# Impacting Robustness in Deep Learning-Based NIDS through Poisoning Attacks
## 1 Introduction  
Cybercriminal activities continue to pose significant threats to personal data, particularly amid an era of heightened technological advancements [1, 2]. Each attacker, driven by the nature of target data, employs a distinct set of skills [3], often targeting valuable information, especially private data encompassing economic, military, and celebrity--related content [4]. These attackers carefully lead their attacks through using different techniques, such as data interruption, interception, modification, and manufacturing, to produce harm in the targets [5, 6, 7]. They orchestrate different cybercriminal activities using their effective ways to provide malicious threats, namely data poisoning [3]. To prevent such attacks, intrusion detection systems (IDSs) have been effectively introduced to play a crucial role in checking the data streams and give alerts to decision-makers once certain criteria are achieved [8; 9; 10]. More specifically, IDSs transfer into Network Intrusion Detection Systems (NIDS) at the network flow stage, which necessitates training data to identify network flow records [11]. Traditional retraining of NIDS is important to improve the flow behavior [12]. Deep Learning (DL) is considered to be one of the best techniques in many domains, such as pattern recognition, spanning language, images, speech, and video content [13; 14; 15; 16]. Its superiority over other techniques stems from its improved computational capabilities, cost-effectiveness of computing equipment, and breakthroughs in Machine Learning (ML) [15]. However, poisoning cyberattacks targeting training datasets have emerged as a prominent concern among machine learning practitioners [12]. These attacks aim to corrupt training data intentionally, leading to poor performance of ML systems [12]. Yet, creating feasible poisoning attacks for cyber activities remains challenging, with limited understanding of mitigation strategies [17]. Motivated by the discrepancy between proposed adversarial settings in NIDS studies and their actual feasibility [18], our research aims to address this gap. Many studies often assume that threat models are without sufficient consideration of their practicality [18; 19; 20]. Moreover, research on poisoning attempts in the cyber realm has been confined to specific applications, such as computer vision, tabular, and text data [21; 22; 23]. However, reliance on outdated datasets like NSL-KDD (35%) [24], fraught with flaws and unreflecting modern networks, underscores the necessity for updated datasets, such as CICIDS2017, CSECICIDS2018, and LITENT2020 [25; 26; 27; 28]. Utilizing these updated datasets allows for accurate conclusions regarding modern technological challenges in networks [27; 28]. Label manipulation attack techniques in training data, though limited in attacking power, present an evident drawback as it is incapable of achieving sophisticated adversarial goals [29; 30]. Current hostile machine learning studies predominantly focus on evasion attacks during inference [31]. Recent surveys highlight poisoning attacks as a primary concern among implementing ML organizations, necessitating a shift towards addressing poisoning attack during the training [32]. This shift emphasizes the need for further research in this critical area. While poisoning assault strategies have been extensively explored within conventional ML techniques, only few studies have been specifically tailored for DL [33; 34]. To address these issues, we introduce a poisoning attack approach aimed at evaluating the performance of DL model. Our experimentation involves inserting varying quantities of harmful samples into the model. These poisoned samples, generated via the DeepFool method as an untargeted attack [35], ensure minimal modifications to repeatedly deceive the model's classification [36]. This methodology strategically avoids large modifications that might drastically deviate samples from benign elements, resulting in diminished performance and rapid detection [37].