{"id":"https://openalex.org/W4387705798","doi":"https://doi.org/10.3390/computers12100209","title":"On the Robustness of ML-Based Network Intrusion Detection Systems: An Adversarial and Distribution Shift Perspective","display_name":"On the Robustness of ML-Based Network Intrusion Detection Systems: An Adversarial and Distribution Shift Perspective","publication_year":2023,"publication_date":"2023-10-17","ids":{"openalex":"https://openalex.org/W4387705798","doi":"https://doi.org/10.3390/computers12100209"},"language":"en","primary_location":{"id":"doi:10.3390/computers12100209","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers12100209","pdf_url":"https://www.mdpi.com/2073-431X/12/10/209/pdf?version=1697537233","source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2073-431X/12/10/209/pdf?version=1697537233","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102876450","display_name":"Minxiao Wang","orcid":"https://orcid.org/0000-0003-3646-9479"},"institutions":[{"id":"https://openalex.org/I110378019","display_name":"Southern Illinois University Carbondale","ror":"https://ror.org/049kefs16","country_code":"US","type":"education","lineage":["https://openalex.org/I110378019","https://openalex.org/I2801502357"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Minxiao Wang","raw_affiliation_strings":["The Computer Engineering Program in the School of Electrical, Computer, and Biomedical Engineering, Southern Illinois University, Carbondale, IL 62901, USA"],"raw_orcid":"https://orcid.org/0000-0003-3646-9479","affiliations":[{"raw_affiliation_string":"The Computer Engineering Program in the School of Electrical, Computer, and Biomedical Engineering, Southern Illinois University, Carbondale, IL 62901, USA","institution_ids":["https://openalex.org/I110378019"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100662844","display_name":"Ning Yang","orcid":"https://orcid.org/0000-0003-4837-6632"},"institutions":[{"id":"https://openalex.org/I110378019","display_name":"Southern Illinois University Carbondale","ror":"https://ror.org/049kefs16","country_code":"US","type":"education","lineage":["https://openalex.org/I110378019","https://openalex.org/I2801502357"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Ning Yang","raw_affiliation_strings":["The Information Technology Program in the School of Computing, Southern Illinois University, Carbondale, IL 62901, USA"],"raw_orcid":"https://orcid.org/0000-0003-4837-6632","affiliations":[{"raw_affiliation_string":"The Information Technology Program in the School of Computing, Southern Illinois University, Carbondale, IL 62901, USA","institution_ids":["https://openalex.org/I110378019"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091880974","display_name":"Dulaj Gunasinghe","orcid":"https://orcid.org/0000-0001-8537-7082"},"institutions":[{"id":"https://openalex.org/I110378019","display_name":"Southern Illinois University Carbondale","ror":"https://ror.org/049kefs16","country_code":"US","type":"education","lineage":["https://openalex.org/I110378019","https://openalex.org/I2801502357"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dulaj H. Gunasinghe","raw_affiliation_strings":["The Computer Engineering Program in the School of Electrical, Computer, and Biomedical Engineering, Southern Illinois University, Carbondale, IL 62901, USA"],"raw_orcid":"https://orcid.org/0000-0001-8537-7082","affiliations":[{"raw_affiliation_string":"The Computer Engineering Program in the School of Electrical, Computer, and Biomedical Engineering, Southern Illinois University, Carbondale, IL 62901, USA","institution_ids":["https://openalex.org/I110378019"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5077388020","display_name":"Ning Weng","orcid":"https://orcid.org/0000-0003-4869-8383"},"institutions":[{"id":"https://openalex.org/I110378019","display_name":"Southern Illinois University Carbondale","ror":"https://ror.org/049kefs16","country_code":"US","type":"education","lineage":["https://openalex.org/I110378019","https://openalex.org/I2801502357"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Ning Weng","raw_affiliation_strings":["The Computer Engineering Program in the School of Electrical, Computer, and Biomedical Engineering, Southern Illinois University, Carbondale, IL 62901, USA"],"raw_orcid":"https://orcid.org/0000-0003-4869-8383","affiliations":[{"raw_affiliation_string":"The Computer Engineering Program in the School of Electrical, Computer, and Biomedical Engineering, Southern Illinois University, Carbondale, IL 62901, USA","institution_ids":["https://openalex.org/I110378019"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5077388020","https://openalex.org/A5100662844"],"corresponding_institution_ids":["https://openalex.org/I110378019"],"apc_list":{"value":1600,"currency":"CHF","value_usd":1732},"apc_paid":{"value":1600,"currency":"CHF","value_usd":1732},"fwci":4.1439,"has_fulltext":true,"cited_by_count":22,"citation_normalized_percentile":{"value":0.945232,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"12","issue":"10","first_page":"209","last_page":"209"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.8876845836639404},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6111326813697815},{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.5554234385490417},{"id":"https://openalex.org/keywords/robustness-testing","display_name":"Robustness testing","score":0.547142505645752},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.46857309341430664},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3712626099586487},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3657090663909912},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.338226318359375},{"id":"https://openalex.org/keywords/chemistry","display_name":"Chemistry","score":0.08046996593475342}],"concepts":[{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.8876845836639404},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6111326813697815},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.5554234385490417},{"id":"https://openalex.org/C137726913","wikidata":"https://www.wikidata.org/wiki/Q7353550","display_name":"Robustness testing","level":3,"score":0.547142505645752},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.46857309341430664},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3712626099586487},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3657090663909912},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.338226318359375},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.08046996593475342},{"id":"https://openalex.org/C17409809","wikidata":"https://www.wikidata.org/wiki/Q161764","display_name":"Geochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C58166","wikidata":"https://www.wikidata.org/wiki/Q224821","display_name":"Fuzzy logic","level":2,"score":0.0},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/computers12100209","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers12100209","pdf_url":"https://www.mdpi.com/2073-431X/12/10/209/pdf?version=1697537233","source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:1b15361070854da98f79199b44391b38","is_oa":true,"landing_page_url":"https://doaj.org/article/1b15361070854da98f79199b44391b38","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Computers, Vol 12, Iss 10, p 209 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/computers12100209","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers12100209","pdf_url":"https://www.mdpi.com/2073-431X/12/10/209/pdf?version=1697537233","source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/12","display_name":"Responsible consumption and production","score":0.5400000214576721}],"awards":[{"id":"https://openalex.org/G8157719259","display_name":"CC* Networking Infrastructure: Enhancing SIUC Campus Cyberinfrastructure to Accelerate Data-Driven Research and Education","funder_award_id":"2018919","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4387705798.pdf"},"referenced_works_count":83,"referenced_works":["https://openalex.org/W28747464","https://openalex.org/W1513231349","https://openalex.org/W2021354639","https://openalex.org/W2099419573","https://openalex.org/W2099940443","https://openalex.org/W2163605009","https://openalex.org/W2772317693","https://openalex.org/W2901200207","https://openalex.org/W2911634294","https://openalex.org/W2921494018","https://openalex.org/W2923778952","https://openalex.org/W2944176689","https://openalex.org/W2950204666","https://openalex.org/W2959169310","https://openalex.org/W2962763344","https://openalex.org/W2963197901","https://openalex.org/W2971296908","https://openalex.org/W3005097670","https://openalex.org/W3006008420","https://openalex.org/W3021219025","https://openalex.org/W3030742901","https://openalex.org/W3035542229","https://openalex.org/W3037492894","https://openalex.org/W3046042764","https://openalex.org/W3083614422","https://openalex.org/W3096929904","https://openalex.org/W3100068262","https://openalex.org/W3102015031","https://openalex.org/W3102091066","https://openalex.org/W3111088413","https://openalex.org/W3117572899","https://openalex.org/W3134622107","https://openalex.org/W3135028703","https://openalex.org/W3135367836","https://openalex.org/W3153208318","https://openalex.org/W3155427574","https://openalex.org/W3165205057","https://openalex.org/W3168146198","https://openalex.org/W3168855424","https://openalex.org/W3173151551","https://openalex.org/W3175362188","https://openalex.org/W3176065393","https://openalex.org/W3197410585","https://openalex.org/W3202183072","https://openalex.org/W3205604077","https://openalex.org/W3205605959","https://openalex.org/W3208097639","https://openalex.org/W3209651413","https://openalex.org/W3213537051","https://openalex.org/W3214321642","https://openalex.org/W4206331418","https://openalex.org/W4211223593","https://openalex.org/W4220846496","https://openalex.org/W4224068037","https://openalex.org/W4225472587","https://openalex.org/W4255466416","https://openalex.org/W4282047883","https://openalex.org/W4283776948","https://openalex.org/W4285110406","https://openalex.org/W4287812705","https://openalex.org/W4293238913","https://openalex.org/W4313003631","https://openalex.org/W4313342124","https://openalex.org/W4313591247","https://openalex.org/W4315498031","https://openalex.org/W4319879104","https://openalex.org/W4323315170","https://openalex.org/W4324007187","https://openalex.org/W4360841610","https://openalex.org/W4361296232","https://openalex.org/W4376130364","https://openalex.org/W4379618922","https://openalex.org/W4381059423","https://openalex.org/W4387007222","https://openalex.org/W4399045945","https://openalex.org/W6601192393","https://openalex.org/W6774685073","https://openalex.org/W6785333560","https://openalex.org/W6797132756","https://openalex.org/W6804306256","https://openalex.org/W6807871031","https://openalex.org/W6839476588","https://openalex.org/W6853502424"],"related_works":["https://openalex.org/W1985538490","https://openalex.org/W2385695368","https://openalex.org/W2048346223","https://openalex.org/W1980755708","https://openalex.org/W1566806263","https://openalex.org/W2560201613","https://openalex.org/W172227863","https://openalex.org/W1576602683","https://openalex.org/W2013496695","https://openalex.org/W2126636874"],"abstract_inverted_index":{"Utilizing":[0],"machine":[1],"learning":[2],"(ML)-based":[3],"approaches":[4],"for":[5],"network":[6],"intrusion":[7],"detection":[8],"systems":[9],"(NIDSs)":[10],"raises":[11],"valid":[12],"concerns":[13],"due":[14],"to":[15,23,66,77,86,88,109,119,210],"the":[16,50,91,111,115,121,138,145,148,157,175,185,217,226,239],"inherent":[17],"susceptibility":[18],"of":[19,52,71,93,123,137,147,160,228,242],"current":[20,54],"ML":[21,94,117,186,218],"models":[22],"various":[24],"threats.":[25],"Of":[26],"particular":[27,69],"concern":[28],"are":[29],"two":[30],"significant":[31],"threats":[32],"associated":[33],"with":[34,126],"ML:":[35],"adversarial":[36,164],"attacks":[37,165],"and":[38,73,99,166,180,206,215,222,235],"distribution":[39,167],"shifts.":[40],"Although":[41],"there":[42],"has":[43],"been":[44],"a":[45,68,84,134],"growing":[46],"emphasis":[47],"on":[48,58,184],"researching":[49],"robustness":[51,72,92,146,158,207,219,237],"ML,":[53],"studies":[55,64],"primarily":[56],"concentrate":[57],"addressing":[59],"specific":[60,80],"challenges":[61,179],"individually.":[62],"These":[63],"tend":[65],"target":[67],"aspect":[70],"propose":[74],"innovative":[75],"techniques":[76],"enhance":[78],"that":[79,196,233],"aspect.":[81],"However,":[82],"as":[83,201],"capability":[85],"respond":[87],"unexpected":[89],"situations,":[90],"should":[95],"be":[96],"comprehensively":[97],"built":[98],"maintained":[100],"in":[101,143,177,225],"every":[102],"stage.":[103],"In":[104],"this":[105,130],"paper,":[106],"we":[107,132,154,173,190,213,231],"aim":[108],"link":[110],"varying":[112],"efforts":[113],"throughout":[114,238],"whole":[116],"workflow":[118],"guide":[120],"design":[122],"ML-based":[124,161,244],"NIDSs":[125,162],"systematic":[127],"robustness.":[128],"Toward":[129],"goal,":[131],"conduct":[133],"methodical":[135],"evaluation":[136],"progress":[139],"made":[140],"thus":[141],"far":[142],"enhancing":[144],"targeted":[149],"NIDS":[150,245],"application":[151],"task.":[152],"Specifically,":[153],"delve":[155],"into":[156],"aspects":[159],"against":[163],"shift":[168],"scenarios.":[169],"For":[170,188],"each":[171],"perspective,":[172],"organize":[174],"literature":[176],"robustness-related":[178],"technical":[181],"solutions":[182,195],"based":[183],"workflow.":[187],"instance,":[189],"introduce":[191],"some":[192],"advanced":[193],"potential":[194],"can":[197],"improve":[198],"robustness,":[199],"such":[200],"data":[202],"augmentation,":[203],"contrastive":[204],"learning,":[205],"certification.":[208],"According":[209],"our":[211],"survey,":[212],"identify":[214],"discuss":[216],"research":[220],"gaps":[221],"future":[223],"direction":[224],"field":[227],"NIDS.":[229],"Finally,":[230],"highlight":[232],"building":[234],"patching":[236],"life":[240],"cycle":[241],"an":[243],"is":[246],"critical.":[247]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":6}],"updated_date":"2026-06-19T17:40:00.097472","created_date":"2025-10-10T00:00:00"}