FlowGuard: 基于流匹配的能源系统入侵检测系统中无数据模型窃取攻击的身份无关检测
FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems
AI总结：
提出FlowGuard，一种基于流匹配的身份无关防御方法，通过检测查询是否属于分布外（OOD）来防御针对能源系统入侵检测系统的无数据模型窃取攻击，在单客户端和分布式Sybil场景下均保持稳定检测率。
摘要：
部署在能源基础设施中的人工智能入侵检测系统（IDS）容易受到模型窃取攻击，攻击者可以离线创建规避流量。当前针对模型提取的防御要么依赖于身份绑定的查询监控（对分布式攻击者Sybil无效），要么通过软标签扰动进行预测中毒（不适用于硬标签IDS部署）。因此，我们提出FlowGuard，一种基于流匹配的身份无关防御，在IDS处理之前将传入查询分类为分布外（OOD）。该方法利用了以下事实：为无数据模型窃取攻击合成的查询占据比真实网络流量更低维的流形，导致在使用基于合法数据训练的连续归一化流时，对数似然显著降低。我们在单客户端和分布式（100客户端Sybil）设置下，使用MAZE和DisGUIDE攻击评估了我们的方法，并与PRADA和FDINet进行了比较。当分布发生变化时，PRADA的检测率降至0%，而我们的防御在不依赖身份信息的情况下，在两种设置下均保持稳定的检测率。我们讨论了该方法的范围和局限性，并概述了在数据依赖攻击中的潜在应用。
英文摘要：
Artificial Intelligence (AI)-based Intrusion Detection Systems (IDS) deployed in energy infrastructure are vulnerable to model theft attacks, which allow adversaries to create evasive traffic offline. Current defences against model extraction rely either on identity-bound query monitoring, which is ineffective against distributed attackers (Sybil), or on prediction poisoning through soft-label perturbation, which is inapplicable to hard-label IDS deployments. Therefore, we propose FlowGuard, an identity-independent defence based on flow matching that classifies incoming queries as out-of-distribution (OOD) prior to IDS processing. This approach exploits the fact that queries generated synthetically for data-free model stealing attacks occupy a lower-dimensional manifold than real network traffic. This results in measurably lower log-likelihoods when using a Continuous Normalizing Flow that has been trained on legitimate data. We evaluate our method against PRADA and FDINet using MAZE and DisGUIDE attacks in single-client and distributed (100-client Sybil) settings. While PRADA's detection rate dropped to 0% when the distribution changed, our defence maintained a stable detection rate across both settings without relying on identity information. We discuss the scope and limitations of the approach, and outline potential applications to data-dependent attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
