Security Evaluation of Support Vector Machines in Adversarial Environments

By Battista Biggio, Igino Corona, Blaine Nelson, Benjamin I. P. Rubinstein, Davide Maiorca, Giorgio Fumera, Giorgio Giacinto, Fabio Roli. 2014

128 citations recorded by the source corpus.

Support vector machines (SVMs) are among the most popular classification techniques adopted in security applications like malware detection, intrusion detection, and spam filtering. However, if SVMs are to be incorporated in real-world security systems, they must be able to cope with attack patterns that can either mislead the learning algorithm (poisoning), evade detection (evasion) or gain information about their internal parameters (privacy breaches). The main contributions of this chapter are twofold. First, we introduce a formal general framework for the empirical evaluation of the security of machine-learning systems. Second, according to our framework, we demonstrate the feasibility of evasion, poisoning and privacy attacks against SVMs in real-world security problems. For each attack technique, we evaluate its impact and discuss whether (and how) it can be countered through an adversary-aware design of SVMs. Our experiments are easily reproducible thanks to open-source code that we have made available, together with all the employed datasets, on a public repository.

Subfields: Artificial Intelligence, Computer Networks and Communications, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Privacy & Security

In Signal Processing

Citations in the corpus

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, methodology): “In some applications, reactive strategies may be even more convenient and effective than pure proactive approaches aimed to solely mitigate the risk of potential future attacks [28, 40, 83].”
Randomized Prediction Games for Adversarial Machine Learning (2016, background): “evade detection of either known or zero-day exploits [8], [9], [15], [16].”
Adversarial Feature Selection Against Evasion Attacks (2016, background): “, by misspelling bad words like “cheap” as “che@p”), and the exploitation code embedded in malware samples and network packets [5], [7], [10]–[12], [14]–[19].”
Support vector machines under adversarial label contamination (2015, methodology): “We formalize a corresponding optimal attack strategy, and solve it by means of heuristic approaches to keep the computational complexity tractable.”
Data Poisoning Attacks against Autoregressive Models (2016, methodology): “She performs an evasion attack (Biggio et al. 2013) by augmenting her original message so as to be classified as benign by the already learned model.”
Adversarial Attacks and Defences: A Survey (2018, background): “[16], [15] Pattern recognition detection, intrusion detection, biometric identification Papernot et al.”
White-box vs Black-box: Bayes Optimal Strategies for Membership Inference (2019, background): “They were ﬁrst discussed in the context of support vector machines (Rubinstein et al., 2009; Biggio et al., 2014).”
The relationship between trust in AI and trustworthy machine learning technologies (2019, background): “Integrity can be enhanced by either preventing tampering, such as in pre-processing [73], or by discovering and possibly repairing tampered data [12, 14, 58].”
Pattern Recognition Systems under Attack: Design Issues and Research Challenges (2014, background): “4.1, and how to re-engineer their design cycle, using a proactive approach.”
A Survey on Security Threats and Defensive Techniques of Machine Learning: A Data Driven View (2018, background): “Based on the above idea, some researchers proposed quantitative security analysis and evaluation of machine learning algorithms in adversarial environments [19], [73], [75].”
Explicit Defense Actions Against Test-Set Attacks (2017, background): “Support vector machines have received special attention (Biggio, Nelson, and Laskov 2012; Biggio et al. 2014; Xiao et al. 2014; Xiao, Xiao, and Eckert 2012).”
Towards Adversarial Malware Detection (2018, methodology): “The aforementioned optimization problem is usually solved by projected gradient descent [9, 10], and it has been used in follow-up work to generate adversarial PDF malware [83, 96], adversarial binaries [52] and adversarial images against deep networks [67].”
Review: machine learning techniques applied to cybersecurity (2019, background): “…for security applications such as malware detection, and identified the main harmful actions that the classification algorithm could suffer, namely poisoning (misleading the algorithm), evasion (evading the detection) and privacy breaches (obtaining information from the internal parameters) [154].”
Analysis of Causative Attacks against SVMs Learning from Data Streams (2017, methodology): “Support Vector Machines have been shown to be vulnerable to causative attacks [4, 15], in which the attacker is able to modify the learner based on the addition of new samples or the change of training sample labels.”
Incremental on-line learning: A review and comparison of state of the art algorithms (2018, unknown): “Recent applications can be found in [26, 27].”
A survey on adversarial attacks and defences (2021, methodology): “Biggio et al. [64], using gradient ‐ descent based approach, demonstrated the evasion attack on kernel ‐ based classifiers [65].”
Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos (2018, background): “A number of powerful attacks on the test phase of ML systems used for classiﬁcation have been developed over the past few years, including attacks on Support Vector Machines [1], [2] and deep neural networks [3], [4], [5].”