A DeepSHAP-based Adversarial Attack on Machine Learning-Based Network Intrusion Detection

Abstract

We propose an adversarial attack for machine-learning-based network intrusion detection systems that selectively alters only the most influential features. Unlike conventional attacks such as the Fast Gradient Sign Method (FGSM) and multi-step Projected Gradient Descent (PGD), which can perturb all feature dimensions, our DeepSHAP-guided masked-PGD approach focuses its updates on a small set of highly influential features while still achieving competitive success rates on the X-IIoTID dataset. Experimental results indicate that it yields lower autoencoder-based reconstruction error and uses much sparser perturbations, making its adversarial examples harder to detect. By systematically varying the perturbation budget and the number of targeted features, we show the trade-off between stealth and effectiveness. These findings demonstrate the difficulty of detecting adversarial examples guided by feature importance.