通过精简网络结构，无需额外防御即可提升入侵检测模型抗攻击能力。
A No-Defense Defense Against Gradient-Based Adversarial Attacks on ML-NIDS: Is Less More?
- 采用浅层网络、少特征和ReLU激活函数，降低模型对抗脆弱性。
- 该方法在多种攻击下表现优于深度对抗训练模型，且误检率极低。
- 适合追求高效可靠安全检测的工业部署场景。
基于梯度的对抗攻击会微妙地操纵机器学习模型的输入，导致错误预测。本文研究仅通过精心设计网络架构，是否能在不使用任何显式防御的情况下，实现内在鲁棒的基于深度神经网络的网络入侵检测系统（DNN-based NIDS）。通过数千次实验，约2200组不同配置，涵盖网络深度、特征维度、激活函数及丢弃率，针对FGSM、PGD和BIM攻击进行测试，结果表明：较浅的网络、减少的特征集以及使用ReLU激活函数能一致且协同地降低对抗漏洞。此外，遵循此设计原则的简单模型，在多种攻击下表现优于更深、全特征的对抗训练模型，同时保持接近完美的正常流量检测准确率，并显著缩短训练时间。尽管‘少即是多’，但选择合适的‘少’才是关键。
原文摘要 · Abstract (English)
Gradient-based adversarial attacks subtly manipulate inputs of Machine Learning (ML) models to induce incorrect predictions. This paper investigates whether careful architectural choices alone can yield an inherently robust Deep Neural Network (DNN)-based Network Intrusion Detection Systems (NIDS), without any additional explicit defenses. Through thousands of experiments, around 2200, varying network depth, feature dimensionality, activation functions, and dropout across FGSM, PGD, and BIM attacks, we show that shallower networks, reduced feature sets, and ReLU activation consistently and jointly reduce adversarial vulnerability. Moreover, a simple model following this recipe outperforms deeper, fully-featured adversarially trained models, while maintaining near-perfect clean-traffic detection and lower training times. Nevertheless, while less is more, the selection of the right less is what truly matters.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。