Loss‐Guided Dynamic Step Adversarial Attack Algorithm for Network Intrusion Detection Systems

ABSTRACT Deep Neural Networks (DNNs) have recently achieved remarkable success in the field of network security, and deep neural network‐based Intrusion Detection Systems (IDSs) are able to automatically learn potential patterns from network traffic and detect malicious traffic. However, IDSs are vulnerable to adversarial network traffic, which weakens their defense capabilities. Therefore, IDSs need high‐quality adversarial traffic for adversarial training to improve robustness. Existing adversarial sample generation algorithms are mainly focused on image‐based applications, overlooking the textual features of network traffic and inadequately considering perturbation magnitude. In response to these challenges, this paper proposes a Loss‐Guided Dynamic Step Adversarial Attack for Network Intrusion Detection Systems (LGDA) and a Discrete Adversarial Rounding (DAR) scheme. The LGDA analyzes model loss trend and dynamically adjusts perturbation step size to balance attack effectiveness and perturbation magnitude. The DAR targets discrete text features in network traffic, using integer encoding and rounding to allow partial preservation of perturbation direction, ensuring compatibility between existing adversarial attack algorithms and network traffic. Compared with state‐of‐the‐art adversarial attacks, experimental results on the NSL‐KDD, UNSW‐NB15, and CIC‐IDS2017 datasets using five models (LR, MLP, CNN, LSTM, and Transformer) show that the LGDA improves the attack success rate by 12.9% and reduces the perturbation magnitude by 19.1%. Additionally, the DAR scheme can be incorporated into any adversarial attack algorithm in the field of network security, increasing adversarial sample's attack success rate by 6.9%.