Abstract:As a new programming paradigm, deep learning (DL) has achieved impressive performance in areas such as image processing and speech recognition, and has expanded its application to solve many real-world problems. However, neural networks and DL are normally black-box systems; even worse, DL-based software are vulnerable to threats from abnormal examples, such as adversarial and backdoored examples constructed by attackers with malicious intentions as well as unintentionally mislabeled samples. Therefore, it is important and urgent to detect such abnormal examples. Although various detection approaches have been proposed respectively addressing some specific types of abnormal examples, they suffer from some limitations; until today, this problem is still of considerable interest. In this work, we first propose a novel characterization to distinguish abnormal examples from normal ones based on the observation that abnormal examples have significantly different (adversarial) robustness from normal ones. We systemically analyze those three different types of abnormal samples in terms of robustness and find that they have different characteristics from normal ones. As robustness measurement is computationally expensive and hence can be challenging to scale to large networks, we then propose to effectively and efficiently measure robustness of an input sample using the cost of adversarially attacking the input, which was originally proposed to test robustness of neural networks against adversarial examples. Next, we propose a novel detection method, named attack as detection (A 2 D for short), which uses the cost of adversarially attacking an input instead of robustness to check if it is abnormal. Our detection method is generic, and various adversarial attack methods could be leveraged. Extensive experiments show that A 2 D is more effective than recent promising approaches that were proposed to detect only one specific type of abnormal examples. We also thoroughly discuss possible adaptive attack methods to our adversarial example detection method and show that A 2 D is still effective in defending carefully designed adaptive adversarial attack methods—for example, the attack success rate drops to 0% on CIFAR10.

Adversarial Analysis of ML-Based Anomaly Detection in Multi-Layer Network Automation

Self-Taught Black-Box Adversarial Attack to Multilayer Network Automation.

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

B3: Backdoor Attacks Against Black-box Machine Learning Models

Attack As Detection: Using Adversarial Attack Methods to Detect Abnormal Examples.

Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors

Practical Traffic-space Adversarial Attacks on Learning-based NIDSs.

A Black-Box Attack Method against Machine-Learning-Based Anomaly Network Flow Detection Models

Adversarial Attacks Against Network Intrusion Detection in IoT Systems

Explainable and Transferable Adversarial Attack for ML-Based Network Intrusion Detectors

Adversarial Attacks against Deep-Learning-Based Automatic Dependent Surveillance-Broadcast Unsupervised Anomaly Detection Models in the Context of Air Traffic Management

Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples

Detection Tolerant Black-Box Adversarial Attack Against Automatic Modulation Classification With Deep Learning

Adversarial Attacks Against Deep Learning-Based Network Intrusion Detection Systems and Defense Mechanisms

Amplification methods to promote the attacks against machine learning-based intrusion detection systems

Untargeted White-box Adversarial Attack with Heuristic Defence Methods in Real-time Deep Learning based Network Intrusion Detection System

Adversarial attacks based on time-series features for traffic detection

Adversarial Network Traffic: Towards Evaluating the Robustness of Deep Learning-Based Network Traffic Classification

Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models

Adversarial Machine Learning Attacks Against Video Anomaly Detection Systems

Detect & Reject for Transferability of Black-box Adversarial Attacks Against Network Intrusion Detection Systems