This repository provides the code base for our scientific work on constrained adversarial attacks in NIDS with a comparison of datasets and classification methods.
It is structured in flows, covering an operation that produces or/and consumes artifacts (e.g., preprocessing data or training the models), which can be called using python main.py <flow-name> (see main.py). All code regarding data processing can be found in datasets and preprocessing, training and testing classifiers in classification and models and applying and evaluating adversarial attacks in attacking and attacks. Necessary parameters, including the models and datasets used in the run of a flow, are defined in parameters.py.
pip install -r requirements.txt
python main.py <flow-name>
<flow-name> describes the processing step:
data-cleaning: Pre-processing of the datasetsdata-undersampling: Tests undersampling strategiesdata-feature-selection: Tests feature selection parametersdata-oversampling: Tests oversampling strategiesmodel-parameter-fitting: Finds the optimal model hyper-parameters using cross validationmodel-retraining: Retrains the models with hyper-parameters on the full training setmodel-evaluation: Evaluates the models on the test setattack-initialization: Initializes the adversarial attack samplesattack-minimization': Minimizes successful adversarial examplesattack-evaluation-initialization: Evaluates the attack successattack-evaluation-minimization: Evaluates the perturbation minimization
Define the datasets, models and attack types of a run in parameters.py. The paths to the raw datasets must be defined in the respective loading scripts in datasets. To add new datasets, models or attacks, define them in the respective folder and load them in parameters.py.
See classification-report.md for a detailed report on the classification results, including datasets, data processing, classifiers, and selected hyperparameters.