# Polymorphic Adversarial Cyberattacks Using WGAN
## 5 Proposed Framework
### Polymorphic Engine to Generate a Polymorphic Attack
Figure 10 depicts the polymorphic adversarial attack synthesized using automated feature selection (40 features) successfully evading the IDS. The red bars indicate the success of the polymorphic attack engine in evading IDS. As expected, each training session (yellow bar) improves the IDS detection rate against the attack. The number of cycles indicates how many times the attack generator is able to evade the IDS until the IDS is fully trained with all of the features or the attack engine runs out of features. Throughout our study, we also observed that using fewer features (e.g., five instead of 10) improves the evasion rates, but offers fewer options for synthesizing more polymorphic attacks. Figure 7: Polymorphic adversarial DDoS/DoS attack using Algorithm 4. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Performance** & **Attack Type** & \multicolumn{2}{c}{**Random Forest IDS**} \\ \hline  & **(Algorithm 3)** & **Attack Cycle** & **Retrain Cycle** \\ \hline  & Adversarial & 9.91\% & 98.40\% \\  & Polymorphic 1 & 46\% & 98.20\% \\ Recall (TPR) & Polymorphic 2 & 56.70\% & 98.30\% \\  & Polymorphic 3 & 90.60\% & 98.40\% \\  & Polymorphic 4 & 100\% & N/A \\ \hline  & Adversarial & 98.60\% & 95.60\% \\  & Polymorphic 1 & 98.60\% & 95.60\% \\ TNR & Polymorphic 2 & 98.60\% & 95.60\% \\  & Polymorphic 3 & 98.60\% & 95.70\% \\  & Polymorphic 4 & 98.60\% & N/A \\ \hline  & Adversarial & 12.30\% & 98.60\% \\  & Polymorphic 1 & 56.80\% & 98.50\% \\ F1\_Score & Polymorphic 2 & 70.00\% & 98.50\% \\  & Polymorphic 3 & 94.30\% & 98.60\% \\  & Polymorphic 4 & 99.30\% & N/A \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance evaluation and comparison for random forest IDS on different adversarial polymorphic attacks using Algorithms 3 and 4 (Approach 1). Figure 8: **(a)** Comparing the IDS evasion success rate for polymorphic adversarial attacks. The figure represents the results using Algorithm 3. **(b)** Comparing the IDS evasion success rate for polymorphic adversarial attacks. The figure represents the results using Algorithm 4. ### Analysis and Discussion

To evaluate the performance of our WGAN-based framework comprehensively, several state-of-the-art machine learning models are employed as black-box IDS. The adopted machine learning models include Random Forest (RF), Decision Tree (DT), Support Vector Machine (SVM), K-Nearest Neighbor (KNN), and Naive Bayes (NB). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Performance** & **Attack Type** & \multicolumn{2}{c}{**Random Forest IDS**} \\ \hline  & **(Algorithm 4)** & **Attack Cycle** & **Retrain Cycle** \\ \hline  & Adversarial & 22.50\% & 98.40\% \\  & Polymorphic 1 & 34.10\% & 69.70\% \\ Recall (TPR) & Polymorphic 2 & 33.20\% & 89.60\% \\  & Polymorphic 3 & 100\% & N/A \\  & Polymorphic 4 & 100\% & N/A \\ \hline  & Adversarial & 98.60\% & 95.50\% \\  & Polymorphic 1 & 98.60\% & 95.70\% \\ TNR & Polymorphic 2 & 98.70\% & 95.60\% \\  & Polymorphic 3 & 98.70\% & N/A \\  & Polymorphic 4 & 98.60\% & N/A \\ \hline  & Adversarial & 24.70\% & 98.50\% \\  & Polymorphic 1 & 41.30\% & 81.60\% \\ F1\_Score & Polymorphic 2 & 48.30\% & 93.80\% \\  & Polymorphic 3 & 99.30\% & N/A \\  & Polymorphic 4 & 99.30\% & N/A \\ \hline \hline \end{tabular}
\end{table} 
Table 4: _Cont._

Figure 9: Polymorphic adversarial attacks using the manual feature selection (20 features). Multiple IDS models are initially trained using CICIDS2017 data one by one, and then evaluated against adversarial polymorphic attacks using our framework. Figure 11 provides a comparative analysis of these models against adversarial polymorphic attacks. During the first attack cycle, the models are trained using the original training dataset and their performance is evaluated against adversarial attacks. As seen in all of the subfigures above, the adversarial detection rates of all the models are very low in the first phase. For SVM and NB, the adversarial detection rates are close to zero.