## 8 Challenges and Future Directions  
Generally, the process of creating an adversarial example entails adding the necessary amount of perturbation to the model's direction. Thus, the defense strategies section has presented many studies that can protect the models against adversaries in the two significant areas of computer vision and IDS by detecting or eliminating the adversaries. Equally important the following questions: Are these solutions effective in addressing our problem? Which of these defenses is the best fit for our problem? Thus, in light of this, this section lists some of the gaps and challenges in this domain.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Year** & **Method** & **Description** & **Result** \\ \hline \multirow{3}{*}{[49]} & \multirow{3}{*}{2017} & \multirow{3}{*}{Adversary Detection Network} & The authors suggested training a binary detector network to distinguish between samples from the original dataset and adversarial instances. & DeepFool adversary-specific detectors performed admirably compared to all other adversarial instances. & The researchers might infer that the APE-GAN has a wide range of applications because it works despite no understanding of the model on which it is based. \\ \hline \multirow{3}{*}{[81]} & \multirow{3}{*}{2017} & \multirow{3}{*}{2017} & \multirow{3}{*}{2017} & \multirow{3}{*}{2017} \\  & & & This method was based on training the model to remove the adversarial perturbation before feeding the processed sample to classification networks. Then, they generated adversarial samples and used the discriminator to discriminate those samples. & The researchers might infer that the APE-GAN has a wide range of applications because it works despite no understanding of the model on which it is based. \\ \hline \multirow{3}{*}{[98]} & \multirow{3}{*}{2017} & \multirow{3}{*}{Dropout} & \multirow{3}{*}{Dropout is a random process that perturbs the model’s architecture [98]. Furthermore, this study focused on the ability to apply CW attacks in this field as well as the ability to detect them. This method takes incomplete or damaged images and eliminates noise from these images. Furthermore, there are two stages for the image before being processed; first, arbitrary pixels are discarded from the picture, and then the picture is rebuilt using ME. In the first place, the researchers investigated the impact of random image alterations on clean pictures to understand better how accuracy deteriorates. They trained a unique classifier to identify distinguishing characteristics in the distributions of softmax outputs of converted clean pictures and predict the class label. \\ \hline \multirow{3}{*}{[87]} & \multirow{3}{*}{2020} & \multirow{3}{*}{Stochastic transformation-based defenses} & This method implemented an attack on NIDS and then suggested adversarial feature reduction (AFR), which decreased the attack’s efficacy by reducing adversarial feature development. & The implemented attack achieved more than a 97\% rate in half cases, and the proposed defense technique (AFR) successfully minimized such attacks. \\ \hline \multirow{3}{*}{[80]} & \multirow{3}{*}{2021} & \multirow{3}{*}{AFR} & This method implemented an attack on NIDS and then suggested adversarial feature reduction (AFR), which decreased the attack’s efficacy by reducing adversarial feature development. & The implemented attack achieved more than a 97\% rate in half cases, and the proposed defense technique (AFR) successfully minimized such attacks. \\ \hline \multirow{3}{*}{[87]} & \multirow{3}{*}{2021} & \multirow{3}{*}{DIPDefend} & This method examined the internal prior of the image and then divided them into two steps: robust feature learning and non-robust feature learning. It reconstructed the image by beginning with a robust feature and then a non-robust feature to make them stronger against adversarial attacks. \\ \hline \hline \end{tabular}
\end{table}
Table 4: Summary of Defense Methods.