Abstract:Background: Machine learning-based security detection models have become prevalent in modern malware and intrusion detection systems. However, previous studies show that such models are susceptible to adversarial evasion attacks. In this type of attack, inputs (i.e., adversarial examples) are specially crafted by intelligent malicious adversaries, with the aim of being misclassified by existing state-of-the-art models (e.g., deep neural networks). Once the attackers can fool a classifier to think that a malicious input is actually benign, they can render a machine learning-based malware or intrusion detection system ineffective. Goal: To help security practitioners and researchers build a more robust model against non-adaptive, white-box, and non-targeted adversarial evasion attacks through the idea of an ensemble model. Method: We propose an approach called Omni, the main idea of which is to explore methods that create an ensemble of "unexpected models"; i.e., models whose control hyperparameters have a large distance to the hyperparameters of an adversary's target model, with which we then make an optimized weighted ensemble prediction. Result: In studies with five types of adversarial evasion attacks (FGSM, BIM, JSMA, DeepFooland Carlini-Wagner) on five security datasets (NSL-KDD, CIC-IDS-2017, CSE-CIC-IDS2018, CICAnd-Mal2017, and the Contagio PDF dataset), we show Omni is a promising approach as a defense strategy against adversarial attacks when compared with other baseline treatments. Conclusion: When employing ensemble defense against adversarial evasion attacks, we suggest creating an ensemble with unexpected models that are distant from the attacker's expected model (i.e., target model) through methods such as hyperparameter optimization.

Decision-based Evasion Attacks on Tree Ensemble Classifiers

Evasion and Hardening of Tree Ensemble Classifiers

Faster Repeated Evasion Attacks in Tree Ensembles

Robustness Analysis of Classical and Fuzzy Decision Trees under Adversarial Evasion Attack

Improving Adversarial Robustness of Ensemble Classifiers by Diversified Feature Selection and Stochastic Aggregation

Misleading Sentiment Analysis: Generating Adversarial Texts by the Ensemble Word Addition Algorithm

Certifying Decision Trees Against Evasion Attacks by Program Analysis

Evading Black-box Classifiers Without Breaking Eggs

Verifiable Learning for Robust Tree Ensembles

Attack Tree Analysis for Adversarial Evasion Attacks

Adversarial Feature Selection Against Evasion Attacks

Vulnerability of Deep Forest to Adversarial Attacks

Omni: Automated Ensemble with Unexpected Models against Adversarial Evasion Attack

Gradient Masking All-at-Once: Ensemble Everything Everywhere Is Not Robust

One-and-a-Half-Class Multiple Classifier Systems for Secure Learning Against Evasion Attacks at Test Time

Decision-forest voting scheme for classification of rare classes in network intrusion detection

Embedding and extraction of knowledge in tree ensemble classifiers

Evaluating Resilience of Encrypted Traffic Classification against Adversarial Evasion Attacks

Genetic Adversarial Training of Decision Trees

Robust Decision Trees Against Adversarial Examples

Adversarial Robust Decision-Making under Uncertainty Learning and Dynamic Ensemble Selection