{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T09:10:39Z","timestamp":1785316239774,"version":"3.55.0"},"reference-count":168,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Italian Ministry of University and research","award":["CUP B53D23012910006"],"award-info":[{"award-number":["CUP B53D23012910006"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/access.2025.3600984","type":"journal-article","created":{"date-parts":[[2025,8,20]],"date-time":"2025-08-20T18:43:26Z","timestamp":1755715406000},"page":"148613-148645","source":"Crossref","is-referenced-by-count":61,"title":["Adversarial Challenges in Network Intrusion Detection Systems: Research Insights and Future Prospects"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-5119-3467","authenticated-orcid":false,"given":"Sabrine","family":"Ennaji","sequence":"first","affiliation":[{"name":"Sapienza University of Rome, Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9718-1044","authenticated-orcid":false,"given":"Fabio","family":"de Gaspari","sequence":"additional","affiliation":[{"name":"Sapienza University of Rome, Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5686-3831","authenticated-orcid":false,"given":"Dorjan","family":"Hitaj","sequence":"additional","affiliation":[{"name":"Sapienza University of Rome, Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alicia","family":"Kbidi","sequence":"additional","affiliation":[{"name":"Sapienza University of Rome, Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4859-2191","authenticated-orcid":false,"given":"Luigi","family":"Vincenzo Mancini","sequence":"additional","affiliation":[{"name":"Sapienza University of Rome, Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2009.2034031"},{"key":"ref2","first-page":"689","article-title":"DROWN: Breaking TLS using SSLv2","volume-title":"Proc. 25th USENIX Secur. Symp. (USENIX Secur.)","author":"Aviram"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11119-3_23"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TETC.2018.2806977"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663755"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.5555\/3241189.3241275"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2006.06.015"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.matpr.2021.02.153"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.102159"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-33432-1_1"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-02110-8_2"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-0977-9"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3318964"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3129336"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICMSAO.2015.7152200"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3472753"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.195"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1181"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/DSN53405.2022.00035"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638947"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2205597"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-21568-2_11"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00453"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17143-7_21"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3288215"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-022-07586-7"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-65745-1_3"},{"key":"ref29","volume-title":"How Valencia Crushed COVID With AI","author":"Marx","year":"2021"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-86514-6_24"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-010-5188-5"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/s13748-021-00269-9"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3551636"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-70879-4_5"},{"key":"ref35","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Goodfellow"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2019.2933524"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-05981-0_7"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00019"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2019.8761337"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-57878-7_13"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3395352.3402618"},{"key":"ref42","article-title":"Generating practical adversarial network traffic flows using NIDSGAN","author":"Zolbayar","year":"2022","journal-title":"arXiv:2203.06694"},{"key":"ref43","article-title":"Adversarial training for deep learning-based intrusion detection systems","author":"Debicha","year":"2021","journal-title":"arXiv:2104.09852"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2494502"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2896380"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1002\/ett.4150"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-020-02014-x"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-021-10037-9"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-24318-0_69"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3547330"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3627817"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3003816"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3433667.3433670"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3453158"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3127960"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1016\/j.sysarc.2022.102526"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.37256\/jeee.4120255738"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.3036778"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2974752"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.3390\/fi15020062"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.3390\/s23052415"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2022.3233793"},{"key":"ref63","first-page":"1","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Ma"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2019.105124"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2014.04.012"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2020.04.133"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-86337-1_23"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3234200.3234238"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/PMBS56514.2022.00007"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/s12243-022-00910-1"},{"key":"ref71","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Szegedy"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.3390\/e23010018"},{"key":"ref76","article-title":"NIPS 2016 tutorial: Generative adversarial networks","author":"Goodfellow","year":"2017","journal-title":"arXiv:1701.00160"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00031"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2020\/197"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref83","article-title":"MagNet and \u2019efficient defenses against adversarial attacks\u2019 are not robust to adversarial examples","author":"Carlini","year":"2017","journal-title":"arXiv:1711.08478"},{"key":"ref84","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref85","article-title":"On evaluating adversarial robustness","author":"Carlini","year":"2019","journal-title":"arXiv:1902.06705"},{"key":"ref86","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tram\u00e8r"},{"key":"ref87","article-title":"On detecting adversarial perturbations","author":"Hendrik Metzen","year":"2017","journal-title":"arXiv:1702.04267"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3162874"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/ICIVC55077.2022.9886997"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00714"},{"key":"ref91","article-title":"Wasserstein auto-encoders","volume-title":"Proc. 6th Int. Conf. Learn. Represent. (ICLR)","author":"Tolstikhin"},{"key":"ref92","first-page":"4970","article-title":"Improving adversarial robustness via promoting ensemble diversity","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pang"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/3469659"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/PST62714.2024.10788064"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2024.3492032"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.3390\/a17040155"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3238823"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103601"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2994931"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3372202"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2022.103202"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1145\/3360468.3368183"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOMW.2018.8407032"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2986013"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2017.7966339"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.04.013"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-021-00448-4"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2021.03.060"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2022.09.026"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453101"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2019.107049"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2928048"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107247"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-019-8208-z"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.05.022"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2875045"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2022.107764"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2022.108156"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1145\/3365001"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3407029"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.123808"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2022.3168533"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1016\/j.asej.2024.102777"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.3390\/fi14080240"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1109\/MPRV.2018.03367731"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2023.110173"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/CISS48834.2020.1570617116"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-26763-6_72"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1145\/3359992.3366642"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2020.102717"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2021.115782"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2021.3137084"},{"key":"ref136","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilyas"},{"key":"ref137","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"Brendel","year":"2017","journal-title":"arXiv:1712.04248"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref139","article-title":"Towards the first adversarially robust neural network model on MNIST","author":"Schott","year":"2018","journal-title":"arXiv:1805.09190"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/CAC51589.2020.9326734"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/ICTAI.2019.00179"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3201377"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103176"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.3390\/fi14040108"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-210094"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.109073"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2021.3087242"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1002\/dac.5554"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3317877"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.125119"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/TCCN.2020.3010330"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.3390\/rs15184514"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6918"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.3390\/computers11070115"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1145\/3555776.3577651"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1016\/j.heliyon.2023.e13520"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2022.02.019"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1145\/3411495.3421359"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2022.103398"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3148990"},{"key":"ref161","article-title":"A boundary tilting persepective on the phenomenon of adversarial examples","author":"Tanay","year":"2016","journal-title":"arXiv:1608.07690"},{"key":"ref162","article-title":"The robust manifold defense: Adversarial training using generative models","author":"Jalal","year":"2017","journal-title":"arXiv:1712.09196"},{"key":"ref163","article-title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","author":"Samangouei","year":"2018","journal-title":"arXiv:1805.06605"},{"key":"ref164","article-title":"The relationship between high-dimensional geometry and adversarial examples","author":"Gilmer","year":"2018","journal-title":"arXiv:1801.02774"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103483"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2022.107986"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1109\/ICSESS49938.2020.9237728"},{"key":"ref168","article-title":"Feature squeezing: Detecting adversarial examples in deep neural networks","author":"Xu","year":"2017","journal-title":"arXiv:1704.01155"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10820123\/11131124.pdf?arnumber=11131124","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,29]],"date-time":"2025-08-29T17:43:40Z","timestamp":1756489420000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11131124\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":168,"URL":"https:\/\/doi.org\/10.1109\/access.2025.3600984","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}