traffic. Previous research [@grosse_adversarial_2016; @foley_adversarial_2017] acknowledge that certain fields in the data sets are immutable while others are open to perturbations. In this work, we subscribe to this position and place technical constraints on data fields that are mutable. For the data sets used, the mutable fields are described below.

### NSL-KDD Data Set

This data set is an altered version of the KDD’99 data set with over 125,000 training samples and more than 22,000 test samples. As described in [@iglesias_analysis_2015], it contains 41 features based upon raw network traffic elements, flow traffic elements, and content. The data contains attacks from four attack types that were more prevalent at the time of the set’s creation (Denial of Service, Probes, Remote-to-local, and User-to-Root). Attack traffic comprises a little over 50 percent of the data in the set and the normal data in the set is not representative of modern traffic. Engineering the features using common techniques such as one-hot encoding and Min-Max Scaling results in a final data set with 121 features. Of these features, some are immutable such as *protocol-type*, *service*, and *flag*. A change to these values would cause the underlying traffic to become non-functional. The remaining features are 