# Impacting Robustness in Deep Learning-Based NIDS through Poisoning Attacks
## 6 Results  
The pursuit of enhancing DL-based NIDS has garnered considerable attention among researchers. Various methodologies have surfaced, encompassing diverse technologies, tools, algorithms, datasets, and benchmarks. Notably, many researchers have adopted DL algorithms in their investigations, each utilizing distinct datasets. The efficacy of our system can be readily gauged through its accuracy, when compared to previous works, which are detailed in Table 5 below. Figure 2: The correlations between features based Pearson method. Figure 3 depicts the accuracy curve of our DL model after training on selected features in the first phase, in which the generated poisoned data are not included. The curve demonstrates a steady increase as epochs progress, indicating the suitability of the chosen features for training the system and the sufficiency of epochs in achieving high accuracy. Additionally, Figure 4 illustrates the model's loss, indicating a consistent decrease with increasing epochs. Figure 4: DL loss curve on clean data. Figure 3: DL accuracy curve on clean data. \begin{table}
\begin{tabular}{l c c c c} \hline
**Authors** & **Year** & **Dataset** & **Technique** & **Acc** \\ \hline [PERSON] [61] & 2018 & NSL-KDD & GRU-RNN & 0.89 \\ \hline [PERSON] [62] & 2019 & NSL-KDD & RNN & 0.89 \\ \hline [PERSON] [15] & 2020 & CICIDS2017 & CNN-LSTM & 0.93 \\ \hline [PERSON] [63] & 2021 & CICIDS2017 & ANN & 0.99 \\ \hline [PERSON], [PERSON] [64] & 2022 & IADA, IADB & BiLSTM-DNN & 0.97 \\ \hline Proposed idea & 2024 & CICIDS2019 & DL-ANN & 0.99 \\ \hline \end{tabular}
\end{table} 
Table 5: Comparison of DL-based NIDS Accuracy with Existing Studies. In the study's second phase, we evaluated the performance of the model after injecting three different ratios, 1%, 5%, and 10%, of constructed poisoned patterns into the training set, where the inserting has been performed randomly to make the attack more realistic (closer to the real-world scenario) and render revealing the attack much harder once a traditional defense technique is employed. The main purpose of leveraging this technique is to appraise the effectiveness of the injected poisoned data to the model performance. Remarkably, even after injecting all three percentages of patterns into the original training set while isolating the test data, the accuracy remained relatively high. Figures 5-7 display the accuracy across these three cases, while Figures 8-10 visualize the corresponding model loss. Figure 8: DL loss curve-case 1. Figure 7: DL accuracy curve-case 3 (10,000 training samples). Figure 9: DL loss curve-case 2. During the first injection of the poisoned data with the ratio of 1% (1000) into the training set, there is no much difference in the result of the Acc when comparing the trained model with and without injecting poisoned data, but the MSE has increased and PPV has decreased. When the 5% ratio dataset is injected, the MSE and PPV have been further impacted, and the Acc has slightly affected. When the poisoned data ratio is increased to 10%, the MSE and PPV have been more affected while still the Acc has barely changed. In general, the effectiveness of the injected poisoned data to the model is summarized in Table 6, in which the impact of the Acc, PPV, FPR and MSE are reported when the ratio of the injected poisoned samples is elevated. This explains the effect of the randomly injected points within the training group, and how the rate of misclassification increases as the injection rate elevates. To provide an additional proof, we injected half of the training set with the generated poisoned data (50%) to further show the effectiveness of the injected poisoned data on the model performance.