[论文解读] New data poison attacks on machine learning classifiers for mobile exfiltration

Miguel A. Ramirez, Sang-Young Yoon+8 more|arXiv (Cornell University)|Oct 20, 2022

Advanced Malware Detection Techniques被引用 5

一句话总结

本文提出两种新颖的、与模型无关的标签翻转数据中毒攻击，针对移动恶意软件外泄检测的机器学习分类器。攻击通过随机翻转标签或选择性地针对某一类进行翻转，显著降低多种分类器（如逻辑回归、决策树、随机森林和K近邻）的模型准确率，并提高误分类率，揭示了恶意软件检测系统存在严重漏洞。

ABSTRACT

Most recent studies have shown several vulnerabilities to attacks with the potential to jeopardize the integrity of the model, opening in a few recent years a new window of opportunity in terms of cyber-security. The main interest of this paper is directed towards data poisoning attacks involving label-flipping, this kind of attacks occur during the training phase, being the aim of the attacker to compromise the integrity of the targeted machine learning model by drastically reducing the overall accuracy of the model and/or achieving the missclassification of determined samples. This paper is conducted with intention of proposing two new kinds of data poisoning attacks based on label-flipping, the targeted of the attack is represented by a variety of machine learning classifiers dedicated for malware detection using mobile exfiltration data. With that, the proposed attacks are proven to be model-agnostic, having successfully corrupted a wide variety of machine learning models; Logistic Regression, Decision Tree, Random Forest and KNN are some examples. The first attack is performs label-flipping actions randomly while the second attacks performs label flipping only one of the 2 classes in particular. The effects of each attack are analyzed in further detail with special emphasis on the accuracy drop and the misclassification rate. Finally, this paper pursuits further research direction by suggesting the development of a defense technique that could promise a feasible detection and/or mitigation mechanisms; such technique should be capable of conferring a certain level of robustness to a target model against potential attackers.

研究动机与目标

• 研究用于移动恶意软件检测的机器学习分类器在训练阶段对数据中毒攻击的脆弱性。
• 开发并评估两种新型的标签翻转数据中毒攻击，这些攻击在多种最先进的二元分类器中均具有效性。
• 分析这些攻击对模型准确率和误分类率的影响，特别是在真实世界移动外泄数据下的表现。
• 识别当前针对与模型无关的中毒攻击在恶意软件检测系统中防御机制的关键漏洞。
• 为未来能够检测和缓解标签翻转攻击的防御机制奠定基础。

提出的方法

• 第一种攻击在训练样本子集上执行随机标签翻转，旨在破坏模型训练过程中的完整性。
• 第二种攻击仅在两个类别中的一个类别中选择性地翻转标签，重点是最大化对特定类别的误分类。
• 将攻击应用于移动外泄数据集，并在多种二元分类器上进行评估，包括逻辑回归、决策树、随机森林和K近邻。
• 通过中毒后的准确率下降和误分类率指标来量化模型性能。
• 所提出的攻击具有与模型无关的特性，即无需了解模型的内部架构或训练过程。
• 本研究使用公开可获取的数据集和代码仓库，以确保可复现性和透明度。

实验结果

研究问题

• RQ1 随机标签翻转攻击在降低多种机器学习分类器在移动恶意软件检测中性能方面的有效性如何？
• RQ2 对单一类别进行选择性标签翻转是否能显著提高误分类率，同时降低整体模型准确率？
• RQ3 现代二元分类器在多大程度上对使用标签翻转的与模型无关的数据中毒攻击具有鲁棒性？
• RQ4 当前恶意软件检测流水线中存在哪些关键漏洞，使得此类中毒攻击得以实现？
• RQ5 能够检测或缓解此类标签翻转攻击的防御机制需要哪些关键组件？

主要发现

• 所提出的随机标签翻转攻击导致模型准确率显著下降，某些分类器（如逻辑回归和决策树）的准确率降幅超过50%。
• 选择性标签翻转攻击在目标类别上实现了更高的误分类率，表明有针对性的操纵比随机翻转更具有效性。
• 所有测试的分类器——逻辑回归、决策树、随机森林和K近邻——在两种攻击变体下均表现出显著的性能退化。
• 这些攻击在多种模型上均有效，证实了其与模型无关的特性，并表明其在恶意软件检测系统中具有广泛适用性。
• 结果凸显了在模型训练前实施强大数据清洗和防御机制的迫切需求。
• 本研究表明，即使小规模的数据中毒攻击，也能严重损害移动环境中基于机器学习的恶意软件检测的可靠性。