Adversarial Active Learning

Miller, Brad; Kantchelian, Alex; Afroz, Sadia; Bachwani, Rekha; Dauber, Edwin; Huang, Ling; Tschantz, Michael Carl; Joseph, Anthony D.; Tygar, J. D.

doi:10.1145/2666652.2666656

Cited by 67 publications

(56 citation statements)

References 43 publications

(38 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Online active learning [21,30,31,44,45] is well-suited to follow the evolution of the threats: experts perform annotations over time to update the detection model that is already deployed. In this setting, the detection model in production has been initially trained on a labelled dataset representative of the deployment environment.…”

Section: Fig 2: Sampling Bias Examplementioning

confidence: 99%

ILAB: An Interactive Labelling Strategy for Intrusion Detection

Beaugnon

Chifflier

Bach

2017

Research in Attacks, Intrusions, and Defenses

View full text Add to dashboard Cite

Abstract. Acquiring a representative labelled dataset is a hurdle that has to be overcome to learn a supervised detection model. Labelling a dataset is particularly expensive in computer security as expert knowledge is required to perform the annotations. In this paper, we introduce ILAB, a novel interactive labelling strategy that helps experts label large datasets for intrusion detection with a reduced workload. First, we compare ILAB with two state-of-the-art labelling strategies on public labelled datasets and demonstrate it is both an effective and a scalable solution. Second, we show ILAB is workable with a real-world annotation project carried out on a large unlabelled NetFlow dataset originating from a production environment. We provide an open source implementation (https://github.com/ANSSI-FR/SecuML/) to allow security experts to label their own datasets and researchers to compare labelling strategies.

show abstract

Section: Fig 2: Sampling Bias Examplementioning

confidence: 99%

ILAB: An Interactive Labelling Strategy for Intrusion Detection

Beaugnon

Chifflier

Bach

2017

Research in Attacks, Intrusions, and Defenses

View full text Add to dashboard Cite

show abstract

“…This is represented by the evaluator, which is an external component that can be inserted into the analysis phase. The evaluator functionality can be performed by a human examiner as well as an external plugin which implements advanced AI techniques [10], such as Machine Learning [11], Expert Systems [12], Human Expertise, and so on.…”

Section: Design and Architecturementioning

confidence: 99%

HyBIS: Advanced Introspection for Effective Windows Guest Protection

Pietro¹,

Franzoni²,

Lombardi³

2017

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

Abstract-Effectively protecting the Windows OS is a challenging task, since most implementation details are not publicly known. Windows has always been the main target of malwares that have exploited numerous bugs and vulnerabilities. Recent trusted boot and additional integrity checks have rendered the Windows OS less vulnerable to kernel-level rootkits. Nevertheless, guest Windows Virtual Machines are becoming an increasingly interesting attack target. In this work we introduce and analyze a novel Hypervisor-Based Introspection System (HyBIS) we developed for protecting Windows OSes from malware and rootkits. The HyBIS architecture is motivated and detailed, while targeted experimental results show its effectiveness. Comparison with related work highlights main HyBIS advantages such as: effective semantic introspection, support for 64-bit architectures and for latest Windows (8.x and 10), advanced malware disabling capabilities. We believe the research effort reported here will pave the way to further advances in the security of Windows OSes.

show abstract

“…The other dimension is about designing and developing a software environment where one can explore and exploit in a coordinated fashion different functional modules that complement each other and address conflicting asymmetries. The proposed integrated environment should expand on the likes of SALT [2] and optimally engage and gate modules that challenge both offense and defense while at the same time enhances and evaluates both. Such an enterprise is supported by meta-reasoning and meta-recognition, whose workings are intertwined.…”

Section: Meta-reasoning and Meta-recognitionmentioning

confidence: 99%

“…Miller et al [2] have recently surveyed the field of ACL to promote Security-oriented Active Learning Testbed (SALT) architecture in order to experiment and evaluate diverse strategies surrounding active learning to counter adversarial contexts and deliberate manipulation. SALT evaluation has been so far relatively limited to the continuous 2D feature space where the aim is usually that of learning a binary classifier while evaluating different active learning strategies to prioritize requests (e.g., queries) for annotation.…”

Section: Introductionmentioning

confidence: 99%

“…The results reported indicate that for "the system which is not under attack, the maximum uncertainty strategy performs significantly better than random choice. When the system is under attack [the case of interest here], randomization of training samples becomes the best strategy, while the maximum uncertainty choice suffers severe degradations" [2]. Principled randomization using conformal prediction inspired transduction (see Sect.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Cyberspace Security Using Adversarial Learning and Conformal Prediction

Wechsler¹

2015

IIM

View full text Add to dashboard Cite

This paper advances new directions for cyber security using adversarial learning and conformal prediction in order to enhance network and computing services defenses against adaptive, malicious, persistent, and tactical offensive threats. Conformal prediction is the principled and unified adaptive and learning framework used to design, develop, and deploy a multi-faceted self-managing defensive shield to detect, disrupt, and deny intrusive attacks, hostile and malicious behavior, and subterfuge. Conformal prediction leverages apparent relationships between immunity and intrusion detection using non-conformity measures characteristic of affinity, a typicality, and surprise, to recognize patterns and messages as friend or foe and to respond to them accordingly. The solutions proffered throughout are built around active learning, meta-reasoning, randomness, distributed semantics and stratification, and most important and above all around adaptive Oracles. The motivation for using conformal prediction and its immediate off-spring, those of semi-supervised learning and transduction, comes from them first and foremost supporting discriminative and non-parametric methods characteristic of principled demarcation using cohorts and sensitivity analysis to hedge on the prediction outcomes including negative selection, on one side, and providing credibility and confidence indices that assist meta-reasoning and information fusion.

show abstract

Adversarial Active Learning

Cited by 67 publications

References 43 publications

ILAB: An Interactive Labelling Strategy for Intrusion Detection

ILAB: An Interactive Labelling Strategy for Intrusion Detection

HyBIS: Advanced Introspection for Effective Windows Guest Protection

Cyberspace Security Using Adversarial Learning and Conformal Prediction

Contact Info

Product

Resources

About