious to Benign. We extensively evaluate the success of our attacks, and how they depend on several optimization objectives and imbalance ratios in the training data.

Motivation & Objective

• To address the vulnerability of deep learning models in cyber security analytics to adversarial attacks during inference.
• To identify the limitations of existing attacks that violate feature constraints when applied to intermediate feature representations.
• To develop a generalizable attack framework that respects mathematical and physical constraints in security-relevant feature spaces.
• To evaluate the effectiveness of adversarial attacks under varying optimization objectives and class imbalance ratios in training data.
• To demonstrate the feasibility of crafting realistic adversarial examples that evade detection in real-world cyber security applications.

Proposed method

• The framework formulates adversarial example generation as an optimization problem that respects the mathematical dependencies between intermediate features used in cyber security models.
• It incorporates domain-specific constraints derived from the physical and logical relationships among features (e.g., network connection properties) to ensure generated examples are semantically valid.
• The method uses constrained optimization techniques to generate perturbations that remain within feasible input space while maximizing misclassification.
• It applies gradient-based optimization with projection steps to maintain feature consistency and physical plausibility during attack generation.
• The approach is evaluated on two real-world cyber security tasks: malicious connection detection and malicious domain classification.
• The framework supports multiple optimization objectives and is tested across varying class imbalance ratios to assess robustness.

Experimental results

Research questions

• RQ1 How can adversarial examples be generated in cyber security applications without violating the mathematical and physical constraints of intermediate feature representations?
• RQ2 To what extent do optimization objectives and class imbalance in training data affect the success rate of adversarial attacks?
• RQ3 Can adversarial examples be crafted that are both semantically valid and effective in evading deep learning-based cyber security models?
• RQ4 What is the minimal number of network connections or feature modifications required to successfully flip a model’s prediction from malicious to benign?
• RQ5 How do constraint-aware attacks compare to unconstrained attacks in terms of feasibility and evasion success?

Key findings

• The proposed framework successfully generates adversarial examples that respect feature constraints and physical plausibility in cyber security applications.
• With as few as 12 malicious network connections, an attacker can successfully change a model’s prediction from malicious to benign.
• The success of adversarial attacks is significantly influenced by the choice of optimization objective and the class imbalance ratio in the training data.
• The method produces feasible adversarial examples that are semantically valid and indistinguishable from normal traffic in the context of the application.
• The framework demonstrates high evasion success even under constrained optimization, outperforming standard attacks that violate feature dependencies.
• The results show that current deep learning models for cyber security are vulnerable to targeted, constraint-aware adversarial attacks with minimal input modifications.