Everybody’s Got ML, Tell Me What Else You Have: Practitioners’ Perception of ML-Based Security Tools and Explanations
Everybody’s Got ML, Tell Me What Else You Have: Practitioners’ Perception of ML-Based Security Tools and Explanations
复制标题
DOI：
10.1109/sp46215.2023.10179321
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Jaron Mink;Hadjer Benkraouda;Limin Yang;A. Ciptadi;Aliakbar Ahmadzadeh;Daniel Votipka;Gang Wang
中科院分区：
文献类型：
--
作者：
Jaron Mink;Hadjer Benkraouda;Limin Yang;A. Ciptadi;Aliakbar Ahmadzadeh;Daniel Votipka;Gang Wang
为了开发基于机器学习(ML)的工具来支持安全操作，已经进行了大量的努力。然而，它们在实践中仍面临着关键挑战。人们普遍认为机器学习的一个弱点是缺乏解释，这促使研究人员开发机器学习解释技术。然而，在安全操作的背景下，安全从业者如何感知机器学习和相应的解释方法的好处和痛点，目前还没有很好的理解。为了填补这一空白并了解“需要什么”，我们对18名具有不同角色、职责和专业知识的安全从业人员进行了半结构化访谈。我们发现，实践者普遍认为ML工具应该与传统的基于规则的方法结合使用(而不是取代)。虽然ML的输出被认为很难推理，但令人惊讶的是，严格来说，基于规则的方法并不更容易解释。我们还发现，只有少数从业者将安全性(对对手攻击的健壮性)作为选择工具的关键因素。关于ML解释，实践者在认识到它们在模型验证和理解安全事件方面的价值的同时，也发现了现有解释方法与其下游任务需求之间的差距。我们收集和综合从业者关于解释方案设计的建议，并讨论未来的工作如何有助于满足这些需求。
Significant efforts have been investigated to develop machine learning (ML) based tools to support security operations. However, they still face key challenges in practice. A generally perceived weakness of machine learning is the lack of explanation, which motivates researchers to develop machine learning explanation techniques. However, it is not yet well understood how security practitioners perceive the benefits and pain points of machine learning and corresponding explanation methods in the context of security operations. To fill this gap and understand "what is needed", we conducted semi-structured interviews with 18 security practitioners with diverse roles, duties, and expertise. We find practitioners generally believe that ML tools should be used in conjunction with (instead of replacing) traditional rule-based methods. While ML’s output is perceived as difficult to reason, surprisingly, rule-based methods are not strictly easier to interpret. We also find that only few practitioners considered security (robustness to adversarial attacks) as a key factor for the choice of tools. Regarding ML explanations, while recognizing their values in model verification and understanding security events, practitioners also identify gaps between existing explanation methods and the needs of their downstream tasks. We collect and synthesize the suggestions from practitioners regarding explanation scheme designs, and discuss how future work can help to address these needs.