## 3 Background
### Common Adversarial Example Algorithms  
There are numerous algorithms to produce adversarial examples. [PERSON] et al. [17] used a box-constrained limited memory L-BFGS. Other methods include FGSM [63] and iterative derivatives, including the basic iterative method (BIM) and projected gradient descent (PGD). JSMA optimises for the minimal number of altered features (\(L_{0}\)). The Deep-fool algorithm [62] optimises for the root-mean-square (Euclidean distance, \(L_{2}\)). [PERSON] and [PERSON] [64] proposed powerful C&W attacks optimizing for the \(L_{0}\), \(L_{2}\), and \(L_{\infty}\) distance metrics. There are many algorithms to choose from. Furthermore, [PERSON] et al. [65] developed a software library for the easy generation of adversarial examples. There are now a number of similar libraries that can be used to generate adversarial examples, as shown in Table 3.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Work** & **Metric** & **Advantages** & **Disadvantages** \\ \hline N/A [59] & F1-Score & Commonly used by researchers. & Biased by the majority class \\  & CLEVER & Attack-agnostic and computationally feasible. & CLEVER is less suited to black-box attacks and where gradient masking occurs [60]. However, extensions to CLEVER help mitigate these scenarios [61]. \\  
Moreover, algorithms such as FGSM that modify all features are unlikely to preserve functionality. Algorithms such as JSMA that modify a small subset of features are not guaranteed to preserve functionality; however, with fewer modified features, the likelihood improves. Checking for and keeping only examples that preserve functionality is possible, although it is a time-consuming and inelegant solution. A potentially better solution could ensure only functionality-preserving adversarial examples are generated. When considering the robustness of machine learning models, we first must consider the threat model. We must consider how much the adversary knows about the classifier, ranging from _no knowledge_ to _perfect knowledge_. Adversaries may have a number of different goals:  
1. Accuracy degradation (where the adversary wants to sabotage the effectiveness of the overall classifier accuracy);
2. Target misclassification (where the adversary wants to misclassify a particular instance as another given class);
3. Untargeted classification (where the adversary wants to misclassify a particular instance to any random class). We now consider the attack surface. In IDS, the attack surface can be considered as an end-to-end pipeline, with varying vulnerabilities and potential for compromise at each stage of the pipeline. In one basic pipeline, as shown in Figure 2, the raw network traffic on network interfaces is collected as packet capture files (PCAPs), which are then processed into network flows. There are different applications that could be used to process PCAPs into network flows. ClCFlowMeter [69] is a network traffic flow generator and analyser that has been used in cyber-security datasets [70,71] and produces bidirectional flows with over 80 statistical network traffic features. The generated flows are unlabelled and so must be labelled manually with the traffic type, typically benign/malicious, although multiclasses could be labelled given sufficient information including attack type, IP source and destination dyad, duration, and start time. Finally, the labelled flows are used to train the model. Repetitive training cycles could enable detection of new attacks; however, the cyclic nature of the training means that an adversary could attack any iteration of training. Furthermore, an adversary could choose to attack any point in the pipeline. The training data used to train the model generally consist of feature-vectors and expected outputs, although some researchers are considering unsupervised learning models. The collection and validation of these data offer an attack surface. Separately, the inference phase also offers an attack surface.