DeepCloak：对抗性工艺作为一种防御措施来掩盖进程
DeepCloak: Adversarial Crafting As a Defensive Measure to Cloak Processes
摘要：
在过去的十年中，侧信道已被证明是对现代计算系统的重大和实际的威胁。最近的攻击都利用了底层共享硬件。虽然可行，但发动如此复杂的攻击仍然类似于在拥挤的训练站收听私人谈话。攻击者必须进行大量的体力劳动，或者使用人工智能系统来自动化这个过程。最近的学术文献指出了后一种选择。随着廉价计算能力的丰富和人工智能的改进，自动化这些任务非常有利。然而，通过使用人工智能系统，恶意方也继承了它们的弱点。毫无疑问，其中一个弱点是对对抗性样本的脆弱性。与以前的文献相比，我们首次提出使用对抗学习作为一种防御工具来混淆和掩盖私人信息。我们通过首先训练CNN和其他机器学习分类器对不同过程的泄漏跟踪来证明这种方法的可行性。在训练了高度准确的模型（99%以上的准确率）之后，我们研究了它们对对抗性学习方法的解决方案。通过对输入轨迹应用最小的扰动，防御者的对抗性流量可以作为原始进程的附件运行，并将其伪装成恶意分类器。最后，我们研究了攻击者是否可以通过采用对抗性防御方法，即对抗性再训练和防御性蒸馏来保护她的分类器模型。我们的研究结果表明，即使存在采用此类技术的智能对手，所有10种经过测试的对抗性学习方法仍然能够成功地制造对抗性扰动，并且所提出的隐形方法也取得了成功。
英文摘要：
Over the past decade, side-channels have proven to be significant and practical threats to modern computing systems. Recent attacks have all exploited the underlying shared hardware. While practical, mounting such a complicated attack is still akin to listening on a private conversation in a crowded train station. The attacker has to either perform significant manual labor or use AI systems to automate the process. The recent academic literature points to the latter option. With the abundance of cheap computing power and the improvements made in AI, it is quite advantageous to automate such tasks. By using AI systems however, malicious parties also inherit their weaknesses. One such weakness is undoubtedly the vulnerability to adversarial samples. In contrast to the previous literature, for the first time, we propose the use of adversarial learning as a defensive tool to obfuscate and mask private information. We demonstrate the viability of this approach by first training CNNs and other machine learning classifiers on leakage trace of different processes. After training highly accurate models (99+% accuracy), we investigate their resolve against adversarial learning methods. By applying minimal perturbations to input traces, the adversarial traffic by the defender can run as an attachment to the original process and cloak it against a malicious classifier. Finally, we investigate whether an attacker can protect her classifier model by employing adversarial defense methods, namely adversarial re-training and defensive distillation. Our results show that even in the presence of an intelligent adversary that employs such techniques, all 10 of the tested adversarial learning methods still manage to successfully craft adversarial perturbations and the proposed cloaking methodology succeeds.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
