Probabilistic robustness improves attacks on reinforcement learning based intrusion detection

Probabilistic Robustness-driven Universal Adversarial Perturbations with Explainability against Deep Reinforcement Learning-based Intrusion Detection System

Machine Learning

Summary

Intrusion detection systems protect networks by spotting bad activity, but modern systems that learn and adapt using deep reinforcement learning can be tricked by adding small changes to network data. These tricky changes, which work universally across many inputs, are called universal adversarial perturbations (UAPs). The authors introduced a way to make these attacks stronger by measuring how often they cause mistakes overall, and they use explainable AI methods to make sure the changes follow real-world rules. Their technique, called PX-UAP, was tested extensively and found to be more effective than previous attack methods.

What this means in practice

  • For network security teams: Design evaluations of intrusion detection systems that reveal vulnerabilities from universal adversarial perturbations using probabilistic robustness measures.
  • For cybersecurity product developers: Develop more effective adversarial testing tools for deep reinforcement learning based intrusion detection systems by integrating explainability and probabilistic robustness.$Commercial implications: Enables creation of robust testing services or security products that validate IDS resilience and improve cyber defense tools.

Authors

Hongsen Zhang, Lu Zhang, Mingjing Xu, Yi Zhang, Gregory Epiphaniou, Carsten Maple

Abstract

Deep reinforcement learning (DRL) enables adaptive intrusion detection in dynamic network environments but also exposes intrusion detection systems (IDS) to adversarial threats such as universal adversarial perturbations (UAPs), which apply a single input-agnostic perturbation to degrade detection performance across traffic. Probabilistic Robustness (PR), as a post-hoc evaluation metric, provides a principled, population-level measure of adversarial impact that conceptually aligns with the universality objective of UAPs, i.e., PR quantifies the prevalence of misclassification in the input space, making it a natural signal for guiding UAP generation. Hence, we propose PR-based UAP, which represents the first integration of an explicit PR-driven objective into generating UAPs against DRL-based IDS. Building on this formulation, we introduce PX-UAP, which leverages explainable artificial intelligence (XAI) to guide perturbation shaping under realistic domain constraints, and provides a rigorous theoretical analysis of its design. Extensive experiments demonstrate that PX-UAP consistently outperforms state-of-the-art UAP methods in attack effectiveness.
View PDFOpen arXiv