## 5 Results
### Adversarial Example Attacks
#### 5.2.5 Adversarial Examples in Cyber-Security Domains
\begin{table}
\begin{tabular}{p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt} p{28.5 pt}} \hline \hline
**Work** & **Year** & **Domain** & **Generation Method** & **Realistic Constraints** & **Findings** \\ \hline
[53] & 2019 & Malware & Gradient-based & Minimal content additions/modification & Experiments showed that we are able to use that information to find optimal sequences of transformations without rendering the malware sample corrupt. \\ \hline
[94] & 2019 & IDS & GAN & Preserve functionality & The proposed adversarial attack successfully evades the IDS while ensuring preservation of functional behavior and network traffic features. \\ \hline
[108] & 2019 & IDS & Gradient-based & Respects mathematical dependencies and domain constraints. \\ \hline
[109] & 2019 & IDS & Random modification \(\leq\)4 features: flow duration, sent bytes, received bytes, exchanged packets. & Retains internal logic & Feature removal is insufficient defense against functionality-preserving attacks, which may are possible by modifying very few features. \\ \hline
[110] & 2019 & IDS & Legitimate transformations: split, delay, inject & Packets must maintain malicious intent, transformations hold to underlying protocols. \\ \hline
[56] & 2020 & IDS—Flows & Jacobian method (JSMA) & Obeys TCP/IP constraints & Biased distributions with low dimensionality enable constrained adversarial examples. Constrained to five random features, \(-50\%\) adversarial examples succeed. \\ \hline
[95] & 2020 & IDS—packet & Valid packet & Minimal modification/insertion of packets & Experimental results show powerful and effective functionality-preserving attacks. More accurate models are more susceptible to adversarial examples. \\ \hline
[98] & 2021 & Malware & Injected unexecuted benign content & Minimal injected content & Section-injection attack can decrease the detection rate. Their analysis highlights that commercial products can be evaded via transfer attacks. \\ \hline
[101] & 2021 & CPS & Best-effort search & Real-world linear inequality & Best-effort search algorithms effectively generate adversarial examples meeting linear constraints. Their evaluation shows constrained adversarial examples significantly decrease detection accuracy. \\ \hline
[111] & 2021 & IDS & Minimal perturbation of each feature & FGSM & Functionality is not reported, but is less likely to preserve functionality because all features are perturbed. \\ \hline
[112] & 2021 & CPS/ICS & JSMA & Minimal number of perturbed features & Functionality is not reported, but is more likely to preserve functionality because relatively few features are perturbed. \\ \hline
[113] & 2021 & IDS & PSO-based mutation & Original traffic retained and packet order is unchanged & Measured attack effect, malicious behavior and attack efficiency \\ \hline
[114] & 2021 & IDS & GAN & preserving functional features of attack traffic & F1 score drop to zero from around 99\% DIGFuPAS adversarial examples. \\ \hline
[115] & 2021 & IDS & PSO/GA/GAN & Only modifies features where network functionality is retained & In the network traffic data, it is unrealistic to assume an adversary can alter all traffic features—constraints on features that do not break functionality \\ \hline
[116] & 2020 & IDS & GAN/PSO & Original traffic and packet order is retained. & Detection performance and robustness should both be considered in feature extraction systems. \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Functionality-preservation in cybersecurity and intrusion detection. sequences and the outputs of the generative RNN. The generative model aims to minimize the predicted malicious probability. Subsequently, adversarial sequences are presented to six different models. Following adversarial perturbation, the majority of the malware was not detected by any victim RNNs.