Adversarial Machine Learning Meets Intrusion Detection

Analysis by the aitrendblend editorial team. Published based on Espindola, Santin, Casimiro, Ferreira, and Viegas, Computer Science Review, 2026.

The question this survey actually asks

Adversarial machine learning is not a new worry. Since researchers first showed that tiny, carefully chosen changes to an input could flip a neural network’s classification, the idea has spread into every domain where models make consequential decisions, and network security is one of the more consequential ones. A network intrusion detection system, or NIDS, sits at a chokepoint watching packets or aggregated flow records go by, deciding in real time whether traffic looks normal or looks like an attack. If a machine learning model can be fooled into waving malicious traffic through, the whole point of deploying it collapses.

The trouble, according to this survey, is that a lot of published attacks demonstrate something narrower than that. Most work in the field perturbs the numeric features a NIDS actually classifies, things like flow duration, byte counts, or flag ratios, rather than the packets those features were derived from. Nudging a feature vector across a decision boundary is a controlled, differentiable optimization problem. Reconstructing a version of that nudge into a packet stream that is still valid under the relevant network protocol, that still arrives with plausible timing, and that still does whatever the attacker actually wants it to do, is a much harder engineering problem that most papers never attempt. The authors call this the difference between feature space success and problem space feasibility, and they built the entire survey around measuring how often the literature conflates the two.

To answer that question with numbers instead of impressions, the team ran a formal PRISMA style review. They searched six databases, ACM Digital Library, Google Scholar, IEEE Xplore, ScienceDirect, Scopus, and Web of Science, starting from roughly 8,000 candidate publications. After deduplication, venue quality filtering against Q1 journals and well ranked conferences, and multiple rounds of screening, 94 primary studies published between 2022 and the first quarter of 2025 survived into the final corpus. Every one of those 94 papers was then hand coded across 16 dimensions covering threat assumptions, attack and defense methods, datasets, and evaluation practices.

Where this fits among prior surveys

This is not the first survey to raise the feature space versus problem space concern. Apruzzese and colleagues proposed an influential five dimensional adversary power model back in 2022, covering literature from 2010 through 2021 and warning that many early studies assumed adversaries with implausibly complete access to the target model. Vitorino and colleagues later introduced functional coherence and semantic validity as explicit criteria for judging whether adversarial network traffic would actually survive contact with a real protocol stack. McCarthy and colleagues coined the term functionality preserving adversarial machine learning, arguing that a perturbation which breaks the underlying traffic’s actual function is not a useful attack no matter how well it fools the classifier.

What sets this survey apart, according to the authors, is combining that realism minded lineage with an actual coded corpus and a quantitative mapping across five threat model axes, a defense taxonomy, and reproducibility markers, something they say no prior post 2021 survey had done together. Earlier work built the conceptual vocabulary. This one puts numbers behind how often the field actually lives up to it.

A five axis threat model, and why NIDS threat modeling needed one

Most adversarial machine learning taxonomies borrow their vocabulary from computer vision, where the standard split is white box versus black box knowledge of the model. The authors argue that framing is too thin for network security, because a NIDS attacker’s capability depends on more than just how much they know about the classifier. It depends on where in the pipeline they can act, when in the model’s lifecycle they act, and what position they hold relative to the network itself. So the survey formalizes five separate axes.

Attack surface

Where the manipulation happens. Network level attacks craft real, protocol valid packets. Feature level attacks perturb the derived numeric features directly, without any guarantee the result maps back to legitimate traffic. Data level attacks poison the training data itself.

Attack phase

When the intervention happens. Training time poisoning corrupts the model before deployment. Inference time evasion targets an already trained model. A small third category, continuous attacks, models an adversary who adapts across multiple retraining cycles, mirroring a genuine arms race rather than a single snapshot in time.

Adversary position and access

Whether the attacker sits entirely outside the network, has limited insider access such as a compromised host, or holds privileged, administrative level control over logs and pipelines.

Adversary knowledge

How much the attacker understands about the NIDS pipeline itself, not just the model. The survey defines white box as full access to model internals and gradients, gray box as knowledge of the dataset or feature extraction process without model parameters, and black box as nothing beyond observable detector behavior.

Adversary goal

What the attacker is actually trying to accomplish. Integrity evasion aims to get malicious traffic misclassified as benign. Integrity poisoning aims to corrupt the learned decision boundary for later exploitation. Confidentiality attacks try to extract information about training data or model internals. Availability attacks try to overwhelm the detector with false alarms.

That five axis structure then becomes the coding scheme applied to all 94 papers, which is what makes the survey’s numbers comparable across such a methodologically scattered literature.

What the numbers actually show

The quantitative mapping is where the survey earns its keep. Rather than describing the field impressionistically, the authors report grouped counts across every taxonomy facet, and the pattern that emerges is consistent across nearly all of them, a strong pull toward whatever setup is most convenient to study rather than whatever setup is most realistic to defend against.

Stack those numbers on top of each other and a composite picture appears. The typical AML NIDS paper studies an insider with partial knowledge of the feature extraction process, manipulating derived numeric features rather than raw traffic, at inference time, with the sole goal of getting malicious traffic misclassified as benign. That is a real and useful thing to study. It is also, as the authors point out, a fairly narrow slice of what an actual adversary campaign looks like, since it leaves out training time poisoning of retraining pipelines, purely external attackers with no inside access, and confidentiality style attacks that try to extract information rather than evade detection.

The model choices reinforce the same conservatism. Tabular neural networks and tree based ensembles such as random forests and gradient boosting together account for 46 percent of all model family assignments in the corpus, reflecting how thoroughly the field still relies on architectures built for structured, flow level features rather than richer sequence or graph based representations. Flow based detection, as opposed to packet level detection, appears in roughly 86 percent of grouped granularity entries, which the authors trace directly back to dataset availability. Public benchmarks like the CIC and UNSW families ship pre aggregated flow statistics, so that is what gets used, even though flow aggregation can smooth over exactly the low level timing and protocol quirks that a more careful adversary would exploit.

Attack techniques lean on gradients, defenses lean on retraining

On the attack side, gradient based methods such as FGSM and PGD dominate at 33.1 percent of grouped attack technique assignments, which tracks with the gray box and white box knowledge assumptions already discussed, since gradients require some access to model internals to compute or approximate. Generative and learning based attacks, including GANs and diffusion style models aimed at producing more realistic adversarial traffic, come in second at 18.6 percent, and the authors read this as a genuinely encouraging trend toward closing the feature space gap, since these methods are explicitly trying to learn what plausible benign traffic looks like rather than just nudging numbers toward a boundary.

Defenses tell a more uneven story. Just over a quarter of grouped defense assignments fall into a category the authors label no countermeasure, meaning 34 of the 94 papers propose an attack and stop there, without testing any mitigation. Among papers that do propose a defense, adversarial retraining is the most common approach at 20.6 percent of assignments, followed by ensemble based defenses at 13.0 percent. Both strategies have a documented weakness the survey calls out directly. Adversarial retraining tends to overfit to the specific perturbation style it was trained against, offering limited protection against a transfer based or otherwise unseen attack. The survey found that among the 60 studies proposing at least one concrete defense, 46 evaluate it only in inference time, feature level settings, meaning the defenses are mostly being validated against the same convenient threat model the attacks were built under, rather than against a broader or more adversarial set of conditions.

Datasets and the reproducibility problem

Dataset choice shapes everything downstream, and here the survey documents a persistent reliance on a small handful of benchmarks. The CIC and UNSW dataset families together account for nearly half of all dataset mentions in the corpus, led by CIC-IDS-2017 at 22.0 percent. That popularity is not without cost. The survey cites independent work by Engelen and colleagues and by Liu and colleagues documenting real construction errors in CIC-IDS-2017 and CSE-CIC-IDS-2018, spanning flow construction, feature extraction, and labeling, and notes that many papers in the corpus cite these datasets by name without specifying which corrected or uncorrected version they actually used, which quietly undermines comparability between papers that both claim to use the same benchmark.

Legacy datasets fare worse still. NSL-KDD, an improved successor to the two decade old KDDCup99, still appears in 15 papers, largely to enable comparison against older baselines rather than because it represents current traffic or attack patterns. On the reproducibility front, the numbers are blunt. 60 papers, nearly two thirds of the corpus, release only datasets or rely on public ones without releasing their own code. Only 23 papers, about a quarter, release both code and data together. Eight papers release no artifacts of any kind. The practical upshot is that fewer than one in four robustness claims in this literature can currently be independently checked end to end.

Six open challenges, and what they mean for practitioners

The survey closes its analysis with six consolidated challenges for the field, each mapped back to a specific gap the quantitative data revealed.

• Overreliance on feature space manipulation, disconnected from packet level feasibility and protocol semantics.
• Optimistic adversary knowledge and access assumptions, concentrated in gray box or white box, insider positioned scenarios that overstate both attack success and defense strength relative to a genuine external, query bounded adversary.
• Evasion dominance, with poisoning and confidentiality attacks receiving comparatively little attention despite growing relevance to retraining pipelines and collaborative or federated NIDS deployments.
• Fragmented and reactive defense strategies, tested almost exclusively against the same paper’s own attack rather than cross evaluated against independent threats.
• A lack of standardized robustness metrics, with classification accuracy still dominating over attack success rate, perturbation magnitude, or traffic realism measures.
• A persistent gap between academic research and operational deployment, where latency, alert triage, and continuous adaptation rarely factor into how attacks or defenses get evaluated.

For a security team trying to use this literature rather than just read about it, those six challenges translate into a fairly concrete checklist. Before trusting a reported attack success rate, it is worth asking whether the perturbation was applied to raw traffic or to already extracted features, whether the assumed adversary has knowledge or access a real attacker would plausibly have, and whether any proposed defense was tested against attacks the same authors did not invent. On that last point, the survey’s own numbers suggest skepticism is warranted more often than not.

Honest limitations

The authors are direct about where their own methodology introduces uncertainty, and it is worth taking that seriously rather than treating the survey’s numbers as beyond question.

• The venue quality gate, restricting the corpus to Q1 journals and conferences with a Google Scholar h5 index of 15 or higher, plus manually reviewed unranked papers, inevitably excludes some relevant work, particularly from newer workshops, IoT and industrial control system specific venues, and preprints that had not yet matured into a formal publication by the search cutoff.
• Coding 94 papers across 16 dimensions required substantial interpretive judgment, especially for facets like adversary knowledge, where self reported labels sometimes conflicted with the paper’s actual described methodology. The authors applied explicit normalization rules and resolved disagreements through consensus discussion, but they note this process was not accompanied by a retrospective inter rater agreement statistic, which limits how precisely the coding consistency can be quantified after the fact.
• Because many grouped totals in the paper’s figures exceed 94, reflecting papers that were coded with more than one attack technique, dataset, or metric, some percentages describe assignments rather than papers, and reading them as if they described the whole corpus would overstate certain trends.
• The search window runs only through the first quarter of 2025, so the apparent decline in 2025 publication counts reflects incomplete coverage of that year rather than an actual slowdown in the field.
• The survey itself is a snapshot of published, quality screened literature. It cannot speak to unpublished red team findings, internal vendor testing, or attacks that organizations chose not to publish for competitive or security reasons, all of which likely paint a different picture of what currently works against production systems.

Conclusion

The core achievement of this survey is turning a widely shared but mostly anecdotal worry, that adversarial machine learning research against intrusion detection is too comfortable with unrealistic assumptions, into a documented, countable pattern across 94 independently coded papers. That distinction matters. It is one thing to suspect a field leans toward convenient threat models. It is another to be able to say, with a citable number, that feature level attacks outnumber network level attacks by roughly four to one, or that studies proposing a defense mostly test it only against their own paper’s attack.

The conceptual shift underneath those numbers is a five axis threat model that treats attack surface, phase, position, knowledge, and goal as independent dimensions rather than collapsing everything into a single white box versus black box split. That framing is more work to apply, but it is also more honest about what actually determines whether a study’s findings would survive contact with a real network, and it gives future authors a shared vocabulary for stating their assumptions precisely instead of leaving them implicit.

There is a reasonable case that this kind of threat model formalization matters well beyond network intrusion detection specifically. Any adversarial machine learning subfield built on structured, tabular, operationally constrained data, fraud detection, spam filtering, or industrial anomaly detection among them, faces a similar temptation to study the mathematically convenient version of the threat rather than the operationally realistic one. A taxonomy this explicit about separating those two things could travel well.

The honest remaining gaps matter for anyone building on this literature today. Poisoning and confidentiality attacks remain comparatively unexplored relative to evasion. Defenses are validated almost exclusively against attacks their own authors invented. And fewer than one in four studies can currently be independently reproduced end to end. None of that erases the genuine progress the survey documents, including growing use of generative attack methods aimed at closing the feature space gap and a modest but real increase in code and data sharing compared to the pre 2022 literature. It does mean anyone treating a single paper’s attack success rate as settled operational fact should read the fine print first.

Adversarial robustness in network security is ultimately not just an academic exercise, it is a prerequisite for trusting automated defenses in increasingly automated and interconnected environments. A survey that makes the field’s convenient assumptions visible and countable, rather than leaving them buried in dozens of individually reasonable seeming papers, is exactly the kind of unglamorous infrastructure work that makes the next round of research harder to fool and easier to trust.

Frequently asked questions

Related reading