Feature-space, not problem-space. Constraints approximate what packet-level changes can do;
side effects (more packets also lengthen duration) and attack semantics (a DoS needs its volume)
are not enforced, which favours the attacker. But the schema also treats as fixed several
features a client can influence indirectly: ct_* (its own connection counts, via pacing or
decoy connections), trans_depth (HTTP pipelining), and server-response features bwd_* /
dbytes and syn_count (via request choice and retransmissions). That favours the defender, and
the robust-feature model's flat curve is conditional on it.
Budget semantics. eps bounds the controllable features; derived features (rates, means) are
recomputed after projection and integer rounding, so the realised all-feature L-inf can exceed eps.
The textbook attack bounds all features by eps. The two are not budget-matched and neither is a
superset of the other.
Empirical robustness only. Our attacks are strong but not exhaustive; every robustness number
is an upper bound. Adversarial training was evaluated with the same attack family it trained on.
The adversarial-input alarm's 1.000 AUC is not a robustness claim. Against a detector-aware
attacker (one attack at eps=2, gradients from an alarm-unaware MLP) it detects 0.876 on
CIC-IDS2017 but raises FPR to 2.8 %; this single-budget figure may be optimistic.
Poisoning defence is partial. The robust-feature kNN sanitiser recovers most poisons but a
handful of survivors keeps the backdoor alive (5 seeds: success 0.08 on CIC, 0.68 on UNSW), and on
UNSW it removes 10.8 % of clean benign flows, costing 2.6 points of clean accuracy. On CIC the
trigger value alone already evades 33 % of the clean model's detections because init_win_fwd is
itself a strong, attacker-controlled feature.
Dataset artefacts. CIC-IDS2017 has known labelling issues (Engelen et al., 2021) and UNSW-NB15's
sttl / swin separate classes because of the testbed; both inflate clean scores. FEINT surfaces
them (SHAP, single-feature attacks) rather than fixing them.
Sampling. CIC results use a de-duplicated 10 % per-class sample (floor 5,000 flows, smaller
classes kept whole; duplicates counted in the 11-feature schema projection) for CPU budget; UNSW
uses the full official split; CICIoT2023 is capped at 5,000 flows per label. The 5-seed study
covers clean metrics, constrained curves (undefended, adversarially trained and robust-feature
models) and poisoning; counterfactuals, the alarm and stealing are single-seed.
UNSW derived features (sload, dload, sinpkt, smean, dmean) are recomputed from base
columns with a different convention from the published columns (e.g. the sload ratio is about
spkts/(spkts-1)); only rate matches. Clean metrics can differ slightly from models trained on the
published columns.
Not implemented from the spec: self-captured lab pcaps via CICFlowMeter (needs an isolated lab
network and traffic generation; not feasible on this machine). The React dashboard is replaced by a
static JavaScript dashboard over the committed JSON reports (demo).
Roadmap
[x] Multiple seeds with confidence intervals (feint seeds)
[x] Model-stealing experiment (feint steal)
[x] Docs site, static dashboard, Docker image and tagged releases
[ ] Problem-space validation: replay perturbed flows in a lab network and re-extract with CICFlowMeter