Deep learning based intrusion detection systems (DL-based IDS) have emerged
as one of the best choices for providing security solutions against various
network intrusion attacks. However, due to the emergence and development of
adversarial deep learning technologies, it becomes challenging for the adoption
of DL models into IDS. In this paper, we propose a novel IDS architecture that
can enhance the robustness of IDS against adversarial attacks by combining
conventional machine learning (ML) models and Deep Learning models. The
proposed DLL-IDS consists of three components: DL-based IDS, adversarial
example (AE) detector, and ML-based IDS. We first develop a novel AE detector
based on the local intrinsic dimensionality (LID). Then, we exploit the low
attack transferability between DL models and ML models to find a robust ML
model that can assist us in determining the maliciousness of AEs. If the input
traffic is detected as an AE, the ML-based IDS will predict the maliciousness
of input traffic, otherwise the DL-based IDS will work for the prediction. The
fusion mechanism can leverage the high prediction accuracy of DL models and low
attack transferability between DL models and ML models to improve the
robustness of the whole system. In our experiments, we observe a significant
improvement in the prediction performance of the IDS when subjected to
adversarial attack, achieving high accuracy with low resource consumption.

提出了一种新颖的 IDS 结构，它通过结合传统机器学习模型和深度学习模型来增强 IDS 对抗敌对攻击的鲁棒性，该结构包含 DL-based IDS、adversarial example detector 和 ML-based IDS 三个组件，并使用 DL 模型高预测准确性和 DL 模型与 ML 模型之间的低攻击可转移性来改善整个系统的鲁棒性。实验证明，在遭受对抗攻击时，该 IDS 系统在预测性能方面显著提高，高准确率，资源消耗低。

增强深度学习入侵检测系统的对抗鲁棒性的简单框架

A Simple Framework to Enhance the Adversarial Robustness of Deep  Learning-based Intrusion Detection System

The vulnerability of deep neural networks to adversarial perturbations has
been widely perceived in the computer vision community. From a security
perspective, it poses a critical risk for modern vision systems, e.g., the
popular Deep Learning as a Service (DLaaS) frameworks. For protecting
off-the-shelf deep models while not modifying them, current algorithms
typically detect adversarial patterns through discriminative decomposition of
natural-artificial data. However, these decompositions are biased towards
frequency or spatial discriminability, thus failing to capture subtle
adversarial patterns comprehensively. More seriously, they are typically
invertible, meaning successful defense-aware (secondary) adversarial attack
(i.e., evading the detector as well as fooling the model) is practical under
the assumption that the adversary is fully aware of the detector (i.e., the
Kerckhoffs's principle). Motivated by such facts, we propose an accurate and
secure adversarial example detector, relying on a spatial-frequency
discriminative decomposition with secret keys. It expands the above works on
two aspects: 1) the introduced Krawtchouk basis provides better
spatial-frequency discriminability and thereby is more suitable for capturing
adversarial patterns than the common trigonometric or wavelet basis; 2) the
extensive parameters for decomposition are generated by a pseudo-random
function with secret keys, hence blocking the defense-aware adversarial attack.
Theoretical and numerical analysis demonstrates the increased accuracy and
security of our detector w.r.t. a number of state-of-the-art algorithms.

本文提出了一种基于空间频率判别分解的密钥安全对抗样本检测方法，相比现有算法更能准确识别和防御深度模型的对抗攻击，并防止防御感知攻击。

针对对抗扰动的准确安全检测器

Towards an Accurate and Secure Detector against Adversarial  Perturbations

Deep Neural Networks (DNNs) are vulnerable to adversarial examples, while
adversarial attack models, e.g., DeepFool, are on the rise and outrunning
adversarial example detection techniques. This paper presents a new adversarial
example detector that outperforms state-of-the-art detectors in identifying the
latest adversarial attacks on image datasets. Specifically, we propose to use
sentiment analysis for adversarial example detection, qualified by the
progressively manifesting impact of an adversarial perturbation on the
hidden-layer feature maps of a DNN under attack. Accordingly, we design a
modularized embedding layer with the minimum learnable parameters to embed the
hidden-layer feature maps into word vectors and assemble sentences ready for
sentiment analysis. Extensive experiments demonstrate that the new detector
consistently surpasses the state-of-the-art detection algorithms in detecting
the latest attacks launched against ResNet and Inception neutral networks on
the CIFAR-10, CIFAR-100 and SVHN datasets. The detector only has about 2
million parameters, and takes shorter than 4.6 milliseconds to detect an
adversarial example generated by the latest attack models using a Tesla K80 GPU
card.

本研究提出了一种新的对抗性样本检测器，使用情感分析和神经网络中的隐藏层特征映射来对检测模型进行优化。实验结果表明，该检测器在检测对 ResNet 和 Inception 中性网络在 CIFAR-10、CIFAR-100 和 SVHN 数据集上最新攻击时，优于目前的检测算法，仅具有约 200 万参数，耗时少于 4.6 毫秒。

基于情感分析的新对抗图像检测

New Adversarial Image Detection Based on Sentiment Analysis

Keyless entry systems in cars are adopting neural networks for localizing its
operators. Using test-time adversarial defences equip such systems with the
ability to defend against adversarial attacks without prior training on
adversarial samples. We propose a test-time adversarial example detector which
detects the input adversarial example through quantifying the localized
intermediate responses of a pre-trained neural network and confidence scores of
an auxiliary softmax layer. Furthermore, in order to make the network robust,
we extenuate the non-relevant features by non-iterative input sample clipping.
Using our approach, mean performance over 15 levels of adversarial
perturbations is increased by 55.33% for the fast gradient sign method (FGSM)
and 6.3% for both the basic iterative method (BIM) and the projected gradient
method (PGD).

本论文提出了一种通过量化预训练神经网络的局部中间响应和辅助 softmax 层的置信度得出输入的对抗样本的测试时间对抗样本例探测器，并通过非迭代输入样本剪辑来减弱非相关特征，从而提高了 15 种对抗扰动水平下的平均性能，其中快速梯度符号法（FGSM）提高了 55.33％，而基本迭代法（BIM）和投影梯度法（PGD）分别提高了 6.3％。