Discovering Imperfectly Observable Adversarial Actions using Anomaly Detection

04/22/2020
by   Olga Petrova, et al.
0

Anomaly detection is a method for discovering unusual and suspicious behavior. In many real-world scenarios, the examined events can be directly linked to the actions of an adversary, such as attacks on computer networks or frauds in financial operations. While the defender wants to discover such malicious behavior, the attacker seeks to accomplish their goal (e.g., exfiltrating data) while avoiding the detection. To this end, anomaly detectors have been used in a game-theoretic framework that captures these goals of a two-player competition. We extend the existing models to more realistic settings by (1) allowing both players to have continuous action spaces and by assuming that (2) the defender cannot perfectly observe the action of the attacker. We propose two algorithms for solving such games – a direct extension of existing algorithms based on discretizing the feature space and linear programming and the second algorithm based on constrained learning. Experiments show that both algorithms are applicable for cases with low feature space dimensions but the learning-based method produces less exploitable strategies and it is scalable to higher dimensions. Moreover, we use real-world data to compare our approaches with existing classifiers in a data-exfiltration scenario via the DNS channel. The results show that our models are significantly less exploitable by an informed attacker.

READ FULL TEXT
POST COMMENT

Comments

There are no comments yet.

Authors

page 1

page 2

page 3

page 4

10/02/2018

GLAD: GLocalized Anomaly Detection via Active Feature Space Suppression

We propose an algorithm called GLAD (GLocalized Anomaly Detection) that ...
03/13/2022

Feature space reduction as data preprocessing for the anomaly detection

In this paper, we present two pipelines in order to reduce the feature s...
07/17/2019

Real-time Evasion Attacks with Physical Constraints on Deep Learning-based Anomaly Detectors in Industrial Control Systems

Recently, a number of deep learning-based anomaly detection algorithms w...
08/12/2020

Rule-based Anomaly Detection for Railway Signalling Networks

We propose a rule-based anomaly detection system for railway signalling ...
11/29/2021

Anomaly Rule Detection in Sequence Data

Analyzing sequence data usually leads to the discovery of interesting pa...
05/14/2022

Unsupervised Abnormal Traffic Detection through Topological Flow Analysis

Cyberthreats are a permanent concern in our modern technological world. ...
02/18/2020

A flexible outlier detector based on a topology given by graph communities

Outlier, or anomaly, detection is essential for optimal performance of m...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.