TriAlign-ATG: protocol-constrained adversarial traffic generation for learning-based traffic analysis

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Deep-learning-based network intrusion detection systems are increasingly deployed to protect network security in operational environments. Strengthening their real-world robustness, however, requires physically executable adversarial traffic that can expose detector vulnerabilities under realistic conditions and ultimately support defensive hardening. A major obstacle in current research is the disconnect between abstract feature perturbations and realizable packet-level traffic. Many existing attacks optimize perturbations in feature space and then reconstruct them into transmittable packets. Under strict protocol constraints, this inverse mapping is both computationally expensive and inherently lossy, causing the intended perturbations to be distorted and their adversarial effectiveness to degrade in real environments. To mitigate the reconstruction distortion caused by feature-to-packet inverse mapping, we propose an LLM-guided edit-generation and deterministic traffic-materialization framework. We introduce a traffic-text alignment mechanism that converts binary packet sequences into structured textual descriptions, enabling the model to understand and manipulate complex traffic semantics while preserving protocol-relevant structure. We further design a progressive three-stage alignment strategy that teaches the syntax of traffic serialization, semantic reasoning for traffic manipulation, and strategic adversarial logic. Finally, a traffic editing module materializes the generated protocol-constrained adversarial edit descriptions into executable PCAP traces while ensuring protocol correctness. Evaluations on the CIC-IoT-2023 and MobileTraffic datasets show that our framework outperforms the strongest baseline by an average of 20 percentage points while producing executable adversarial traffic under protocol constraints.