On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attacker Capability <s> Machine learning systems offer unparalled flexibility in dealing with evolving input in a variety of applications, such as intrusion detection systems and spam e-mail filtering. However, machine learning algorithms themselves can be a target of attack by a malicious adversary. This paper provides a framework for answering the question, "Can machine learning be secure?" Novel contributions of this paper include a taxonomy of different types of attacks on machine learning techniques and systems, a variety of defenses against those attacks, a discussion of ideas that are important to security for machine learning, an analytical model giving a lower bound on attacker's work function, and a list of open problems. <s> BIB001 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attacker Capability <s> Pattern classification systems are commonly used in adversarial applications, like biometric authentication, network intrusion detection, and spam filtering, in which data can be purposely manipulated by humans to undermine their operation. As this adversarial scenario is not taken into account by classical design methods, pattern classification systems may exhibit vulnerabilities, whose exploitation may severely affect their performance, and consequently limit their practical utility. Extending pattern classification theory and design methods to adversarial settings is thus a novel and very relevant research direction, which has not yet been pursued in a systematic way. In this paper, we address one of the main open issues: evaluating at design phase the security of pattern classifiers, namely, the performance degradation under potential attacks they may incur during operation. We propose a framework for empirical evaluation of classifier security that formalizes and generalizes the main ideas proposed in the literature, and give examples of its use in three real applications. Reported results show that security evaluation can provide a more complete understanding of the classifier's behavior in adversarial environments, and lead to better design choices. <s> BIB002
It is also important to consider the capability of the attacker. We assume that the attacker has no access to the control (ML) algorithm itself; however, he is limited to modifying the input (training or testing) data. The ability of the attacker to change the data is in part limited by the specific application under consideration. For example, in the case of PDF files, certain features can be changed freely, although changing some features has a direct impact on other features [Šrndic and Laskov 2014] . BIB002 define the capability of an attacker (against classification algorithms) using four measures: (1) Attacker influence in terms of causative or exploratory (as previously described by BIB001 in Table II 