Adversarial Feature Selection Against Evasion Attacks

By Fei Zhang, Patrick P. K. Chan, Battista Biggio, Daniel S. Yeung, Fabio Roli. 2016

240 citations recorded by the source corpus.

Pattern recognition and machine learning techniques have been increasingly adopted in adversarial settings such as spam, intrusion, and malware detection, although their security against well-crafted attacks that aim to evade detection by manipulating data at test time has not yet been thoroughly assessed. While previous work has been mainly focused on devising adversary-aware classification algorithms to counter evasion attempts, only few authors have considered the impact of using reduced feature sets on classifier security against the same attacks. An interesting, preliminary result is that classifier security to evasion may be even worsened by the application of feature selection. In this paper, we provide a more detailed investigation of this aspect, shedding some light on the security properties of feature selection against evasion attacks. Inspired by previous work on adversary-aware classifiers, we propose a novel adversary-aware feature selection model that can improve classifier security against evasion attacks, by incorporating specific assumptions on the adversary's data manipulation strategy. We focus on an efficient, wrapper-based implementation of our approach, and experimentally validate its soundness on different application examples, including spam and malware detection.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, methodology): “While this framework only considers attacks against supervised learning algorithms, we refer the reader to similar threat models to evaluate the security of clustering [58–60], and feature selection algorithms [27, 61] under di ﬀ erent attack settings.”
Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks (2017, background): “ary cause of a classier's vulnerability to adversarial examples [27]. Zhang et al. proposed an adversaryaware feature selection model that can improve classier robustness against evasion attacks [29]. Our proposed feature squeezing method is broadly part of this theme. Adversarial Training. A s”
Is Feature Selection Secure against Training Data Poisoning? (2015, background): “To this end, one may follow the intuition behind the recently-proposed feature selection algorithms to contrast evasion attacks, i.e. , to model interactions between the attacker and the feature selection algorithm (Li & Vorobeychik, 2014; Wang et al., 2014; Zhang et al., 2015).”
Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection (2017, methodology): “To tune the parameters of our classifiers, as suggested in [10], [48], one should not only optimize accuracy on a set of collected data, using traditional performance evaluation techniques like cross validation or bootstrapping.”
On Security and Sparsity of Linear Classifiers for Adversarial Settings (2016, background): “…that is classiﬁed as legitimate with the highest possible conﬁdence) subject to the constraint that x ∗ lies within a distance d max from x 0 : where the distance measure d ( · , · ) is deﬁned in terms of the cost of data manipulation ( e.g. , the number of modiﬁed words in each spam) [1,2,8,9,12].”
Black-Box Attacks against RNN based Malware Detection Algorithms (2017, background): “Several defensive algorithms against adversarial examples have been proposed, such as feature selection [32], defensive distillation [24] and retraining [17].”
Enhancing robustness of machine learning systems via data transformations (2017, background): “Zhang et al. [54] use adversarial feature selection to increase the robustness of SVMs.”
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade (2020, unknown): “In contrast, if the cyber attacker inﬂuences the data during deployment to fool the already trained model by manipulat-VOLUME ing the attack samples, then the attack is called an evasion attack [662].”
Deep Identity-aware Transfer of Facial Attributes (2016, background): “In the following, we provide more details on these losses and regularization terms. Adversarial attribute loss. Adversarial strategy is a common stratey that is widely used in security problems [56], [57]. For computer vision, an adversarial learning framework called generative adversarial networks(”
Learning Universal Adversarial Perturbations with Generative Models (2017, unknown): “∞ metrics [3], [4], [6], [10], [14], [16], [20], [21], [40].”
Secure Kernel Machines against Evasion Attacks (2016, background): “Adding or removing a term amounts to switching the value of the corresponding Boolean feature [4, 7, 18, 22, 36].”
Judging a Book by its Description : Analyzing Gender Stereotypes in the Man Bookers Prize Winning Fiction (2018, background): “, 2013) and (Zhang et al., 2016)) is to train a primary classifier while simultaneously trying to ”deceive” an adversarial classifier that tries to predict gender from the predictions of the primary classifier.”
On Lipschitz Bounds of General Convolutional Neural Networks (2018, background): “causes serious security problems in practice [25], [26].”
Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks (2018, background): “This double-initialization strategy helps finding better local optima, through the identification of more promising paths towards evasion [13, 47, 50].”
Dimensionality Reduction as a Defense against Evasion Attacks on Machine Learning Classifiers (2017, methodology): “[60] use adversarial feature selection to increase the robustness of SVMs.”
A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples (2016, methodology): “, 2008) propose a method to introduce some randomness in the selection of classification boundaries; (2) A few recent studies (Xiao et al., 2015; Zhang et al., 2015) consider the impact of using reduced feature sets on classifiers under adversarial attacks.”
Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables (2018, background): “To our knowledge, this is among the first attacks proposed at the byte-level scale, similarly to [14], as most work in adversarial machine learning for malware detection has considered injection and removal of API calls or similar characteristics [3], [6], [9], [11], [12], [16], [24], [27], [28].”
Feature Conservation in Adversarial Classifier Evasion: A Case Study (2017, background): “…a constraint on the evasion cost, and explicitly trading off the degree to which an instance appears as benign and evasion cost [2], [3], [14], [38], [16], [18], [19], [26], [34]. c) Evasion-Robust Classiﬁcation: Dalvi et al. [7] presented the ﬁrst approach for evasion-robust classiﬁcation,…”