domains. By doing so, we achieve high misclassification rates in the majority of commonly used machine learning models applied to the data sets NSL-KDD and UNSW-NB15. Our baseline MC simulation perturbation method generates more or less random perturbations in the data.

We end this section by mentioning that similar techniques appeared previously in the adversarial machine learning literature [@shah2019evaluating]. Hu and Tan [@hu2017generating] propose a GAN-based algorithm named MalGAN to generate adversarial malware examples which are able to bypass black box machine learning detection models. Nguyen, Yosinski and Clune [@Nguyen_2015] use evolutionary algorithms to generate images that are given high prediction scores by convolutional neural networks. Drawing ideas from genetic programming, Xu, Qi, and Evans [@xu2016automatically] propose a generic method to evaluate the robustness of classifiers under attack. Their key idea is to stochastically manipulate a malicious sample to find a variant that preserves the malicious behavior but is classified as benign by the classifier. More recently, Alzantot et al. [@10.1145/3321707.3321749] introduced GenAttack, a gradient-free optimization technique that uses genetic algorithms for synthesizing adversarial examples in the black box setting. Mosli et al. [@mosli2019giants] created AdversarialPSO, a black-box attack that uses fewer queries to create adversarial examples with high success 