# A Holistic Review of Machine Learning Adversarial Attacks in IoT Networks
## 6 Research Works in ML-Based Security Systems of IoT Networks
\begin{tabular}{c} **Adversarial Attack** \\ **Methods** \\ \end{tabular}  } & **Threat Modelity** & **Threat Scenario** & \multicolumn{2}{c}{ \begin{tabular}{c} **Adversarial Defense** \\ **Techniques** \\ \end{tabular}  } \\ \cline{4-14}
[123] & 2019 & IoT & IDS & & FNN, SNN & Bot-IoT & FGSM, PGD, BIM & - & Fusion & - & White-box & - & Feature Normalization \\ \hline
[124] & 2020 & IoT & IDS & SVM & & Gaussian & Gaussian & - & Model Extraction & - & Black-box & \(\times\) \\ \hline
[125] & 2021 & IoT & IDS & SVM & ANNs & Bot-IoT & LFA, FGSM & - & Polositing & - & White-box & \(\times\) \\ \hline
\begin{tabular}{c} \begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline
**Ref.** & **Year** & **Network** & \begin{tabular}{c} **Security** \\ **System(s)** \\ \end{tabular} & \begin{tabular}{c} **Target Model (s)** \\ \end{tabular} & \begin{tabular}{c} **Dataset(s)** \\ **Methods** \\ \end{tabular} & \begin{tabular}{c} **Dataset(s)** \\ **Methods** \\ \end{tabular} & \begin{tabular}{c} **Dataset(s)** \\ **Treat Models(s)** \\ \end{tabular} & \
\begin{tabular}{c} **Treat Scenario** \\ \end{tabular} &
\begin{tabular}{c} **Adversarial Defense** \\ **Techniques** \\ \end{tabular} \\ \hline
[137] & 2021 & IoT & DIS & & \begin{tabular}{c} CVNN \\ \end{tabular} & \begin{tabular}{c} Generated Device \\ Dataset \\ \end{tabular} & \begin{tabular}{c} FGSM, BM \\ FD, MIM \\ \end{tabular} & - & \
\begin{tabular}{c} Polosening \\ \end{tabular} & - &
\begin{tabular}{c} White-box \\ \end{tabular} & \(\times\) \\ \hline
[138] & 2022 & IoT & DIS & GAP & FCN, CNNs & IoT-Trace & CAM, Card-CAM++ & - & Polosening & - & Black-box & \(\times\) \\ \hline
[139] & 2022 & IoT & DIS & \begin{tabular}{c} LSTM-CNN \\ \end{tabular} & \begin{tabular}{c} Low-HBench \\ \end{tabular} & \begin{tabular}{c} FGSM, BM, MM, \\ PGD, JSMA, CAW, \\ Boundary Attack \\ \end{tabular} & - & \begin{tabular}{c} Fvasion \\ - \\ \end{tabular} & - & \
\begin{tabular}{c} White-box \\ - \\ \end{tabular} & - &
\begin{tabular}{c} Adversarial Training \\ Model Distillation \\ \end{tabular} \\ \hline
[140] & 2019 & IoT & MDS & \begin{tabular}{c} CFG-CNN \\ \end{tabular} & \begin{tabular}{c} CFG dataset \\ \end{tabular} & - & \
\begin{tabular}{c} Fvasion \\ \end{tabular} & - &
\begin{tabular}{c} White-box \\ \end{tabular} & \(\times\) \\ \hline
[141] & 2020 & IoT & MDS & \begin{tabular}{c} CNN \\ \end{tabular} & \begin{tabular}{c} Debin, Centagio, \\ Genome \\ \end{tabular} & \begin{tabular}{c} SC-1/A \\ \end{tabular} & - & Polosening & - & \begin{tabular}{c} White-box \\ - \\ \end{tabular} & - & \
\begin{tabular}{c} F-1, \\ \end{tabular} &
\begin{tabular}{c} LSD \\ \end{tabular} \\ \hline
[112] & 2023 & IoT & MDS & \begin{tabular}{c} CNNs \\ \end{tabular} & \begin{tabular}{c} CMlabdroid, Drebin \\ \end{tabular} & \begin{tabular}{c} VGAE-MaGAN \\ \end{tabular} & - & \begin{tabular}{c} Fvasion \\ \end{tabular} & - & \
\begin{tabular}{c} White-box \\ \end{tabular} & - &
\begin{tabular}{c} Adversarial Training \\ by VGAE-MaGAN \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._[PERSON] et al. [128] studied adversarial attack against a novel state-of-the-art Kitsune IDS within the scenario of black-box access in the IoT network. The authors designed a method leveraging model extraction to create a shadow model with the same behaviors as the target black-box model using a limited quantity of training data. Then, the saliency map technique is used to identify the critical features and to reveal the influence of each attribute of the packet on the detection outcomes. Consequently, the authors granularly modified the critical features using iterative FGSM to generate adversarial samples. Using the Kitsune (Mirai) [142] dataset in their experiments, the authors demonstrated that using their novel technique to perturb less than 0.005% of bytes in the data packets secure an average attack success rate of 94.31% which significantly diminishes the ability of the Kitsune IDS to distinguish between legitimate and malicious packets. [PERSON] et al.