# Securing Network Traffic Classification Models against Adversarial Examples Using Derived Variables
## 2 Related Work
### Common AE Generation Methods
#### 2.2.3 Jacobian-Based Saliency Map Attack (JSMA)  
The JSMA was proposed by [PERSON] et al. [39] to find the optimal perturbation to create an AE by taking forward derivatives of the classifier model. It is a targeted attack that aims to modify the input data in a manner that causes the model to misclassify the input as a specific target class. The JSMA attack works by computing the saliency map of the input data, which indicates the importance of each input feature for the model's decision. The saliency map is computed using the Jacobian matrix, which describes the rate of change of the model outputs with respect to the input features. The saliency map is then used to identify the most important input features that could be modified to cause the model to misclassify the input as the target class. The JSMA is a white-box attack, which means that it requires access to the internal parameters of the ML model being attacked. It is typically performed by iteratively modifying the input features that have the highest saliency values to maximize the likelihood that the model misclassifies the input as the target class. The modified input is then checked to determine if it has the desired misclassification, and the process is repeated until a successful AE is found.  
Given an input data point \(x\), an ML model with parameters \(\theta\), a target class \(t\), and a perturbation budget \(\epsilon\), the JSMA seeks to find a perturbed data point \(x^{\prime}\) that maximizes the probability of the model predicting the target class (\(t\)), subject to the constraint that the perturbations are bounded by \(\epsilon\):  
\[\begin{split} argmax_{x}^{\prime}P(y=t|x^{\prime})\\ \text{subject to}\quad||x^{\prime}-x||_{p}\leq\epsilon\end{split} \tag{4}\]  
where \(P(y=t|x^{\prime})\) is the probability that the model predicts the target class (\(t\)) for perturbed data points \(x^{\prime}\) and \(||.||_{p}\) denotes the \(L_{p}\) norm that measures the distance between \(x\) and \(x^{\prime}\).  
To compute the perturbed data point \(x^{\prime}\), the JSMA uses the Jacobian matrix (\(J(\theta,x)\)), which describes the rate of change in the output of the model with respect to the input features. The saliency score of each input feature (i) is calculated as shown in Equation (5).  
\[S_{i}(x)=max_{j\
eq t}[(J(\theta,x)_{j},i*(f_{t}(x^{\prime})-f_{j}(x^{\prime}) ))] \tag{5}\]  
where \(J(\theta,x)_{j}\), \(i\) is the \((j,i)\)_th_ element of the Jacobian matrix, \(f_{t}(x^{\prime})\) is the output of the model for the target class (\(t\)), and \(f_{j}(x^{\prime})\) is the output of the model for class \(j\).  
The saliency scores are then used to identify the \(k\) most salient input features for modification. The modification to each input feature \(i\) is given by Equation (6).  
\[x^{\prime}_{i}=x_{i}+\epsilon_{i} \tag{6}\]  
where \(\epsilon_{i}\) is the smallest perturbation that increases the saliency score of feature \(i\) while maintaining the perturbation within the budget (\(\epsilon\)). The JSMA iteratively modifies the \(k\) most salient input features until the model predicts the target class (\(t\)) for the perturbed data point (\(x^{\prime}\)). The attack can terminate after a specified number of iterations or when the model predicts the target class with a specified probability threshold. The JSMA is effective in generating AEs with high success rates, but it requires access to the model's parameters and outputs, which may not always be available in real-world scenarios.