Recent work on network attacks have demonstrated that ML-based network intrusion detection systems (NIDS) can be evaded with adversarial perturbations. However, these attacks rely on complex optimizations that have large computational overheads, making them impractical in many real-world settings. In this paper, we introduce a lightweight adversarial agent that implements strategies (policies) trained via reinforcement learning (RL) that learn to evade ML-based NIDS without requiring online optimization. This attack proceeds by (1) offline training, where the agent learns to evade a surrogate ML model by perturbing malicious flows using network traffic data assumed to be collected via reconnaissance, then (2) deployment, where the trained agent is used in a compromised device controlled by an attacker to evade ML-based NIDS using learned attack strategies. We evaluate our approach across diverse NIDS and several white-, gray-, and black-box threat models. We demonstrate that attacks using these lightweight agents can be highly effective (reaching up to 48.9% attack success rate), extremely fast (requiring as little as 5.72ms to craft an attack), and require negligible resources (e.g., 0.52MB of memory). Through this work, we demonstrate that future botnets driven by lightweight learning-based agents can be highly effective and widely deployable in diverse environments of compromised devices.

翻译：近期关于网络攻击的研究表明，基于机器学习的网络入侵检测系统（NIDS）可能因对抗性扰动而被规避。然而，这些攻击依赖于复杂的优化过程，计算开销巨大，导致其在许多现实场景中难以实际应用。本文提出一种轻量级对抗智能体，该智能体通过强化学习（RL）训练的策略来学习规避基于机器学习的NIDS，无需在线优化。攻击过程分为两个阶段：（1）离线训练阶段，智能体利用通过侦察收集的网络流量数据，学习通过扰动恶意流量来规避一个替代机器学习模型；（2）部署阶段，训练完成的智能体被置于攻击者控制的受感染设备中，利用习得的攻击策略规避基于机器学习的NIDS。我们在多种NIDS以及白盒、灰盒和黑盒威胁模型下评估了该方法。实验表明，使用此类轻量级智能体的攻击具有极高的有效性（攻击成功率最高可达48.9%）、极快的速度（仅需5.72毫秒即可生成一次攻击）以及可忽略的资源消耗（例如仅需0.52MB内存）。通过这项工作，我们证明未来由轻量级学习型智能体驱动的僵尸网络能够在各类受感染设备环境中高效且广泛地部署。