ARCHIVES

Machine learning-based Network Intrusion Detection Systems (NIDS) have become critical security infrastructure, but the vast majority of published research reports accuracy only on clean, unperturbed traffic, leaving their robustness to adversarial evasion unexplored. Existing research into adversarial robustness, when it has occurred, has largely imported image-domain approaches of unconstrained perturbation to network traffic, producing "adversarial" examples that could not possibly occur on a real network, and so failing to probe the true robustness of the system to real-world adversaries. We propose AdvRoNIDS, a constraint-aware adversarial robustness framework for NIDS that (i) trains a deep 1D-CNN classifier on flow-based features from the CICIDS2017 benchmark, (ii) crafts adversarial examples using the Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) restricted to a feasibility-constrained perturbation set (ПЅ) respecting feature immutability, non-negativity of cumulative counters, and empirical feature bounds, (iii) hardens the classifier through min-max adversarial training against this constrained attacker, and (iv) evaluates the resulting system using a transparent two-number benchmark of clean accuracy and accuracy-under-attack across a full perturbation-budget sweep. The undefended classifier collapses from 90.45% clean accuracy to 25.11% under realistic constrained attack at ε = 0.10, while the adversarially trained classifier retains 87.96% accuracy under the same attack, a 62.85 percentage-point improvement, with negligible cost to clean accuracy (90.45% to 90.86%). A SHAP-based attribution-drift analysis further demonstrates that this robustness arises mechanistically rather than incidentally: the undefended model's decision attribution shifts drastically under attack (mean drift 1.898), while the robust model's attribution remains substantially more stable (mean drift 0.923), a 51.4% reduction that is statistically significant (Mann-Whitney p<1.87×10⁻¹⁶¹,Cliff's δ = 0.70, a large effect). We additionally present an applied explainability and LLM-assisted incident-triage layer that translates the system's outputs into analyst-readable incident narratives. This work explicitly scopes itself to constrained feature-space robustness, leaving end-to-end packet-level attack realizability for future work.