NonsaliencyCrossover: A Novel Adversarial Example Generation Strategy for IDS Using Explainable AI

System vulnerability can be exposed through adversarial attack, facilitating the improvement of system robustness. However, existing research has predominantly focused on white-box attacks, which typically require access to system parameter information, thus limiting the attack conditions. In contrast, research on black-box attacks is relatively scarce, and there is a lack of innovative adversarial attack methods specifically tailored for structured data. Therefore, in conjunction with Explainable AI, we propose a novel simple, fast and efficient black-box technique to generate adversarial example, focusing on the attack perspective. The proposed method constructs new traffic data by performing a crossover operation between the nonsaliency portion of the original traffic and the corresponding portion of the candidate traffic. A combination that successfully alters the prediction results of the original sample is obtained through a search strategy based on random sampling and iterative update, and the initial adversarial example is generated. To make the number of modified features and the magnitude of perturbations minimized, the integration feature selection and perturbation control strategies were performed, generating the final adversarial example. In order to verify the performance of the method in evading intrusion detection system (IDS), we compared it against six state-of-the-art attack algorithms. The experimental results show that the proposed method outperforms the compared black-box methods in terms of attack success rate (ASR) and query count on the three datasets, and in most cases, it even surpasses the compared white-box attack methods. Specifically, against the NSL-KDD dataset, when the target model is a deep neural network (DNN), the ASR increases by 29%–33%, and the query count is reduced by 23–33 times compared to the baseline black-box methods; the average number of modified features decreases by 90% compared to the white-box methods.