A taxonomy and survey of attacks against machine learning

Intelligent attacks using document-based malware that exploit vulnerabilities in document viewing software programs or document file structure are increasing rapidly. There are many cases of using PDF (portable document format) in proportion to its usage. We provide in-depth analysis on PDF structure and JavaScript content embedded in PDFs. Then, we develop the diverse feature set encompassing the structure and metadata such as file size, version, encoding method and keywords, and the content features such as object names, keywords, and readable strings in JavaScript. When features are diverse, it is hard to develop adversarial examples because small changes are robust for machine-learning algorithms. We develop a detection model using black-box type models with the structure and content features to minimize the risk of adversarial attacks. To validate the proposed model, we design the adversarial attack. We collect benign documents containing multiple JavaScript codes for the base of adversarial samples. We build the adversarial samples by injecting the malware codes into base samples. The proposed model is evaluated against a large collection of malicious and benign PDFs. We found that random forest, an ensemble algorithm of a decision tree, exhibits a good performance on malware detection and is robust for adversarial samples.

show abstract

“…Adversarial attacks are classified into evasion and positing attacks [15]. Our approach confirms to evasion attack to detour the detection model.…”

Section: Adversarial Attackmentioning

confidence: 97%

Malicious PDF Detection Model against Adversarial Attack Built from Benign PDF Containing JavaScript

et al. 2019

View full text Add to dashboard Cite

show abstract

“…Deep learning gathered significant interest and its applications are being explored inside many research areas, for example healthcare, automotive design and law implementa- tion. There are likewise several existing works inside the area of NIDS in SDN [17], [18].…”

Section: Background and Related Workmentioning

confidence: 99%

Hybrid Deep Learning: An Efficient Reconnaissance and Surveillance Detection Mechanism in SDN

et al. 2020

View full text Add to dashboard Cite

Software defined network (SDN) centralized control intelligence and network abstraction aims to facilitate applications, service deployment, programmability, innovation and ease in configuration management of the underlying networks. However, the centralized control intelligence and programmability is primarily a potential target for the evolving cyber threats and attacks to throw the entire network into chaos. The authors propose a control plane-based orchestration for varied sophisticated threats and attacks. The proposed mechanism comprises of a hybrid Cuda-enabled DL-driven architecture that utilizes the predictive power of Long short-term memory (LSTM) and Convolutional Neural Network (CNN) for an efficient and timely detection of multi-vector threats and attacks. A current state of the art dataset CICIDS2017 and standard performance evaluation metrics have been employed to thoroughly evaluate the proposed mechanism. We rigorously compared our proposed technique with our constructed hybrid DL-architectures and current benchmark algorithms. Our analysis shows that the proposed approach outperforms in terms of detection accuracy with a trivial trade-off speed efficiency. We also performed a 10-fold cross validation to explicitly show unbiased results. INDEX TERMS Security, hybrid deep learning model, software defined networks, long short-term memory, convolutional neural network.

show abstract

“…Adversarial Behaviour: The overall goal of the framework is to detect malicious attacks (e.g., Botnets) in the presence of adversarial users [7] who generate malicious traffic to set the system perception to a faked value. We assume that adversaries collaborate to attack the data collection process.…”

Section: A Lstm Modelsmentioning

confidence: 99%

“…In the machine learning community, security problems have already been addressed in the form of adversarial machine learning [7]. For instance, novelty detection has been addressed to detect anomaly in acoustic data [8].…”

Section: Introductionmentioning

confidence: 99%

Orchestrating SDN Control Plane towards Enhanced IoT Security

Hasan

Akhunzada

Giannetsos

et al. 2020

2020 6th IEEE Conference on Network Softwarization (NetSoft)

Self Cite

View full text Add to dashboard Cite

The Internet of Things (IoT) is rapidly evolving, while introducing several new challenges regarding security, resilience and operational assurance. In the face of an increasing attack landscape, it is necessary to cater for the provision of efficient mechanisms to collectively detect sophisticated malware resulting in undesirable (run-time) device and network modifications. This is not an easy task considering the dynamic and heterogeneous nature of IoT environments; i.e., different operating systems, varied connected networks and a wide gamut of underlying protocols and devices. Malicious IoT nodes or gateways can potentially lead to the compromise of the whole IoT network infrastructure. On the other hand, the SDN control plane has the capability to be orchestrated towards providing enhanced security services to all layers of the IoT networking stack. In this paper, we propose an SDN-enabled control plane based orchestration that leverages emerging Long Short-Term Memory (LSTM) classification models; a Deep Learning (DL) based architecture to combat malicious IoT nodes. It is a first step towards a new line of security mechanisms that enables the provision of scalable AI-based intrusion detection focusing on the operational assurance of only those specific, critical infrastructure components,thus, allowing for a much more efficient security solution. The proposed mechanism has been evaluated with current state of the art datasets (i.e., N BaIoT 2018) using standard performance evaluation metrics. Our preliminary results show an outstanding detection accuracy (i.e., 99.9%) which significantly outperforms state-of-the-art approaches. Based on our findings, we posit open issues and challenges, and discuss possible ways to address them, so that security does not hinder the deployment of intelligent IoT-based computing systems.

show abstract

A taxonomy and survey of attacks against machine learning

Cited by 188 publications

References 55 publications

Malicious PDF Detection Model against Adversarial Attack Built from Benign PDF Containing JavaScript

Malicious PDF Detection Model against Adversarial Attack Built from Benign PDF Containing JavaScript

Hybrid Deep Learning: An Efficient Reconnaissance and Surveillance Detection Mechanism in SDN

Orchestrating SDN Control Plane towards Enhanced IoT Security

Contact Info

Product

Resources

About