Investigating Adversarial Attacks against Network Intrusion Detection Systems in SDNs

被引:43
作者
Aiken, James [1 ]
Scott-Hayward, Sandra [1 ]
机构
[1] Queens Univ Belfast, Ctr Secure Informat Technol, Belfast BT3 9DT, Antrim, North Ireland
来源
2019 IEEE CONFERENCE ON NETWORK FUNCTION VIRTUALIZATION AND SOFTWARE DEFINED NETWORKS (IEEE NFV-SDN) | 2019年
关键词
Network Security; Software-Defined Networks; Intrusion Detection Systems; Machine Learning; Adversarial Attacks;
D O I
10.1109/nfv-sdn47374.2019.9040101
中图分类号
TP3 [计算技术、计算机技术];
学科分类号
0812 ;
摘要
Machine-learning based network intrusion detection systems (ML-NIDS) are increasingly popular in the fight against network attacks. In particular, promising detection results have been demonstrated in conjunction with Software-Defined Net-works (SDN), in which the logically centralized control plane provides access to data from across the network. However, research into adversarial attacks against machine learning classifiers has highlighted vulnerabilities in a number of fields. These vulnerabilities raise concerns about the implementation of similar classifiers in anomaly-based NIDSs within SDNs. In this work, we investigate the viability of adversarial attacks against classifiers in this field. We implement an anomaly-based NIDS, Neptune, as a target platform that utilises a number of different machine learning classifiers and traffic flow features. We develop an adversarial test tool, Hydra, to evaluate the impact of adversarial evasion classifier attacks against Neptune with the goal of lowering the detection rate of malicious network traffic. The results demonstrate that with the perturbation of a few features, the detection accuracy of a specific SYN flood Distributed Denial of Service (DDoS) attack by Neptune decreases from 100% to 0% across a number of classifiers. Based on these results, recommendations are made as to how to increase the robustness of classifiers against the demonstrated attacks.
引用
收藏
页数:7
相关论文
共 27 条
[1]  
Abaid Z., 2017, 2017 IEEE 16th International Symposium on Network Computing and Applications (NCA), P1
[2]  
Abubakar A, 2017, 2017 SEVENTH INTERNATIONAL CONFERENCE ON EMERGING SECURITY TECHNOLOGIES (EST), P138, DOI 10.1109/EST.2017.8090413
[3]   Security in Software Defined Networks: A Survey [J].
Ahmad, Ijaz ;
Namal, Suneth ;
Ylianttila, Mika ;
Gurtov, Andrei .
IEEE COMMUNICATIONS SURVEYS AND TUTORIALS, 2015, 17 (04) :2317-2346
[4]  
[Anonymous], 1999, KDD CUP 1999 DAT
[5]  
Biggio Battista, 2013, Machine Learning and Knowledge Discovery in Databases. European Conference, ECML PKDD 2013. Proceedings: LNCS 8190, P387, DOI 10.1007/978-3-642-40994-3_25
[6]  
Braga R, 2010, C LOCAL COMPUT NETW, P408, DOI 10.1109/LCN.2010.5735752
[7]  
C. S. U. Manaf Gharaibeh, 2009, DARPA 2009 INTRUSION
[8]   Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues [J].
Corona, Igino ;
Giacinto, Giorgio ;
Roli, Fabio .
INFORMATION SCIENCES, 2013, 239 :201-225
[9]  
faucetsdn, 2019, FAUC SDN CONTR
[10]  
Goodfellow I J, 2015, P INT C LEARN REPR I