NIPS 2007 Workshop on
Machine Learning in Adversarial Environments
for Computer Security

dates | description | schedule | invited speakers | recommended readings

Morning session (9:00am - 12:00am):

Afternoon session (2:00pm - 5:00pm):

From intrusion detection to worm signature generation to network traffic analysis to spam filtering, real-world applications increasingly use machine learning because of its ability to adapt to changing conditions and infer patterns from data. A growing body of work has begun to raise the question of security for these machine learning techniques--the adaptability that makes learning useful may also create new opportunities for attack.

In this talk, we will survey the current research in this nascent field and present a taxonomy developed by our group at Berkeley for categorizing attacks against learning systems [1]. We will discuss how our taxonomy can organize and connect the work done to date. Framing research in this way provides two benefits: it draws out similarities between attacks, suggesting the possibility of generalizing attack descriptions and perhaps developing common defenses; and it spotlights types of attack that have received scant research attention. Building on this foundation, we will share what our research group sees as the prominent open problems in this area and which directions we believe are most promising for future research.

[1] Marco Barreno, Blaine Nelson, Russell Sears, Anthony D. Joseph, and J. D. Tygar. Can machine learning be secure? In Proceedings of the ACM Symposium on InformAtion, Computer, and Communications Security (ASIACCS'06), March 2006. (Invited paper.)

Content-based Anomaly Detection in Intrusion Detection
Salvatore J. Stolfo, Columbia University

There are many anti-virus and intrusion detection systems in wide use that are primarily signature-based detectors. They detect what is already known to be bad by matching a signature pattern against input. These systems have been effective at detecting known exploits and intrusion attempts but they fail to recognize new attacks and carefully crafted variants of old exploits. Anomaly Detection has been proposed as an alternative strategy for detecting new attacks. Anomaly Detectors model what is known to be good in order to detect deviations that are presumed to be bad. Anomaly Detection systems that analyze network flow level statistics have been the subject of research for several years and some are now appearing in commercial products. Content-based Anomaly Detection systems that utilize machine learning algorithms are designed to model normal content for a distinct site or host. These systems are designed to detect content deviations of interest that may indicate the presence of malcode that otherwise would not be detected by conventional (and soon to be obsolete) signature-based detectors. In the continuing battle between attacker and defender, Anomaly Detectors can also be thwarted by a variety of obfuscation methods. In this talk we will provide an overview of the state of the art in content-based Anomaly Detection in intrusion detection, describe various approaches to blind these detectors, and propose new approaches to counter these evasion tactics based upon randomization strategies to blind the attacker.

Spam, Phishing, Scam: How to Thrive on Fraud and Deception
Tobias Scheffer, Max-Planck-Institute for Computer Science

Operating a spam business successfully involves many challenges. To start with, it is important to team up with the right vendors. The art of acquiring email addresses of likely customers has well advanced over harvesting addresses from web pages. Disseminating spam requires engineering proficiency: popular methods are the construction and use of viruses that form a network of software bots and the exploitation of web services. Competently engineered, phishing emails are virtually indistinguishable from legitimate personal communication. Analogously, impostor web portals can be made indistinguishable from their legitimate banking and ecommerce counterparts. Text, image, PDF, and audio messages that are generated individually according to probabilistic grammars render text classification based spam filters useless. Recognizing spam, phishing, and scam emails raises great research challenges for machine learning far beyond text classification. They include learning under distribution shift and adversarial learning models, and the recognition of batches of messages that have been generated according to the same (text, image, audio) grammar.

Misleading Automated Worm Signature Generators
Wenke Lee, Georgia Institute of Technology

In this talk, I present a noise-injection technique for defeating worm signature generation. An attacker can craft and inject noise (faked worm flows) into the traffic in such a way that an automated (learning-based) worm signature generator cannot learn reliable signatures. This in turn means that signature-based network intrusion detection systems cannot have good worm signatures to stop the worm traffic until manual/slow worm analysis is conducted.

Organizers

• Pavel Laskov (Fraunhofer Institute FIRST, Germany)
• Richard Lippmann (MIT Lincoln Laboratory, USA)

Supported by