선형 판별 분석 및 k-means 알고리즘을 이용한 적대적 공격 유형 분류 방안
An Adversarial Attack Type Classification Method Using Linear Discriminant Analysis and k-means Algorithm
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
인공지능 기술은 우수한 성능을 기반으로 다양한 분야에 적용되고 있지만 입력 데이터에 인간이 감지할 수 없는 적대적 섭동을 추가하여 인공지능 모델의 오작동을 유도하는 적대적 예제에 취약하다. 현재까지 적대적 예제에 대응하기 위한 방법은 세 가지 범주로 분류할 수 있다. (1) 모델 재학습 방법; (2) 입력 변환 방법; (3) 적대적 예제 탐지 방법. 이러한 적대적 예제에 대응하기 위한 방법은 끊임없이 등장하고 있지만 각 적대적 공격 유형을 분류하는 연구는 미비한 실정이다. 따라서, 본 논문에서는 차원 축소와 군집화 알고리즘을 활용한 적대적 공격 유형 분류 방법을 제안한다. 구체적으로, 제안하는 방법은 적대적 예시로부터 적대적 섭동을 추출하고 선형 판별 분석(LDA)를 통해 적대적 섭동의 차원을 축소한 후에 k-means 알고리즘으로 적대적 공격 유형 분류를 수행한다. MNIST 데이터셋과 CIFAR-10 데이터셋을 대상으로 한 실험을 통해, 제안하는 기법은 5개의 적대적 공격(FGSM, BIM, PGD, DeepFool, C&W)을 효율적으로 분류할 수 있으며, 적대적 예제에 대한 정상 입력을 알 수 없는 제한적인 상황에서도 우수한 분류 성능을 나타내는 것을 확인하였다.
Abstract
Although Artificial Intelligence (AI) techniques have shown impressive performance in various fields, they are vulnerable to adversarial examples which induce misclassification by adding human-imperceptible perturbations to the input. Previous studies to defend the adversarial examples can be classified into three categories: (1) model retraining methods; (2) input transformation methods; and (3) adversarial examples detection methods. However, even though the defense methods against adversarial examples have constantly been proposed, there is no research to classify the type of adversarial attack. In this paper, we proposed an adversarial attack family classification method based on dimensionality reduction and clustering. Specifically, after extracting adversarial perturbation from adversarial example, we performed Linear Discriminant Analysis (LDA) to reduce the dimensionality of adversarial perturbation and performed K-means algorithm to classify the type of adversarial attack family. From the experimental results using MNIST dataset and CIFAR-10 dataset, we show that the proposed method can efficiently classify five tyeps of adversarial attack(FGSM, BIM, PGD, DeepFool, C&W). We also show that the proposed method provides good classification performance even in a situation where the legitimate input to the adversarial example is unknown.
참고문헌 (28)
- Tractica, "Artificial Intelligence Market Forecasts", ~ (2019)
- Szegedy, C., "Intriguing properties of neural networks", arXiv preprint arXiv : 1312. 6199, ~ (2013)
- Nicolae, M. I., "Adversarial Robustness Toolbox v0. 2.2", ~ (2018)
- Jackie SnowMar, "To protect artificial intelligence from attacks, show it fake data", ~ (2018)
- Goodfellow, I. J., "Explaining and harnessing adversarial examples", arXiv preprint arXiv : 1412. 6572, ~ (2014)
- Kurakin, A., "Adversarial examples in the physical world", ~ (2016)
- Madry, A., "Towards deep learning models resistant to adversarial attacks", arXiv preprint arXiv : 1706. 06083, ~ (2017)
- Moosavi-Dezfooli, S. M., "Deepfool : a simple and accurate method to fool deep neural networks", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.2574~2582 (2016)
- Carlini, N., "Towards evaluating the robustness of neural networks", 2017 ieee symposium on security and privacy (sp), pp.39~57 (2017)
- Madry, A., "Towards deep learning models resistant to adversarial attacks", arXiv preprint arXiv : 1706. 06083, ~ (2017)
- Carlini, N., "Defensive distillation is not robust to adversarial examples", arXiv preprint arXiv : 1607. 04311, ~ (2016)
- Guo, C., "Countering adversarial images using input transformations", arXiv preprint arXiv : 1711. 00117, ~ (2017)
- Song, Y., "Pixeldefend : Leveraging generative models to understand and defend against adversarial examples", arXiv preprint arXiv : 1710. 10766, ~ (2017)
- Lu, J., "Safetynet : Detecting and rejecting adversarial examples robustly", Proceedings of the IEEE International Conference on Computer Vision, pp.446~454 (2017)
- Carrara, F., "Adversarial examples detection in features distance spaces", Proceedings of the European Conference on Computer Vision (ECCV) Workshops (2018)
- Xu, W., "Feature squeezing : Detecting adversarial examples in deep neural networks", arXiv preprint arXiv : 1704. 01155, ~ (2017)
- Choi, S. H., "EEJE : Two-Step Input Transformation for Robust DNN Against Adversarial Examples", IEEE Transactions on Network Science and Engineering, 8(2), pp.908~920 (2020)
- Mohaisen, A., "Chatter : Classifying malware families using system event ordering", 2014 IEEE Conference on Communications and Network Security, pp.283~291 (2014)
- AlAhmadi, B. A., "MalClassifier: Malware family classification using network flow sequence behaviour", 2018 APWG Symposium on Electronic Crime Research (eCrime), pp.1~13 (2018)
- Ahmadi, M., "Novel feature extraction, selectio and fusion for effective malware family classification", Proceedings of the sixth ACM conference on data and application security and privacy, pp.183~194 (2016)
- Alswaina, F., "Android malware family classification and analysis : Current status and future directions", Electronics, 9(6), pp.942~ (2020)
- Yann LeCun, "MNIST handwritten digit database", ~ (2010)
- Alex Krizhevsky, "CIFAR-10 (Canadian Institute for Advanced Research)", ~ (2009)
- Balakrishnama, S., "Linear discriminant analysis-a brief tutorial", Institute for Signal and information Processing, 18, pp.1~8 (1998)
- Hartigan, J. A., "Algorithm AS 136 : A k-means clustering algorithm", Journal of the royal statistical society, 28(1), pp.100~108 (1979)
- Technical report on the cleverhans v2. 1.0 adversarial examples library, "Papernot, N.", ~ (2016)
- He, K., "Deep residual learning for image recognition", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.770~778 (2016)
- Zheng, Yanbin, "Defence against adversarial attacks using clustering algorithm", International Conference of Pioneering Computer Scientists, Engineers and Educators (2019)