Abstract
While malicious samples were widely found in many application fields of machine learning, suitable countermeasures have been researched in the research field of adversarial machine learning. Support vector machines (SVMs), as a kind of successful approach, were widely used to solve security problems, such as image classification, malware detection, spam filtering, and intrusion detection. However, many adversarial attack methods have emerged recently, considering deep neural networks as machine learning models. Therefore, we consider applying them to SVMs and put forward an effective defense strategy against the attacks. In this paper, we aim to develop secure kernel machines against a prevalent attack method that was previously proposed in deep neural networks. This defense approach is based on the kernel optimization of SVMs with radial basis function kernels. To test this hypothesis, we evaluate our approach on MNIST and CIFAR-10 image classification datasets, and the experimental results show that our method is beneficial and makes our classifier more robust.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Vorobeychik, Y.: Adversarial machine learning. In: Synthesis Lectures on Artificial Intelligence and Machine Learning, vol. 12, no. (3) pp. 1–169 (2018)
Kumar, R.S.S.: Adversarial machine learning-industry perspectives. In: 2020 IEEE Security and Privacy Workshops (SPW), pp. 69–75. IEEE (2020)
Kianpour, M., Wen, S.-F.: Timing attacks on machine learning: state of the art. In: Bi, Y., Bhatia, R., Kapoor, S. (eds.) IntelliSys 2019. AISC, vol. 1037, pp. 111–125. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-29516-5_10
Goodfellow, I.: Making machine learning robust against adversarial inputs. Commun. ACM 61(7), 56–66 (2018)
Jati, A.: Adversarial attack and defense strategies for deep speaker recognition systems. Comput. Speech Lang. 68, 101199 (2021)
Islam, M.S.: Efficient hardware malware detectors that are resilient to adversarial evasion. IEEE Trans. Comput. (2021)
Papernot, N.: Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE Symposium on Security and Privacy (SP), Washington, pp. 582–597. IEEE (2016)
Prakash, A.: Deflecting adversarial attacks with pixel deflection. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 8571–8580 (2018)
Zheng, H.: Efficient adversarial training with transferable adversarial examples. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1181–1190 (2020)
Xu, J.: Adversarial defense via local flatness regularization. In: 2020 IEEE International Conference on Image Processing (ICIP), pp. 2196–2200. IEEE (2020)
Ma, Y., Guo, G. (eds.): Support Vector Machines Applications. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-02300-7
Gu, J.: A novel approach to intrusion detection using SVM ensemble with feature augmentation. Comput. Secur. 86, 53–62 (2019)
Zamil, Y.: Spam image email filtering using K-NN and SVM. Int. J. Electr. Comput. Eng. 9(1), 2088–8708 (2019)
Biggio, B.: Wild patterns: ten years after the rise of adversarial machine learning. Pattern Recogn. 84, 317–331 (2018)
Biggio, B.: Poisoning attacks against support vector machines. In: 29th International Conference on Machine Learning, pp.1807–1814. arXiv:1206.6389 (2012)
Koh,P.W.: Stronger data poisoning attacks break data sanitization defenses. arXiv:1811.00741 (2018)
Mei, S.: Using machine teaching to identify optimal training-set attacks on machine learners. In: Proceedings of the Twenty-Ninth AAAI Conference on Artificial Intelligence, pp. 2871–2877 (2015)
Xiao, H.: Is feature selection secure against training data poisoning? In: 32th International Conference on Machine Learning, pp. 1689–1698 (2015)
Xiao, X.: Adversarial label flips attack on support vector machines. In: ECAI, pp. 870–875 (2012)
Laishram, R.: Curie: A method for protecting SVM Classifier from Poisoning Attack. arXiv:1606.01584 (2016)
Weerasinghe, S.: Support vector machines resilient against training data integrity attacks. Pattern Recogn. 96, 106985 (2019)
Biggio, B., et al.: Evasion attacks against machine learning at test time. In: Blockeel, H., Kersting, K., Nijssen, S., Železný, F. (eds.) ECML PKDD 2013. LNCS (LNAI), vol. 8190, pp. 387–402. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40994-3_25
Goodfellow, I.: Explaining and harnessing adversarial examples. arXiv:1412.6572 (2014)
Kurakin, A.: Adversarial machine learning at scale. arXiv:1611.01236 (2016)
Kurakin, A.: Adversarial examples in the physical world. arXiv:1607.02533 (2016)
Moosavi-Dezfooli, S.M.: Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2574–2582 (2016)
Boser, B.E.: A training algorithm for optimal margin classifier. In: Proceedings of the Fifth Annual Workshop on Computational Learning Theory, pp.144–152 (1992)
LeCun, Y.: Gradient-based learning applied to document recognition. Proc. IEEE 86(11), 2278–2324 (1998)
Krizhevsky, A.: Learning multiple layers of features from tiny images. Citeseer (2009)
Acknowledgments
This work is supported by the National Natural Science Foundation of China under Grant No. 61966011.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2021 Springer Nature Switzerland AG
About this paper
Cite this paper
Li, W., Liu, X. (2021). Kernel Optimization in SVM for Defense Against Adversarial Attacks. In: Cheng, J., Tang, X., Liu, X. (eds) Cyberspace Safety and Security. CSS 2020. Lecture Notes in Computer Science(), vol 12653. Springer, Cham. https://doi.org/10.1007/978-3-030-73671-2_4
Download citation
DOI: https://doi.org/10.1007/978-3-030-73671-2_4
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-73670-5
Online ISBN: 978-3-030-73671-2
eBook Packages: Computer ScienceComputer Science (R0)