On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attacker Knowledge <s> Intrusion Detection Systems (IDSs) are one of the key components for securing computing infrastructures. Their objective is to protect against attempts to violate defense mechanisms. Indeed, IDSs themselves are part of the computing infrastructure, and thus they may be attacked by the same adversaries they are designed to detect. This is a relevant aspect, especially in safety-critical environments, such as hospitals, aircrafts, nuclear power plants, etc. To the best of our knowledge, this survey is the first work to present an overview on adversarial attacks against IDSs. In particular, this paper will provide the following original contributions: (a) a general taxonomy of attack tactics against IDSs; (b) an extensive description of how such attacks can be implemented by exploiting IDS weaknesses at different abstraction levels; (c) for each attack implementation, a critical investigation of proposed solutions and open points. Finally, this paper will highlight the most promising research directions for the design of adversary-aware, harder-to-defeat IDS solutions. To this end, we leverage on our research experience in the field of intrusion detection, as well as on a thorough investigation of the relevant related works published so far. <s> BIB001 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Attacker Knowledge <s> Pattern classification systems are commonly used in adversarial applications, like biometric authentication, network intrusion detection, and spam filtering, in which data can be purposely manipulated by humans to undermine their operation. As this adversarial scenario is not taken into account by classical design methods, pattern classification systems may exhibit vulnerabilities, whose exploitation may severely affect their performance, and consequently limit their practical utility. Extending pattern classification theory and design methods to adversarial settings is thus a novel and very relevant research direction, which has not yet been pursued in a systematic way. In this paper, we address one of the main open issues: evaluating at design phase the security of pattern classifiers, namely, the performance degradation under potential attacks they may incur during operation. We propose a framework for empirical evaluation of classifier security that formalizes and generalizes the main ideas proposed in the literature, and give examples of its use in three real applications. Reported results show that security evaluation can provide a more complete understanding of the classifier's behavior in adversarial environments, and lead to better design choices. <s> BIB002
One of the main considerations when discussing an attacker is the level of knowledge that an attacker has about the target system. In their attack against the PDFRate system,Šrndic and Laskov [2014] split this into knowledge about the classifier (and its parameters), the feature set in use, and the training set. The attack knowledge is then a combination of these, with knowledge of all three being the "perfect" case. This is illustrated in Figure 3 . There is also the case that the attacker can gain no knowledge at all. This model can be transferred to the clustering example by replacing "training dataset" with "test dataset" and "classifier algorithm" with "clustering algorithm." It is worth noting, however, that knowledge of the test dataset in a clustering algorithm is different from that of the training data used in a classifier. The training data used within a classifier is pre-existing and may be publicly available, so it could easily be gained by the attacker. However, the input to a clustering algorithm (test dataset) includes all new data (the new traffic data in the network example), so is more likely to only be estimated by the attacker. BIB002 classify attacker knowledge specifically for the classification setting with more detail. As well as knowledge of the (1) training data and (2) feature set, they also incorporate the knowledge of the (3) learning algorithm and its decision function, (4) the decision function and its parameters, and (5) the feedback available from the classifier (e.g., the class labels applied to sample queries from the attacker). The attacker knowledge can vary between systems. There is a difference between systems that stem from published research and commercially designed systems. Research papers that describe the design of systems are likely, at a minimum, to contain the ML algorithm in use, plus the training/test data used (which may be publicly available) and at least a subset of the features used. Any production system that is released as open source software reveals the ML algorithm and feature set, although the training data may be user specific. For commercial, closed source software, probing attacks or reverse engineering can be used to discover at least partial information about the system BIB001 . The targeted attacker can improve his knowledge through research and social engineering techniques. For example, the motivated attacker could learn of contracts between an organization and detection system provider, leading the attacker to learn the detection system in use.