A Kitchenham-informed systematic literature review methodology, this review synthesizes 186 studies published between 2018 and 2026 and develops a perturbation-realism taxonomy, ranging from feature-level manipulation to executable packet-level attacks, that clarifies when reported success corresponds to deployable risk.
Abstract
Machine learning-based Network Intrusion Detection Systems (ML-based NIDS) have become central to modern cyber defense because they can learn complex traffic patterns and detect evolving malicious behavior beyond predefined signatures. However, their reliance on statistical feature representations also exposes them to adversarial evasion, where malicious traffic is modified at inference time to induce misclassification while preserving its operational intent. In network environments, such attacks are shaped by protocol semantics, feature dependencies, traffic timing, and functionality-preservation constraints, making adversarial evasion in ML-based NIDS distinct from adversarial examples in more continuous domains. This review synthesizes 186 studies published between 2018 and 2026—a fast-growing but fragmented body of work—using a Kitchenham-informed systematic literature review methodology. It introduces a lifecycle-aware, NIDS-specific threat model and organizes the literature into three domains—adversarial generation, robustness evaluation, and defense—developing a hierarchical taxonomy within each and conducting a two-tier critical analysis that separates domain-specific limitations from cross-cutting methodological, empirical, and operational constraints. The synthesis shows that much reported evasion success reflects diagnostic feature-space sensitivity rather than executable, deployable adversarial risk, and that many defenses demonstrate component-level robustness rather than system-level resilience. The review also develops a perturbation-realism taxonomy, ranging from feature-level manipulation to executable packet-level attacks, that clarifies when reported success corresponds to deployable risk. Finally, it derives evidence-grounded lessons learned and a future research roadmap for improving realistic evaluation, reproducible reporting, and deployable robustness in adversarial ML-based NIDS.
Machine learning and deep learning have become essential components of modern cybersecurity because of their ability to detect malicious activities, classify network traffic, identify malware, recognize phishing attempts, and support automated incident response. However, machine learning–based cybersecurity classifiers are vulnerable to adversarial attacks in which attackers deliberately manipulate data, features, model inputs, or training processes to cause misclassification or evade detection. This study systematically analyzes adversarial attacks against machine learning–based cybersecurity classifiers and proposes a comprehensive defense framework to improve their robustness and reliability. The study examines major attack categories, including evasion, data poisoning, model extraction, inference, backdoor, and adversarial example attacks. It also analyzes attack surfaces, threat models, and the consequences of adversarial manipulation in intrusion detection, malware detection, phishing classification, and other AI-enabled cybersecurity systems. The findings indicate that adversarial attacks can significantly reduce detection performance, increase false-negative and false-positive rates, manipulate decision boundaries, and undermine trust in automated security systems. A defense-in-depth framework is proposed, incorporating secure data management, adversarial training, robust feature engineering, model validation, ensemble learning, anomaly detection, explainable AI, continuous monitoring, human oversight, and regular security auditing. The study concludes that no single defense mechanism can provide complete protection against adversarial machine learning attacks. Therefore, resilient AI-based cybersecurity requires a layered approach that protects data, features, models, inference processes, and the entire machine learning lifecycle.
Nwamini Bartholomew Tochukwu, C. Ezeaku-Ezeme· International journal of res...· 0 citations
Abstract
The escalating scale and sophistication of cyber threats - including advanced persistent threats, ransomware, and zero-day exploits - has driven a decade-long shift in cybersecurity research away from static, signature-based defences and toward machine learning (ML) systems capable of learning attack patterns from data and generalising to previously unseen threats. This paper presents a systematic literature review of machine learning in cyber security, organising the field into classical supervised intrusion detection, deep learning and hybrid detection architectures, graph-based and provenance-aware detection, machine-learning-based malware and phishing detection, and the adversarial machine learning literature that studies how the very ML systems built to defend networks can themselves be attacked and manipulated. The review examines the benchmark datasets - including NSL-KDD, UNSW-NB15, and CICIDS2017 - and evaluation practices that recur across this literature, situates the technical literature against industry data on the real-world cost and frequency of breaches, and discusses cross-cutting challenges including class imbalance, concept drift, adversarial vulnerability, explainability, and the operational gap between benchmark accuracy and production deployment. The paper concludes by proposing a conceptual layered framework for machine-learning-based security operations that integrates detection, adversarial-robustness testing, and human-analyst oversight, and by outlining directions for future research.
Keywords: machine learning, cyber security, intrusion detection, malware detection, adversarial machine learning, phishing detection, network security
Dr. C. Thilagavathy, Saeed Mudether Saeed Taha, Krithik M S et al.· International Scientific Jou...· 0 citations
Deep learning based network intrusion detection systems (IDS) can achieve strong traffic classification performance, but their resilience to adversarial manipulation remains a critical concern. This study evaluates the adversarial robustness of Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models in a multiclass intrusion detection setting using the Train_Test_Network dataset with ten traffic classes. The models were trained on true sliding flow-window sequences under a unified preprocessing pipeline to support fair comparison. Adversarial robustness was first assessed under a white-box Fast Gradient Sign Method (FGSM) setting and then broadened through additional FGSM and Projected Gradient Descent (PGD) stress testing. SHapley Additive exPlanations (SHAP) were further used to analyse explanation instability under clean and adversarial conditions, and explanation-drift features were evaluated as a secondary adversarial detection signal. Under clean evaluation, both models achieved strong and nearly identical performance, with accuracies of 0.9614 for LSTM and 0.9615 for GRU and weighted F1-scores of 0.9597 and 0.9598, respectively. Under the main FGSM condition, performance declined substantially: the LSTM achieved adversarial accuracy of 0.6094 and weighted F1-score of 0.6290 with an evasion rate of 37.38%, while the GRU achieved adversarial accuracy of 0.5130 and weighted F1-score of 0.5690 with an evasion rate of 47.02%. The broader robustness sweep showed that iterative PGD exposed stronger fragility than FGSM alone. SHAP analysis indicated that adversarial perturbation altered both prediction outcomes and local explanation structure. A learned explanation-driven detector improved over the rule-based baseline, while larger-scale validation confirmed that explanation drift remained informative, though not perfectly separable, at broader scale. Overall, the results show that strong clean performance does not imply adversarial robustness, and that explanation drift provides a useful auxiliary signal for adversarial monitoring in recurrent IDS models.
Elijah M. Maseno, Yanxia Sun, Zenghui Wang· International Journal of Inf...· 0 citations
The review explores the key adversarial attack classes: poisoning, evasion, model extraction, model extraction, model inversion, and membership inference and also white-box, black-box, and grey-box threat models.
Ujjwal Deshmukh· International Journal of Inn...· 0 citations
UA-EAD is proposed, an uncertainty-aware evidential adversarial defense that equips the detector with an evidential head yielding calibrated predictive uncertainty in a single forward pass, trains it with an uncertainty-weighted adversarial objective plus a consistency regularizer that concentrates robustness on the most uncertain, near-boundary flows, and uses the resulting uncertainty for selective prediction.
Jiawen Luo, Samuel Price· International Journal of Adv...· 0 citations
Cybersecurity frameworks are increasingly incorporating machine learning-based Intrusion Detection Systems (IDS) into their security measures. Despite the effectiveness of these systems, they remain susceptible to different forms of attacks that take advantage of their operation; specifically, those that are designed to circumvent their protective mechanisms. For example, modifications made to network traffic can produce “adversarial samples,” which are designed to go undetected. To tackle this issue, two systems based on Principal Component Analysis (PCA) have been proposed for spotting adversarial samples: Standard Principal Component Analysis (SPCA) and Outlier Filtered Principal Component Analysis (OFPCA). SPCA identifies the basic structure of normal network traffic through principal components and detects adversarial attacks by looking at reconstruction errors. A sample is projected onto the principal components and then reconstructed in the original space. The difference between the original and reconstructed features is the reconstruction error. Larger errors can indicate manipulation. OFPCA, on the other hand, is trained only on normal samples after removing outlier data points from the training set. When testing SPCA method using the NSL-KDD dataset, it achieved an AUC-ROC score of 0.97 in detecting FGSM adversarial samples. OFPCA had a higher AUC-ROC score of 0.99 in identifying FGSM adversarial samples. OFPCA performed better than SPCA and other techniques, when tested under different adversarial attacks.
N. Dhinakaran, S. Anto· Frontiers of Computer Scienc...· 0 citations