Defending against Adversarial Machine Learning Attacks using Hierarchical Learning - A case study on Network Traffic Attack Classification

Aug 3, 2026

Upload by Jiven

Machine learning supports automated detection of malicious network activity to protect organizations from cyber security attacks. Adversarial machine learning studies how an adversary can manipulate inputs to force misclassification, a risk that applies beyond vision to network traffic analysis. The study investigates adversarial attacks against a well-trained network traffic classification model, showing adversarial examples that mislabel known attacks as benign. A hierarchical learning defense reduces the exploitable attack surface within the intended parameter constraints, preserving robustness and maintaining accuracy under non-attack conditions.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages36

Reading Time1 h 31 min

AccessFree to download

Introduction

Cyber security context and ML-based traffic classification

Adversarial machine learning and functionality preservation

Paper contributions

Related Work

Adversarial Attack Study

Hierarchical Learning Defense

Discussion

Defending against Adversarial Machine Learning Attacks using Hierarchical Learning: A case study on Network Traffic Attack Classification Andrew McCarthya , Essam Ghadafia , Panagiotis Andriotisa , Phil Leggaa Computer Science Research Centre, University of the West of England, Bristol, UK Abstract Machine learning is key for automated detection of malicious network activity to ensure that computer networks and organizations are protected against cyber security attacks. Recently, there has been growing interest in the domain of adversarial machine learning, which explores how a machine learning model can be compromised by an adversary, resulting in misclassified output. Whilst to date, most focus has been given to visual domains, the challenge is present in all applications of machine learning where a malicious attacker would want to cause unintended functionality, including cyber security and network traffic analysis. We first present a study on conducting adversarial attacks against a well-trained network traffic classification model. We show how well-crafted adversarial examples can be constructed so that known attack types are misclassified by the model as benign activity. To combat this, we present a novel defensive strategy based on hierarchical learning to help reduce the attack surface that an adversarial example can exploit within the constraints of the parameter space of the intended attack. Our results show that our defensive learning model can withstand crafted adversarial attacks and can achieve classification accuracy in line with our original model when not under attack. Keywords: adversarial learning, hierarchical classification, network traffic analysis, functionality preservation, machine learning, model robustness 1. Introduction Cyber security and the protection of associated computer and network systems is fundamental for most organizations. The recent Cyber Security Preprint submitted to Journal of Information Security and ApplicationsDecember 6, 2022 Breaches survey 2022 conducted by the UK Government found that 39% businesses had experienced a cyber attack in the last 12 months, with the average cost of a cyber attack currently estimated as £2.2 million [1] . The sheer scale and magnitude of modern cyber attacks requires automated response and intervention. Machine learning (ML) is becoming widely used for the detection and classification of malicious network activity to aid the response to cyber attacks, where a mathematical model is learned to relate input feature observations to a set of possible output classes. For the classification of network traffic attacks, input features may be derived from the observed network communications and packet header information, which maybe indicative of either benign traffic, or a malicious attack such as a Denial of Service, a Remote Access Trojan, a BotNet, or other network-based attack. Whilst machine learning can help manage this wealth of information, it is not without limitation. Recent years have seen a growing interest in the domain of adversarial machine learning [2] that seeks to identify well-crafted examples that knowingly force misclassification by the model. This has been particularly effective in the computer vision domain since the manipulation of few input features (i.e., image pixels) may inadvertently adjust the performance of the model without being noticeable to the human observer, due to small perturbations of pixel intensity values. The challenge in adversarial learning is to determine which features are most susceptible such that a minimal change can result in misclassification by the model, whilst the overall input to the model appears unchanged or unaltered to the human observer. Drawing a parallel to the challenge of network traffic classification, a malicious attack should exhibit the same characteristics such that the activity is still deemed as malicious, whilst identifying the minimal amount of perturbation in the der

FAQs

What problem does adversarial machine learning target in network traffic classification?

It targets the model’s ability to classify traffic correctly by crafting inputs that cause misclassification, such as turning known malicious activities into outputs labeled as benign.

How do the authors define functionality preservation in adversarial attacks?

Functionality preservation refers to keeping the attack’s essential malicious characteristics while introducing minimal perturbations in the derived features so the model still believes the observation is benign.

What defense strategy is proposed to counter adversarial network attacks?

The paper proposes a defensive strategy based on hierarchical learning to reduce the attack surface an adversarial example can exploit while staying within the constraints of the intended attack’s parameter space.

Aug 3, 2026

Upload by Jiven