# Predicting the Impact of Data Poisoning Attacks in Blockchain-Enabled Supply Chain Networks
## 2 Related Work
DPA-FL employs a two-phase strategy to identify and eliminate the attackers who inject poisoned data into the federated learning process. Using DPA-FL, NIDSs can achieve high detection accuracy and robustness against poisoning attacks. Our research is related to recent studies on data poisoning attacks and their defences for NIDSs. Whereas previous studies by [14; 15] proposed novel defence methods based on poisoned sample detection and training data sanitisation, respectively, for federated learning-based NIDSs and machine learning models in NIDSs. However, our research differs from theirs in several aspects. First, this research focuses on distance-based label flipping attacks, which are more realistic and challenging than random label flipping attacks, as they target the most influential samples for the classifier. Second, this research use several machine learning models, including logistic regression, random forest, SVC, and XGB Classifier, to evaluate the effect of these attacks on different types of classifiers. Third, it uses the KDDCUP'99 dataset, a widely used benchmark for NIDSs, to compare our results with previous studies that have also used this dataset. Targeted label flipping, random label flipping, and random input data poisoning are the three types of data poisoning attacks that are compared practically in a study by [16], emphasising how they affect federated learning environments. A novel data poisoning technique was proposed by inverting the loss function of a benign model. This inverted loss function produces malicious gradients almost in contradiction to the minima throughout each Stochastic Gradient Descent (SGD) phase. Once created, these malicious gradients inject poisoned labels into the dataset. Utilising three distinct datasets--MNIST, Fashion-MNIST, and CIFAR10--the attack was evaluated and contrasted with other known data poisoning techniques. The findings indicated that this novel attack could be 1.6 times more successful than targeted attacks and 3.2 times more effective than random poisoning attacks in some situations, especially when used with federated machine learning. Two more papers that are related to distance-based label flipping [17; 18] propose a white-box, realisable poisoning attack that reduces the original model accuracy from 95% to less than 50% by generating mislabelled samples in the vicinity of a selected subset of training points, which is similar to the idea of distance-based label flipping. It proposes a novel community detection algorithm that uses distance-based label propagation, which can be applied to identify the nodes most vulnerable to label flipping attacks in social networks. Another relevant paper for our research is [18], which proposes a network intrusion detection model based on a two-layer convolution neural network for handling imbalanced datasets, a common challenge in NIDSs. These papers can provide some insights into the design and analysis of data poisoning attacks and their defences for NIDSs. This paper has several research implications for network anomaly detection and data poisoning attacks. First, it provides empirical evidence of the impact of label flipping attacks on network anomaly detection models, a novel and realistic type of data poisoning attack that has not been extensively studied before [19]. Second, it compares the performance and robustness of two neural network models with the same architecture on a non-poisoned and a poisoned dataset, which can serve as a baseline for future studies on this topic; it highlights the resilience of some machine learning models, to some extent, to label flipping, as they can still achieve moderate performance despite the noise in the training data, which could motivate further research on understanding and enhancing the robustness of neural network models to data poisoning attacks. Table 1 below shows the limitations and research gaps of the existing literature on data poisoning attack frameworks.