{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T15:54:35Z","timestamp":1787068475468,"version":"3.56.0"},"reference-count":51,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,2,19]],"date-time":"2026-02-19T00:00:00Z","timestamp":1771459200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Journal of Information Security and Applications"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.jisa.2026.104409","type":"journal-article","created":{"date-parts":[[2026,3,7]],"date-time":"2026-03-07T21:46:12Z","timestamp":1772919972000},"page":"104409","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":2,"special_numbering":"C","title":["A novel perturb-ability score to mitigate evasion adversarial attacks on flow-based ML-NIDS"],"prefix":"10.1016","volume":"99","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2958-0064","authenticated-orcid":false,"given":"Mohamed","family":"ElShehaby","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9220-4630","authenticated-orcid":false,"given":"Ashraf","family":"Matrawy","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.jisa.2026.104409_bib0001","unstructured":"Varonis. 139 cybersecurity statistics and trends. 2025. Accessed: December 29, 2025; https:\/\/www.varonis.com\/blog\/cybersecurity-statistics."},{"key":"10.1016\/j.jisa.2026.104409_bib0002","unstructured":"Investigation F.B. o.. Internet crime report 2024. Tech. Rep.; FBI Internet Crime Complaint Center (IC3); 2024. Accessed: December 29, 2025 https:\/\/www.ic3.gov\/Media\/PDF\/AnnualReport\/2024_IC3Report.pdf."},{"key":"10.1016\/j.jisa.2026.104409_bib0003","unstructured":"Shehaby M.e., Matrawy A.. Adversarial evasion attacks practicality in networks: testing the impact of dynamic learning2023. arXiv: 230605494."},{"issue":"1","key":"10.1016\/j.jisa.2026.104409_bib0004","article-title":"Network intrusion detection system: a systematic study of machine learning and deep learning approaches","volume":"32","author":"Ahmad","year":"2021","journal-title":"Transact Emerg Telecommun Technolog"},{"key":"10.1016\/j.jisa.2026.104409_bib0005","first-page":"16","article-title":"The threat of adversarial attacks against machine learning in network security: a survey","author":"Ibitoye","year":"2025","journal-title":"J Electron Electr Eng"},{"issue":"13s","key":"10.1016\/j.jisa.2026.104409_bib0006","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3585385","article-title":"Wild patterns reloaded: a survey of machine learning security against training data poisoning","volume":"55","author":"Cin\u00e0","year":"2023","journal-title":"ACM Comput Surv"},{"key":"10.1016\/j.jisa.2026.104409_bib0007","series-title":"Proceedings of the AAAI conference on artificial intelligence","first-page":"11957","article-title":"Hidden trigger backdoor attacks","volume":"vol. 34","author":"Saha","year":"2020"},{"key":"10.1016\/j.jisa.2026.104409_bib0008","series-title":"2019\u202fIEEE European symposium on security and privacy (EuroS&P)","first-page":"512","article-title":"Prada: protecting against dnn model stealing attacks","author":"Juuti","year":"2019"},{"key":"10.1016\/j.jisa.2026.104409_bib0009","series-title":"Machine learning and knowledge discovery in databases: European conference, ECML PKDD 2013, Prague, Czech Republic, September 23\u201327, 2013, proceedings, part III 13","first-page":"387","article-title":"Evasion attacks against machine learning at test time","author":"Biggio","year":"2013"},{"key":"10.1016\/j.jisa.2026.104409_bib0010","series-title":"2020\u202fIEEE symposium on security and privacy (SP)","first-page":"1332","article-title":"Intriguing properties of adversarial ml attacks in the problem space","author":"Pierazzi","year":"2020"},{"key":"10.1016\/j.jisa.2026.104409_bib0011","series-title":"33rd USENIX security symposium (USENIX security 24)","first-page":"4891","article-title":"Towards more practical threat models in artificial intelligence security","author":"Grosse","year":"2024"},{"key":"10.1016\/j.jisa.2026.104409_bib0012","series-title":"2023\u202fIEEE Conference on secure and trustworthy machine learning (SaTML)","first-page":"339","article-title":"\u201dReal attackers don\u2019t compute gradients\u201d: bridging the gap between adversarial ml research and practice","author":"Apruzzese","year":"2023"},{"issue":"8","key":"10.1016\/j.jisa.2026.104409_bib0013","doi-asserted-by":"crossref","first-page":"2632","DOI":"10.1109\/JSAC.2021.3087242","article-title":"Evaluating and improving adversarial robustness of machine learning-based network intrusion detectors","volume":"39","author":"Han","year":"2021","journal-title":"IEEE J Sel Areas Commun"},{"key":"10.1016\/j.jisa.2026.104409_bib0014","series-title":"Proceedings of the 3rd ACM CoNEXT workshop on big DAta, machine learning and artificial intelligence for data communication networks","first-page":"14","article-title":"Towards evaluation of nidss in adversarial setting","author":"Hashemi","year":"2019"},{"key":"10.1016\/j.jisa.2026.104409_bib0015","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103433","article-title":"Sok: realistic adversarial attacks and defenses for intelligent network intrusion detection","author":"Vitorino","year":"2023","journal-title":"Comput Secur"},{"issue":"7","key":"10.1016\/j.jisa.2026.104409_bib0016","doi-asserted-by":"crossref","first-page":"401","DOI":"10.1007\/s12243-023-00953-y","article-title":"Towards adversarial realism and robust learning for iot intrusion detection and classification","volume":"78","author":"Vitorino","year":"2023","journal-title":"Ann Telecommun"},{"issue":"4","key":"10.1016\/j.jisa.2026.104409_bib0017","doi-asserted-by":"crossref","first-page":"108","DOI":"10.3390\/fi14040108","article-title":"Adaptative perturbation patterns: realistic adversarial learning for robust intrusion detection","volume":"14","author":"Vitorino","year":"2022","journal-title":"Future Inter"},{"issue":"1","key":"10.1016\/j.jisa.2026.104409_bib0018","doi-asserted-by":"crossref","first-page":"153","DOI":"10.1109\/TDSC.2023.3247585","article-title":"Automatic evasion of machine learning-based network intrusion detection systems","volume":"21","author":"Yan","year":"2023","journal-title":"IEEE Trans Depend Secure Comput"},{"key":"10.1016\/j.jisa.2026.104409_bib0019","doi-asserted-by":"crossref","unstructured":"Homoliak I., Teknos M., Ochoa M., Breitenbacher D., Hosseini S., Hanacek P.. Improving network intrusion detection classifiers by non-payload-based exploit-independent obfuscations: An adversarial approach2018. arXiv: 180502684.","DOI":"10.4108\/eai.10-1-2019.156245"},{"key":"10.1016\/j.jisa.2026.104409_bib0020","doi-asserted-by":"crossref","unstructured":"Apruzzese G., Fass A., Pierazzi F.. When adversarial perturbations meet concept drift: an exploratory analysis on ML-NIDS2024;.","DOI":"10.1145\/3689932.3694757"},{"key":"10.1016\/j.jisa.2026.104409_bib0021","series-title":"2017 IEEE symposium on security and privacy (sp)","first-page":"39","article-title":"Towards evaluating the robustness of neural networks","author":"Carlini","year":"2017"},{"key":"10.1016\/j.jisa.2026.104409_bib0022","series-title":"Proceedings of the 19th international conference on availability, reliability and security","first-page":"1","article-title":"Towards realistic problem-space adversarial attacks against machine learning in network intrusion detection","author":"Catillo","year":"2024"},{"issue":"3","key":"10.1016\/j.jisa.2026.104409_bib0023","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3469659","article-title":"Modeling realistic adversarial attacks against network intrusion detection systems","volume":"3","author":"Apruzzese","year":"2022","journal-title":"Digit Threat: Res Pract (DTRAP)"},{"key":"10.1016\/j.jisa.2026.104409_bib0024","series-title":"2023\u202fIEEE Conference on communications and network security (CNS)","first-page":"1","article-title":"The impact of dynamic learning on adversarial attacks in networks (IEEE CNS 23 poster)","author":"El Shehaby","year":"2023"},{"key":"10.1016\/j.jisa.2026.104409_bib0025","unstructured":"Goodfellow I.J., Shlens J., Szegedy C.. Explaining and harnessing adversarial examples2014. arXiv: 14126572."},{"issue":"5","key":"10.1016\/j.jisa.2026.104409_bib0026","doi-asserted-by":"crossref","first-page":"727","DOI":"10.3233\/JCS-210094","article-title":"Adversarial examples for network intrusion detection systems","volume":"30","author":"Sheatsley","year":"2022","journal-title":"J Comput Secur"},{"key":"10.1016\/j.jisa.2026.104409_bib0027","doi-asserted-by":"crossref","DOI":"10.1109\/COMST.2022.3233793","article-title":"Adversarial machine learning for network intrusion detection systems: a comprehensive survey","author":"He","year":"2023","journal-title":"IEEE Commun Surv Tutor"},{"key":"10.1016\/j.jisa.2026.104409_bib0028","first-page":"1","article-title":"Binary feature mask optimization for feature selection","author":"Lorasdagi","year":"2024","journal-title":"Neural Comput Applic"},{"key":"10.1016\/j.jisa.2026.104409_bib0029","series-title":"2015 military communications and information systems conference (MilCIS)","first-page":"1","article-title":"Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set)","author":"Moustafa","year":"2015"},{"key":"10.1016\/j.jisa.2026.104409_bib0030","series-title":"2022\u202fIEEE Conference on communications and network security (CNS)","first-page":"254","article-title":"Error prevalence in nids datasets: a case study on cic-ids-2017 and cse-cic-ids-2018","author":"Liu","year":"2022"},{"key":"10.1016\/j.jisa.2026.104409_bib0031","first-page":"108","article-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization","volume":"1","author":"Sharafaldin","year":"2018","journal-title":"ICISSp"},{"key":"10.1016\/j.jisa.2026.104409_bib0032","unstructured":"S.I.R. Team. Datasets malware. 2023. Accessed: 2025-02-19; https:\/\/www.stratosphereips.org\/datasets-malware."},{"key":"10.1016\/j.jisa.2026.104409_bib0033","unstructured":"Networkx. https:\/\/networkx.org\/; 2024. Accessed: 2024-10-10."},{"key":"10.1016\/j.jisa.2026.104409_bib0034","unstructured":"ipapi. https:\/\/pypi.org\/project\/ipapi\/; 2024. Accessed: 2024-10-10."},{"key":"10.1016\/j.jisa.2026.104409_bib0035","series-title":"31st USENIX security symposium (USENIX security 22)","first-page":"3971","article-title":"Dos and don\u2019ts of machine learning in computer security","author":"Arp","year":"2022"},{"key":"10.1016\/j.jisa.2026.104409_bib0036","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2019.105292","article-title":"Dealing with class imbalance in classifier chains via random undersampling","volume":"192","author":"Liu","year":"2020","journal-title":"Knowl Base Syst"},{"key":"10.1016\/j.jisa.2026.104409_bib0037","unstructured":"Qosient L.. Argus netflow documentation. Accessed: February 19, 2026; https:\/\/qosient.com\/argus\/argusnetflow.shtml."},{"key":"10.1016\/j.jisa.2026.104409_bib0038","unstructured":"ElShehaby M., Matrawy A.. Exploring the effect of DNN depth on adversarial attacks in network intrusion detection systems2025.arXiv: 251019761."},{"issue":"3","key":"10.1016\/j.jisa.2026.104409_bib0039","doi-asserted-by":"crossref","first-page":"2751","DOI":"10.1109\/TNSM.2024.3357316","article-title":"Constraining adversarial attacks on network intrusion detection systems: transferability and defense analysis","volume":"21","author":"Alhussien","year":"2024","journal-title":"IEEE Trans Netw Serv Manage"},{"key":"10.1016\/j.jisa.2026.104409_bib0040","series-title":"Proceedings of the 10th ACM workshop on artificial intelligence and security","first-page":"15","article-title":"Zoo: zeroth order optimization based black-box attacks to deep neural networks without training substitute models","author":"Chen","year":"2017"},{"key":"10.1016\/j.jisa.2026.104409_bib0041","doi-asserted-by":"crossref","unstructured":"Bai T., Luo J., Zhao J., Wen B., Wang Q.. Recent advances in adversarial training for adversarial robustness2021. arXiv: 210201356.","DOI":"10.24963\/ijcai.2021\/591"},{"key":"10.1016\/j.jisa.2026.104409_bib0042","series-title":"2024 International conference on computing, networking and communications (ICNC)","first-page":"671","article-title":"Could min-max optimization be a general defense against adversarial attacks?","author":"Abou Khamis","year":"2024"},{"key":"10.1016\/j.jisa.2026.104409_bib0043","unstructured":"Nayebi A., Ganguli S.. Biologically inspired protection of deep networks from adversarial attacks2017.arXiv: 170309202."},{"key":"10.1016\/j.jisa.2026.104409_bib0044","unstructured":"Feinman R., Curtin R.R., Shintre S., Gardner A.B.. Detecting adversarial samples from artifacts2017. arXiv: 170300410."},{"key":"10.1016\/j.jisa.2026.104409_bib0045","series-title":"2020 international symposium on networks, computers and communications (ISNCC)","first-page":"1","article-title":"Evaluation of adversarial training on different types of neural networks in deep learning-based idss","author":"Abou Khamis","year":"2020"},{"key":"10.1016\/j.jisa.2026.104409_bib0046","series-title":"ICC 2020-2020 IEEE International conference on communications (ICC)","first-page":"1","article-title":"Investigating resistance of deep learning-based IDS against adversaries using min-max optimization","author":"Abou Khamis","year":"2020"},{"key":"10.1016\/j.jisa.2026.104409_bib0047","series-title":"30th USENIX security symposium (USENIX security 21)","first-page":"2291","article-title":"{Cost-aware} robust tree ensembles for security applications","author":"Chen","year":"2021"},{"key":"10.1016\/j.jisa.2026.104409_bib0048","unstructured":"Xie C., Wang J., Zhang Z., Ren Z., Yuille A.. Mitigating adversarial effects through randomization2017. arXiv: 171101991."},{"key":"10.1016\/j.jisa.2026.104409_bib0049","series-title":"The 22nd international conference on artificial intelligence and statistics","first-page":"684","article-title":"Defending against whitebox adversarial attacks via randomized discretization","author":"Zhang","year":"2019"},{"issue":"1","key":"10.1016\/j.jisa.2026.104409_bib0050","article-title":"Enhancing adversarial defense in neural networks by combining feature masking and gradient manipulation on the MNIST dataset","volume":"15","author":"Ingle","year":"2024","journal-title":"Int J Adv Comput Sci Applic"},{"key":"10.1016\/j.jisa.2026.104409_bib0051","series-title":"2022\u202fIEEE international symposium on measurements & networking (M&N)","first-page":"1","article-title":"On the use of machine learning approaches for the early classification in network intrusion detection","author":"Guarino","year":"2022"}],"container-title":["Journal of Information Security and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2214212626000396?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2214212626000396?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,4,11]],"date-time":"2026-04-11T15:23:59Z","timestamp":1775921039000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2214212626000396"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":51,"alternative-id":["S2214212626000396"],"URL":"https:\/\/doi.org\/10.1016\/j.jisa.2026.104409","relation":{},"ISSN":["2214-2126"],"issn-type":[{"value":"2214-2126","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A novel perturb-ability score to mitigate evasion adversarial attacks on flow-based ML-NIDS","name":"articletitle","label":"Article Title"},{"value":"Journal of Information Security and Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.jisa.2026.104409","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Author(s). Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"104409"}}