Online Anomaly Detection under Adversarial Impact

Security analysis of learning algorithms is gaining increasing importance, especially since they have become target of deliberate obstruction in certain applications. Some security-hardened algorithms have been previously proposed for supervised learning; however, very little is known about the behavior of anomaly detection methods in such scenarios. In this contribution, we analyze the performance of a particular method-online centroid anomaly detection--in the presence of adversarial noise. Our analysis addresses three key security-related issues: derivation of an optimal attack, analysis of its efficiency and constraints. Experimental evaluation carried out on real HTTP and exploit traces confirms the tightness of our theoretical bounds.

• Type: Journal
• Year: 2010
• Where: JMLR
• Authors: Marius Kloft, Pavel Laskov
• Keywords: Analysis, Anomaly Detection, JMLR 2010, Key Security-related Issues