## 6 Discussion and Conclusions
Functionality-preserving adversarial examples should: only perform legitimate transformations; respect mathematical dependencies, real-world, and domain constraints; minimize the number of perturbed features and restrict modification to non-critical features; and where possible retain the original payload and/or packet order. Defences against adversarial examples must consider that adversaries are likely to adapt by adopting new strategies. Many researchers propose adversarial training to improve robustness. Adversarial training is a simple method aiming to improve robustness; however, it is potentially a cosmetic solution: the problem of adversarial examples cannot be solved only through ever greater numbers of adversarial examples in the training data. Adversarial training, if used, must be bolstered by other defenses. Interesting defence strategies include randomisation: randomising decision boundaries makes evasion more difficult because attackers have less information on the exact position of a decision boundary. They must therefore make too conservative or too risky choices when generating adversarial examples. Game theoretic models could be used to address more complex situations with many adversaries of different types as found in intrusion detection. Equilibrium strategies acceptable to both defender and adversary mean neither has an incentive to change. Therefore, assuming rational opponents, game theory-based approaches allowing a Nash equilibrium could potentially end the evolutionary arms race, although it is difficult to conceive a world where no advantage is possible. Current promising defenses such as dropout exchange a relatively small decrease in accuracy for a significant reduction of successful attacks, even successfully blocking black-box and transferability-based attacks. Hardening techniques force successful attacks to use larger perturbations, which in turn may be more readily recognized as adversarial. In a broader cybersecurity context, risks arising from adversarial examples are not yet fully understood. Furthermore, algorithms and models from other domains may not readily apply because of distributed sensors and inherent real-world constraints. It is uncertain whether current defences are sufficient. Furthermore, adversarial example detectors must function efficiently in a real-time monitoring environment while maintaining low false alarm rates. Many academic researchers use old datasets that do not fairly represent modern network traffic analysis problems due to concept-drift. Problems of labelling data and retraining systems provide an impetus to explore unsupervised and active learning. Unfortunately, adversarial attacks are possible on active learning systems [150]. [PERSON] et al. [82] described an enchanting attack to lure a machine learning system to a target state through crafting a series of adversarial examples. It is conceivable that similar attacks could lure anomaly detection systems towards normalizing and accepting malicious traffic. Adversarial ML is a critical area of research. Researchers must address the robustness of ML models against adversarial examples allowing safer deployment of ML models across cybersecurity domains. Better robustness metrics should be used and developed. We find the traditional benchmark of human perception may be less relevant in functionality preservation. Moreover, traditional gradient descent algorithms may be insufficient to generate functionality-preserving attacks, and adversaries may use other methods such as GANS. Therefore, defences against gradient descent algorithms may likewise be insufficient. Defences must consider reactive adversaries who adapt to defences. Randomisation of decision boundaries can make evasion more difficult. Moreover, research into multiclassifier systems could help thwart evasion attacks, making it harder to evade classification. Dropout is currently a promising defense against adversarial examples, although multiple defenses may be required and a combination of defenses will likely offer better defense capability.