## 5 Results
### Adversarial Example Attacks
#### 5.2.5 Adversarial Examples in Cyber-Security Domains
[95] noted that it is more challenging to generate DDoS adversarial examples because of their discrete properties. They noted that work in the visual domain cannot be directly applied to adversarial examples for intrusion detection of DDoS. The input to their algorithm is a series of packets. This makes it difficult to optimize the distance between the original and adversarial sample while guaranteeing the validity of each packet. They proposed two black-box methods to generate DDoS adversarial examples against LSTM-based intrusion detection systems: genetic algorithm (GA) and probability weighted packet saliency attack (PWPSA). Each method modifies the original input, either inserting or modifying packets. The GA method evolves a population of DDoS samples and selects adversarial examples from the population. The PWPSA method finds the most important packet in the sequence and replaces it with a different \"best packet\" for this position. Both methods produce adversarial examples that can successfully evade their DDoS intrusion detection model. They reported success rates for their different attacks against different detectors. For example, success results for detector D: GA-Replace 91.37%, GA-Insert 74.5%, PWPSA-Replace 88.9%, and PWPSA-Insert 67.17%. [PERSON] et al. [100] warned that adversarial examples have consequences for system safety because they can cause systems to provide incorrect outputs. They presented a detection method for adversarial examples in CPS. They used a case study of an advanced emergency braking system, where a DNN estimates the distance to an obstacle. Their adversarial example detection method uses a variational auto-encoder to predict a target variable (distance) and compare it with a new input. Any anomalies are considered adversarial. Furthermore, adversarial example detectors for CPS must function efficiently in a real-time monitoring environment and maintain low false alarm rates. They reported that since the \(p\)-values for the adversarial examples are almost 0, the number of false alarms is very small and the detection delay is smaller than 10 frames or 0.5 s.  
CPS include critical national infrastructure, such as power grids, water treatment plants, and transportation. [PERSON] et al. [101] asserted that adversarial examples could exploit vulnerabilities in CPS with terrible consequences; however, such adversarial examples must satisfy real-world constraints (commonly linear inequality constraints). For example, meter readings downstream may never be larger than meter readings upstream. Adversarial examples breaking constraints are noticeably anomalous. Risks to CPS arising from adversarial examples are not yet fully understood. Furthermore, algorithms and models from other domains may not readily apply because of distributed sensors and inherent real-world constraints. However, generated adversarial examples that meet such linear constraints were successfully applied to power grids and water treatment system case studies. The evaluation results show that even with constraints imposed by the physical systems, their approach still effectively generates adversarial examples, significantly decreasing the detection accuracy. For example, they reported the accuracy under adversarial conditions to be as low as 0%.