A Game-Theoretic Analysis of Adversarial Classification

Abstract

Attack detection is usually approached as a classification problem. However, standard classification tools often perform poorly because an adaptive attacker can shape his attacks in response to the algorithm. This has led to the recent interest in developing methods for adversarial classification, but to the best of our knowledge, there have been very few prior studies that take into account the attacker's tradeoff between adapting to the classifier being used against him with his desire to maintain the efficacy of his attack. Including this effect is key to derive solutions that perform well in practice.In this investigation we model the interaction as a game between a defender who chooses a classifier to distinguish between attacks and normal behavior based on a set of observed features and an attacker who chooses his attack features (class 1 data). Normal behavior (class 0 data) is random and exogenous. The attacker's objective balances the benefit from attacks and the cost of being detected while the defender's objective balances the benefit of a correct attack detection and the cost of false alarm. We provide an efficient algorithm to compute all Nash equilibria and a compact characterization of the possible forms of a Nash equilibrium that reveals intuitive messages on how to perform classification in the presence of an attacker. We also explore qualitatively and quantitatively the impact of the non-attacker and underlying parameters on the equilibrium strategies.

Reliable Smart Road Signs

“…We can seek to exploit certain properties of Φ ∈ R κ×(do+1) and r ∈ R κ . To this end, we will first show that the matrix Φ ∈ R κ×(do+1) can be written as in (28), where δ i ∈ Z n+1 is a vector which can be viewed as the histogram of the distances from a i x to the encoded codewords, i.e., h(a i x ). Next, we will examine h(a i x )…”

“…The proposed framework can be applied to any linear block code since the analytical results are based only on the abstraction of the code, i.e., [n, k, d] q . Therefore, in order to compute the detection rule, specific to the underlying encoding-decoding scheme, we need the configuration of the code, i.e., [n, k, d] q , and the matrix R ∈ R (n+1)×(do+1) , as defined in (28). At run-time, the detection mechanism triggers an alert based only on the number of mismatched symbols.…”

A Survey of Game Theoretic Approaches for Adversarial Machine Learning in Cybersecurity Tasks

“…about prob. Exploratory attacks by changing Spam filtering distribution of input and ground truth values of future input [18] Full information about learner's Exploratory attacks counterfeiting Image classification utility, cost and classifier params valid input Sequential, Bayesian, Non-zero Sum Games [6,21,5] No information about learner's Exploratory attacks by changing Spam filtering [22,36,7] utility, costs and classifier parameters values of future input [1] No information about learner's Exploratory attacks on test Stock prices utility, costs and classifier parameters set only [62,60,13] No information about learner's Exploratory attacks by mixing valid Spam filtering utility, costs and classifier parameters and adversarial input, e.g., altering [62,60] all or part of input features…”

On Fair Cost Sharing Games in Machine Learning

“…This kind of problems, for instance, can be faced by game playing machine learning algorithms that seek to find an optimal trade-off between successfully passing the game level, earning the highest number of bonuses and doing all this in the fastest possible way. To this end, game theory has become a topic of ongoing interest in machine learning field that has already found its application in contributions related to numerous learning scenarios such as reinforcement learning (Peshkin et al 2000;Hu and Wellman 2003;Claus and Boutilier 1998;Panait and Luke 2005), supervised learning (Freund and Schapire 1999;Shalev-Shwartz and Singer 2007a;2007b;Schuurmans and Zinkevich 2016), and adversarial classification (Liu and Chawla 2009;Brückner and Scheffer 2011;Dritsoula, Loiseau, and Musacchio 2017) to name a few.…”