Collaborative Research: SaTC: CORE: Small: Machine Learning for Cybersecurity: Robustness Against Concept Drift

协作研究：SaTC：核心：小型：网络安全机器学习：针对概念漂移的稳健性

• 批准号: 2154873
• 负责人: David Wagner
• 金额: $ 30万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-10-01 至 2024-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2154873&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Small

A promising direction for cybersecurity is to use machine learning to detect threats and attacks. For instance, machine learning is currently used to detect computer viruses, malware, malicious mobile applications, spam email, and network intrusions. However, one fundamental challenge for using machine learning in this way is the problem of concept drift. Concept drift refers to the problem that threats change over time, and normal benign behavior changes over time, and as a result, machine learning algorithms rapidly degrade and become less effective as time passes. Empirically, concept drift is one of the main challenges that make it hard to apply machine learning more broadly in cybersecurity. This project will develop new methods tailored to the cybersecurity domain for addressing concept drift, and it will advance the state of knowledge on robustness against concept drift in cybersecurity. The project has the potential to improve cybersecurity protections for everyday people, including improving antivirus software, phishing detectors, fraud/scam detection, and more, thereby making the Internet safer for everyone.The team's approach is based on an understanding of the fundamental drivers of concept drift, including both gradual drift and emergence of entirely new types of threats. Threats can often be categorized into multiple categories. For instance, malware falls into many different "malware families". Each category may experience concept drift at a different rate. This provides an opportunity for new methods that take advantage of such differences across categories. To address the problem of categories that are experiencing rapid concept drift, the team plans to develop techniques to detect which categories are suffering from concept drift to the greatest degree and then select samples from those categories for human analysts to evaluate. For new types of threats, the team plans to develop techniques to identify samples from new categories so they can be submitted for human analysis. For categories that are experiencing gradual but sustained concept drift, the team plans to explore use of semi-supervised learning and pseudo labels to help the machine learning algorithm adapt to these changes in the data.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

网络安全的一个有前途的方向是使用机器学习来检测威胁和攻击。例如，机器学习目前被用于检测计算机病毒、恶意软件、恶意移动应用程序、垃圾邮件和网络入侵。然而，以这种方式使用机器学习的一个基本挑战是概念漂移的问题。概念漂移指的是威胁会随着时间的推移而改变，正常的良性行为也会随着时间的推移而改变，因此机器学习算法会随着时间的推移而迅速退化，变得不那么有效。从经验上看，概念漂移是使机器学习难以更广泛地应用于网络安全的主要挑战之一。该项目将开发针对网络安全领域的新方法，以解决概念漂移问题，并将推进网络安全中对概念漂移的鲁棒性的知识状态。该项目有可能改善日常人们的网络安全保护，包括改进防病毒软件、网络钓鱼检测器、欺诈/骗局检测等，从而使互联网对每个人都更安全。该团队的方法是基于对概念漂移的基本驱动因素的理解，包括逐渐漂移和全新威胁类型的出现。威胁通常可以分为多个类别。例如，恶意软件分为许多不同的“恶意软件家族”。每个类别可能以不同的速度经历概念漂移。这为利用这些类别之间的差异的新方法提供了机会。为了解决正在经历快速概念漂移的类别的问题，该团队计划开发技术来检测哪些类别的概念漂移程度最大，然后从这些类别中选择样本供人类分析人员评估。对于新类型的威胁，该团队计划开发技术来识别新类别的样本，以便将其提交给人类分析。对于正在经历逐渐但持续的概念漂移的类别，该团队计划探索使用半监督学习和伪标签来帮助机器学习算法适应数据中的这些变化。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

Continuous Learning for Android Malware Detection

• DOI: 10.48550/arxiv.2302.04332
• 发表时间: 2023-02
• 期刊: ArXiv
• 作者: Yizheng Chen;Zhoujie Ding;David A. Wagner