SaTC: CORE: Medium: Collaborative: Using Machine Learning to Build More Resilient and Transparent Computer Systems

SaTC：核心：媒介：协作：使用机器学习构建更具弹性和透明的计算机系统

• 批准号: 1801494
• 负责人: Michael Reiter
• 金额: $ 33.33万
• 依托单位: University of North Carolina at Chapel Hill
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2018
• 资助国家: 美国
• 起止时间: 2018-09-01 至 2021-03-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1801494&HistoricalAwards=false
• 关键词: SaTC; CORE; Medium; Collaborative; Using

Machine learning algorithms are increasingly part of everyday life: they help power the ads that we see while browsing the web, self-driving aids in modern cars, and even weather prediction and critical infrastructure. We rely on these algorithms in part because they perform better than alternatives and they can be easy to customize to new applications. Many machine learning algorithms also have a big weakness: it is difficult to understand how and why they compute the answers they provide. This opaqueness means that the answers we get from a machine learning algorithm could be subtly biased or even completely wrong, and yet we might not realize it. This project's goal is to make machine learning algorithms easier to understand, as well as to leverage some of the techniques used by attackers to trick machine learning algorithms into making mistakes to build computer systems that are more resistant to attack. In addition to making fundamental contributions to how machine learning algorithms are designed and used, the project includes outreach efforts that will entice students to gain hands-on experience with machine learning tools.This project focuses on deep neural networks (DNNs). A groundswell of research within the past five years has demonstrated the propensity of these models to being evaded by inputs created to fool them -- so called "adversarial examples." These types of attacks leverage DNNs' opacity: while DNNs can perform remarkably well on some classification tasks, they often defy simple explanations of how they do so, and indeed can leverage features for doing so that humans might find surprising. This project leverages DNNs and the attacks against them to gain insights into how to build more resilient computer systems. Specifically, the project will use DNNs to model adversaries trying to attack computer systems and then "attack" these DNNs to learn how to improve these systems' resilience to attack. This modeling will be done using Generative Adversarial Nets (GANs), in which "generator" and "discriminator" models compete. Central to this vision are the abilities to evade DNNs under constraints and to extract explanations from them about how they perform classification. Consequently, this project will make fundamental advances both in developing better methods to deceive DNNs and in improving this important machine-learning tool.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

机器学习算法越来越成为日常生活的一部分：它们帮助我们浏览网页时看到的广告、现代汽车的自动驾驶辅助设备，甚至天气预报和关键基础设施。我们依赖这些算法的部分原因是它们的性能比其他算法更好，并且可以轻松定制以适应新的应用程序。许多机器学习算法也有一个很大的弱点：很难理解它们如何以及为什么计算它们提供的答案。这种不透明性意味着我们从机器学习算法得到的答案可能存在微妙的偏差，甚至完全错误，但我们可能没有意识到这一点。该项目的目标是使机器学习算法更容易理解，并利用攻击者使用的一些技术来欺骗机器学习算法犯错误，以构建更能抵抗攻击的计算机系统。除了对机器学习算法的设计和使用做出基本贡献外，该项目还包括外展工作，以吸引学生获得机器学习工具的实践经验。该项目重点关注深度神经网络（DNN）。 过去五年的大量研究表明，这些模型很容易被用来愚弄它们的输入所规避——即所谓的“对抗性例子”。这些类型的攻击利用了 DNN 的不透明性：虽然 DNN 在某些分类任务上可以表现得非常好，但它们常常无法简单解释它们是如何做到这一点的，而且实际上可以利用一些特征来做到这一点，这样人类可能会感到惊讶。该项目利用 DNN 和针对它们的攻击来深入了解如何构建更具弹性的计算机系统。具体来说，该项目将使用 DNN 对试图攻击计算机系统的对手进行建模，然后“攻击”这些 DNN，以了解如何提高这些系统的攻击弹性。该建模将使用生成对抗网络（GAN）完成，其中“生成器”和“鉴别器”模型相互竞争。这一愿景的核心是能够在约束下规避 DNN，并从中提取有关它们如何执行分类的解释。因此，该项目将在开发更好的方法来欺骗 DNN 和改进这一重要的机器学习工具方面取得根本性进展。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力价值和更广泛的影响审查进行评估，被认为值得支持标准。

项目成果

Statistical Privacy for Streaming Traffic

流媒体流量的统计隐私

• DOI: 10.14722/ndss.2019.23210
• 发表时间: 2019-02
• 期刊: Proceedings of the 26th ISOC Symposium on Network and Distributed System Security
• 作者: Zhang, Xiaokuan;Hamm, Jihun;Reiter, Michael K.;Zhang, Yinqian
• 通讯作者: Zhang, Yinqian

Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes

恶意软件改造：通过修改可执行字节破坏基于 ML 的静态分析

• DOI: 10.1145/3433210.3453086
• 发表时间: 2021-06
• 期刊: Proceedings of the ACM Asia Conference on Computer and Communications Security
• 作者: Lucas, Keane;Sharif, Mahmood;Bauer, Lujo;Reiter, Michael K.;Shintre, Saurabh
• 通讯作者: Shintre, Saurabh

A General Framework for Adversarial Examples with Objectives

具有目标的对抗性示例的通用框架

• DOI: 10.1145/3317611
• 发表时间: 2019-06
• 期刊: ACM Transactions on Privacy and Security
• 影响因子: 2.3
• 作者: Sharif, Mahmood;Bhagavatula, Sruti;Bauer, Lujo;Reiter, Michael K.
• 通讯作者: Reiter, Michael K.