  Due to its high expressiveness and speed, Deep Learning (DL) has become an
increasingly popular choice as the detection algorithm for Network-based
Intrusion Detection Systems (NIDSes). Unfortunately, DL algorithms are
vulnerable to adversarial examples that inject imperceptible modifications to
the input and cause the DL algorithm to misclassify the input. Existing
adversarial attacks in the NIDS domain often manipulate the traffic features
directly, which hold no practical significance because traffic features cannot
be replayed in a real network. It remains a research challenge to generate
practical and evasive adversarial attacks.
  This paper presents the Liuer Mihou attack that generates practical and
replayable adversarial network packets that can bypass anomaly-based NIDS
deployed in the Internet of Things (IoT) networks. The core idea behind Liuer
Mihou is to exploit adversarial transferability and generate adversarial
packets on a surrogate NIDS constrained by predefined mutation operations to
ensure practicality. We objectively analyse the evasiveness of Liuer Mihou
against four ML-based algorithms (LOF, OCSVM, RRCF, and SOM) and the
state-of-the-art NIDS, Kitsune. From the results of our experiment, we gain
valuable insights into necessary conditions on the adversarial transferability
of anomaly detection algorithms. Going beyond a theoretical setting, we replay
the adversarial attack in a real IoT testbed to examine the practicality of
Liuer Mihou. Furthermore, we demonstrate that existing feature-level
adversarial defence cannot defend against Liuer Mihou and constructively
criticise the limitations of feature-level adversarial defences.
