在线质心异常检测的安全性分析
Security Analysis of Online Centroid Anomaly Detection
摘要：
安全问题在许多机器学习应用中是至关重要的，特别是在处理人类活动而不是自然现象的场景中（例如，信息排名、垃圾邮件检测、恶意软件检测等）。在这种情况下，学习算法将不得不处理旨在阻碍决策的操纵数据。虽然以前的一些工作解决了在监督学习的背景下处理恶意数据，但对异常检测方法在这种情况下的行为知之甚少。在这篇文章中，我们分析了一种特定的方法-在线质心异常检测-在对抗性噪声的存在下的性能。我们的分析解决了以下与安全相关的问题：学习和攻击过程的形式化，推导出最佳攻击，分析其效率和约束。我们推导出在不同的条件下，对质心异常的中毒攻击的有效性的界限：有界和无界的流量百分比，和有界的误报率。我们的界限表明，而中毒攻击可以有效地分期在无约束的情况下，它可以任意困难（严格的上限攻击者的收益），如果外部约束被正确使用。我们对真实HTTP和漏洞利用跟踪进行的实验评估证实了我们的理论界限的严密性和我们的保护机制的实用性。
英文摘要：
Security issues are crucial in a number of machine learning applications, especially in scenarios dealing with human activity rather than natural phenomena (e.g., information ranking, spam detection, malware detection, etc.). It is to be expected in such cases that learning algorithms will have to deal with manipulated data aimed at hampering decision making. Although some previous work addressed the handling of malicious data in the context of supervised learning, very little is known about the behavior of anomaly detection methods in such scenarios. In this contribution we analyze the performance of a particular method -- online centroid anomaly detection -- in the presence of adversarial noise. Our analysis addresses the following security-related issues: formalization of learning and attack processes, derivation of an optimal attack, analysis of its efficiency and constraints. We derive bounds on the effectiveness of a poisoning attack against centroid anomaly under different conditions: bounded and unbounded percentage of traffic, and bounded false positive rate. Our bounds show that whereas a poisoning attack can be effectively staged in the unconstrained case, it can be made arbitrarily difficult (a strict upper bound on the attacker's gain) if external constraints are properly used. Our experimental evaluation carried out on real HTTP and exploit traces confirms the tightness of our theoretical bounds and practicality of our protection mechanisms.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
