Hajizadeh, Mehrdad, Pegah Golchin, Ehsan Nowroozi, Maria Rigaki, Veronica Valeros, Sebastian García, Mauro Conti, and Thomas Bauschert. "{DeepRed}: A Deep {Learning–Powered} Command and Control Framework for {Multi-Stage} Red Teaming Against {ML-based} Network Intrusion Detection Systems." In 19th USENIX WOOT Conference on Offensive Technologies (WOOT 25), pp. 103-127. 2025.
Abstract
Emerging studies demonstrate that machine learning (ML) has the potential to improve the detection capabilities of network intrusion detection systems (NIDS) against evolving cyber threats. However, recent adversarial ML (AML) studies have revealed critical ML vulnerabilities. This paper presents innovative multistage red-teaming techniques to evaluate the robustness of ML-NIDS in real-world adversarial settings. Although extensive research has been conducted in this area, existing studies have critical shortcomings:(1) relying on unrealistic threat models,(2) focusing on traffic flow perturbation for evasion while neglecting that malicious activity occurs at the packet level, and (3) failing to preserve attack functionality after perturbation. Guided by offensive security principles, we present DeepRed, an ML-powered Command and Control (C2) framework designed to evade targeted ML-NIDS while maintaining a stealthy post-exploitation communication channel. DeepRed leverages Generative Adversarial Networks (GANs) to generate adversarial examples that comply with TCP/IP constraints and are realizable as packet-level perturbations. We further propose two novel attack strategies, Single-Packet Single-Feature (SPSF) and Single-Feature Perturbation (SFP), to achieve evasion under highly constrained conditions with minimal perturbation. To enable robust evaluation, we built a comprehensive ML-NIDS benchmarking dataset containing benign and malicious traffic from our red-team exercises. Additionally, we introduce pipeline-independent adversarial testing to evaluate state-of-the-art models, such as FlowTransformer and SSCL-IDS, across varying features, training data, and preprocessing pipelines—while preserving attack functionality. Results demonstrate that DeepRed can reduce detection rates by up to 20%, highlighting the framework’s ability to bypass ML-NIDS while maintaining operational integrity.
Read more: https://www.usenix.org/conference/woot25/presentation/hajizadeh