Strategic Games and Zero Shot Attacks on Heavy-Hitter Network Flow Monitoring

Strategic Games and Zero Shot Attacks on Heavy-Hitter Network Flow Monitoring

Speakers: Francesco Da Dalt

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=vv1xcudyhQU

Overview

This research applies game-theoretic reinforcement learning to the problem of configuring network flow monitoring systems against adaptive adversaries. The core insight is that both defenders (configuring heavy-hitter detectors) and attackers (crafting evasion traffic) face a dependency loop: the optimal defense depends on the attack, and the optimal attack depends on the defense. Rather than relying on heuristics or historical data, the researchers use adversarial co-training to find robust configurations that approximate Nash equilibria.

The work produces two notable results. First, co-training a heavy-hitter detector against learned adversaries reduces exploitability by a factor of 2.2x (from 300% overuse to 140%) without changing any algorithms -- only configuration parameters change. Second, a neural network adversary trained against a proxy neural heavy-hitter detector generates zero-shot attacks that successfully evade 8 out of 9 peer-reviewed detection algorithms it has never seen during training, demonstrating that learned attack strategies transfer across fundamentally different monitoring implementations.

Background

▶ Watch: Problem: optimally configuring systems against adaptive adversaries (0:00)

Heavy-hitter detection is a core component of volumetric DDoS defense. Network monitoring systems classify traffic flows as either "mice" (normal) or "elephant" (heavy-hitter) flows. Detected heavy-hitters are then subjected to token bucket rate limiting, which drops packets from flows exceeding their fair share of bandwidth. The detection component is designed to be computationally cheap but approximate (accepting false positives and negatives), while the rate limiter is exact but more resource-intensive.

The challenge is configuration: heavy-hitter detectors have parameters that must be tuned, and the optimal parameter choices depend on the attack patterns the system will face. In practice, operators configure these systems using heuristics, historical data, or best practices -- approaches that leave systems vulnerable to adaptive adversaries who can observe and exploit specific configurations.

Nine different heavy-hitter detection algorithms from the academic literature were implemented and evaluated, spanning a range of algorithmic approaches. The research uses both synthetic and captured real-world background traffic for evaluation, with all code, simulation framework, and trained models available as open source.

Key Findings

▶ Watch: Reinforcement learning feedback loop for defender optimization (4:00)

Adaptive adversaries can consistently evade heavy-hitter detectors. Neural network adversaries trained via reinforcement learning found ways to overuse bandwidth against all nine heavy-hitter detection methods, both on synthetic and captured traffic. On captured traffic, overuse was generally even higher due to different traffic statistics that provided more cover for evasive behavior.

Each detection method has a distinct vulnerability profile. The nine neural networks trained against nine different detectors generated distinctly different attack traffic patterns, as visualized in phase-space diagrams of packet size vs. frequency. This clustering indicates that attacks are truly adapting to specific detection mechanisms rather than finding generic evasion strategies.

Adversarial co-training reduces exploitability by 2.2x without changing algorithms. By iteratively training adversaries and defenders against each other, the defense configuration parameters converge to more robust settings. In one instance, attacker overuse dropped from 300% to 140%, and defender detection scores increased by a factor of 1.6x -- all without modifying the underlying detection algorithms, only their configuration parameters.

Zero-shot attacks transfer across unseen detection methods. A neural adversary trained only against a neural proxy detector (never exposed to any of the nine peer-reviewed algorithms) successfully evaded 8 out of 9 methods on synthetic traffic and 9 out of 9 on captured traffic. This demonstrates that the proxy captures enough of the fundamental detection landscape to produce generalizable evasion strategies.

The co-training procedure converges to Nash equilibrium. The iterative training process is guaranteed to converge to a mixed Nash equilibrium, where both attacker and defender play probabilistic mixtures of their learned strategies.

Technical Deep Dive

▶ Watch: Phase-space analysis: distinct attack strategies per detection method (8:00)

The system architecture consists of two reinforcement learning loops:

Defender loop: The heavy-hitter detector is instrumented with configurable parameters. A reward signal is generated based on the amount of malicious traffic successfully dropped. The RL agent optimizes these parameters to maximize detection reward across simulation episodes.

Adversary loop: A neural network controls a traffic generator, determining packet sizes and inter-packet timing intervals. The reward signal is the amount of traffic that successfully traverses the network link and reaches the receiver (acknowledged back to the neural network). The adversary is incentivized to find traffic patterns that circumvent rate limiting while maximizing throughput.

Adversarial co-training uses an iterative procedure: train defender version 0, then train adversary 0 to attack it, then train defender version 1 to defend against adversary 0, then train adversary 1 to attack both defender versions 0 and 1, and so forth. Each iteration, the defender learns to handle all previous adversary versions, and each adversary learns to evade all previous defender versions. This is guaranteed to converge to a mixed Nash equilibrium.

For zero-shot attacks, the key innovation is replacing the parameterized heavy-hitter detector with a neural network proxy that has many more degrees of freedom. This proxy can model a much larger space of possible detection behaviors than any individual algorithm with its limited parameter set. The adversary trained against this proxy learns general evasion principles that transfer to real detection algorithms it has never seen. The neural proxy and adversary are co-trained using the same iterative procedure.

The nine implemented heavy-hitter detection methods represent a diverse cross-section of the literature, ensuring that the zero-shot transfer results are not an artifact of algorithmic similarity.

Demo / Proof of Concept

▶ Watch: Co-training reduces exploitability by 2.2x without algorithm changes (10:00)

The researchers conducted extensive simulations demonstrating both the attack and defense capabilities:

Attack demonstration: Nine separate neural network adversaries were trained against nine heavy-hitter detection methods. Each successfully found ways to overuse bandwidth, with phase-space analysis showing distinct attack strategies per method. On captured real-world traffic, overuse was generally higher than on synthetic traffic.

Defense improvement: Adversarial co-training on a specific method reduced attacker overuse from 300% to 140% (2.2x reduction) while improving the defender's detection score by 1.6x. Critically, no algorithm changes were required -- only configuration parameter adjustments derived from the co-training process.

Zero-shot transfer: A single adversary trained against a neural proxy detector achieved successful overuse against 8/9 methods on synthetic traffic and 9/9 on captured traffic, despite never having seen any of these methods during training.

All code, the simulation framework, and trained models are publicly available.

Defensive Implications

▶ Watch: Results: zero-shot attacks succeed against 8/9 unseen methods (14:00)

This research has important implications for how organizations configure and evaluate their network monitoring infrastructure:

Static configurations are exploitable. Any heavy-hitter detection system configured using fixed heuristics or historical data is vulnerable to adaptive adversaries who can probe and learn the configuration. Defenders should assume that sophisticated attackers will adapt their traffic patterns to the specific monitoring system deployed.

Configuration matters more than algorithm choice. The co-training results show that properly configured detection parameters can reduce exploitability by 2.2x without any algorithmic changes. This suggests that organizations may be under-investing in configuration optimization relative to algorithm selection.

Zero-shot transfer attacks are a real threat. An adversary does not need to know which specific detection algorithm is deployed. By training against a sufficiently expressive proxy model, they can generate traffic patterns that evade a wide range of detection methods. This undermines the "security through obscurity" approach of not disclosing which monitoring tools are in use.

Adversarial evaluation should become standard. Organizations should evaluate their flow monitoring systems not just against historical attack data but against adaptive adversaries. The open-source framework released with this paper enables this type of evaluation.

The game-theoretic framework is generalizable beyond flow monitoring to any security scenario with antagonistic entities and large configuration spaces -- firewall rules, WAF configurations, anomaly detection thresholds, and more.

Key Takeaways

• Neural network adversaries can consistently find ways to evade all nine tested heavy-hitter detection algorithms, generating distinct attack strategies per method
• Adversarial co-training reduces exploitability by 2.2x without changing detection algorithms -- only configuration parameters improve
• Zero-shot attacks trained against a neural proxy detector successfully evade 8/9 unseen peer-reviewed detection methods on synthetic traffic and 9/9 on captured traffic
• The co-training procedure is guaranteed to converge to a mixed Nash equilibrium
• All training uses label-free or synthetic data, eliminating the need for labeled attack datasets
• The framework and all code are open-source and applicable to other adversarial security scenarios beyond flow monitoring

About the Speaker(s)

Francesco Da Dalt is a PhD student at ETH Zurich, working under the supervision of Adrian Perrig. The research focuses on applying game-theoretic and reinforcement learning approaches to network security configuration problems, with emphasis on finding principled solutions to the configuration challenge in adversarial environments.