2013/01/01 by Battista Biggio, Igino Corona, Davide Maiorca +6 · 6 citations
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Adversarial machine learning #Adversarial system #Adversary #Classifier (UML) #Evasion (ethics) #Malware #Security and Verification in Computing #Sketch #Vetting #cs.CR #cs.LG
paper · pdf · doi:10.1007/978-3-642-40994-3_25
published as ECML PKDD, Part III, vol. 8190, LNCS, pp. 387--402. Springer, 2013 · In this paper, in 2013, we were the first to introduce the notion of evasion attacks (adversarial examples) created with high confidence (instead of minimum-distance misclassifications), and the notion of surrogate learners (substitute models). These two concepts are now widely re-used in developing attacks against deep networks (even if not always referring to the ideas reported in this work). arXiv admin note: text overlap with arXiv:1401.7727
crossref issued 2013/01/01 · crossref published 2013/01/01 · crossref published-print 2013/01/01 · openalex publication_date 2013/01/01 · crossref created 2013/08/28 · arxiv created 2017/08/21 · arxiv updated 2017/08/22 · openalex created_date 2020/11/23 · crossref deposited 2024/05/17 · openalex updated_date 2026/08/05 · crossref indexed 2026/08/05
In security-sensitive applications, the success of machine learning depends on a thorough vetting of their resistance to adversarial data. In one pertinent, well-motivated attack scenario, an adversary may attempt to evade a deployed system at test time by carefully manipulating attack samples. In this work, we present a simple but effective gradient-based approach that can be exploited to systematically assess the security of several, widely-used classification algorithms against evasion attacks. Following a recently proposed framework for security evaluation, we simulate attack scenarios that exhibit different risk levels for the classifier by increasing the attacker's knowledge of the system and her ability to manipulate attack samples. This gives the classifier designer a better picture of the classifier performance under evasion attacks, and allows him to perform a more informed model selection (or parameter setting). We evaluate our approach on the relevant security task of malware detection in PDF files, and show that such systems can be easily evaded. We also sketch some countermeasures suggested by our analysis.