# Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT
## 3 Methodology
### Orchestrating Attacks against Machine Learning  
The first stage was to replicate the linear SVM model that was proposed by [14]. The purpose of the aforementioned replicating is to enable valid comparison of metrics such as accuracy, recall, precision, F1-scores. An artificial neural network (ANN) was implemented to train and evaluate data more quickly than the RNN and LSTM models. \begin{table}
\begin{tabular}{c c} \hline \hline
**Features** & **Description** \\ \hline pkSeqID & Row Identifier \\ \hline Proto & Textual representation of transaction protocols present in network flow \\ \hline sadr & Source IP address \\ \hline sport & Source port number \\ \hline daddr & Destination IP address \\ \hline dport & Destination port number \\ \hline attack & Class label: 0 for Normal traffic, 1 for Attack Traffic \\ \hline category & Traffic category \\ \hline subcategory & Traffic subcategory \\ \hline \hline \end{tabular}
\begin{tabular}{c c} \hline \hline
**Top-10 Features** & **Description** \\ \hline seq & Argus sequence number \\ \hline stddev & Standard deviation of aggregated records \\ \hline N\_IN\_Conn\_P\_SrcIP & Number of inbound connections per source IP. \\ \hline min & Minimum duration of aggregated records \\ \hline state\_number & Numerical representation of transaction state \\ \hline mean & Average duration of aggregated records \\ \hline N\_IN\_Conn\_P\_DstIP & Number of inbound connections per destination IP. \\ \hline date & Destination-to-source packets per second \\ \hline state & Source-to-destination packets per second \\ \hline max & Maximum duration of aggregated records \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Total features in the Training dataset [14]. Nevertheless, the activation functions and neural network structure remained the same for a fairer comparison. The second and third stages focused on adversarial examples for both the SVM and ANN. With SVM adversarial examples, the undertaken method was labelled noise generation during the training phase. As previously discussed, the label noise generation is a more effective attack against traditional machine learning models than feature noise experiments. Firstly, a certain percentage of data labels was manipulated, ranging from 0% to 50% of flipped labels. The SVM model was trained using adversarial examples. The increasing rate of flipped labels should incrementally reduce the accuracy of the SVM models. However, as discussed in Section 2.5, random label manipulation could also result in little effect on model accuracy. Accordingly, targeted label manipulation was also performed. On the default SVM model, each label's margin to the SVM hyperplane is calculated; consequently, the top selected percentage (ranging from 0% to 50%) with the smallest margin to the SVM hyperplane was chosen, and their label is flipped. Using the targeted label flipping method should result in a more significant impact on model accuracy and negatively impact the metrics. After experimenting with SVM manipulation, FGSM methods were applied to the data used for the ANN. In contrast to the SVM threat model, which assumes that the attacker can manipulate the training data, the FGSM assumes that the attacker controls the data and tries to evade the model after it has been deployed. The CleverHans package was used to generate adversarial examples based on the testing dataset, which simulates attacking the model after the deployment [48]. As discussed in Section 2.5, the noise factor determines the level at which the generated adversarial examples will differ from the non manipulated data. The work of [44], found that a noise factor of 0.02 was sufficient to get 100% incorrect classification on the NSL-KDD dataset. However, as the NSL-KDD dataset is smaller in size than the Bot-IoT dataset, a noise factor from 0 to 1, with an increment in steps of 0.1, was applied and evaluated. The ANN was trained on a binary classification model, similar to that of the RNN and LSTM models proposed by [14].