Adversarial Feature Selection against Evasion Attacks

Abstract

Pattern recognition and machine learning techniques have been increasingly adopted in adversarial settings such as spam, intrusion and malware detection, although their security against well-crafted attacks that aim to evade detection by manipulating data at test time has not yet been thoroughly assessed. While previous work has been mainly focused on devising adversary-aware classification algorithms to counter evasion attempts, only few authors have considered the impact of using reduced feature sets on classifier security against the same attacks. An interesting, preliminary result is that classifier security to evasion may be even worsened by the application of feature selection. In this paper, we provide a more detailed investigation of this aspect, shedding some light on the security properties of feature selection against evasion attacks. Inspired by previous work on adversary-aware classifiers, we propose a novel adversary-aware feature selection model that can improve classifier security against evasion attacks, by incorporating specific assumptions on the adversary's data manipulation strategy. We focus on an efficient, wrapper-based implementation of our approach, and experimentally validate its soundness on different application examples, including spam and malware detection.

References in corpus (4)

• Machine Learning in Automated Text Categorization
• Poisoning Attacks against Support Vector Machines
• Security Evaluation of Pattern Classifiers under Attack
• Feature Selection via Probabilistic Outputs

Cited by in corpus (35)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Is feature selection secure against training data poisoning?
• Adversarial Examples: Opportunities and Challenges
• Deep Identity-aware Transfer of Facial Attributes
• MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
• Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks
• Black-Box Attacks against RNN based Malware Detection Algorithms
• Hardening Random Forest Cyber Detectors Against Adversarial Attacks
• TAD: Transfer Learning-based Multi-Adversarial Detection of Evasion Attacks against Network Intrusion Detection Systems
• Adv-Bot: Realistic Adversarial Botnet Attacks against Network Intrusion Detection Systems
• (Quasi-)Real-Time Inversion of Airborne Time-Domain Electromagnetic Data via Artificial Neural Network
• PiNcH: an Effective, Efficient, and Robust Solution to Drone Detection via Network Traffic Analysis
• Arms Race in Adversarial Malware Detection: A Survey
• Adversarial Attacks and Defenses in Physiological Computing: A Systematic Review
• Towards a Robust Deep Neural Network in Texts: A Survey
• A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples
• Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features
• Enhancing Robustness of Deep Neural Networks Against Adversarial Malware Samples: Principles, Framework, and AICS'2019 Challenge
• On Security and Sparsity of Linear Classifiers for Adversarial Settings
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Easy to Fool? Testing the Anti-evasion Capabilities of PDF Malware Scanners
• A Dynamic-Adversarial Mining Approach to the Security of Machine Learning
• Automated Poisoning Attacks and Defenses in Malware Detection Systems: An Adversarial Machine Learning Approach
• Smoke Screener or Straight Shooter: Detecting Elite Sybil Attacks in User-Review Social Networks
• Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers
• Generating Clues for Gender based Occupation De-biasing in Text
• Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
• Judging a Book by its Description : Analyzing Gender Stereotypes in the Man Bookers Prize Winning Fiction
• Secure Detection of Image Manipulation by means of Random Feature Selection
• Technologies for Trustworthy Machine Learning: A Survey in a Socio-Technical Context
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks
• On Lipschitz Bounds of General Convolutional Neural Networks
• Group-Structured Adversarial Training