Online Anomaly Detection under Adversarial Impact

By Marius Kloft, Pavel Laskov. 2010

159 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Evaluation & Benchmarks

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “Online attacks such as these have been commonly observed in domains such as SPAM detection and network intrusion detection [28].”
Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “To our knowledge, the earliest poisoning attacks date back to 2006-2010 [21–23, 25, 82].”
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering (2018, background): “Steinhardt et al. (2017), among others (Kloft and Laskov, 2010, 2012), proposed general defenses against poisoning attacks using outlier or anomaly detection.”
Evasion Attacks against Machine Learning at Test Time (2013, methodology): “Machine learning is being increasingly used in security-sensitive applications such as spam ﬁltering, malware detection, and network intrusion detection [3,5,9,11,14,15,16,19,21].”
Poisoning Attacks against Support Vector Machines (2012, methodology): “Compared to previous work on evasion of learning algorithms ( e.g. , Br¨uckner & Scheﬀer, 2009; Kloft & Laskov, 2010), such inﬂuence may facilitate the practical realization of various evasion strategies.”
Machine Learning Models that Remember Too Much (2017, background): “Poisoning attacks [9, 18, 38, 57, 65] insert malicious data points into the training dataset to make the resulting model easier to evade.”
Stealing Hyperparameters in Machine Learning (2018, background): “Existing studies have demonstrated poisoning attacks to worm signature generators [34], [41], [35], spam ﬁlters [31], [32], anomaly detectors [43], [24], SVMs [5], face recognition methods [4], as well as recommender systems [27], [57].”
Is Feature Selection Secure against Training Data Poisoning? (2015, background): “…which the attacker has full knowledge of the attacked sys-tem, is usually referred to as perfect knowledge case (Big-gio et al., 2014; 2013b; 2012; Kloft & Laskov, 2010; Br¨uckner et al., 2012; Huang et al., 2011; Barreno et al., 2006), and it allows one to empirically evaluate an upper bound on…”
Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples (2016, methodology): “For instance poisoning the training data used to learn models was only considered in the context of binary SVMs whose training data is known [7] or anomaly detection systems whose underlying model is known [15].”
Poisoning behavioral malware clustering (2014, background): “The worst-case scenario in which the attacker has full knowledge of the targeted system is usually referred to as perfect knowledge [2, 5–8, 10, 17, 22].”
Security Evaluation of Pattern Classifiers under Attack (2014, methodology): “cious traffic during the collection of training samples to force the IDS to learn a wrong model of the normal traffic [11], [17], [29], [30], [36].”
Security Evaluation of Support Vector Machines in Adversarial Environments (2014, methodology): “Examples of causative attacks include work in [14, 38, 40, 52, 58], while exploratory attacks can be found in [26, 31, 41, 47, 66].”
Is data clustering in adversarial settings secure? (2013, background): “The worst-case scenario in which the attacker has full knowledge of the attacked system, is usually referred to as perfect knowledge case [6, 7, 19, 8, 17, 3].”
Support vector machines under adversarial label contamination (2015, methodology): “We formalize a corresponding optimal attack strategy, and solve it by means of heuristic approaches to keep the computational complexity tractable.”
Generative Poisoning Attack Method Against Neural Networks (2017, neutral): “A similar work was presented in [9].”
SoK: Security and Privacy in Machine Learning (2018, background): “a model that classifies a test input as malicious when it is too far from the empirical mean of the training data [22].”
Poisoning and Backdooring Contrastive Learning (2021, background): “Poisoning attacks exist for many tasks, including supervised (Biggio et al., 2012; Turner et al., 2019; Koh & Liang, 2017), unsupervised (Kloft & Laskov, 2010; 2012; Biggio et al., 2013), and semi-supervised (Liu et al., 2020; Carlini, 2021) learning.”
Adversarial Attacks and Defences: A Survey (2018, background): “(Image Credit: Kloft et al. [41]) Although the attacker is assumed to have knowledge about the algorithm and the training data, he cannot modify existing data other than adding new points.”