Evaluating the Robustness of Time Series Anomaly and Intrusion Detection Methods against Adversarial Attacks
Authors: Shahroz Tariq
Simon S. Woo
Venue: ICLR 2022 Submitted (2022)
Keywords: Time series
Anomaly Detection
Intrusion Detection
Adversarial Attack

Abstract: Time series anomaly and intrusion detection are extensively studied in statistics, economics, and computer science. Over the years, numerous methods have been proposed for time series anomaly and intrusion detection using deep learning-based methods. Many of these methods demonstrate state-of-the-art performance on benchmark datasets, giving the false impression that these systems are robust and deployable in practical and industrial scenarios. In this paper, we demonstrate that state-of-the-art anomaly and intrusion detection methods can be easily fooled by adding adversarial perturbations to the sensor data. We use different scoring metrics such as prediction errors, anomaly, and classification scores over several public and private datasets belong to aerospace applications, automobiles, server machines, and cyber-physical systems. We evaluate state-of-the-art deep neural networks (DNNs) and graph neural networks (GNNs) methods, which claim to be robust against anomalies and intrusions, and find their performance can drop to as low as 0\% under adversarial attacks from Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) methods.  To the best of our knowledge, we are the first to demonstrate the vulnerabilities of anomaly and intrusion detection systems against adversarial attacks. Our code is available here: https://anonymous.4open.science/r/ICLR298

Under review as a conference paper at ICLR 2022
EVALUATING THE ROBUSTNESS OF TIME SERIES ANOMALY AND INTRUSION DETECTION METHODS AGAINST ADVERSARIAL ATTACKS
Anonymous authors Paper under double-blind review
ABSTRACT
Time series anomaly and intrusion detection are extensively studied in statisties, economics, and computer science. Over the years, numerous methods have been proposed for time series anomaly and intrusion detection using deep learning- based methods. Many of these methods demonstrate state-of-the-art performance benchmark datasets, giving the false impression that these systems are robust and deployable in practical and industrial scenarios. In this paper, we demon- strate that state-of-the -oee------e-rtttt art anomaly and intrusion detection methods can be eas- ily fooled by adding adversarial perturbations to the sensor data. We use differ- ent scoring metrics such as prediction errors, anomaly, and classification scores over several public and private datasets belong acrospace applications, auto- mobiles, server machines, and eyber-physiee systems. We evaluate state-of- of-the- art deep neural networks (DNNs) and graph neural networks (GNNs) methods, which claim to be robust against anomalies and intrusions, and find their perfor- mance drop to low 0% under adversarial attacks from Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) methods. To the best of our knowledge, we the first to demonstrate the vulnerabilities of anomaly and intrusion detection systems against adversarial attacks. Our code is available here: https::/ /ats:s///nnomouuss.mmm 4open. weience/I/ICLR20
INTRODUCTION
Machine learning and deep learning have profoundly impacted numerous fields of research and ciety over the last decade (LeCun et al.] 2015 Goodfellow et af., 2016)). Medical imaging (Litjens) 2018), and smart manufacturing systems (Wang al.)
ct 2017), speech recognition (Kumar 2018 are a few of these areas. With the proliferation of smart sensors, massive advances in data col- lection and storage, and the ease with which data analytics and predictive modeling can be applied, multivariate time series data obtained from collections of sensors can be analyzed to identify regular patterns that can be interpreted and exploited. Numerous researchers have been interested in time series anomaly and intrusion detection (Pang et al. 2021 Khraisat et al., 2019). For instance, time series anomaly detection methods are used the aerospace industry for satellite health monitoring, while intrusion detection methods are employed in the automobile industry for in-vehicle controller area networks. These deep neural network- based solutions outperform the competition on a vari- cty of benchmark datasets. However, as deep learning became more prevalent, researchers began to investigate the vulnerability of deep networks, particularly to adversarial attacks. In the context of image recognition, adversarial attack entails modifying original image in such way that the modifications are nearly imperceptible to the human eye (Yuan et al., 2019). The modified im- age is referred to adversarial image, it will be classified incorrectly by the neural network, whereas the original image will be classified correctly. One of the most well-known real-world at- tacks involves manipulating the image of traffic sign in such way that it is misinterpreted by an autonomous vehicle (Eykholt et al., 2018). The most common type of attack is gradient-based, in which the attacker modifies the image in the direction of the gradient of the loss function relative to the input image, thereby increasing the rate of misclassification (Yuan et al. 2019 Goodfellow et al. 2014 Madry et al. 2017).

---

Under review as a conference paper at ICLR 2022
While adversarial attacks have been extensively studied in the context of image recognition, they have not been extensively investigated for
1.0
Asoesely Savtr
Ground Truth
0.8
FGSM
anomaly and intrusion detection systems. It is surprising given the increasing popularity of deep learning models for classifying time se-
Ver
PGD
Values
0.6
Mogetie Mayao
ries (Ma al., 2018 Zheng et al. 2017 Wang
0.4
et al. 2017).
0.2
M
Additionally, adversarial attacks are a possibil- ity in a large number of applications that require the use of time series data. For instance, Fig- ure | (top) depicts the original and perturbed time series for the Korean Aerospace Research Institute's ' KOMPSAT-5 satellite (KARI). The prediction error (see Figure T bottom) is gen- erated by the "Convolutional LSTM with Mix- tures of Probabilistic Principal Component An- alyzers" (CLMPPCA) method, which is rently deployed at KARI, to predict anoma- lies. While CLMPPCA accurately predicts the anomaly for the original time series, adding small perturbations in the form of FGSM and PGD attacks causes the entire input samples to be classified as an anomaly. This attack can have severe impact on the satellite health monitoring system.
0.0
Samples
500
1.0
Ground Truth
0.8
FGSM
PGD
Values
0.6
Threshold
0.4
Wyy
WWw
0.2
0.0
Samples
Anouatyy
Saarte
500
Figure 1: Example of ground truth and perturbed time series using FGSM and PGD attacks on CLMPPCA.
We present, transfer, and adapt adversarial at- tacks that have been demonstrated to work well on images to time series data (containing anoma- lies and intrusions) in this work. Additionally, mark datasets from the aerospace and automobile industries and server machines, demonstrating that toite-of-thh-aal anomaly and intrusion detection methods are vulnerable to adversarial attacks. We highlight specific real-world use cases to emphasize the critical nature of such attacks in real-world scenarios. Our findings indicate that deep networks for time series data, like their computer vision counterparts, are vulnerable to adversarial attacks. As result, this paper emphasizes the importance of protecting against such attacks, particularly when anomaly and intrusion detection systems are used in sensitive industries such as aerospace and automobiles. Finally. we discuss some mecha- nisms for avoiding these attacks while strengthening the models' resistance to adversarial examples.
present experimental study utilizing bench-
Aim, Scope and Contribution. In this work, we do not propose any novel adversarial attack method. However, we demonstrate the threat of existing attacks such as FGSM and PGD on state- of-the-art anomaly and intrusion detection methods. In comparison to the computer vision domain, where adversarial attack has been extensively studied and investigated, the literature on novelty detection, and particularly of this paper is to bring attention to this issue. Additionally, we hope to encourage researchers to consider robustness to adversarial attacks when evaluating future detectors. The paper's scope was limited to SOTA anomaly detectors and intrusion detection systems (Note: As intrusion detection is a vast domain consider only one sub-domain i.e., intrusion detection in Controller Area Network). Finally, to demonstrate that the current generation of detectors is unprepared against adversarial attacks. We demonstrate these attacks successfully on a deployed system in the aerospace industry.
anomaly detection, is noticeably devoid of such studies. The purpose
2 RELATED WORK
2.1 BACKGROUND AND NOTATIONS
When performing a supervised learning task, we define D = (s; v.)li - l...., N} to represent a data set containing N data samples. Each data sample is composed of a m-dimensional multivariate time series s; and a single target value y, for classification. We will observe such formation in intrusion detection scenarios (see Section 4 For unsupervised learning, each data sample is
2

---

Under review as a conference paper at ICLR 2022
again composed of m-dimensional multivariate time series 8; however, Y4 is an n-dimensional multivariate time series obtained from an autoregressive model, predicting the future. In most cases, however, they be different well. Moreover, we define any deep learning method as F()) E f R + and loss function (e.g., cross entropy or mean squared error) as (-)-,)) Finally, generating an adversarial instance sqdv can be described as optimization problem given trained deep learning model F and an original input time series 8,, as follows:
min ||s sqdull
s.t. F(s;) = -b. F(s?do) = yaudu and Ot + sedu.
(1)
2.2 ADVERSARIAL ATTACKS
In 2014, Szegedy et al. 2013)) introduced adversarial examples against deep neural networks for im- age recognition tasks for the first time. Following these inspiring discoveries, an enormous amount of research has been devoted to generating, understanding, and preventing adversarial attacks on deep neural networks (Eykholt et al. 2018 Goodfellow et al. 2014 Madry et al. (017). Adversar- ial attacks can be broadly classified into two types: white-box and black-box attacks. As white-box attacks presume access to the model's design and parameters, they can attack the model effectively and efficiently using gradient information. By contrast, black-box attacks do not require access to the output probabilities or even the label, making them more practical in real-world situations. However, black-box attacks frequently take hundreds, if not millions, of model queries to calculate single adversarial case.
The majority of adversarial attack techniques have been proposed for use in image recognition. For instance, Fast Gradient Sign Method attack was developed by Goodfellow et al. (2014) as sub- stitute for expensive optimization techniques (Szegedy et al. 2013). Madry et al. (2017) proposed Projected Gradient Descent (PGD) in response to the success of FGSM. PGD seeks to find the per- turbation that maximizes a model's loss on a particular input over a specified number of iterations while keeping the perturbation's 's size below a specified value called epsilon (e). This constraint is typically expressed as the perturbation's s I.2 or I norm. It is added to ensure that the content of the adversarial example is identical to that of the unperturbed sample- sarial example is imperceptibly different from the unperturbed sample. Carlini-Wagne is another well-known attack (Carlini& & Wagner, 2017). However, is primarily intended for L norm-based attacks, whereas this study focuses exc cuclusively on L norm- based attacks.
even to ensure that the adver-
Ad Adversarial Attacks on Time Series. Limited efforts have been made to extend similar attacks to time series data. Surprisingly, the community has ignored adversarial attack approaches for time series anomaly and intrusion detection tasks. However, a few adversarial attack approaches have been proposed recently for the time series classification task, which are tangentially related to our work. For instance, in their work on adopting soft K Nearest Neighbors (KNN) classifier with Dynamic Time Warping (DTW), Oregi et al. (2018 deemonstrated that adversarial examples could trick the proposed nearest neighbors classifier on a single simulated synthetic control dataset from the UCR archive (Dau et al. 2019). Given that the KNN classifier is longer considered the state- of-the-art classifier for time series data (Bagnall et al. 2017). Fawaz et al. (2019) extend this work by examining the effect of adversarial attack on the more recent and commonly used ResNet classi- fier (He et al. 2016). Fawaz et al. (2019) on the other hand, focused mainly on univariate datasets from the UCR repository. As a result, Harford et al. (2020) investigate the influence of adversarial attacks on multivariate time series classification using the multivariate dataset from UEA reposi- tory (Bagnall et al. 2018). However, Harford et al. (2020) only consider basic methods such as --eearett Neighbor Dynamic Time Warping (Seto et al. 2015) (1-NN DTW) and Fully Convolu- tional Network (FCN). Karim al. (2020) and Harford et al. (222)) attacked models using Gradient Adversarial Transformation Networks (GATNs). However, they examined just transfer attacks, relatively weak sort of black-box attack. Only Siddiqui et al. (2019) demonstrated the effectiveness of gradient-basee based adversarial attacks on time series classification and regression networks. How- ever, they considered a very simple bascline for the attack, containing only three convolutional, two max-pooling, and one dense layer.
Our study differs from previous research in that we focus on time series anomaly and intrusion detection rather than the broader classification problem. More precisely, we explore autoregres- sive models that have been mostly overlooked in prior works. Additionally, rather than targeting generic deep neural networks KNN with DTW or ResNet, we investigate ofte-of-the-ar anomaly
3

---

Under review as a conference paper at ICLR 2022
TYPICAL Timesenies TRaining PHase
FinaL ClassuricatiOn
Pite- PRocesscnn
POST POsT-PRO PRocessin
InPUT
TRaining
DNN MoneL
NoT Anomaly/larausion
Noise VVVA
AnomaLy Scone on Predicrron Eanon
Raw Fearune VecroRs
Dara Source
ATTaCKeR
PEnTuRSED Timesenies
TRainee DNN MapeL
on Classinicaion Scone
Anomaty/larnnusien
ADvensanIaL PHose
Figure 2: Pipeline of a typical time series training phase and adversarial attack phase.
or intrusion detection methods. For instance, when it comes to anomaly detection, we focus on the most contemporary and commonly used techniques, such as MSCRED (Zhang al. 2019), CLMPPCA Tariq et al. (2019). and MTAD-GAT Zhao et al. (2020). Similarly, for controller area network intrusion detection, explore two well-known methods: CAN-ADF (Tariq al.) (020a) and CANTransfer (Tariq et al. (0200)). Section 4 will cover these methods in further depth.
THREAT MODEL AND ATTACK GENERATION
Adversary's Capabilities. We consider an adversary whose objective is to reduce the effectiveness of a victim model. The attacker apply the perturbations by modifying the victim's test-time samples, for example, by compromising a sensor or the data link that collects the data for inference. We investigate L norm threat model with 0.1 epsilon. Due the variable input range of time series data, there are no box constraints, in contrast to the visual image, where the pixels take on a definite value between [0, 255]. As result, the data was standardized in our case using zero-mean and unit standard deviation which justified the choice of 0.1 as the epsilon value.
Ad Adversary's Knowledge. To evaluate the vulnerability of anomaly and intrusion detection systems, we examine non-targeted white-box scenarios in which the attacker has complete knowledge of the victim model, including its training data and the model's tunable parameters and weights.
Adversary's Goals. The adversary considers two cases: (i) normal to anomaly (or intrusion) and (ii) anomaly to normal. In (i), the adversary creates sq aade for each test sample s; so that the models interpret it as an anomaly (or intrusion), thereby generating a false-positive. However, in (ii), the adversary fabricates sade to achieve the inverse effect, namely, to cause the model predict an anomaly normal, hence generating false-negative examples. As anomalies are rare events, even a few misclassifications caused by the adversary can have a detrimental effect on the model's performance.
Adversarial Attack Generation. The Fast Gradient Sign Method (FGSM) attack was proposed for the first time by Goodfellow et al. (2014). The training of neural networks entails minimizing loss function by adjusting the network weights. FGSM, on the other hand, does the opposite by adjusting the input samples in the direction opposite the loss function's minimum. Thus, the FGSM attack concerned with the computation of optimal perturbation series 7, which can be added/summed an input sample pointwise (i.e., a point refers to a single timestep) in order to maximize the classification loss function, i.c., cause misclassifications This is mathematically expressed as:
n e sign (V. (.))
where V, denotes the derivative of the network's loss, C.),,,, with respect each timestep in s; (calculated for an input datapoint s; and it's true output yı). To control the magnitude of the perturbation (i.e., keep it imperceptibly small), perturbed sample sadv can be computed as 8; +7. Note that FGSM requires the attacker to compute the loss function gradient with respect to a given imput, which may not be possible directly. Due to the fact that FGSM requires knowledge of the internal workings of the network, therefore referred to as a white-box attack. However, a surrogate model can be used to simulate the target model. An FGSM attack can be applied to the surrogate to generate ad adversarial examples (Papernot et al. 2017). allowing for the use such white-bon attacks in practical practice scenarios (Kurakin et al. 2016b).
used as a multiplier factor. After that, the
4

---

Under review as a conference paper at ICLR 2022
Table 1: A summary of anomaly and intrusion detection datasets.
Statisties
SMAP
MSL.
SMD
KARI
Synthetic
OTIDS
Dimensions
55
27
4-35
30
Anomalies (or Intrusions)
13.13%
10.27%
4.16%
1%
1.10%
48.64%
Train Size
135,183
58,317
708,405
4,405,636
8,000
2,306,954
Test Size
427,617
73,729
708,420
17,622,546
10,000
2,306,955
Madry et al. (2017) proposed a more robust adversarial attack called Projected Gradient Descent (PGD). This attack employs multi-step procedure and negative loss function. It overeomes the problem of network overfitting and the shortcomings of the FGSM attack. It is more robust than first-order network information-oe bassdd FGSM, and performs well under large- constraints. Gradient Descent is essentially identical to the Basic Iterative Method (BIM) (Kurakin et al. (01 or the Iterative FGSM (IFGSM) (Kurakin et al. 201 attacks. The only difference is that PGD initializes the example at random location within the ball of interest (determined by the L norm) and performs random restarts, whereas BIM initializes at the original location.
odv s,++1
1Is+5 (sg.d + sign( V Cy B)) s.t. 1 1stsT
(3)
where 5 is a nonempty compact topological space, T is the total number of iterations, and a is the control rate, An illustration of the overall pipeline is provided in Figure 2
4 EXPERIMENTAL SETUP
Datasets. We employ variety of datasets detect anomalies and intrusions. For anomaly detec- tion we employ three public datasets: (i) Mars Science Laboratory rover (MSL) (Hundman et al.) 2018). (ii) Soil Moisture Active Passive satellite (SMAP) (Hundman et al.
2018 and (iii) Server 2019). as well as one private dataset: (vi) Korean Aerospace Re- search Institute KOMPSAT-5 satellit lite (KARI) (Tariq al. 2019) and one synthetic dataset: (v) from the MSCRED paper (Zhang et al.
Machine Dataset (SMD) (Su et al.)
(019). Intrusion detection was performed using the CAN Dataset for intrusion detection (OTIDS) (Lee al.) 2017). The datasets were chosen based on our baselines' shown ability to provide state-of-the-art performance on these datasets. Table [ summarize these datasets.
Evaluation Metrics. For intrusion detection, we use three metrics: Precision, Recall, and F1- score. However, we only provide the Fi score in the main text (please refer to Appendix X for detailed results). To obtain the final classification result for anomaly detection methods, we observed that the majority of detectors use thresholding method on top of the neural network's predictions, which are expressed as an anomaly score or prediction error. The prediction, recall, and F1-score are then calculated using the results from thresholding methods. While these metries are beneficial, the true impact of the adversarial attack is visible primarily in anomaly detectors' anomaly score and prediction errors. Therefore, we include Figure I 3b and Bal as illustrations of this impact. Additionally, we include more related figures in Appendix G
We conduct experiments on the following basclines to demonstrate that the vulnerability to adversar- ial attacks is common among several state-of-the-an anomaly (or intrusion) detection architectures.
4.1 ANOMALY DETECTION BASELINES
Anomaly detectors based on Deep Neural Networks (DNNs) are the most frequently used method. However, some methods based on Graph Neural Networks (GNNs) have also been proposed re- cently. As a result, we evaluated both DNNs- and GNNs-based anomaly detectors. We used the following criteria to determine the baseline: (i) To ensure that we cover a broad range of methods, we decide that the baselines we choose should be diverse, i.e., no two baselines have similar model architecture.
(ii) They should consider a different pre-processing technique (e.g.. using raw data or feature vectors), (ii) They should take into account various post-processing techniques for pre- diction (e.g., anomaly score, prediction error, or classification score). (iv) The method widely accepted and reveereveewed. For this criterion, and publication venues. (v) The source code is freely available or can be obtained upon request. We selected the following baselines based on these criteria:
take into account GitHub Forks, paper citations,
5

---

Under review as a conference paper at ICLR 2022
MSCRED (Zhang et al., 2019)
[AAAI]. Taking advantage of the temporal dependencies in- herent in multivariate time series, Zhang et al. (2019) proposed a
Convolutional Re- (MSCRED) for anomaly detection two datasets: I synthetic and (ii) power plant. Sidenote: [Shen et al. (2020) demonstrated that MSCRED outperforms all SOTA anomaly detection methods except Temporal Hierarchical One-Class (THOC), but we were able to evaluate THOC as the code is not available (see more details below this list). As a result, we chose the second best method (i.e., MSCRRD) among recently developed SOTA anomaly de- tection methods. Because the power plant dataset is not publicly available, we compare MSCRED with and without adversarial attack using the synthetic dataset used by ZZhang et (2019) their work.
current Encoder-
CLMPPCA (Tariq et al. 2019) [KDD]. Tariq et al. (0099) proposed a hybrid approach for anomaly detection in multivariate satellite telemetry data. They propose a Convolutional LSTM with Mixtures Probabilistic Principal Component Analyzers (CLMPPCA) method for trans- forming the time window containing several telemetry data samples into a feature vector that is used to train the model and to predict the future data instances. To make final classification, the prediction errors calculated from the prediction and ground truth combined with moving average-based threshold method. Tariq et al. (2019) evaluated a private dataset from the Korean Aerospace Research Institute's KOMPSAT-5 satellite (KART). We were able obtain the same private dataset and demonstrate how adversarial attacks affect the performance of CLMPPCA. One of the primary reasons for selecting CLMPPCA is that it is currently deployed KARL. Thus, successfully demonstrating an attack on this method will demonstrate its applicability in practical scenario.
MTAD-GAT (Zhao et al. 2020) [ICDM]. Zhao et al. 2020) proposed a multivariate time series anomaly detector based on Graph Attention Networks. The authors treat each univariate time series as separate feature and employ two parallel graph attention layers to learn the complex dependencies between multivariate time series in both temporal and feature dimensions by jointly optimizing imecasting--asse and reconstruction--asee model. MTAD-GAT outperformed sev- cral recent time series anomaly detectors such as OmniAnomaly (Su et al. 2019), MAD-GAN (Li et al., 2019), and DAGMM (Zong et al.) 2018) from ICLR 2018, three publicly available anomaly datasets (SMAP, MSL, and SMD). As a result, MTAD-GAT one of the best SOTA methods currently available. We evaluate MTAD-GAT with and without adversarial attacks all three datasets.
Note that we chose these three baselines based on their compliance with our defined criteria. Ad- ditionally, we were unable evaluate some recent methods, such as Temporal Hierarchical One- Class (THOC) published at NeurlPS 2020, because the source code is not publicly available and our request to obtain the source code from the author was not answered. We diseuss this further in Section g
4.2 INTRUSION DETECTION BASELINES
Khraisat et al. 2019) and Gamage & Samarabandu (2020) discuss the different domains where Intrusion detection-based methods are employed. We selected such area, i.e., Intrusion detection in Vehicle Controller Area Network, and compared sfate-of-the--ar solutions from this domain. We use the same criteria as anomaly detection to select the intrusion detection baselines follows:
CAN-ADE. Tariq et al. (2020a) proposed hybrid of heuristics and recurrent neural network (RNN) to detect different intrusions such as DoS, Fuzzing, and Replay attacks. The heuristics and RNN components in CAN-ADF complement each other resulting in significantly better per- formance and stability. The gradient-based attack can only be applied to the RNN component of CAN-ADF. Therefore, we believe it to be interesting scenario where only of the two components the detector attacked.
CANTransfer. Recently, continual learning-based methods have become prevalent for intrusion detection. They can learn new intrusion signatures with only a few samples while keeping the same performance previously learned intrusions. CANTransfer (Tariq et al. 2020b) one such method. The author first trains the base model on DoS Attack and then uses continual learning techniques to learn new intrusion such Fuzzing and Replay by using only attack

---

Under review as a conference paper at ICLR 2022
Table 2: MTAD-GAT results (Fi score) on MSL,
Table 3: MSCRED results (F₁ score) on
SMAP and SMD datasets.
synthetic dataset from original paper.
Method
MSL
SMAP
SMD
Method
Pre.
Rec. Fj
No Attack
0.950
0.894
0.999
No Attack
1.000
0.800
0.890
FGSM
0.719
0.804
0.803
FGSM
0.487
0.500
0.493
PGD
0.687
0.775
0.665
PGD
0.485
0.500
0.492
instance. We believe that it will be interesting to observe the robustness of continual learning- based intrusion detectors against adversarial attacks.
Both CAN-ADF and CANTransfer use the same OTIDS dataset. Therefore, it gives us the oppor- tunity to perform fair comparison of two different systems (under adversarial attack) solving the same problem.
5 EMPIRICAL EVALUATION
We present results for the L FGSM and PGD attacks against three SOTA anomaly detection meth- ods -dSCMS, CLMPPCA, and MTAD-GAT-ar as well as two controller area network intrusion detection methods-CAie the L results (Appendix A); details on the I,- (Appendix () and 1.2 (Appendix [ attacks; more details on impact of adversarial attacks on MTAD-GAT (Appendix D F some original vs. per- turbed time series samples (Appendix G. and results from the FGSM, PGD. BIM, Garlini-Wagner, and Momentum Iterative Method (MIM) (Dong et al. 2018) attacks on 71 datasets from the UCR repository (Appendix [H.. In general, we observe that perturbations that are -0 -bounded are more effective. This could be explained by optimization challenges, as L' and L attacks are typically more difficult to optimize (Carlini & Wagner 2017 Tramer & Boneh 2019).
and CANTransfer. The Appendix includes additional details about
5.1 ADVERSARIAL ATTACK ON ANOMALY DETECTORS
MSCRED Performance. We employ non-targeted FGSM and PGD methods to attack MSCRED.
As result, only s; from the test set is made available to the attack methods. The e is set to 0.1 for the FGSM attack, and is set 0.1 for the PGD attack with T 40. The MSCRED method determines the appropriate threshold between normal and anomalous data points based on the training data. As a result, any modification to the test samples should not affect the threshold. As shown in Table 3 the victim model (MSCRED) has no efficacy on the samples perturbed by FGSM and PGD attacks and thus fails to detect all anomalies. Additionally, MSCRED classifies all instances of normal data as anomalies. We demonstrate in Figure 3a that MSCRED (No Attack) can accurately predict the majority of anomalies with an F1 score of 0.890 (see see Table 3). According to Figure 3al the anomaly scores under FGSM (yellow) and PGD (blue) attacks are always higher than the threshold (red dashed line), which means that MSCRED is predicting everything as an anomaly, resulting in an Fj score of less than 0.50. It is intriguing that such a small amount of change in the time series, which is primarily imperceptible to the naked eye, can greatly affect the MSCRED's anomaly scores, even when the perturbations are so minute. The results in Table 3 are demonstrating that MSCRED is not robust against adversarial attacks.
MTAD-GAT Performance. As with MSCRED, attack MTAD-GAT using a non-targeted FGSM and PGD method with e = 0.1, a 0.1, and 40. The results of adversarial attacks against MTAD-GAT trained on the MSL, SMAP, and SMD datasets are shown in Table [ MTAD- GAT demonstrates state-of-the-art performance for anomaly detection in the absence of an adver- sarial attack (No Attack). However, when adversarial examples from FGSM and PGD are used to evaluate it, the detection performance drops to low as 66%. The impact of PGD attack is more significant than that of the FGSM attack, which is understandable given that PGD is a more powerful attack than FGSM. It leads us ponder that if more sophisticated attacks explicitly developed for time series data, they will have a significantly greater impact on SOTA anomaly detectors. As a result, future anomaly detection methods should take adversarial examples into account.
Additionally, Figure Segure/3iiluuee ibllsuutsstes the effect of adversarial examples from FGSM (yellow) and PGD (blue) attacks on the MTAD-GAT anomaly score for the MSL dataset. We can see that the anomaly
7

---

Under review as a conference paper at ICLR 2022
140
No Attak
FGSM Loo
PGD Los
Ground
--. Threshold
120
Anomaly Score
100
Anomaly Score
60
Thresoold
PGD
Anomaty
40
20
Test Samples
Test Samples
(a)
(h)
Figure 3: Anomaly score of No Attack, FGSM and PGD on MSCRED (a) and on MTAD-GAT for MSL dataset (b) The y-axis scale is between and I for (b). See Appendix A and for more details on (a) and (b), respectively.
Table 4: CLMPPCA prediction errors KARI KOMPSAT-5 dataset for subsystems (SS)
1-10.
Methods
SS1
SS2
SS3
SS4
SSS
SS6
SS7
SS8
SS9
SS10
No Attack
0.025
0.020
0.646
0.018
0.078
0.081
0.028
0.015
0.043
0.106
FGSM
0.306
0.327
5.657
0.153
1.744
1.708
0.246
0.201
1.303
0.314
PGD
0.688
0.748
11.200
0.205
2.459
3.391
0.430
0.231
1.798
0.555
score for FGSM and PGD frequently exceeds threshold (red dashed line), resulting in a large number of false positives and lowering the F1 score from 94.98% to 71.90% for FGSM and 68.69% for PGD.
CLMPPCA Performance. The KARI dataset is divided into ten subsystems. As result, trained the CLMPPCA model on each subsystem separately, as described the original paper. We then used FGSM and PGD attacks evaluate each of these trained models. For FGSM, we e = 0.1, for PGD, we use a 0.1, and / = 40. Table summarizes the prediction errors for each subsystem prior to and following the attack. We can see that when adversarial attacks are used, the prediction error increases up to twentyfold. Note: For brevity and space constraints, we omit the Fi score from Table 4 it is 0.50 for all subsystems. CLMPPCA fails predict any anomalies under FGSM and PGD attacks because the prediction error is always higher than the threshold (see Figure D. We believe that by employing these straightforward yet effective attacks, an adversary can easily introduce false positives into CLMPPCA's predictions at will, posing significant difficulties for satellite operators.
Our findings indicate that the majority of SOTA anomaly detectors prioritized performance over robustness. This could have dire consequences if such systems are deployed in real-world systems. CLMPPCA is one such example, which is currently being deployed at KARI Please note that have informed KARI of the vulnerability in CLMPPCA; additional information is available in our Ethics Statement (see Section
5.2 ADVERSARIAL ATTACK ON CAN INTRUSION DETECTORS
We evaluate the robustness of two popular and recent Controller Area Network intrusion detec- tors under adversarial impact. We use the same experimental settings (i.e.. same training and test sets, epochs = 50) and attack settings (i.e., e = 0.1, a = 0.1 and 40) for CAN-ADF and CANTransfer to have fair comparison.
8

---

Under review as a conference paper at ICLR 2022
CAN-ADF Performance. The results for CAN-ADF under attack, FGSM attack, and PGD attack are presented in 5 column 2. While CAN-ADF outperforms CANTransfer in a normal scenario (i.e,, attack). it is also more vulnerable to adversarial attacks, with an Fj score of 0.00 for the PGD attack. Even though we could only attack the RNN component of CAN-ADE and the heuristics component remained unaffected, CAN-ADF's poor performance against adversarial attacks demonstrates its high reliance on the RNN component.
CANTransfer Performance. Table 5 column 3 contains the results for CANTransfer with no attack, FGSM attack, and PGD attack. While CANTransfer performs slightly worse than CAN-ADF in the ab- sence of an attack (0. (0.879), exhibits greater resis- tance to adversarial attacks than CAN-ADF, partic- ularly against FGSM attacks, where CANTransfer's performance drops by only 2%. We attempted mul- tiple runs the experiment, but the results remained
Table 5: CAN-ADF and CANTransfer re-
sults (F₁ score) on OTIDS dataset.
Method CAN-ADE
CANTransfer
No Attack
0.987
0.879
FGSM
0.188
0.858
PGD
0.000
0.311
consistent for the FGSM attack. Under PGD, it is different tale, as CANTransfer's performance drops significantly from 0.879 to 0.311, demonstrating its vulnerability.
These findings demonstrate that neither of the two most recent intrusion detectors for Controller Area Networks is resistant to adversarial examples. As a result, future research should consider the robustness of new detectors against adversarial attacks when designing them.
DISCUSSION
Defense against Adversarial Time Series. Adversarial training is one of the most commonly used defense methods against adversarial examples. However, as Kang et al. (2019) suggest, training a network withstand one type of attack may weaken it against others. Additionally, Tramer et al. (220)) outline various methods to conduct an adaptive attack and demonstrate that none of the 13 recently developed defense methods can withstand all types of adaptive attacks. Recently, several techniques for defending against adversarial time series have been proposed. For example, Goodge af. 2020) propose an Approximate Projection Autoencoder (APAE) resistant to IFGSM attacks. However, it only considers autoencoder- based anomaly detectors. Moreover, the performance of several SOTA baselines reported in the paper is significantly lower than that reported in their original paper using the same publicly available benchmark dataset. As result, a thorough examination of the defense methods required.
Limitations and Future Work. There are some limitations to our work, and future work will try to solve them. For instance, we could not evaluate all of the recent anomaly and intrusion detectors in our work due to the following reasons: (i) The most important reason is that the codes are not publicly available in many cases or the code outdated, making it hard to compare ( (we discuss this in detail in reproducibility section). (ii) It is hard to reproduce the same results demonstrated by the paper, mainly when the codes are not from the original authors but developed by the community. Therefore, future work should look for more methods. Moreover, we have only applied FGSM, PGD, and SLID (see Appendix) attacks on the detectors. We do provide results from other attacks such Carlini- Carlini-Wagner L2 and MIM on the UCR dataset in Appendix. Another future work will be to transfer these and new adversarial attacks to anomaly and intrusion detectors. Finally, developing robust detectors should be considered in future studies.
CONCLUSION
The concept of adversarial attacks on deep learning models for time series anomaly and intrusion detection was introduced in this paper. We defined and adapted adversarial attacks initially proposed for image recognition to time series data. On several benchmark datasets, we demonstrated how ad- versarial perturbations could reduce the accuracy of state-of-the-art anomaly and intrusion detectors. As data scientists and developers increasingly implement deep neural network- solutions for time series related real-world critical decision-making systems (e.g., in aerospace and automobile industries), we shed light on several critical use cases where adversarial attacks could have severe and dangerous repercussions.

---

Under review as a conference paper at ICLR 2022
8 ETHICS STATEMENT
Our study, in our opinion, raises only one significant ethical issue (i.e., presenting the vulnerabilities of deployed system). Now, we will describe how deal with it. To begin, we downloaded the CLMPPCA code from GitHub. Second, we contacted the authors of the CLMPPCA paper and requested the dataset. Following KARI's security clearance. We were able obtaín access the dataset and some code associated with the driver, which was kept private on purpose. We contacted the authors and informed them of our findings after identifying the vulnerabilities in CLMPPCA. The authors replicated our findings on the deployed system using the same attacks. For the time being, the system offline, and the authors of the CIMPPCA paper and other KARI developers are investigating possible defense methods. We believe that adhering to this entire procedure resolves any ethical concerns regarding this matter.
REPRODUCIBILITY
Reproducibility Issues in Baselines. According to our research, the majority of recent anomaly detection methods do not make their source code publicly available. Additionally, many methods whose source code was made publicly available by their authors (or implemented unofficially) were outdated. As result, we were unable to run them directly on the most recent machines. For instance, in our experiment, we used an Nvidia RTX 3090 GPU. We discovered that, due to some issues with the CUDA version, could not run older version of TensorFlow optimally. As result, the code either takes an eternity to execute or does not execute at all.
Our Solution. We chose to port the baselines the latest versions of TensorFlow and PyTorch, respectively, which were 2.5.0 for TensorFlow and 1.9.0 for PyTorch at the time of our experiments. We used the CleverHans Library's (Papernot et al.] 2018) FGSM, PGD, BIM, Carlini-Wagner L2, SLID, and MIM attacks, which were recently ported to TensorFlow2 and PyTorcc in version 4.0.0. As a result, our workflows are compatible with the latest libraries. Additionally. after cleaning the code, we will include some tutorial attacks (similar to those included in the CleverHans library for image datasets) that can used to assess the vulnerability of future detectors to adversarial attacks.
Guidelines for Baseline: Note that it is difficult to port or implement all of the most recent methods on our own. Therefore, we tried our best with the limited resources that we had make the baselines compatible with the latest version of libraries. We will provide some guidelines for creating new baselines and evaluating them against adversarial attacks on our GitHub page. We will leave it up to the community to add additional methods in the future.
We are currently cleaning up the code, and an initial draft of our repository is available the following link: https: aanoyyoos 4open science/ E/ICLR298 We will continue to update it. We request and welcome the reviewer to visit the repository and offer constructive feedback on improving it.
Reproducibility Evaluation Code:
Links to Baselines and Datasets. We will include the updated codes for each baseline in our repository well. We obtained the code of the baselines from the following repositories:
MSCRED: http:///thttttt/a//////////////a
MTAD-GAT: http::///hhuaaccco///////aaaaaaa
CLMPPCA: / http://ss/gtttaaoooooo//aaaataaa
CANAADDF C.N.ap/...tass//ggaaa..ooooaaaar
CANTrransfer:
Note that we are unable to share the KARI dataset as is proprietary and requires security clearance
to access. The link to rest of the dataset used in evaluation are follows:
10

---

Under review as a conference paper at ICLR 2022
REFERENCES
Anthony Bagnall, Jason Lines, Aaron Bostrom, James Large, and Eamonn Keogh. The great time se- ries classification bake off: a review and experimental evaluation of recent algorithmic advances. Data mining and knowledge discovery, 31(3):606-66) 2017.
Anthony Bagnall, Hoang Anh Dau, Jason Lines, Michael Flynn, James Large, Aaron Bostrom, Paul Southam, and Eamonn Keogh. The uea multivariate time series classification archive, 2018. arXiv preprint 181 00075, 2018.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium security and privacy (sp). pp. 39-57. IEEE, 2017.
Hoang Anh Dau, Anthony Bagnall, Kaveh Kamgar, Chin-Chia Michael Yeh, Yan Zhu, Shaghayegh Gharghabi, Chotirat Ann Ratanamahatana, and Eamonn Keogh. The ucr time series archive. IEEE/CAA Journal of Automatica Sinica, 6(6):1293-D) 1305, 2019.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018.
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1625-1634, 2018
Hassan Ismail Fawaz, Germain Forestier, Jonathan Weber, Lhassane Idoumghar, and Pierre-Alain Muller. Adversarial attacks on deep neural networks for time series classification. In 2019 Inter- national Joint Conference on Neural Networks (IJCNN), pp. 1-8. IEEE, 2019.
Sunanda Gamage and Jagath Samarabandu. Deep learning methods in network intrusion detection: A survey and an objective comparison. Journal of Network and Computer Applications, 169: 102767, 2020.
Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio. Deep learning, volume 1. MIT Press, 2016.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Adam Goodge, Bryan Hooi, See-Kiong Ng, and Wee Siong Ng. Robustness of autoencoders for anomaly detection under adversarial impact. In ISCAI, pp. 1254-1250, 2020.
Samuel Harford, Fazle Karim, and Houshang Darabi. Adversarial attacks on multivariate time series. arXiv preprint 20Xxh:2004.00410 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp- 770-778, 2016.
Kyle Hundman, Valentino Constantinou, Christopher Laporte, Ian Colwell, and Tom Soderstrom. Detecting spacecraft anomalics using Istms and nonparametric dynamic thresholding. In Pro- ceedings of the 24th ACM SIGKDD international conference knowledge discovery & data mining, pp. 387-395, 2018
Daniel Kang, Yi Sun, Dan Hendrycks, Tom Brown, and Jacob Steinhardt. Testing robustness against unforeseen adversaries. arXiv preprint 1rXiv:/908.0. 08016, 2019.
Fazle Karim, Somshubra Majumdar, and Houshang Darabi. Adversarial attacks on time series. IEEE transactions on pattern analysis and machine intelligence, 2020.
Ansam Khraisat, Iqbal Gondal, Peter Vamplew, and Joarder Kamnuzzaman. Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity, 2(1):1-22, 2019.
11

---

Under review as a conference paper at ICLR 2022
Akshi Kumar, Sukriti Verma, and Himanshu Mangla. A survey of deep learning techniques in speech recognition. In 2018 International Conference on Advances in Computing. Communication Con- trol and Networking (ICACCCN), pp. 179-185. IEEE, 2018.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning scale. arXiv preprint arXiv:661..02253 2016a.
Alexey Kurakin, lan Goodfellow, Samy Bengio, et al. Adversarial examples in the physical world, 2016b.
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature, 521(7553))3664444 2015.
Hyunsung Lee, Scong Hoon Jeong, and Huy Kang Kim. Otids: A novel intrusion detection system for in-velicle network by using remote frame. In 2017 15th Annual Conference on Privacy, Security and Trust (PST), pp- 57-5709. IEEE, 2017.
Dan Li, Dacheng Chen, Baihong Jin, Lei Shi, Jonathan Goh, and See-Kiong Ng. Mad-gan: Multi- variate anomaly detection for time series data with generative adversarial networks. Interna- tional Conference on Artificial Neural Networks, pp. 703-716. Springer, 2019.
Geert Litjens.
Thijs Kooi, Babak Ehteshami Bejnordi, Arnaud Arindra Adiyoso Setio, Francesco Ciompi, Mohsen Ghafoorian, Jeroen Awm Van Der Laak, Bram Van Ginneken, and Clara I Sánchez. A survey on deep learning in medical image analysis. Medical image analysis, 42: 60-88, 2017.
Tengfei Ma, Cao Xiao, and Fei Wang. Hcalth-atm: A deep architecture for multifaceted patient health record representation and risk prediction. Proceedings of the 2018 SIAM International Conference on Data Mining, pp. 261-269 SIAM, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:/706.000 2017.
Izaskun Oregi, Javier Del Ser, Aritz Perez, and Jose Lozano. Adversarial sample crafting for time series classification with elastic similarity measures. In International Symposium Intelligent and Distributed Computing, pp. 26-39. Springer, 2018
Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: A review. ACM Computing Surveys (CSUR), 54(2):1-38, 2021.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp. 506-519, 2017.
Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Ku- rakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, Alexander Matyasko, Vahid Behzadan, Karen Hambardzumyan, Zhishuai Zhang, Yi-Lin Juang, Zhi Li, Ryan Sheatsley, Abhibhay Garg, Jonathan Uesato, Willi Gierke, Yinpeng Dong, David Berthelot, Paul Hendricks, Jonas Rauber, and Rujun Long. Technical report on the cleverhans v2.1.0 adversarial examples library. arXiv preprint arXiv: /tt.:::/11.000660 00768, 2018
Skyler Seto, Wenyu Zhang, and Yichen Zhou, Multivariate time series classification using dynamic time warping template selection for human activity recognition. In 2015 IEEE Symposium Series on Computational Intelligence, pp. 1399-1406. IEEF, 2015.
Lifeng Shen, Zhuocong Li, and James Kwok. Timeseries anomaly detection using temporal hierar- chical one-class network. Advances Neural Information Processing Systems, 13:13016-33026 2020.
Shoaib Ahmed Siddiqui, Dominique Mercier, Mohsin Munir, Andreas Dengel, and Sheraz Ahmed. Tsviz: Demystification deep learning models for time-series analysis. IEEE Access, 7:67027- 67040, 2019.
12

---

Under review as a conference paper at ICLR 2022
Ya Su, Youjian Zhao, Chenhao Niu, Rong Liu, Wei Sun, and Dan Pei. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 2828- 2837, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Shahroz Tariq, Sangyup Lee, Youjin Shin, Myeong Shin Lee, Okchul Jung, Daewon Chung, and Simon S Woo. Detecting anomalies in space using multivariate convolutional Istm with mixtures of probabilistic pea. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 1112-22132 2019.
Shahroz Tariq, Sangyup Lee, Huy Kang Kim, and Simon S Woo. Can-adf: The controller area network attack detection framework. Computers & Securrity 94:101857, 2020a.
Shahroz Tariq, Sangyup Lee, and Simon S Woo. Cantransfer: transfer learning based intrusion detection on controller area network using convolutional Istm network. In Proceedings of the 35th Annual ACM Symposium on Applied Computing, pp. (048-1055, 2020b.
Florian Tramer and Dan Boneh. Adversarial training and robustness for multiple perturbations.
arXiv preprint arXiv: 3300, 2019.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin
(eds.), Advances in Neural Information Processing Systems, volume 33, pp. 1633-1645, Cur- ran Associates, Inc., 2020. URL U mww.riininnnnnnnnnn.n.e.o.....re www.nnuur.i..o. ottpa///eeeeaa...errrrro../////a
pdf
Jinjiang Wang, Yulin Ma, Laibin Zhang, Robert X Gao, and Dazhong Wu. Deep learning for smart manufacturing: Methods and applications. Journal of manufacturing systems, 48:144-156, 2018.
Zhiguang Wang, Weizhong Yan, and Tim Oates. Time series classification from scratch with deep neural networks: A strong baseline. In 2017 International joint conference on neural networks (ICCN), pp. 1578-1585. IEEE, 2017.
Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems, 30(9):2805-25) 2019.
Chuxu Zhang, Dongjin Song, Yuncong Chen, Xinyang Feng, Cristian Lumezanu, Wei Cheng, Jingchao Ni, Bo Zong Haifeng Chen, and Nitesh V Chawla. A deep neural network for un- supervised anomaly detection and diagnosis in multivariate time series data. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pp. 1409-1416, 2019.
Hang Zhao, Yujing Wang, Juanyong Duan, Congrui Huang, Defu Cao, Yunhai Tong, Bixiong Xu, Jing Bai, Jie Tong, and Qi Zhang. Multivariate time-series anomaly detection via graph attention network. In 2020 IEEE International Conference on Data Mining (ICDM), pp. 841-850, IEEE, 2020.
Zibin Zheng, Yatao Yang, Xiangdong Niu, Hong-Ning Dai, and Yuren Zhou. Wide and deep convo- lutional neural networks for electricity-thef detection to secure smart grids. IEEE Transactions on Industrial Informatics, 1644:1666-1615 2017.
Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Daeki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In Inter- national conference on learning representations, 2018
13

---

Under review as a conference paper at ICLR 2022
A DETAILS ON L FGSM AND PGD ATTACKS
In Figure we detail MSCRED's performance against normmaz-norm FGSM and PGD attacks. Under normal conditions, we can see that the model correctly predicted three large anomalies but missed two minor ones. As a result, an Fi score of 0.890 is obtained. However, when attacked with either FGSM or PGD, the MSCRED model produces no meaningful results because predicts everything as an anomaly. Furthermore, the patterns of anomaly score under FGSM and PGD attack are very similar those observed during non-anone anomalous (or normal) periods. As result, adjusting the threshold to account for changes in the anomaly score will not be as effective.
MSCRED
200
Anomaly Score
150
No Attack
PGD Loo
Threshold
Anomaly
100
FGSM Loc
50
200
400
600
800
1000
Test Time
Figure 4: Anomaly score comparison of MSCRED under No Attack and, = based FGSM and PGD attacks.
B SLID AND FGSM L ATTACK
In Figure 5 we present the results from two L attacks: (i) FGSM L and (ii) Sparse L Descent (SLID) attacks. As discussed previously in the main paper. optimizing L and L2-based attacks can be challenging.
can see an excellent illustration of this with the FGSM L attack, where adver- sarial examples from the L baasd FGSM attack produce nearly identical results to the No Attack data samples (with few minor differences). However, the SLID attack, also an bbased attack, performs similar the - attack discussed previously. Although the range of anomaly scores produced by SLID attacks is slightly less than that produced by S attacks, it is still significantly higher than the threshold making the MSCRED model predict the whole input time series as an anomaly.
14

---

Under review as a conference paper at ICLR 2022
MSCRED
No Attack
SLID Anomaly
Threshold
175
FGSM
150
Anomaly Score
125
100
50
200
400
600
800
1000
Test Time
Figure 5: Anomaly score comparison of MSCRED under No Attack and, L -norm based FGSM and SL1D attacks.
C L FGSM AND PGD ATTACK
The results the based FGSM and PGD attacks are shown in Figure Almost identical to the L ---based FGSM attack, the L2-based FGSM attack produces adversarial samples that have effect on the anomaly score and are thus deemed ineffective. Similar results are obtained using the L based PGD attack. As illustrated in Figure the Anomaly scores for No Attack, FGSM L and PGD L all overlap significantly.
MSCRED
No Attack
PGD L2
Threshold
Anomaly
FGSM
40
Anomaly Score
10
1000
Test Time
Figure 6: Anomaly score comparison of MSCRED under No Attack and, I 7.2-norm based FGSM and PGD attacks.
15

---

Under review as a conference paper at ICLR 2022
D DETAILED VIEW OF MTAD-GAT RESULTS ON MSL DATASET
In this section, we discuss the MTAD-GAT results on the MSI. dataset in greater detail. Figure 7-p show No Attack, FGSM attack, and PGD attack results the entire test data, respectively. We see that MTAD-GAT predicts fewer anomalies under FGSM and PGD attacks than normal condi- tions (i.e., No Attack), resulting in a higher rate of false negatives. We have now discussed both of these scenarios in detail in this work: (i) adversarial attack to generate false positives and (ii) adversarial attack generate false negatives. Additionally, consistent with our previous findings, PGD performs better than FGSM and generates more false negatives than FGSM.
1.5
Error
Threshold
0.5
10k
20k
30k
40k
50k
Figure 7: MTAD-GAT's anomaly score on normal data (i.e., No Attack).
1.5
Frror
Threshold
0.5
0
10k
20k
30k
40k
50k
Figure 8: MTAD-GAT's anomaly score under FGSM attack.
1.5
Error
Threshold
0.5
10k
20k
30k
40k
Figure 9: MTAD-GAT's anomaly score under PGD attack.
16

---

Under review as a conference paper at ICLR 2022
E RESULTS ON SMD DATASET FOR MTAD-GAT
We present additional details on the MTAD-GAT results using the Server Machine Dataset (SMD) in Figure 10 Ila and [lb. In the figures, the top row (in red) represents the Anomaly scores, the middle row (in brown) represents the MTAD-GAT predictions, and the bottom row (in blue) represents the ground truth. We can that MTAD-GAT performs normal conditions. However, when subjected to FGSM and PGD attacks, it generates a large number of false positives, resulting in significant decrease in overall performance. Additionally, we can observe that when PGD is used, MTAD-GAT produces more false positives than when FGSM is used.
state-of-the-art level under
I000
1500
2000
Anomaly Scores
Threshold
Predicted Anomalics
Ground Truth
Figure 10: The anomaly score and predicted anomalies for MTAD-GAT on SMD dataset under normal conditions (No Attack).
Sarre
Tancboli
GeeadTie
aa) FGSM
PGD
Figure 1I: The anomaly score and predicted anomalies for MTAD-GAT on SMD dataset under FGSM and PGD Attack.
17

---

Under review as a conference paper at ICLR 2022
F EFFECTS OF FGSM AND PGD ATTACKS ON MTAD-GAT's FEATURES
As previously stated, MTAD-GAT composed of two components (i.e., forecasting and recon- struction). We demonstrate in Figure [2 [4 that both components become equally effective when subjected to adversarial attacks. For example, in normal circumstances (as illustrated in Figure [1). the forecast and reconstruction are quite close to the Yi (ground truth). However, when attacked by FGSM, they deviate from the ground truth. fooling the system into believing it is an anomaly. Ad- ditionally, forecast and reconstruction are more chaotic during PGD attack. As a result, detection performance is even lower than that of FGSM attack.
(Ground Truth)
0.4
Reconstructon
0.3
0.2
0.1
0-
500
1000
1500
2000
Figure 12: Comparison of Forecast and Reconstruction with yr during No Attack.
y (Ground Truth)
0.6
Recenstruction
0.2
500
1000
1500
2000
Figure 13: Comparison of Forecast and Reconstruction with ys during FGSM Attack.
(Ground Truth)
0.4
Reconstruction
Hapny
0.2
500
1000
1500
2000
Figure 14: Comparison of Forecast and Reconstruction with y during PGD Attack.
18

---

Under review as a conference paper at ICLR 2022
G ORIGINAL VS. PERTURBED SAMPLES
We compare some samples of original and perturhed time series in this section. The ground truth (in black), the FGSM (in yellow), and the PGD are depicted in Figure [5] (in dotted blue line). We can easily see that all three of the time series overlap, rendering them largely indistinguishable to the naked eye. Additionally, Figure 16a [6c an expanded version of the time series depicted in Figure Each of the three time senes (i.e., No Attack, FGSM, and PGD) appears identical. Here, we demonstrate that even simpler adversarial attacks such as FGSM and PGD can be highly effective on time series data. Such perturbations will go unnoticed by human observer.
1.0
0.8
0.6
0.4
0.2
0.0
Ground Truth
FGSM
-0.2
PGD
0
500
Figure 15: Comparing No Attack (Ground Truth), FGSM and PGD attack on time series from the KARI Subsystem 2 (SS2). There is no significant difference between the three time series therefore they seem perfectly overlap.
146
035
Tnottwett 'rem hnd Totterttn 'umm Yty) 'nery Yee 110mrmmm /neny
Yem
Inmteettm Yrrm Yew
Potemmte Trmm Tmm)
Yeee Penteettet
(a) FGSM
1.0
011
Inottem foe/ Inmtertt fmm Yml Trwny Yey Titeerme "rrnn Motemttte Phttertt from
0.39
mytttrttin ferm
7ow Mnleyine Timte mm
May Woteyrtt
(b) PGD
1.0
0.5
Peothnit /rom monmertt Ymmm (md 'eery Me titeertee Tromy teemytte Phttertt Trym
0.5
0.5
mittertt frow Pmm Mrmmytte Tmri Peyy Yetmyyttte
1300
280
(c) PGD
Figure 16: more detailed view of the same time series in Figure However, for comparison purposes, the time series generated by No Attack (a), FGSM (b), and PGD (c) are shown separately.
19

---

Under review as a conference paper at ICLR 2022
H UCR DATASET RESULTS
In addition to all the experiment on state-of-the-ard anomaly and intrusion detection system. We also cover general time series classification task where we attack multilayer perception (MLP), fully convolutional network and ResNet trained on different dataset from the UCR repository. We conduct an analysis of 71 datasets from the University of California, Riverside (UCR) repository. future work, we will expand on this experiment by including additional neural networks (MobileNet, Effi- cientNet, DenseNet, and Inception Time) and datasets (the remainder of the UCR dataset, datasets from the UEA repository).
We find that the Carlini- Carlini-Wagner I attack provides the best adversarial examples, resulting in the most significant performance degradation. In Figure [7] we show some original samples and the corresponding perturbed samples generated by FGSM, PGD, BIM, Carlini-Wagner L², and MIM attacks on UCR datasets. Additionally, we present the ResNet classification results in Figure 17
Finally, in Table 6
g
we present the classification results for MLP, FCN, and ResNet.
BIM- 3.7%
FEDE
1.8
Waggert 16.54
SIDI 9.3%
No Attacc 82.1%
0.8
-05
FGSM 200%
-1.
-16
-1.
-15
-28
Atai: 90.05
100
12.5
100
200
walaz
vallz
(a) Adiac dataset
(b) Car dataset
FERM
PCD 5.5
BIM 35%
MIME 4.1%
No Atadk 16.1%
FOSM
-45
0.8
-1.8
20
vallz
(c) Coffee dataset
(d) Diatom Size Reduction dataset
FEAS:: 12.0%
FOBM 53.3%
PNID: 13.9%
RIM 13.9%
OuinaWaano12: 13.5%
1335
Ataci
28
-16
-13
360
400
valuz
valae
(e) Fish dataset
(f) Meat dataset
Figure 17: Comparison of original vs. perturbed samples from different datasets inside UCR repos- itory. Moreover, the classification results of ResNet under normal and five different attack scenarios is also provided.
20

---

Under review as a conference paper at ICLR 2022
Table 6: Multilayer perceptron (MLP) classification result on UCR repository under five adversarial attacks.
MLP
Carlini Wagner
No
Datasets
FGSM
PGD
BIM
MIM
Attack
I,²
50words
44
42+1.3
42+1.3
35+1
43+1
63+1.1
Adiac
14
15+1.6
15+1.6
16#1.3
16+1.8
53+2.7
ArrowHead
29+3.9
2743.3
2743.3
24+4.3
2743.1
7442.6
Beef
3245.1
2643.9
26+3.9
2943.9
2743.4
78+3.9
BeetleFly
7447.7
7447.7
7447.7
70+5
7447.7
75+
BirdChicken
6245.8
6245.8
62+5.8
57+10.5
6245.8
6942.9
Car
49*1
3542.9
3542.9
52+1
45+1
83+1
CBF
7642.6
7642.4
7642.4
63+3.5
76+2.6
9442.6
Chlorine
2440.3
2440.5
2440.5
2420.7
2420.4
65+0.4
Concentration
Coffee
9+2.1
9+2.1
9+2.1
9+4.2
9+2.1
100+0
Computers
46+1.1
45+1.1
45+1.1
45+1.1
45+1.1
58+0.9
Cricket_ X
2640.7
2540.7
25+0.7
21+1
2640.9
45+1
Cricket. Y
3040.8
29+1.7
29+1.7
2420.6
29+1.7
48+1.6
Cricket Z
3240.7
30+1.1
30+1.1
25+1
3140.2
44+1.2
DiatomSize
40+1.2
3741.4
37+1.4
31+4
38+1.5
95+2.4
Reduction
DistalPhalanx
16+0.9
16+1
16+1
16+1
16+0.9
83*0.8
Auerooe
DistalPhalanx
2941.4
28+1.8
28+1.8
25+0.9
29+1.7
7740.9
OutlineCorrect
Distal
1340.8
12+1.1
12+1.1
12+0.9
12+1.2
78+0.7
PhalanxTW
Earthquakes
69+1.5
69+1.5
69+1.5
52+4.2
69+1.5
73+1.1
ECG200
60+1.8
60+2.1
60+2.1
2945.8
60+2.1
84+0.6
ECG5000
6540.2
6440.3
6440.3
61+0.3
6440.4
93+0.2
ECGFiveDays
48+2.3
4642.1
4642.1
35+4.8
4742.1
95+3.3
DlecceicDDevices
2240).4
21:0.5
21+0.5
21+0.6
21:0.6
55+0.8
FaceAll
5740.3
5640.4
5640.4
3940.9
5640.2
7440.6
FaceFourr
7942.4
77+2
7742
76+1.8
79+1.4
88+0.7
FacesUCR
6741.7
63+1.6
63+1.6
55+1.6
65+1.8
83+1.2
FISH
16+2.1
8+1.2
8+1.2
14+1.9
12+1.2
85+0.4
Gui_Point
4846.1
4746.2
4746.2
3425.4
4746.2
92+1.4
Ham
34+2.4
34+2.6
34+2.6
48+3.5
3442.6
70+2
Haptics
2140.9
2140.8
2140.8
21+1.2
2040.7
4140.7
Herring
50+1.9
50+1.9
50+1.9
50+1.9
50+1.9
51+1.9
InlineSkate
21+1.1
1940.8
1940.8
20+1.4
20+1.4
3440.7
InsectWing
3740.7
3040.3
30+0.3
42+0.3
3440.4
62+0.7
beatSound
ItalyPower
8240.8
8240.9
8240.9
11#1.4
8240.9
96+0.2
Demand
LargeKitchen
3342.2
32+1.3
32+1.3
3420.6
33+2.1
51+0.5
Appliances
Lighting2
7042.6
7042.6
70+2.6
58+3.8
7042.6
65+3.5
Lighting7
5344.2
5343.7
5343.7
3543.7
5343.7
6442,4
Meat
26+1
26+1
26+1
25+1.7
26+1
74+
Medicallmages
39+1.9
36+2.2
36+2.2
26+0.5
37+2.2
67+00.5
MiddlePhalanx
32+10.7
26444.8
26+4.88
2020.8
2745.7
73+1.5
Outline
21

---

Under review as a conference paper at ICLR 2022
MiddlcPhalanx
46+1.5
4641.6
46+1.6
45+1.5
4641.6
564 1.5
OutlineCorrect
Middle
18+2.9
1842.8
18+2.8
18*1.7
18+2.9
5612.4
PhalanxTW
MoteStrain
79+0.7
7940.7
7940.7
53+2.3
7940.7
84+1.1
OliveOil
28+2
28+2
28+2
28+2
28+2
5942
OSULeaf
2940.7
29+1.1
29+1.1
2940.9
30+0.7
45+0.3
Phalanges
33+3.2
33+2.6
33+2.6
33+2.3
33+2.7
68+2,4
OutlinesCorrect
Plane
8942
8741.1
8741.1
85+4.3
88+1.1
98 1.111
ProximalPhalanx
18+2
1842.3
18+2.3
18+1.8
1842.3
81
AutineAgeGrrop
ProximalPhalanx
36+1.4
3441.1
34+1.1
33+1.6
3440.9
68 1.6
OutlineCorrect
Proximal
41+3.9
42+4
42+4
42+4
42+3.9
53+4.1
PhalanxTWV
Refrigeration
36
3641.6
36+1.6
36+1.3
36+1.9
43+1.2
Devices
ScreenType
19+1.4 .4
3841.8
38+1.8 .8
38+1
3911.6
3620.3
ShapeletSim
50+1.7
50+1.4
50+1.4
49+1.7
50+1.4
48+0.9 9
ShapesAll
19+1.6
42+1.1
42+1.1
1.+
46+1.8
70+0,2
SmallKitchen
33+1.4
34+1
34+1
36+1.6
34+1.1
49+2.2
Appliances
SonyAIBO
68+2.6
68+2.6
68+2.6
62+7.3
68+2.6
68+4.6
RobotSurface
SonyAIBO
81#0.8
81+0.8
81#0.8
71
81#0.8
83*0.8
RobotSurfacelI
Strawberry
7+0.3
640.3
6+0.3
9+0.7
7+0.2
9640.3
SwedishLeeff
32+1.2
2642.1
26+2.1
25+0.8
29+1.4
82+0.3
Symbols
16+
7441.2
74+1.2
76+1.4
75+1
8940.2
synthetic control
80+1.6
80+1.7
80+1.7
3743.6
80+1.6
95+1
ToeSegmentation
51+1.5
51+1.5
51+1.5
50+1.2
51+1.5
57+0.7
ToeSegmentation2
63+1.8
63+1.8
63+1.8
55+5.5
63+1.8
6713
Trace
2942.7
2942.4
2942.4
29+2.4
2942.9
89+
Twol LedEECG
4542.2
4442.3
4442.3
37+1.8
4542.2
77+0.7
Two Patterns
32+1.8
3111.6
3141.6
12+0.2
31+1.7
9610.4
wafer
3941.5
3941.5
3941.5
21+1.5
3941.5
9640.9
Wine
45+0
45+0
45+0
45+0
45+0
56+0
WordsSynonyms
40+1.2
38+0.5
3840.5
32+1
3941.1
53+0.4
Worms
2840.4
2740.9
2740.9
24+1.5
2840.6
36+1.2
Worms TwoClass
4941.2
49+1
49+1
47+1.4
49+1
60+1
Table 7: Fully Convolutional Network (FCN) classification result on UCR repository under five adversarial attacks.
FCN
Carlini Wagner I
No
Datasets
FGSM
PGD
BIM
MIM
Attack
50words
3+0.5
6+1.4
6+1.4
18+3.6
4+1.3
29+16
Adiac
5+1.8
7+3.8
7+3.8
11#2.1
743.5
24+17.7
ArrowHead
40+0
14#6.2
14+6.2
1426.5
15#6
80+6.6
Beef
16+10.2
2349.7
2349.7
23+12.7
22+7.7
52+9.7
BeetleFly
50+0
2015
20+5
20+5
20:5
8045
BirdChicken
50+0
15+10
15+10
742.9
2242.9
9442.9
Car
22+0
40+27.5
40+27.5
40426.2
40425.1
47423.4
22

---

Under review as a conference paper at ICLR 2022
CBF
83+1.2
7941.6
7941.6
1+0.1
81+1.3
100+0.2
Chlorine
19.1
39+19.8
19*19.8
38+19.1
39+19.8
14+18.5
Concentration
Coffee
0+0
0+0
0+0
040
0+0
100+0
Computers
44+10
1925.7
1945.7
1626.1
28+11
8546.1
Cricket_X _
16+5.7
11+188
11
13+2.3
11#3
72+3.7
Cricket
19+1.9
1643.1
1643.1
1642.9
1643.3
6947.5
Cricket Z
13+1.1
11#3.2
11:3.2
14+3.5
11+2.1
72+5.1
DiatomSize
16+4.9
6+0.9
6:t0.9
7+0.5
7+0.7
93+0.7
Reduction
DistalPhalanx
19+4.7
1944.4
19*4.4
19#4.4
19+4.4
80+4.3
OutincAgeGroup
DistalPhalanx
38+9.6
32#6.1
32+6.1
32+6.2
3346.6
69+6.1
OutineCorrect
Distal
15+1.1
17+1.2
17+1.2
17+1.1
17
73+2.1
PhalanxTW:
Earthquakes
36+4.1
3443.2
3443.2
25+2.5
35+3.3
76+2.5
ECG200
4946.5
16+3.1
16+3.1
11+1.8
24
1.+
ECG5000
6946.9
33424.7
33424.7
4+0.4
51=12.5
9440.4
DCys
3849.5
2+0.2
2+0.2
2+0.3
2+0.3
99+0.3
DeevceicDevices
43+1.3
3242.7
3242.7
14+3.3
35+2.9
70+3.7
FaceAll
6640.7
41+0.4
41+0).4
8+2.7
5740.4
90+2.8
FaceFour
6+2.3
3+1.8
3+1.8
5+1.8
3+1.2
94+0.7
FacesUCR
68+2.4
40+7.9
4047.9
4+0.7
56+4.4
9340.8
FISH
13+0.4
19+11.5
19$11.5
12+11.99
18+11
60+2.9
Gun_Point
51+2.7
2+0.7
2+0.7
1+0.4
4+2.4
100+0.4
Ham
3743.4
3743.5
3743.5
37+3.5
3743.5
64+3.5
Hapties
2343.1
18+4.8
18+4.8
1945
1844.8
2943.44
Herring
60+0
4628.2
4648.2
49+11.9
5445.5
6020
InlineSkate
16+0.5
13+5.2
13+5.2
16+6.7
13+4.5
2247.6
InsecrWingbeat
13+1.8
11+1.3
11#1.3
12+1.5
11+1.4
23+4.4
Sound
ItalyPower
84+1
81+1.7
81+1.7
5+0.5
83+1.5
96+0.3
Demand
LargeKitchen
50+4.9
32+23.7
32+23.7
21+17.5
45+13.9
74+16
Appliances
Lighting2
40+1.7
29+1
29+1
29+1
30+1.7
72+1
Lighting7
3247.6
19+2.9
1942.9
1743.5
23+4.2
7.41.6
Meat
34+0
45+13.7
45+13.7
52+24.9
47+11.7
3440
MedicalImages
23+6.8
14+2
14+2
14+3.1
16+1.2
77+2.8
MiddlePhalanx
1846.6
18+5.9
18+5.9
1725.7
18+6.1
70+6.7
Outine-geGrrop
MiddlePhalanx
44+22.5
43+21.6
43+21.6
45+24.2
43+21.6
58+21.4
OutlineCorrect
MiddlePhalanx
20+10
23+11
23+11
2149
23+10.7
48
MoteStrain
8041
78+1.2
78+1.2
10+0.5
79+1.5
9140.5
OliveOil
18+19.3
16+21.2
16+21.2
18+19.3
18+19.3
56+15.1
OSULeaf
14+0
12+4
12+4
12+4.4
11+4.1
75+
Phalanges
36+2.5
36+2.5
3642.5
36+2.6
36+2.5
65+2.6
OutlinesCorrect
Plane
40+5.8
11+3,9
11+3.9
0+0
25+6.5
100+0
ProximaIPhalanx
32+23.7
2248.8
2248.8
25+10.7
2248.8
64.
Outline Ageroop
ProximalPhalane
32+26.8
31+26.4
31+26.4
31+26.2
31+26.8
70+26.2
OutlineCorrect
23

---

Under review as a conference paper at ICLR 2022
Proximal
18+8.2
14+3.1
1443.1
15+4.7
14+2.9
75+2.9
PhalanxTW
Refrigeration
40+3.5
3640.9
36:00.9
35+1.7
3621
46+
Devices
ScreenType
3343.3
2843.6
28+3.6
27+3.6
2944.3
624:522
ShapeletSim
8+3.7
8+3.1
8#3.1
8+2.8
8+3.1
9342.8
ShapesAll
4+1.4
3+2.9
3+2.9
720.6
3+1.9
19+18
SmallKitchen
53+16.7
37+18.1
37+18.1
39422.6
41+11.1
13+
Appliances
AonyAIBO
84+2.2
8242.7
82+2.7
5+0.3
8342.7
9740.6
RobotSurface
SonyAIBO
86+1.5
84+2.1
84+2.1
3+0.5
85+1.7
98+0.5
RobotSurfacell
Strawberry
44+20.8
3148.8
31+8.8
3148.9
3149.1
70+8,8
SwedishLeaf
28+1.7
10+2.6
10+2.66
6+3.6
13+3.3
93#3.6
Symbols
36+3.2
6+1.6
6+1.6
5+0.6
15+1.9
94+1.3
synthetic control
95+1
95+1.3
95#1.3
3+0.9
95+1.2
98+0.7
ToeSegmentation
41+6.2
11+0.8
11+0.8
3+0.7
18+3
98+0.7
TooeSegmentatio22
43+1.4
26+2.3
2642.3
14+2.8
3640.5
8742.8
Trace
52+18.6
18+8.9
1848.9
1+0.6
43+2.9
100+0.6
TwoLeadECG
743.1
240.4
240.4
1+0.1
3+0.7
100+0.1
Two Patterns
34+7.3
15+0.7
15+0.7
15+0.7
1942.3
8640.7
wafer
8+3.2
3+0.9
3+0.9
1+0.2
3+1.3
100+0.2
Wine
5020
50+0
50=0
5040
50+0
50+0
WordsSynonyms
5+2.2
9+3.3
943.3
12+1.5
6+1.99
30+10.
Worms
17+1.7
21+3.6
21+3.6
21+5.3
2143.4
48+7.3
Twomlss
48+5
39+2.3
3942.3
39+2.5
40+4.2
62+2.3
Table 8: ResNet classification result on UCR repository under five adversarial attacks.
ResNet
Carlini Wagner I,2
No
Datasets
FGSM
PGD
BIM
MIM
Attack
50words
8+2.3
10+1
10+1
13+1.5
9+1.5
6740.7
Adiac
5+0.2
10t1.2
10+1.2
10+0.2
10+0.4
82+0.7
ArrowHead
34+11.5
13+0.9
1340.9
13+1.5
15+1
7942.3
Beef
2448.9
1915.1
1945.1
18+3.9
2243.9
7443.4
BeetleFly
29+5.8
1745,8
1745.8
17+5.8
1745.8
84+5.8
BirdChicken
5445.8
14+2.9
14+2.9
14+2.9
20+5
8742.9
Car
20+1
9+4.5
944.55
8+3.9
10+4.9
89+3.5
CBF
89+1.4
87418
8741.8
1+0.2
88+1.6
100+0.2
Chlorine
14+0.4
14+0.8
14+0.8
13+0.4
1440.7
82+1.1
Concentration
Coffee
(+0
040
Q+=0
0.0
0+0
100+0
Computers
58+5.4
2441.3
24+1.3
20+3.2
4545.1
82+2.6
Cricket_X
3343
1742.5
1742.5
14+2.1
27+1.9
7642.4
Cricket
2340.6
13+0.7
1340.7
13+0.6
1641.7
80
Cricket Z
28+2.9
14+2
14+2
1340.8
2242.4
1.4
DiatomSize
10+4.1
4+1.5
4+1.5
5+2
4+1.4
9.
Reduction
DistalPhalanx
18+2.4
17+1.8
17+1.8
17+2
17+1.8
81
DutlineAgeGroue
DistalPhalanx
29+3.6
23+1
23+1
1.+1.2
25+1.7
80+1
OutlineCorrect
24

---

Under review as a conference paper at ICLR 2022
Distal
1540.3
15+0.8
15+0.8
1440.6
1540.9
7640.7
PhalanxTW
Earthquakes
48+2.9
45+2.7
45+2.7
24
4643.1
80+1.2
ECG200
69+4.4
50+11.6
50+11.6
13+2.1
6344.1
88+2.4
ECG5000
7340.8
61+1.3
61+1.3
5+0.3
6621.3
94#0.3
ECGFiveDays
33+16.2
411.6
4+1.6
3+0.6
6+3.8
98+0.7
DleccricDevvces
41+2.1
31+1.7
31+1.7
15+2.4
3642.2
7024.5
FaceAll
76+0.4
69+1
6941
11+0.5
7440.7
83+1.6
FaceFForr
3045.2
9+2.4
9+2.4
4+2.9
2243.5
95+0.7
FacesUCR
74+1.4
6442.3
64+2.3
3+0.8
70+1.6
95+0.4
FISH
13+0
3+0.9
340.9
3+1.2
320.9
98+1
Gun_Poin
23+5.6
6+2
6+2
1+0.4
10+0.7
100+0
Ham
30+2.9
2942
2942
30+2,4
29
72+2
Hapties
20+0.2
22+3.1
2243.1
2143.7
21+3.8
49+4
Herring
49+11
41+1
41#1
41+1
41+1
60+1
InlineSkate
15+1.3
1942
19+2
1942.9
1941.9
3243.1
InsectWingbeat
22+0.5
23+0.6
23+0.6
23+0.4
24
46 1.1
Sound
ItalyPower
87+1.3
86+0.8
86+0.8
7+0.9
86+1.3
97#0.2
Demand
LargeKitchen
59+2.8
3242.7
32+2.7
8+1.4
47+1.2
90
Appliances
Lighting2
46+0
4242,6
42+2.6
27+1.7
43+1.7
74+1.7
Lighting7
36+3.7
2014.2
20+4.2
19+2.1
2447.7
7444.2
Meat
17+15.5
8+5.44
8+5.4
8+5,4
845.4
93+5.4
Medicallmages
4745
28+3.8
28+3.8
15+2.5
3642,4
78+0.7
MiddlePhalanx
16+1.5
1640.7
16+0.7
15+0.2
1640.8
75+1
Agelroo
MiddlePhalanx
2749.1
2749
27:9
2749.1
27+9
7449.2
OutlineCorrect
Middle
15+2.8
17+0.4
17+0.4
17+0.6
17+0.7
62+0.8
PhalanxTW:
MoteStrain
76+0.9
73+1.1
73+1.1
10+0.8
75+1.1
91
OliveOil
14+0
1745.8
1745.8
18+3.9
1745.8
79+2
OSULeaf
14+1
6+2.2
6+2.2
5+1.9
6+2.2
9442.8
Phalanges
27+3
17+0.9
1740.9
18+0.7
1740.9
84+0.9
OutlinesCorrect
Plane
7346.2
41+6.4
41+6.4
0+0
6345.3
100+0
ProximalPhalanx
16+4.8
15+0.8
15+0.8
16+1.5
15+0.8
8640.6
OutlineAgeGrroug
ProximalPhalanx
16+2.6
11
11+1.6
11
11+1.6
90+
OutlineCorrect
Proximal
8+1.2
13+0.5
13+0.5
14+0.3
1440.4
82+0.5
PhalanxTWW
Refrigeration
35+2.5
3443.1
3443.1
31+2.3
3443.1
5440.6
Devices
ScreenType
35+7
29+2.6
29+2.6
28+3.5
32+4.5
61+3.8
ShapeletSim
1347.9
1248.6
1248.6
10+10.2
1348.1
9749.9
ShapesAll
7+0.7
3+0.3
340.3
5+0.3
440.7
88+0.5
SmallKitchen
4414.5
2845.6
2845.6
29+7.7
3445.2
56+ 16
Appliances
AIBO
80+2.3
7942.9
79+2.9
14+3.2
79+2.5
92+0.9
RobotSurface
SonyAIBO
81+1.1
19+1.6
79+1.6
4+0.8
80+1
98+0.8
RobotSurfacell
Strawberry
24+16
12+17.7
22+17.7
12+17.6
22+17.7
80+
25

---

Under review as a conference paper at ICLR 2022
SwedishLeaf
3440.8
1640.5
16+0.5
4+0.5
2240.9
9610.4
Symbols
3242.1
8+0.5
840.5
5+1.6
1621.5
95+1.7
synthetic.contre
9540.7
9540.4
9540.4
2044
9540.7
100#0.4
ToeSegmentation!
5441.8
3142.5
3142.5
4+0.7
3942
97+0.7
ToeSegmentation2
45+5.2
35:5.9
3545.9
11+2.5
4144.3
90#2.5
Trace
30+2.1
1349.7
1349.7
2+1.6
3748.6
98+0
TwoLeadECG
8+4.8
240.6
240.6
1+0.5
4+1.7
100
Two_ Patters
68+1.9
42+6.2
42+6.2
6+1.1
5643.8
96+/
wafer
17+11.8
7+7.8
747.8
2+0.2
11+10.8
100
Wine
34216
2548.4
2548.4
25+8.4
2548.4
7628.4
WordsSynonyms
15+3.1
14+1
14
1640.4
1441.4
5421.3
Worms
26+2
21+1.5
21+1.5
19+0.9
25+0.4
63+2
Worms TwoClas
5442.7
2942
29#2
2742
32+1.4
75+1.4
26


Reviews:
[{"review_id": "yZlcuzt7tZn", "reviewer": "Reviewer_VZJZ", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths: \n- The problem is relevant\n- Clearly outlined criteria for choosing anomaly detection baselines\n- I strongly appreciate Section 9, in addition to the authors making all their code available\n- Authors avoid base-rate fallacy by using F1, Precision, Recall\n\nWeaknesses:\n- There is no new strong methodology/attack proposed\n- The authors claim to be the first tackling adversarial in intrusion detection, but it is not the case (e.g., [1-3] )\n- The authors only consider feature-space attack, where it could have been more interesting to consider realizable problem-space perturbations [4] which consider modifications of real world objects/traffic within CANs\n\nComments:\n\nThe paper proposes a thorough evaluation of some time series-based anomaly detectors applied on datasets in the CAN domain. While the evaluation is generally well thought, I do have some concerns with the work:\n- **Contribution**. The contribution seem rather limited: at the end of the day, you are just applying a PGD/FGSM datasets to attack time series-based anomaly detection systems that use neural networks. It is not necessarily surprising that they are weak against this scenario. Moreover, you claim to be the first tackling the problem of adversarial attacks within the context of intrusion detection. This may unwittingly be a problem of overclaiming: there has been several works in the past (e.g., [1-3]) which studied the problem of adversarial attacks in the context of network intrusion detection systems, which are a super-set of your considered CAN-based attacks. \n- **Challenges**. There seems to be no new attack proposed or no significant challenge in applying PGD/FGSM attacks to these type of detectors. Hence, related to the prior point, it is unclear how much significant are the findings of this work. \n- **Problem-space**. You seem to be working only in the feature space, whereas it would have been more interesting to explore how modifying real-world CAN traffic properties would impact the effectiveness or complexity of the adversarial attack. In particular, you could have considered a modeling based on the framework proposed by Pierazzi et al [4] about realizable problem-space attacks. \n- **Focus on CAN**. It is partially unclear why the paper narrows the focus on CAN-only datasets. It seems to be a somewhat convenient choice, whereas there would be other DDoS datasets in more general network settings. Unless there is a strong motivation to focus only on CAN, it is partially unclear why the authors restricted themselves to this domain. I am saying this because the proposed attack does not depend on the CAN domain. This may change if you consider problem-space attacks. It is also important that the focus of CAN, if preserved, is clarified since the very beginning. As the abstract/intro of the paper seem to be tackling more general IDS systems. \n\nReferences: \n- [1] Apruzzese, Giovanni, and Michele Colajanni. \"Evading botnet detectors based on flows and random forest with adversarial samples.\" 2018 IEEE 17th International Symposium on Network Computing and Applications (NCA). IEEE, 2018.\n- [2] Apruzzese, Giovanni, Michele Colajanni, and Mirco Marchetti. \"Evaluating the effectiveness of adversarial attacks against botnet detectors.\" 2019 IEEE 18th International Symposium on Network Computing and Applications (NCA). IEEE, 2019.\n- [3] Corona, Igino, Giorgio Giacinto, and Fabio Roli. \"Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues.\" Information Sciences 239 (2013): 201-225.\n- [4] Pierazzi, Fabio, et al. \"Intriguing properties of adversarial ml attacks in the problem space.\" 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020.\n\n\nEDIT:\nSligthly raising my score after rebuttal discussion with authors.", "summary_of_the_paper": "This paper shows adversarial attacks to time series anomaly and IDS systems, specifically focused on CAN (Controlled Area Network) dataset. The authors devise some criteria to select datasets and algorithms, and apply PGD/FGSM based attacks and show the brittleness of the detection systems.", "summary_of_the_review": "I feel the major issue is with the limited contributions and originality of the work, and the unclear focus on CAN-only attacks, when the proposed methodology does not seem to tackle this domain specifically. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "r6oNAsG7FQD", "reviewer": "Reviewer_iy4H", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "(this review comes from a security-focused reviewer) I liked the research direction of the paper which I believe is worthy of investigation. Specifically, the claim that the paper is the first to investigate adversarial attacks against time-series-based ML systems in the context of “anomaly and intrusion detection” is valid. I also appreciated that the attacks were carried out on multiple state-of-the-art systems trained on distinct datasets.\n\nHowever, I am not impressed by the achieved results and, moreover, I believe that the paper falls short to be of adequate “impact” for ICLR. Let me elaborate on the abovementioned weaknesses.\n\nFirst, the **poor treatment of previous work**. It is true that adversarial attacks against time-series-based ML applications are not well-investigated. Yet, within the context of Intrusion Detection, there exist a plethora of works that highlighted the vulnerability of ML-based systems to adversarial attacks. A very recent summary is [A], which reports more than 40 papers within the specific context of Network Intrusion Detection (similar reviews can also be found in [B] and [C], although they also cover Malware and Phishing detectors). Specifically, [D] in 2018 was one of the first papers to expose the weaknesses of ML-based NIDS to imperceptible adversarial perturbations. Hence, the authors’ claim that “While adversarial attacks have been extensively studied in the context of image recognition, they have not been extensively investigated for anomaly and intrusion detection systems.” (start of page 2) is wrong, and should be amended. \n\n**Unimpressive Results**. I acknowledge that the paper is “the first”; however we are now in 2021, and the fact that ML-systems can be broken via adversarial perturbations is an accepted fact. Although in the specific context of time-series analyses such papers are rare, this is simply another setting. In other words: from a purely ML-perspective, there is no difference between a “static” and “temporal” phenomenon: in a “static” problem the dimension of the feature set is smaller as each sample is denoted only by its “current” values; in a “temporal” problem the feature set is larger and more complex as it also takes into account the past history. However, aside from such “dimensionality difference”, the two problems are identical. As such, I am not surprised that a white box attacker can thwart a similar system with a FGSM and PGD attack. To aggravate the issue, the attacker has no bounds on the perturbations: I acknowledge that this is a “realistic” assumption, however the attacker essentially can do whatever they want. In these circumstances, after thousands of paper that showed that ML is susceptible to adversarial attacks, is there any surprise that a “yet another” ML system can be broken?\n\n**Poor Threat Model**. This issue is strongly related to the previous comment, but since the targeted system is specifically devoted to security tasks it is even more relevant. In other words: the attacker knows and can do everything with the target system. I could accept a similar assumption if the target system addressed a task that had little in common with security (e.g., the general computer vision problem). However, when the targeted model is meant to be part of a security system, the situation changes. Specifically, an attacker that has full control of a security system is a violation of the basic security assumptions, as any security system under attacker’s control is compromised and its security is not guaranteed. In a similar circumstance, the attacker could achieve the same (or even worse) results without relying on adversarial examples.\n\n**Inadequate problem definition**. According to the authors, the attacks targeted systems devoted to “anomaly and intrusion detection methods”. However, little is done to explain these problems. Specifically, “anomaly detection” is a very broad term. It is true that the authors attack state-of-the-art systems, yet I would have appreciated a little more context w.r.t. what are the “anomalies” that are meant to be detected. Moreover, the authors’ definition of “intrusion detection” is extremely limited, as the attack seems to be specific to CAN (controller area network) which are systems embedded in vehicles, and thus represent a very niche subfield of intrusion detection. The resulting impression is that the paper simply assumes a (unrealistic and “obvious”) threat model, and then carries out (obviously successful) attacks but without considering any real world constraints or implications. I believe that a similar research method is inadequate in 2021, and even more so for ICLR. For instance, a common issue with current adversarial strategies is that the adversarial samples are crafted without taking into account the “problem space” ([E]). After reading the paper I was not able to figure out if this is also the case for the considered attacks.\n\nEXTERNAL REFERENCES\n\n[A]: \"Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems.\" ACM Digital Threats: Research and Practice (2021).\n\n[B]: \"Adversarial machine learning applied to intrusion and malware scenarios: a systematic review.\" IEEE Access 8 (2020): 35403-35419.\n\n[C]: \"Addressing adversarial attacks against security systems based on machine learning.\" 2019 11th International Conference on Cyber Conflict (CyCon). Vol. 900. IEEE, 2019.\n\n[D]: \"Evading botnet detectors based on flows and random forest with adversarial samples.\" 2018 IEEE 17th International Symposium on Network Computing and Applications (NCA). IEEE, 2018.\n\n[E]: \"Intriguing properties of adversarial ml attacks in the problem space.\" 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020.\n\n", "summary_of_the_paper": "The paper tackles the problem of adversarial attacks against time-series-based ML applications devoted to intrusion detection. The paper is relatively simple: they use existing adversarial ML strategies (white-box attacks) to thwart a similar ML system. The main contribution is the fact that few efforts investigated adversarial attacks against time-series based ML methods, and – specifically – no paper considered “anomaly and intrusion detection” scenarios.\n\nOverall, the presentation of the paper is adequate.\nThe quality of the English text is fair.\nFigures and Tables are appropriate.\nThe topic addressed by the manuscript is relevant and within ICLR’s scope.\nThe references are not appropriate.\nThe contribution is not very significant.\n\nSTRENGTHS:\n+ It is truly the first\n+ Evaluation on multiple datasets\n\n\nWEAKNESSES\n- Poor treatment of previous work\n- Unimpressive results\n- Poor threat model\n- Inadequate problem definition\n", "summary_of_the_review": "The paper has its merit, but the poor and unrealistic threat model undermine the “impact” of the results. It is true that attacks against time-series based ML are rare, but many efforts studied the impact of “traditional” adversarial attacks in intrusion detection. The extremely powerful adversary is able to thwart state-of-the-art ML systems… but such outcome is obvious considered the attacker’s assumptions.\n\nIn the current state, I do not believe the paper passes the bar for ICLR. I believe the paper requires a more realistic threat model that clearly outlines the real capabilities and knowledge of the adversary. In its current state, despite some originality, the paper represents just a “yet another adversarial ML paper”. The complete lack of references to security-focused works is emblematic of the issues affecting this paper. I acknowledge that ICLR is not a security-focused venue, but since the claimed contribution of this paper is its \"novel\" application, then I expect a stronger security background.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "orTa0Uzif-9", "reviewer": "Reviewer_hY71", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\n\nThe paper clearly shows that DNN and GNN based anomaly and intrusion detection methods are sensitive to adversarial attacks. The authors consider all sota methods they can find and demonstrate their findings with thorough experiments. The paper is well written. \n\n\nCons:\n1.\tThis paper is not the first paper to transfer adversarial attacks to anomaly detection models for time series. As noticed by the authors, the paper titled “Robustness of Autoencoders for Anomaly Detection Under Adversarial Impact” published at IJCAI 2020 has studied the impact of IFGSM attacks on autoencoder-based anomaly detection methods. Therefore, it is better not to highlight “first” in the abstract. \n2.\tThe major contribution, that is, the performance of DNN and GNN based anomaly and intrusion detection methods suffers from the adversarial attacks, is not surprising. The potentially more attractive perspective of this research, as mentioned by the authors in Section 6, is to propose more robust algorithms, which is not done here.\n\nMinor Comments:\n1.\tPage 9, CANTransfer Performance: please provide some insights on why CANTransfer is more robust to FGSM attacks. \n2.\tPage 5, Section 4, Datasets, the last sentence: Table 1 summarize -> summarizes\n3.\tPage 5, Section 4, Evaluation Metrics: the prediction, recall, and f1-score -> the precision, recall, and f1-score\n4.\tThe same sentence as above: from thresholding methods -> from the thresholding methods\n5.\tPage 6, Line 3: I synthetic -> (i) synthetic\n", "summary_of_the_paper": "In this paper, the authors apply adversarial attack techniques, such as FGSM and PGD, to “fool” the SOTA DNN and GNN methods for anomaly and intrusion detection in time series. They show that small perturbations to the input time series can lead to significant deterioration in the performance of the SOTA methods. ", "summary_of_the_review": "It is a contribution to show that current SOTA anomaly and intrusion methods are quite sensitive to adversarial attacks through a systematic set of experiments. However, no new algorithms or methods or insights are proposed in this paper, and so I lean to rank the paper as borderline. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper investigates attacks against time series analysis methods such as GNN and DNN for anomaly and intrusion detection. Standard attacks such as FGSM and PGD are extended for the time series domain and evaluated on several datasets including automotive, aerospace and resource utilization datasets. While the authors claim to be the first to investigate such attacks, some related work was not considered in the paper, which was pointed out by reviewers. Also some other weaknesses of the proposed method, e.g., its focus on feature space perturbations were pointed out. Hence, while acknowledging the importance and the novelty of this paper's contributions, the reviewers agree that the paper must be better positioned in the context of the related work in order to be accepted.
Decision: Reject