derived from the underlying network traffic. Normally, this data is engineered in research work to detect intrusions in a network. In many works [@grosse_adversarial_2016; @foley_adversarial_2017; @elsayed_adversarial_2018], effort is made to alter the data to create adversarial examples that can fool detection systems and classifiers. In domains such as image and speech recognition, perturbing the data to fool the systems can be done in a manner that does not affect the functionality or appearance of the original item. For example, changing pixel values in an image by a few bits can be undetectable to the human eye yet fool a trained machine learning classifier. In network security applications, which is an unconstrained domain, care must be taken when generating adversarial examples that alter the source data. There are data, such as the duration of a network packet flow, that if altered will not impact the functionality of the protocol. However, there are fields that if changed can cause the functionality of the transmission to fail, such as changing the protocol type from TCP to UDP.

The goal of an attacker (who may use adversarial examples) is to alter packets to achieve a desired effect while still maintaining the functionality of the 