Discovering Imperfectly Observable Adversarial Actions using Anomaly Detection

by   Olga Petrova, et al.

Anomaly detection is a method for discovering unusual and suspicious behavior. In many real-world scenarios, the examined events can be directly linked to the actions of an adversary, such as attacks on computer networks or frauds in financial operations. While the defender wants to discover such malicious behavior, the attacker seeks to accomplish their goal (e.g., exfiltrating data) while avoiding the detection. To this end, anomaly detectors have been used in a game-theoretic framework that captures these goals of a two-player competition. We extend the existing models to more realistic settings by (1) allowing both players to have continuous action spaces and by assuming that (2) the defender cannot perfectly observe the action of the attacker. We propose two algorithms for solving such games – a direct extension of existing algorithms based on discretizing the feature space and linear programming and the second algorithm based on constrained learning. Experiments show that both algorithms are applicable for cases with low feature space dimensions but the learning-based method produces less exploitable strategies and it is scalable to higher dimensions. Moreover, we use real-world data to compare our approaches with existing classifiers in a data-exfiltration scenario via the DNS channel. The results show that our models are significantly less exploitable by an informed attacker.



There are no comments yet.


page 1

page 2

page 3

page 4


GLAD: GLocalized Anomaly Detection via Active Feature Space Suppression

We propose an algorithm called GLAD (GLocalized Anomaly Detection) that ...

Feature space reduction as data preprocessing for the anomaly detection

In this paper, we present two pipelines in order to reduce the feature s...

Real-time Evasion Attacks with Physical Constraints on Deep Learning-based Anomaly Detectors in Industrial Control Systems

Recently, a number of deep learning-based anomaly detection algorithms w...

Rule-based Anomaly Detection for Railway Signalling Networks

We propose a rule-based anomaly detection system for railway signalling ...

Anomaly Rule Detection in Sequence Data

Analyzing sequence data usually leads to the discovery of interesting pa...

Unsupervised Abnormal Traffic Detection through Topological Flow Analysis

Cyberthreats are a permanent concern in our modern technological world. ...

A flexible outlier detector based on a topology given by graph communities

Outlier, or anomaly, detection is essential for optimal performance of m...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.