Evaluating the Robustness of Time Series Anomaly and Intrusion Detection Methods against Adversarial Attacks

Time series anomaly and intrusion detection are extensively studied in statistics , economics , and computer science . Over the years , numerous methods have been proposed for time series anomaly and intrusion detection using deep learningbased methods . Many of these methods demonstrate state-of-the-art performance on benchmark datasets , giving the false impression that these systems are robust and deployable in practical and industrial scenarios . In this paper , we demonstrate that state-of-the-art anomaly and intrusion detection methods can be easily fooled by adding adversarial perturbations to the sensor data . We use different scoring metrics such as prediction errors , anomaly , and classification scores over several public and private datasets belong to aerospace applications , automobiles , server machines , and cyber-physical systems . We evaluate state-of-theart deep neural networks ( DNNs ) and graph neural networks ( GNNs ) methods , which claim to be robust against anomalies and intrusions , and find their performance can drop to as low as 0 % under adversarial attacks from Fast Gradient Sign Method ( FGSM ) and Projected Gradient Descent ( PGD ) methods . To the best of our knowledge , we are the first to demonstrate the vulnerabilities of anomaly and intrusion detection systems against adversarial attacks . Our code is available here : https : //anonymous.4open.science/r/ICLR298 1 INTRODUCTION . Machine learning and deep learning have profoundly impacted numerous fields of research and society over the last decade ( LeCun et al. , 2015 ; Goodfellow et al. , 2016 ) . Medical imaging ( Litjens et al. , 2017 ) , speech recognition ( Kumar et al. , 2018 ) , and smart manufacturing systems ( Wang et al. , 2018 ) are a few of these areas . With the proliferation of smart sensors , massive advances in data collection and storage , and the ease with which data analytics and predictive modeling can be applied , multivariate time series data obtained from collections of sensors can be analyzed to identify regular patterns that can be interpreted and exploited . Numerous researchers have been interested in time series anomaly and intrusion detection ( Pang et al. , 2021 ; Khraisat et al. , 2019 ) . For instance , time series anomaly detection methods are used in the aerospace industry for satellite health monitoring , while intrusion detection methods are employed in the automobile industry for in-vehicle controller area networks . These deep neural network-based solutions outperform the competition on a variety of benchmark datasets . However , as deep learning became more prevalent , researchers began to investigate the vulnerability of deep networks , particularly to adversarial attacks . In the context of image recognition , an adversarial attack entails modifying an original image in such a way that the modifications are nearly imperceptible to the human eye ( Yuan et al. , 2019 ) . The modified image is referred to as an adversarial image , as it will be classified incorrectly by the neural network , whereas the original image will be classified correctly . One of the most well-known real-world attacks involves manipulating the image of a traffic sign in such a way that it is misinterpreted by an autonomous vehicle ( Eykholt et al. , 2018 ) . The most common type of attack is gradient-based , in which the attacker modifies the image in the direction of the gradient of the loss function relative to the input image , thereby increasing the rate of misclassification ( Yuan et al. , 2019 ; Goodfellow et al. , 2014 ; Madry et al. , 2017 ) . While adversarial attacks have been extensively studied in the context of image recognition , they have not been extensively investigated for anomaly and intrusion detection systems . It is surprising given the increasing popularity of deep learning models for classifying time series ( Ma et al. , 2018 ; Zheng et al. , 2017 ; Wang et al. , 2017 ) . Additionally , adversarial attacks are a possibility in a large number of applications that require the use of time series data . For instance , Figure 1 ( top ) depicts the original and perturbed time series for the Korean Aerospace Research Institute ’ s KOMPSAT-5 satellite ( KARI ) . The prediction error ( see Figure 1 , bottom ) is generated by the “ Convolutional LSTM with Mixtures of Probabilistic Principal Component Analyzers ” ( CLMPPCA ) method , which is currently deployed at KARI , to predict anomalies . While CLMPPCA accurately predicts the anomaly for the original time series , adding small perturbations in the form of FGSM and PGD attacks causes the entire input samples to be classified as an anomaly . This attack can have a severe impact on the satellite health monitoring system . We present , transfer , and adapt adversarial attacks that have been demonstrated to work well on images to time series data ( containing anomalies and intrusions ) in this work . Additionally , we present an experimental study utilizing benchmark datasets from the aerospace and automobile industries and server machines , demonstrating that state-of-the-art anomaly and intrusion detection methods are vulnerable to adversarial attacks . We highlight specific real-world use cases to emphasize the critical nature of such attacks in real-world scenarios . Our findings indicate that deep networks for time series data , like their computer vision counterparts , are vulnerable to adversarial attacks . As a result , this paper emphasizes the importance of protecting against such attacks , particularly when anomaly and intrusion detection systems are used in sensitive industries such as aerospace and automobiles . Finally , we discuss some mechanisms for avoiding these attacks while strengthening the models ’ resistance to adversarial examples . Aim , Scope and Contribution . In this work , we do not propose any novel adversarial attack method . However , we demonstrate the threat of existing attacks such as FGSM and PGD on stateof-the-art anomaly and intrusion detection methods . In comparison to the computer vision domain , where adversarial attack has been extensively studied and investigated , the literature on novelty detection , and particularly on anomaly detection , is noticeably devoid of such studies . The purpose of this paper is to bring attention to this issue . Additionally , we hope to encourage researchers to consider robustness to adversarial attacks when evaluating future detectors . The paper ’ s scope was limited to SOTA anomaly detectors and intrusion detection systems ( Note : As intrusion detection is a vast domain we consider only one sub-domain i.e. , intrusion detection in Controller Area Network ) . Finally , to demonstrate that the current generation of detectors is unprepared against adversarial attacks . We demonstrate these attacks successfully on a deployed system in the aerospace industry . 2 RELATED WORK . 2.1 BACKGROUND AND NOTATIONS . When performing a supervised learning task , we define D = { ( si , yi ) |i = 1 , . . . , N } to represent a data set containing N data samples . Each data sample is composed of a m-dimensional multivariate time series si and a single target value yi for classification . We will observe such formation in intrusion detection scenarios ( see Section 4.2 ) . For unsupervised learning , each data sample is again composed of a m-dimensional multivariate time series si however , yi is an n-dimensional multivariate time series obtained from an autoregressive model , predicting the future . In most cases , n = m however , they can be different as well . Moreover , we define any deep learning method as F ( · ) ∈ f : RN → ŷ and loss function ( e.g. , cross entropy or mean squared error ) as Lf ( · , · ) . Finally , generating an adversarial instance sadvi can be described as a optimization problem given a trained deep learning model F and an original input time series si , as follows : min ∥∥si − sadvi ∥∥ s.t . F ( si ) = ŷi , F ( sadvi ) = ŷadvi and ŷi 6= ŷadvi . ( 1 ) 2.2 ADVERSARIAL ATTACKS . In 2014 , Szegedy et al . ( 2013 ) introduced adversarial examples against deep neural networks for image recognition tasks for the first time . Following these inspiring discoveries , an enormous amount of research has been devoted to generating , understanding , and preventing adversarial attacks on deep neural networks ( Eykholt et al. , 2018 ; Goodfellow et al. , 2014 ; Madry et al. , 2017 ) . Adversarial attacks can be broadly classified into two types : white-box and black-box attacks . As white-box attacks presume access to the model ’ s design and parameters , they can attack the model effectively and efficiently using gradient information . By contrast , black-box attacks do not require access to the output probabilities or even the label , making them more practical in real-world situations . However , black-box attacks frequently take hundreds , if not millions , of model queries to calculate a single adversarial case . The majority of adversarial attack techniques have been proposed for use in image recognition . For instance , a Fast Gradient Sign Method attack was developed by Goodfellow et al . ( 2014 ) as a substitute for expensive optimization techniques ( Szegedy et al. , 2013 ) . Madry et al . ( 2017 ) proposed Projected Gradient Descent ( PGD ) in response to the success of FGSM . PGD seeks to find the perturbation that maximizes a model ’ s loss on a particular input over a specified number of iterations while keeping the perturbation ’ s size below a specified value called epsilon ( ) . This constraint is typically expressed as the perturbation ’ s L2 or L∞ norm . It is added to ensure that the content of the adversarial example is identical to that of the unperturbed sample — or even to ensure that the adversarial example is imperceptibly different from the unperturbed sample . Carlini-Wagner is another well-known attack ( Carlini & Wagner , 2017 ) . However , it is primarily intended for L2 norm-based attacks , whereas this study focuses exclusively on L∞ norm-based attacks . Adversarial Attacks on Time Series . Limited efforts have been made to extend similar attacks to time series data . Surprisingly , the community has ignored adversarial attack approaches for time series anomaly and intrusion detection tasks . However , a few adversarial attack approaches have been proposed recently for the time series classification task , which are tangentially related to our work . For instance , in their work on adopting a soft K Nearest Neighbors ( KNN ) classifier with Dynamic Time Warping ( DTW ) , Oregi et al . ( 2018 ) demonstrated that adversarial examples could trick the proposed nearest neighbors classifier on a single simulated synthetic control dataset from the UCR archive ( Dau et al. , 2019 ) . Given that the KNN classifier is no longer considered the stateof-the-art classifier for time series data ( Bagnall et al. , 2017 ) , Fawaz et al . ( 2019 ) extend this work by examining the effect of adversarial attack on the more recent and commonly used ResNet classifier ( He et al. , 2016 ) . Fawaz et al . ( 2019 ) , on the other hand , focused mainly on univariate datasets from the UCR repository . As a result , Harford et al . ( 2020 ) investigate the influence of adversarial attacks on multivariate time series classification using the multivariate dataset from UEA repository ( Bagnall et al. , 2018 ) . However , Harford et al . ( 2020 ) only consider basic methods such as 1-Nearest Neighbor Dynamic Time Warping ( Seto et al. , 2015 ) ( 1-NN DTW ) and a Fully Convolutional Network ( FCN ) . Karim et al . ( 2020 ) and Harford et al . ( 2020 ) attacked models using Gradient Adversarial Transformation Networks ( GATNs ) . However , they examined just transfer attacks , a relatively weak sort of black-box attack . Only Siddiqui et al . ( 2019 ) demonstrated the effectiveness of gradient-based adversarial attacks on time series classification and regression networks . However , they considered a very simple baseline for the attack , containing only three convolutional , two max-pooling , and one dense layer . Our study differs from previous research in that we focus on time series anomaly and intrusion detection rather than the broader classification problem . More precisely , we explore autoregressive models that have been mostly overlooked in prior works . Additionally , rather than targeting generic deep neural networks KNN with DTW or ResNet , we investigate state-of-the-art anomaly or intrusion detection methods . For instance , when it comes to anomaly detection , we focus on the most contemporary and commonly used techniques , such as MSCRED ( Zhang et al. , 2019 ) , CLMPPCA Tariq et al . ( 2019 ) , and MTAD-GAT Zhao et al . ( 2020 ) . Similarly , for controller area network intrusion detection , we explore two well-known methods : CAN-ADF ( Tariq et al. , 2020a ) and CANTransfer ( Tariq et al. , 2020b ) . Section 4 will cover these methods in further depth .

Summary: The paper tackles the problem of adversarial attacks against time-series-based ML applications devoted to intrusion detection. The paper is relatively simple: they use existing adversarial ML strategies (white-box attacks) to thwart a similar ML system. The main contribution is the fact that few efforts investigated adversarial attacks against time-series based ML methods, and – specifically – no paper considered “anomaly and intrusion detection” scenarios.  Overall, the presentation of the paper is adequate. The quality of the English text is fair. Figures and Tables are appropriate. The topic addressed by the manuscript is relevant and within ICLR’s scope. The references are not appropriate. The contribution is not very significant.  STRENGTHS: + It is truly the first + Evaluation on multiple datasets   WEAKNESSES - Poor treatment of previous work - Unimpressive results - Poor threat model - Inadequate problem definition