More Like this

1. Power-Grid Controller Anomaly Detection with Enhanced Temporal Deep Learning

   https://doi.org/10.1109/TrustCom/BigDataSE.2019.00030  

   He, Zecheng; Raghavan, Aswin; Hu, Guangyuan; Chai, Sek; Lee, Ruby (August 2019, 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications (TrustCom))

   null (Ed.)

   Controllers of security-critical cyber-physical systems, like the power grid, are a very important class of computer systems. Attacks against the control code of a power-grid system, especially zero-day attacks, can be catastrophic. Earlier detection of the anomalies can prevent further damage. However, detecting zero-day attacks is extremely challenging because they have no known code and have unknown behavior. Furthermore, if data collected from the controller is transferred to a server through networks for analysis and detection of anomalous behavior, this creates a very large attack surface and also delays detection. In order to address this problem, we propose Reconstruction Error Distribution (RED) of Hardware Performance Counters (HPCs), and a data-driven defense system based on it. Specifically, we first train a temporal deep learning model, using only normal HPC readings from legitimate processes that run daily in these power-grid systems, to model the normal behavior of the power-grid controller. Then, we run this model using real-time data from commonly available HPCs. We use the proposed RED to enhance the temporal deep learning detection of anomalous behavior, by estimating distribution deviations from the normal behavior with an effective statistical test. Experimental results on a real power-grid controller show that we can detect anomalous behavior with high accuracy (>99.9%), nearly zero false positives and short (<360ms) latency. 

   more » « less
2. Fooling Detection Alone is Not Enough: First Adversarial Attack against Multiple Object Tracking

   Jia, Yunhan; Lu, Yantao; Shen, Junjie; Chen, Qi A; Zhong, Zhenyu; Wei, Tao (April 2020, International Conference on Learning Representations (ICLR))

   Recent work in adversarial machine learning started to focus on the visual perception in autonomous driving and studied Adversarial Examples (AEs) for object detection models. However, in such visual perception pipeline the detected objects must also be tracked, in a process called Multiple Object Tracking (MOT), to build the moving trajectories of surrounding obstacles. Since MOT is designed to be robust against errors in object detection, it poses a general challenge to existing attack techniques that blindly target objection detection: we find that a success rate of over 98% is needed for them to actually affect the tracking results, a requirement that no existing attack technique can satisfy. In this paper, we are the first to study adversarial machine learning attacks against the complete visual perception pipeline in autonomous driving, and discover a novel attack technique, tracker hijacking, that can effectively fool MOT using AEs on object detection. Using our technique, successful AEs on as few as one single frame can move an existing object in to or out of the headway of an autonomous vehicle to cause potential safety hazards. We perform evaluation using the Berkeley Deep Drive dataset and find that on average when 3 frames are attacked, our attack can have a nearly 100% success rate while attacks that blindly target object detection only have up to 25%. 

   more » « less
3. Face Liveness Detection Competition (LivDet-Face) - 2021

   https://doi.org/10.1109/IJCB52358.2021.9484359  

   Purnapatra, Sandip; Smalt, Nic; Bahmani, Keivan; Das, Priyanka; Yambay, David; Mohammadi, Amir; George, Anjith; Bourlai, Thirimachos; Marcel, Sebastien; Schuckers, Stephanie; et al (August 2021, 2021 IEEE International Joint Conference on Biometrics (IJCB))

   Liveness Detection (LivDet)-Face is an international competition series open to academia and industry. The competition’s objective is to assess and report state-of-the-art in liveness / Presentation Attack Detection (PAD) for face recognition. Impersonation and presentation of false samples to the sensors can be classified as presentation attacks and the ability for the sensors to detect such attempts is known as PAD. LivDet-Face 2021 * will be the first edition of the face liveness competition. This competition serves as an important benchmark in face presentation attack detection, offering (a) an independent assessment of the current state of the art in face PAD, and (b) a common evaluation protocol, availability of Presentation Attack Instruments (PAI) and live face image dataset through the Biometric Evaluation and Testing (BEAT) platform. The competition can be easily followed by researchers after it is closed, in a platform in which participants can compare their solutions against the LivDet-Face winners. 

   more » « less
4. Fast Geometrically-Perturbed Adversarial Faces

   https://doi.org/10.1109/WACV.2019.00215  

   Dabouei, Ali; Soleymani, Sobhan; Dawson, Jeremy; Nasrabadi, Nasser (January 2019, IEEE Winter Conference on Applications of Computer Vision (WACV))

   The state-of-the-art performance of deep learning algorithms has led to a considerable increase in the utilization of machine learning in security-sensitive and critical applications. However, it has recently been shown that a small and carefully crafted perturbation in the input space can completely fool a deep model. In this study, we explore the extent to which face recognition systems are vulnerable to geometrically-perturbed adversarial faces. We propose a fast landmark manipulation method for generating adversarial faces, which is approximately 200 times faster than the previous geometric attacks and obtains 99.86% success rate on the state-of-the-art face recognition models. To further force the generated samples to be natural, we introduce a second attack constrained on the semantic structure of the face which has the half speed of the first attack with the success rate of 99.96%. Both attacks are extremely robust against the state-of-the-art defense methods with the success rate of equal or greater than 53.59%. Code is available at https://github.com/alldbi/FLM. 

   more » « less
5. Adversarial-Aware Deep Learning System Based on a Secondary Classical Machine Learning Verification Approach

   https://doi.org/10.3390/s23146287  

   Alkhowaiter, Mohammed; Kholidy, Hisham; Alyami, Mnassar A.; Alghamdi, Abdulmajeed; Zou, Cliff (July 2023, Sensors)

   Deep learning models have been used in creating various effective image classification applications. However, they are vulnerable to adversarial attacks that seek to misguide the models into predicting incorrect classes. Our study of major adversarial attack models shows that they all specifically target and exploit the neural networking structures in their designs. This understanding led us to develop a hypothesis that most classical machine learning models, such as random forest (RF), are immune to adversarial attack models because they do not rely on neural network design at all. Our experimental study of classical machine learning models against popular adversarial attacks supports this hypothesis. Based on this hypothesis, we propose a new adversarial-aware deep learning system by using a classical machine learning model as the secondary verification system to complement the primary deep learning model in image classification. Although the secondary classical machine learning model has less accurate output, it is only used for verification purposes, which does not impact the output accuracy of the primary deep learning model, and, at the same time, can effectively detect an adversarial attack when a clear mismatch occurs. Our experiments based on the CIFAR-100 dataset show that our proposed approach outperforms current state-of-the-art adversarial defense systems. 

   more » « less