Adversarial Machine Learning Against Bot Detection Classifiers

Automated bots made up 51% of all web traffic in 2024, the first year on record that machines outnumbered people online, and bad bots alone accounted for 37% of all internet traffic. That crossover changes what the fight over bot detection actually is: a contest over who controls the majority of traffic hitting a server, fought through adversarial machine learning. Attackers manipulate classifiers. Defenders rebuild them, and the two sides trade the lead back and forth without ever settling the question. This piece maps where each side currently stands, and takes a clear position: defenders who treat this as a one-time hardening exercise, rather than a permanent arms race, end up several laps behind, and most of them do.

Simple, high-volume attacks grew from 40% of all bot attacks in 2023 to 45% in 2024, a rise Imperva ties to free, AI-powered automation tools that let low-skill attackers run what used to require real engineering effort. The floor for launching an attack dropped. The ceiling for defending against one kept climbing, and most of the defensive literature still hasn't caught up to that gap.

The three axes of adversarial ML attack that matter for bot detection

Attacks against bot detection classifiers split into three categories, and treating them as one problem is the most common mistake in how this space gets discussed.

Evasion attacks happen at inference time. The attacker tweaks traffic or behavioral signals just enough to slip past the classifier at the moment of prediction, without touching the training pipeline. This is the category that matters most in practice, since it needs nothing more than the ability to shape what the model sees when it makes a call.

Poisoning attacks work upstream, corrupting training data or labels so the model degrades over time or ships with a hidden backdoor. A 2025 systematic survey, framed as the first adversarial-aware analysis of botnet detection strategies, zeroes in on noise injection and feature perturbation as key vectors attackers use to manipulate a model's inputs and degrade its reliability.

Generative attacks go further still. Instead of one crafted sample, the attacker uses GANs or deep reinforcement learning to build entire populations of traffic that read as statistically legitimate, a factory that turns out working keys on demand rather than a single lockpick. Defenders underestimate this category more than the other two, because it doesn't look like a single exploit to patch. It looks like an entire distribution of traffic that happens to be fake.

Treating poisoning, evasion, and generation as three separate patches is the mistake, because none of these axes work alone and a defender who patches them one at a time misses how they compound. An attacker can poison a model to weaken its decision boundary, then follow with evasion traffic engineered specifically to slip through that weakened spot.

Perturbing network traffic versus an image (the feature-space constraint problem)

Adversarial machine learning started in computer vision, where the bar for success is oddly forgiving: change pixels enough to fool the model, but not enough for a human eye to notice. Network traffic offers no such room. A perturbed packet still has to route, still has to complete a handshake, still has to carry a payload that does whatever the attacker needs it to do. Fooling the classifier while breaking the protocol is just a dropped packet. It is just a dropped packet.

The constraint runs deeper once you look at the data itself. Most features in network intrusion detection (NIDS) datasets are boolean or discrete: a port is either open or it isn't, a flag is either set or it isn't. That leaves an attacker almost no room to nudge a real-valued feature the way you'd nudge a pixel's color value in an image. The math that works cleanly on continuous image data hits a wall on traffic data that's mostly categorical, and that's why image-domain adversarial techniques don't port over to network security nearly as well as early researchers assumed.

A second mismatch grows out of the same split between raw packets and statistical summaries. ML-based NIDS systems don't classify raw packets, they classify statistical summaries of traffic flows: byte counts, timing intervals, protocol distributions. That splits the problem into two spaces. There's the traffic space, where actual packets move across the wire, and the feature space, where the classifier does its work. A change that looks harmless in feature space can be physically impossible to produce in traffic space, and a genuinely realistic adversarial example has to satisfy both at once.

A 2024 paper in IEEE Transactions on Network and Service Management tries to formalize this, proposing four domain constraints that separate a real adversarial NIDS attack from a toy version of one. Whether an attacker can touch a given field at all without breaking the protocol underneath is what feature mutability asks. Feature value constraints ask what range of values is physically possible. Feature dependency constraints capture the fact that changing one field forces changes elsewhere: altering packet size shifts timing, which shifts flow duration downstream. Distribution-preserving constraints require that the doctored traffic not stick out statistically against the rest of the network's background noise. If any one of these four is skipped, the attack is solving an easier problem than the one that actually sits on a live network.

Evasion in practice: Adv-Bot, deep reinforcement learning, and the black-box setting

Adv-Bot is a black-box adversarial algorithm built to generate valid botnet traffic without any knowledge of the target NIDS's architecture or internal parameters, and that framing is the whole point of the design. An attacker probing a live detection system from outside almost never has weight or gradient access, so white-box attacks describe a threat model that barely exists once a system actually ships.

Adv-Bot's hard constraint is functionality preservation. A command-and-control beacon has to still beacon. A flood packet has to still hit its target. Traffic that evades detection by degrading into garbage is just failure with extra steps. It's just failure with extra steps. On the defense side, the paper pairs adversarial detection with ensemble bagging, on the bet that combining multiple base classifiers raises the cost of crafting one sample that transfers across all of them.

Deep reinforcement learning pushes the problem into a different register. Research on web bots using RL to dodge behavior-based detection looks less like a single attack and more like co-evolution. The bot updates its policy to slip past the current detector, the detector retrains on the newly evasive behavior, and the bot adapts again, with the reward signal steering it toward whatever action sequence currently confuses the classifier. That loop has no natural endpoint.

If the detector retrains on the very evasive samples the bot just generated, the attacker is effectively feeding the defender's training set. That's a poisoning effect hiding inside what looks like ordinary evasion. Naive retraining on adversarial samples can end up teaching the model what the attacker wants it to learn, and most retraining pipelines aren't built to catch that.

Generative attacks: how GANs synthesize adversarial bot traffic

Christos Iliou and colleagues demonstrated GAN-based evasion of web bot detection in work now cited as a foundational reference in this literature. RELEVAGAN builds on an earlier system called EVAGAN and adds deep reinforcement learning to drive semantic-aware generation of evasion samples.

Several of these GAN-based approaches preserve functionality by only manipulating non-functional features, so the GAN never has to produce a complete, end-to-end feature vector. A GAN that perturbs timing and padding while leaving the functional core of a packet untouched is a proof of concept, not a deployable weapon aimed at a production system.

CAPTCHA defenses sit on a parallel track of the same story. These systems were built around tasks assumed to be hard for machines and easy for people: distorted text, image grids, audio clips. Deep learning closed that gap faster than the CAPTCHA designs anticipated. Recent work represented by systems like VIPER Strike sits at the current edge of the trend, targeting visual reasoning CAPTCHAs through vision-language inference rather than brute-force pattern matching, which puts it in the same LLM-era bracket as the fingerprinting failures below.

The defensive answer here has its own name: CAPTURE. It is presented as a system that turns the adversarial example mechanism back on the attacker, generating CAPTCHAs engineered to stay easy for a human and hard for an ML-based solver. Testing showed it holding up against automated solvers, which makes it one of the few defenses in this space built on the attacker's own mathematics, redirected against them.

The LLM-bot frontier: fingerprinting failures and behavioral drift as a new evasion paradigm

A 2026 paper claims the first large-scale study identifying LLM-based bots from a web server's own vantage point, using single-request, multi-layer fingerprinting that reads technical, API-level signals instead of waiting to watch a bot across multiple visits. That's a real shift in method. Earlier bot-detection work usually needed a session's worth of behavior to build confidence. This approach tries to make the call on request one.

Browser fingerprinting has been the workhorse stateless detection layer for years: software versions, screen resolution, installed fonts, plugins, HTTP header order, all collected into something close to a unique identifier for the requesting client. Because it doesn't depend on cookies, it resists older evasion tricks like spoofing a user-agent string, since the fingerprint draws on far more than one header field.

And yet a single request from one of these LLM-based crawlers can pass a fingerprint check cleanly. Nothing about it looks synthetic on its own. The tell appears only at the session level, in systematic, exhaustive content consumption, working through a site page by page in a pattern no incidental human browsing session produces. A practitioner field report describes major vendors building what it calls "LLM-flavored anomaly detection," flagging sessions whose request sequences read like an automated agent working methodically through a site rather than a person clicking around. That's an architectural pivot, from judging one request at a time to judging the shape of an entire session, and it's the direction the whole field is being pushed, whether the tooling is ready or not. Fingerprinting alone can't carry this fight anymore. It was built to catch a different kind of impostor.

Adversarial examples transfer across model architectures, weakening ensemble defenses

Adversarial transferability is one of the more uncomfortable findings in this field. An adversarial example crafted against one model, a neural network standing in as a surrogate, often keeps its adversarial property when handed to a completely different architecture, like a tree-based classifier. That implies the adversarial structure is partly baked into the data itself, not just into one model's blind spot, which makes it a far harder problem to design around than any single classifier's weakness.

One study tested this directly: adversarial examples crafted against a neural network surrogate, then checked against tree-based algorithms. They transferred across architectural boundaries, a result that complicates any defense built on the assumption that different classifier families provide independent protection. That result should worry anyone leaning on a common defensive assumption, that stacking classifiers of different architectural families (a neural net here, a random forest there, a gradient-boosted tree somewhere else) buys resilience automatically because an attacker would need a separate exploit for each one. Architectural diversity still helps, but it isn't the guarantee people treat it as. An adversary with surrogate access can potentially craft one input that transfers across several ensemble members at once, and the defense that assumes otherwise is building on sand.

The same study reports a genuinely strong number on the defensive side: a conformal prediction layer rejected incorrect predictions at a rate up to 98.94% on certain datasets. The qualifier matters as much as the number. A rejection rate that high in one dataset configuration doesn't automatically hold for different traffic types, different adversarial strategies, or production conditions the original study never tested. The result is strong. Its scope is narrow, and both facts belong in the same sentence.

Defense architectures: adversarial training, conformal prediction, and adaptive continual learning

Adversarial training is the default starting point for hardening a classifier: expose it to adversarial examples during training so it learns to handle them at inference time. It works, up to a point, and that point arrives faster than most teams expect. Piling more adversarial samples into training doesn't produce proportional gains in accuracy. Adversarially trained models still get bypassed by attack methods the training set never anticipated, and every added retraining cycle eats real compute time. A classifier hardened against last year's evasion techniques carries no guarantee against next year's, and treating adversarial training as a finished task rather than a recurring cost is where a lot of security budgets go to die.

GAN-augmented defenses flip the generative playbook around: the same technology attackers use, pointed instead at building stronger classifiers. A systematic review of studies published through August 2025 found GANs providing targeted resilience gains against evasion, poisoning, and privacy inference attacks alike. Research has shown CGAN-generated adversarial traffic cutting evasion success by 15% under both FGSM and PGD attack scenarios. GAN-augmented intrusion detection has been found to lift anomaly recall on CICIDS2017 by 12%, with the approach scaling reasonably well against zero-day evasion attempts it was never specifically trained on. The tools that manufacture adversarial bot traffic and the tools that stress-test defenses against it are, mechanically, the same tools pointed in opposite directions. Pretending otherwise is a category error common in a lot of vendor pitches.

Conformal prediction offers a different kind of defense, one built around refusing to answer rather than answering wrong. Instead of forcing a classifier to commit to a label for every input, a conformal prediction layer lets the model abstain when an input looks low-confidence or falls outside the distribution it learned from. A model that says "not sure" on a crafted adversarial input is worth more, operationally, than one that confidently gets it wrong. The 98.94% rejection figure belongs here too, with the same caveat repeated on purpose: strong within its tested scope, not yet a general property of conformal methods across every traffic type.

Adaptive continual learning tries to solve the exact problem the DRL evasion loop exposes: a static model, however well-trained today, decays because attacker behavior drifts while the model stays fixed. Work by Junar and Arockiasamy combines several pieces into one architecture built for zero-day and evolving botnet detection: self-supervised learning, prototypical networks, few-shot learning for handling novel attack classes with limited examples, and a WGAN-GP component that generates synthetic samples to correct for class imbalance. To keep the model from forgetting older attack patterns while it learns new ones, the architecture pairs elastic weight consolidation with an experience replay buffer, aimed squarely at catastrophic forgetting. A drift detector running the KS test, Wasserstein distance, and class-prior shift monitoring watches for concept drift, and triggers retraining once the underlying data distribution has moved enough to justify it.

That last piece closes the loop the DRL section opened earlier. A detector that only retrains on a fixed schedule stays vulnerable to exactly the co-evolutionary attack RL-driven bots run: adapt faster than the retraining cadence, and stay ahead indefinitely. A detector wired to sense its own drift and retrain in response doesn't end that race. It just keeps the defender running in it, instead of watching from several laps behind.