Adversarial ML — Attacking and Defending an Intrusion Detection Model

This project demonstrates the full adversarial machine learning cycle on a network intrusion detection model: training a target model, attacking it with an evasion attack to make it miss real threats, and then hardening it with adversarial training so the same attack no longer works.

Built as a hands-on project to understand AI security (MLSecOps) — how ML models can be fooled by manipulated inputs, and how to defend them.

The three stages

1. Train the target model — a Random Forest classifier trained on the NSL-KDD dataset to detect network attacks. Baseline accuracy: ~99.8%.
2. Attack it (evasion) — by adding small, carefully-scaled random noise to attack samples, the model's detection rate on those attacks dropped from ~99.7% to ~54.6%. The traffic is still an attack, but the model now misses nearly half of them.
3. Defend it (adversarial training) — by retraining the model on both clean and adversarially-perturbed examples, the robust model detects ~100% of the same perturbed attacks. The attack no longer works.

Why this matters

A model being "99% accurate" is misleading in the real world, because a real attacker can manipulate their input. This is exactly how attackers evade real intrusion detection systems, antivirus engines, and spam filters. A security engineer needs to understand both sides — how to break a model and how to defend it. Adversarial training acts like a vaccine: showing the model weakened attacks so it becomes immune to stronger ones.

Tech stack

• Python — core language
• scikit-learn — Random Forest model
• pandas / numpy — data handling and perturbation
• matplotlib — visualization
• NSL-KDD — network intrusion dataset

Project structure

download_data.py -> downloads the NSL-KDD dataset train_target.py -> trains the target model (the one we attack) attack.py -> evasion attack: perturbs attacks to evade detection defend.py -> adversarial training: hardens the model visualize.py -> generates the attack/defense results chart

Running it

python -m venv venv
venv\Scripts\activate          # Windows
python -m pip install pandas scikit-learn numpy matplotlib

python download_data.py
python train_target.py
python attack.py
python defend.py
python visualize.py

What I learned

• Evasion attacks — how small input perturbations can dramatically reduce a model's detection rate without changing what the traffic actually is.
• Model robustness vs accuracy — high accuracy on clean data does not mean a model is safe against a motivated attacker.
• Adversarial training — the most common defense: training on adversarial examples makes the model resistant to the same attacks.
• The MLSecOps mindset — thinking like both an attacker and a defender of AI systems, which is the core of AI security engineering.

Author

Batikan Avsar — Computer Engineering student

• GitHub: batikanavsar000