标题： 在线中心点异常检测的安全性分析 显示英文标题

标题： Security Analysis of Online Centroid Anomaly Detection

摘要： 安全问题是许多机器学习应用中的关键问题，特别是在处理人类活动而非自然现象的场景中（例如，信息排名、垃圾邮件检测、恶意软件检测等）。在这种情况下，可以预期学习算法将不得不处理旨在干扰决策的操纵数据。尽管一些先前的工作研究了监督学习背景下恶意数据的处理，但关于异常检测方法在这些场景中的行为知之甚少。在本贡献中，我们分析了在对抗噪声存在的情况下一种特定方法——在线中心点异常检测——的性能。我们的分析涉及以下安全相关问题：学习和攻击过程的形式化，最优攻击的推导，其效率和约束的分析。我们推导了在不同条件下对中心点异常检测的中毒攻击的有效性界限：有限和无限的流量百分比，以及有限的误报率。我们的界限表明，虽然在无约束情况下可以有效地进行中毒攻击，但如果正确使用外部约束，可以使攻击变得极其困难（攻击者的收益有严格的上限）。我们在真实HTTP和漏洞利用痕迹上的实验评估证实了我们理论界限的紧密性和保护机制的实用性。 显示英文摘要

摘要： Security issues are crucial in a number of machine learning applications, especially in scenarios dealing with human activity rather than natural phenomena (e.g., information ranking, spam detection, malware detection, etc.). It is to be expected in such cases that learning algorithms will have to deal with manipulated data aimed at hampering decision making. Although some previous work addressed the handling of malicious data in the context of supervised learning, very little is known about the behavior of anomaly detection methods in such scenarios. In this contribution we analyze the performance of a particular method -- online centroid anomaly detection -- in the presence of adversarial noise. Our analysis addresses the following security-related issues: formalization of learning and attack processes, derivation of an optimal attack, analysis of its efficiency and constraints. We derive bounds on the effectiveness of a poisoning attack against centroid anomaly under different conditions: bounded and unbounded percentage of traffic, and bounded false positive rate. Our bounds show that whereas a poisoning attack can be effectively staged in the unconstrained case, it can be made arbitrarily difficult (a strict upper bound on the attacker's gain) if external constraints are properly used. Our experimental evaluation carried out on real HTTP and exploit traces confirms the tightness of our theoretical bounds and practicality of our protection mechanisms.