WO2021012220A1

WO2021012220A1 - Evasion attack method and device for integrated tree classifier

Info

Publication number: WO2021012220A1
Application number: PCT/CN2019/097532
Authority: WO
Inventors: 张福勇; 王艺; 李宽
Original assignee: 东莞理工学院
Priority date: 2019-07-24
Filing date: 2019-07-24
Publication date: 2021-01-28

Abstract

Disclosed in the present invention are an evasion attack method and device for an integrated tree classifier. The method comprises: acquiring a substitution data set and a learning model for training to obtain a substitution classifier; and searching an optimal modification feature by using a shortest path algorithm and an evasion attack strategy according to the substitution classifier, positioning and modifying a corresponding feature of an original input sample, and generating a tentative sample to perform tentative evasion attack on a target classifier until the evasion attack succeeds or the maximum modification frequency limit is reached. By implementing the present method, a black box attack method of the integrated tree classifier (a gradient boosting tree, a random forest, etc.) can be deeply researched, so that a basis and a reference are provided for designing a robust integrated tree classifier.

Description

Method and device for evading attack against integrated tree classifier

Technical field

The present invention relates to the technical field of network security research, in particular to an evasion attack method and device for an integrated tree classifier.

Background technique

With the continuous increase of information data, machine learning as an important data analysis tool has been successfully applied to multiple network security applications such as intrusion detection, malicious code detection, spam filtering, and malicious webpage detection. Machine learning algorithms, such as random forests, aim to learn predictive models through training data to distinguish malicious samples from legitimate samples. Unlike other applications where the operating environment is static, security-related tasks involve smart adversaries who can analyze the vulnerabilities of the learning-based model and attack based on the system output. In such a confrontational environment, traditional learning-based classifiers are vulnerable to evasion attacks in security-based applications. In an evasion attack, the attacker can manipulate the sample to evade system detection. For example, in the application of malicious code detection, in order to make the malicious code evade the detection of the system, the attacker will modify some typical malicious statements in the malicious code (that is, statements that often appear in malicious code but rarely appear in normal code. Statements, malicious code detection systems usually detect malicious code based on these statements), or add some normal statements to the malicious code (that is, statements that frequently appear in normal code but rarely appear in malicious code). In spam filtering, attackers can disguise their email behavior by spelling mistakes or adding normal words.

In an adversarial environment, to prevent attackers from inferring sensitive information from training data and target models, when training the detection classifier, the robustness of the system against potential intelligent attacks must be considered. The biggest difference between adversarial machine learning and traditional machine learning is that the design of the algorithm considers a game model-that is, not only must the performance of the algorithm be achieved by learning the training set data and optimizing the objective function, but also the possible attack strategies of the opponent at each stage and Propose corresponding defensive measures. In the face of a new generation of intelligent attacks based on adversarial machine learning, the current security protection technology for machine learning models is not yet mature. Therefore, studying the behavior and defects of machine learning methods in a confrontational environment is very important for network security-related applications.

The existing vulnerability analysis for learning-based classification models mainly uses gradient-based attack methods, which are only effective for models with differentiable loss functions, and cannot be applied to ensemble tree classification models. There are two main methods currently available for attacking the integrated tree model. The ensemble tree classifier attack method based on mixed integer linear programming proposed by Kantchelian et al. can only be applied to white-box attack scenarios, and the algorithm complexity is high, which cannot be applied to larger data sets. In addition, the inquiry-based black box attack method proposed by Cheng et al. requires that the feature value must be a continuous real value, which cannot be applied to the widely used binary features in the field of network security, and this method is not specifically for the integrated tree classifier Design, the attack effect is poor.

In summary, in the field of network security research, black box attacks on certain integrated tree classifiers (gradient boosting trees, random forests, etc.) have not been effectively studied, and it is impossible to provide basis and reference for the design of robust classifiers in this regard. .

Summary of the invention

The technical problem to be solved by the present invention is to provide an evasion attack method and device for the ensemble tree classifier, so as to conduct in-depth research on the black box attack method for the ensemble tree classifier, so as to provide for the design of robust classifiers Basis and reference.

In order to solve the above technical problems, an embodiment of the present invention provides an evasion attack method for an integrated tree classifier, including the steps:

(1) Obtain an original input sample, a replacement data set, and a learning model of the target classifier, wherein the replacement data set is a data set that has consistent distribution characteristics with the target classifier training data;

(2) Training according to the replacement data set and the learning model to obtain a replacement classifier;

(3) Determine whether the current feature modification times reach the preset maximum modification times threshold; if not, according to the alternative classifier, use the shortest path algorithm and the preset evasion attack strategy to find the optimal modification feature, and according to the The optimal modification feature modifies the corresponding feature of the original input sample, generates a trial sample, and executes step (4); if it is, the operation ends;

(4) Use the target classifier to classify the trial samples to obtain trial classification results, and determine whether the trial classification results are consistent with the pre-stored original classification results; if yes, perform step (3); if not, then output The trial sample; wherein the original classification result is a result of the target classifier classifying the original input sample.

Further, according to the alternative classifier, the shortest path algorithm and the preset evasion attack strategy are used to find the optimal modification feature, specifically:

Determine the target classification result type that needs to be obtained according to the classification result type obtained by classifying the input sample by the alternative classifier;

Using the shortest path algorithm, search for the shortest target decision path of each decision tree according to the target classification result type, and obtain the shortest path set of the target;

Assigning weights to each feature in the shortest path set of the target according to the preset evasion attack strategy;

The weights of each feature are accumulated and the accumulated weights of each feature are compared to obtain the optimal modified feature.

Further, the target shortest path set includes a first target shortest path set and a second target shortest path set;

The shortest path algorithm is used to search the target shortest decision path of each decision tree according to the target classification result type to obtain the target shortest path set, specifically:

According to the target classification result type, the alternative classifier is divided into a first type decision tree and a second type decision tree; wherein the decision value of the first type decision tree is inconsistent with the target classification result type, the The decision value of the second type of decision tree is consistent with the target classification result type;

The shortest path algorithm is used to find the shortest path of the first target in the first type of decision tree to obtain the shortest path set of the first target. At the same time, the shortest path algorithm is used to find the shortest target of the second type of decision tree. Path, the shortest path set of the second target is obtained.

Further, the assigned weight value of the feature in the first target shortest path set is a positive number, and the assigned weight value of the feature in the second target shortest path set is a negative number;

The step of accumulating the weight of each feature and comparing the cumulative weight of each feature to obtain the optimal modified feature is specifically:

The weight of each feature is accumulated and the cumulative weight of each feature is compared, and the feature with the largest cumulative weight is found as the optimal modified feature.

Further, the features in the first target shortest path set are weighted according to the formula 1/10 ^n-1 , where n represents the position order of the feature relative to the decision path.

In order to solve the same technical problem, the present invention also provides an evasion attack device for the integrated tree classifier, which includes a data acquisition module, an alternative classifier training module, a feature modification module, and an evasion attack detection module; wherein,

The data acquisition module is used to acquire original input samples, a replacement data set, and a learning model of a target classifier, where the replacement data set is a data set that has consistent distribution characteristics with the target classifier training data;

The alternative classifier training module is configured to train according to the alternative data set and the learning model to obtain an alternative classifier;

The feature modification module is used to determine whether the current feature modification times reach the preset maximum modification times threshold; if not, according to the alternative classifier, the shortest path algorithm and the preset evasion attack strategy are used to find the optimal modification feature , And modify the corresponding feature of the original input sample according to the optimal modification feature to generate a trial sample; if yes, end the operation;

The evasion attack detection module is used to classify the trial sample by using the target classifier to obtain a trial classification result, and determine whether the trial classification result is consistent with the prestored original classification result; if so, repeat the feature modification process If not, output the trial sample; wherein the original classification result is the result of the target classifier classifying the original input sample.

Compared with the prior art, the present invention has the following beneficial effects:

Aiming at the classification model that does not have a differentiable loss function such as ensemble trees, the present invention starts with the decision structure of the decision tree, finds the decision path of each base classifier, and analyzes its performance from the decision path set of the ensemble tree classifier. Misleading the key features of its decision, and finally realize the attack by modifying the key decision features. Through the implementation of the present invention, the black box attack method of the integrated tree classifier (gradient boosting tree, random forest, etc.) can be deeply studied, so as to provide basis and reference for designing a robust integrated tree classifier.

Description of the drawings

FIG. 1 is a schematic flowchart of an evasion attack method for an integrated tree classifier provided by an embodiment of the present invention;

2 is a schematic diagram of the structure of an integrated tree classifier provided by an embodiment of the present invention;

3 is a schematic diagram of the structure of the first type of decision tree in the integrated classifier provided by an embodiment of the present invention;

4 is a schematic structural diagram of a second type of decision tree in an integrated classifier provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of an attack evasion process and model provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of an evasion attack device for an integrated tree classifier provided by an embodiment of the present invention.

Detailed ways

The following describes the technical solutions in the embodiments of the present invention clearly and completely with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

Referring to Fig. 1, an embodiment of the present invention provides an evasion attack method for an integrated tree classifier, including the steps:

At present, the existing vulnerability analysis for learning-based classification models mainly uses gradient-based attack methods, which are only effective for models with differentiable loss functions and cannot be applied to ensemble tree classification models. There are two main methods currently available for attacking the integrated tree model. The ensemble tree classifier attack method based on mixed integer linear programming proposed by Kantchelian et al. can only be applied to white-box attack scenarios, and the algorithm complexity is high, which cannot be applied to larger data sets. The query-based black box attack method proposed by Cheng et al. requires that the feature value must be a continuous real value, which cannot be applied to the widely used binary features in the field of network security, and this method is not specifically designed for integrated tree classifiers. The attack effect is poor.

Aiming at classification models such as ensemble trees that do not have a differentiable loss function, the present invention starts with the decision structure of the decision tree, finds the decision path of each base classifier, and analyzes it from the set of decision paths of the ensemble tree classifier to be misleading. The key feature of its decision-making is finally realized by modifying the key decision feature to realize the attack. The key issue is how to find the key decision feature from the set of decision paths. The present invention starts with the voting-based integration strategy of the ensemble tree classifier, and finds the key features that can change (or mislead) the decision value of the majority base classifier from the ensemble tree classifier. The method finds a key in each cycle process Decide the characteristics, and modify the corresponding characteristic data of the input sample to generate an attack sample. If the attack cannot be successful, find the next key characteristic on this basis until the attack is successful or the maximum number of modified characteristics is reached.

It is understandable that in evasive attacks, the attacker's purpose is to mislead the target model's decision by estimating the decision boundary of the target model and manipulating input samples. Suppose that for the input sample x, the output of the target model is c(x). The attack strategy is to modify x to the minimum and find a sample x'such that c(x')≠c(x). Assume that d(x,x') is a distance function describing the modifier. The evasion attack problem can be described as:

_{A (x) = arg min x} 'd (x, x'), stc (x ') ≠ c (x) ( a)

Among them, x is the input sample, c(x) is the output category of the classification model to x, and sample x'is the attack sample. The meaning of function (1) is to achieve the purpose of changing the output category (ie attack) by modifying x to the minimum.

In order to evade the attack, the attacker needs to have a certain understanding of the target system. The knowledge of the target system can be divided into four levels: 1) training data D; 2) feature space X; 3) learning algorithm F; 4) target model parameter w. The attacker's knowledge about the target system can be represented by θ=(D, X, F, w). We can divide the attacker's level of knowledge into two types of attack scenarios:

White box attack: In this scenario, it is assumed that the attacker knows all the knowledge of the target system, ie θ=(D,X,F,w), then the attacker can avoid the attack with the least cost. In practice, an attacker is unlikely to have all the knowledge. However, this scenario can be used to evaluate the worst-case safety of a learning-based classifier.

Black box attack: This scenario assumes that the attacker has a certain understanding of the target system. Here we assume that the attacker knows the learning algorithm F and the feature space X, but does not know the training data D and the target model parameter w. However, the attacker can collect an alternative data set D'through the Internet or other sources, and use this data set to estimate the target model parameters w'. Of course, the attacker may also obtain a subset of the original training set. In this case, the knowledge possessed by the attacker can be defined as θ'=(D',X,F,w').

The ensemble tree classifier f:R ⁿ →R shown in Figure 2 is a set T composed of multiple decision trees. Without loss of versatility, suppose that the decision tree T _i ∈T is a binary tree, in which each internal node n∈T _i .nodes with predicate logic. If the result of the predicate is true, the output edge points to its left child n.leftchild, otherwise, the output edge points to its right child n.rightchild. Each leaf node has a l∈T _i .leaves category value l.class∈R. For a given sample x∈R ^n, T _i decision tree path is the path from a leaf node to which the root node. T _i classification results of sample x is a value T _i .class l.class classification leaf node of the path. The decision value f(x) of the ensemble tree is the result of the majority vote of all decision trees.

The embodiment of the present invention mainly aims at a binary classification tree based on binary features. As an example, a certain binary classification tree parameter is as follows: R ∈ {-1, 1}, x _i ∈ {0, 1}. Assuming that the classification result of the classifier on the input sample x is f(x)=1, our attack goal is to find the sample x'such that f(x')=-1, and can minimize d(x,x'). When the feature value is a binary value, d(·,·) corresponds to L ₀ norm or Hamming distance, which means that the feature can only be added (from 0 to 1) or deleted (from 1 to 0) from the initial sample x.

According to the majority voting strategy, if we want to make f(x')=-1, then the decision value of more than half of the decision trees in the set should be -1. The basic idea of the attack algorithm is to modify the minimum number of features so that more than half of the trees get a decision value of -1. In addition, we have two findings. One is that for decision trees with binary features, no feature will split twice in the decision path from the root node to the leaf node; the second is for decision trees with binary features, if To change the decision category, a certain feature in the classification path must first be modified. These two findings are essential to find the key features that can mislead the decision of the ensemble tree classifier.

In the embodiment of the present invention, further, according to the alternative classifier, the shortest path algorithm and the preset evasion attack strategy are used to find the optimal modification feature, specifically:

According to the classification result type obtained by classifying the input sample by the alternative classifier, the target classification result type that needs to be obtained is determined; in the embodiment of the present invention, the classification result type obtained by the classifier classifying the input sample is f(x) = 1, then the target classification result type to be determined in this step is f(x')=-1.

Using the shortest path algorithm, search for the shortest target decision path of each decision tree according to the target classification result type, and obtain the target shortest path set;

In the embodiment of the present invention, further, the target shortest path set includes a first target shortest path set and a second target shortest path set;

In the embodiment of the present invention, further, the weight assigned to the feature in the first target shortest path set is a positive number, and the weight assigned to the feature in the second target shortest path set is a negative number;

In the embodiment of the present invention, further, the features in the first target shortest path set are weighted according to the formula 1/10 ^n-1 , where n represents the position order of the feature relative to the decision path.

The following uses an example of an ensemble tree classifier to explain our model. Suppose an ensemble tree classifier is composed of the decision trees T ₁ , T ₂ and T ₃ shown in Figure 3 and Figure 4, and x = [x ₀ ... x ₉ ] = 1100101100 is a 10-dimensional sample. The dark nodes show the classification paths of the three trees to the sample x, and T ₁ .class=1, T ₂ .class=1, T ₃ .class=-1. In this embodiment, since the classification result type of most decision trees is 1, it can be determined that the target classification result type is -1. Therefore, T ₁ and T _{2 are} divided into the first type of decision tree, and T _{3 is} divided into the first type of decision tree. The second type of decision tree.

From the classification path of T ₁ we can see that if we want to make T ₁ .class = -1, we must first modify a certain feature in the classification path. In this embodiment, the features that can be modified are x ₂ , x ₄ , and x ₇ . Secondly, we need to know which features to modify in order to minimize d(x,x'). In order to achieve this goal, the first thing to consider is to modify as few features as possible so that the decision value of as many trees with the current decision value of 1 (the first type of decision tree) becomes -1. For a tree whose current decision value is 1, we need to find the shortest path from each internal node in the tree's classification path to the leaf node with the value -1. First, we list all paths from each internal node in the classification path to the leaf node with a value of -1, and these paths do not include other internal nodes on the classification path. These paths are the paths of nodes in the tree, and we call them tree paths. However, features in the path of the tree do not mean that they need to be modified. Then, determine which features need to be modified according to the input sample x, and obtain a feature path set that needs to be modified. Finally, we list the shortest path (the shortest path for the first type of target) that needs to modify the feature to change the tree decision category to -1. The specific process is detailed in Algorithm 1. For the trees T1 and T2 with a decision value of 1 in this example, the shortest path generation process is shown in equations (2) and (3).

Algorithm 1. Shortest path algorithm.

Input: T: integrated tree classifier, x: input sample.

Output: P: shortest path set.

FOR T _{i ∈} T and T _i .class=1 DO

List all internal nodes T _i .innodes on the tree classification path

FOR each _n ∈ T _i .innodes DO

IF n.leftchild∈T _i .innodes or n.leftchild=1 THEN

List all paths from n through n.rightchild to the leaf with value -1

ELSEIF n.rightchild∈T _i .innodes or n.rightchild=1 THEN

List all paths from n through n.leftchild to the leaf with value -1

ENDIF

ENDFOR

Use sample x to find the path PM _i that needs to be modified

P _i ←List the shortest path in PM _i

ENDFOR

RETURN:P

The shortest path generation process of the first type of target in the embodiment of the present invention is as follows:

In this example, the feature x ₂ appears twice (P ₂₁ and P ₂₂ ) as the first feature in the path that T ₂ needs to be modified, and both paths are the shortest paths. When a feature appears multiple times as the first feature in the shortest path, we randomly select one of them. In the example of formula (3), the path P ₂₁ can be selected as the shortest path of T ₂ . Therefore, the shortest path set (first target shortest path set) in the tree of T that changes the decision value from 1 to -1 is shown in equation (4).

Because there are multiple decision trees in the ensemble classifier, each tree has multiple shortest paths. We need to find out which feature is the best for each modification, so that more trees can get a decision value of -1. We assign a weight to each feature in the shortest path set P, and select the feature with the largest weight as the optimal modification feature each time. The weight assignment rule can be to assign the weight 1/10 ^{n-1 to} the nth feature in a shortest path. It should be noted that the actual application is not limited to this assignment rule. For the four paths in the shortest path set of formula (4), according to the above distribution rules, the features x ₂ and x ₇ in the first two paths are respectively assigned a weight of 1 (the position order of x ₂ and x ₇ in the path is 1, so the weight is 1/10 ^1-1 =1), the feature x ₂ in the third path is assigned a weight value of 1, x ₁ is assigned a weight value of 0.1, and the feature x ₃ in the fourth path is assigned a weight value 1, x _{8 is} assigned a weight of 0.1.

Although, through the above process, the optimal modified feature can be found in the first target shortest path set, so that the decision value of as many trees as possible in the integrated tree changes from 1 to -1. However, the above process only considers the tree with the current decision value of 1, and there may be trees with the current decision value of -1 in the integrated tree. When selecting the optimal modified feature, you should consider whether the tree with the current decision value of -1 is likely to cause the decision value to become 1 due to feature modification. Therefore, we list the paths in the tree with the current decision value of -1 that may cause the decision value to become 1 into the set P'(the set of the second target shortest paths). For the tree T ₃ with the decision value of -1 in this embodiment, the path set whose decision value becomes 1 due to feature modification is shown in equation (5).

The shortest path generation process of the second type of target in the embodiment of the present invention is as follows:

As shown in formula (5), considering that when there is more than one feature in the path, changing a feature will not directly lead to a change in the decision value. Therefore, for the set of paths whose decision value changes from -1 to 1, we only consider modifying one The feature can lead to a situation where the decision value changes, and a weight value of -1 is assigned to this feature. For the example of formula (5), the feature x _{3 is} assigned a weight of -1. The right to set P and P 'are all the same features and the added value, characterized by comparing the maximum value obtained for the weight x _2, and its weight is 2.

After finding the optimal modified feature x _{2 this} time, the corresponding feature of the input sample x needs to be modified. Since the modified feature will cause the classification path of multiple trees in the random forest to change, it is necessary to recalculate the sets P and P', and select the next optimal feature according to the path in the new set, until the detection is evaded or reached Maximum modification limit ("Evasion of detection" means that the attack is successful, and "Maximum modification limit" means that the attack is not successful when the maximum number of modifications is reached). The specific process of the evasion detection model is shown in Algorithm 2. The symbol P _ijk used here refers to the k-th feature of the j-th path in the shortest path set of the i-th tree with a decision value of 1. P _ijk .weight refers to the weight of P _ijk .

Algorithm 2. Attack method.

Input: T: ensemble tree classifier, x: input sample, m _max : maximum number of modified features.

Output: Attack sample x'.

Use the shortest path algorithm to get the shortest path set P and set P'of T versus x

m←0

WHILE

and m<m _max DO

FOR each feature P _ijk DO

ENDFOR

Assign a weight of -1 to the unique feature in the path of length 1 in P'

Add the weights of the same feature and find the feature with the largest weight x _w

x'←Modify the corresponding feature of the sample x _w

m←m+1

IF f(x')=-1

RETURN:x'

ELSE

Recalculate set P and set P'

ENDIF

ENDWHILE

Please refer to FIG. 5, in order to more intuitively illustrate the main working principle of the present invention, in the embodiment of the present invention, we assume that the attacker knows the learning model f and the replacement data set D'that has a consistent distribution with the training data. First, the attacker needs to train an alternative ensemble tree model based on his own knowledge. Secondly, use evasion attack method to locate and modify the key features of the input sample x. Finally, use the modified sample x'to attack the target classifier.

It should be noted that after implementing the embodiments of the present invention to obtain attack samples (adversarial samples) that successfully perform evasion attacks, in the decision tree training process, by adding the adversarial samples to the training data set, the improvement of the decision tree can be significantly improved. safety.

The ensemble tree model (including random forest, gradient boosting tree, etc.) is a commonly used classification model because it is easy to use and can significantly improve the classification accuracy. The embodiment of the present invention proposes a new evasion attack method for the integrated tree classifier to study its security against evasion attacks.

Compared with other methods in the prior art, the present invention uses the shortest path algorithm to find the least features that can change the decision value of the ensemble tree classifier. The time complexity of finding a modified feature in this scheme is

The time complexity of Kantchelian's method to complete the same task is

Table 1 shows the comparison of the present invention with the Kantchelian method and Cheng's method.

Table 1 Comparison of three methods

方法method	算法效率Algorithm efficiency	支持二进制特征Support binary features	黑盒攻击Black box attack
本发明this invention	高high	是Yes	是Yes
Kantchelian的方法Kantchelian's method	低low	是Yes	否no
Cheng的方法Cheng's method	高high	否no	是Yes

It is understandable that in practical applications, we use both white box attacks and black box attacks to evaluate the security of the integrated tree classifier against evasion attacks. For white box attacks, we assume that the attacker has the same knowledge as the target system. For the black box attack (embodiment of the present invention), we consider two attack scenarios based on the degree of training data the attacker has. The first attack scenario is called the training subset scenario. This scenario assumes that the attacker knows the subset of the original training data. The second scenario is called the replacement data scenario. This scenario assumes that the attacker does not know the original training data, but can collect a replacement data set with the same distribution as the original training data through the network or other means. In these two attack scenarios, the data held by the attacker can be divided into 20%, 50%, 80%, and 100% to evaluate the security of the classifier when the attacker has different amounts of data. The security evaluation of the classifier adopts two evaluation criteria: Hardness of evasion and Evasion rate.

Aiming at the classification model that does not have a differentiable loss function such as ensemble trees, the present invention starts with the decision structure of the decision tree, finds the decision path of each base classifier, and analyzes its performance from the decision path set of the ensemble tree classifier. Misleading the key features of its decision, and finally realize the attack by modifying the key decision features. Through the implementation of the embodiments of the present invention, it is possible to conduct in-depth research on black box attack methods for widely used binary feature-based integrated tree classifiers (gradient boosting trees, random forests, etc.), thereby providing a basis for designing robust classifiers and reference.

It should be noted that for the above method or process embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that the embodiments of the present invention are not affected by the described sequence of actions. Limitation, because according to the embodiment of the present invention, some steps can be performed in other order or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

Please refer to FIG. 6, in order to solve the same technical problem, the present invention also provides an evasion attack device for the integrated tree classifier, including a data acquisition module 1, an alternative classifier training module 2, a feature modification module 3, and an evasion attack probe Module 4; among them,

The data acquisition module 1 is configured to acquire original input samples, a replacement data set, and a learning model of a target classifier, where the replacement data set is a data set that has consistent distribution characteristics with the target classifier training data;

The alternative classifier training module 2 is configured to train according to the alternative data set and the learning model to obtain an alternative classifier;

The feature modification module 3 is used to determine whether the current feature modification times reach the preset maximum modification times threshold; if not, the shortest path algorithm and the preset evasion attack strategy are used to find the optimal modification according to the alternative classifier Feature, and modify the corresponding feature of the original input sample according to the optimal modified feature to generate a trial sample; if yes, end the operation;

The evasive attack detection module 4 is used to classify the trial samples by using the target classifier to obtain a trial classification result, and determine whether the trial classification result is consistent with the pre-stored original classification result; if so, repeat feature modification Process; if not, output the trial sample; wherein, the original classification result is the result of the target classifier classifying the original input sample.

It is understandable that the foregoing system item embodiment corresponds to the method item embodiment of the present invention. The present invention provides an evasion attack device for the integrated tree classifier, which can realize the method described in any method item embodiment of the present invention. Provides an evasion attack method for the integrated tree classifier.

The above are the preferred embodiments of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and modifications can be made, and these improvements and modifications are also considered This is the protection scope of the present invention.

Claims

An evasion attack method for ensemble tree classifiers is characterized in that it comprises the steps:

(1) Obtain an original input sample, a replacement data set, and a learning model of the target classifier, wherein the replacement data set is a data set that has consistent distribution characteristics with the target classifier training data;

(2) Training according to the replacement data set and the learning model to obtain a replacement classifier;

(3) Determine whether the current feature modification times reach the preset maximum modification times threshold; if not, according to the alternative classifier, use the shortest path algorithm and the preset evasion attack strategy to find the optimal modification feature, and according to the The optimal modification feature modifies the corresponding feature of the original input sample, generates a trial sample, and executes step (4); if it is, the operation ends;

(4) Use the target classifier to classify the trial samples to obtain trial classification results, and determine whether the trial classification results are consistent with the pre-stored original classification results; if yes, perform step (3); if not, then output The trial sample; wherein the original classification result is a result of the target classifier classifying the original input sample.
The evasion attack method for the ensemble tree classifier according to claim 1, wherein, according to the alternative classifier, the shortest path algorithm and a preset evasion attack strategy are used to find the optimal modification feature, specifically:

Determine the target classification result type that needs to be obtained according to the classification result type obtained by classifying the input sample by the alternative classifier;

Using the shortest path algorithm, search for the shortest target decision path of each decision tree according to the target classification result type, and obtain the shortest path set of the target;

Assigning weights to each feature in the shortest path set of the target according to the preset evasion attack strategy;

The weights of each feature are accumulated and the accumulated weights of each feature are compared to obtain the optimal modified feature.
The evasion attack method for the ensemble tree classifier according to claim 2, wherein the shortest path set for the target includes a shortest path set for a first target and a shortest path set for a second target;

The shortest path algorithm is used to search the target shortest decision path of each decision tree according to the target classification result type to obtain the target shortest path set, specifically:

According to the target classification result type, the alternative classifier is divided into a first type decision tree and a second type decision tree; wherein the decision value of the first type decision tree is inconsistent with the target classification result type, the The decision value of the second type of decision tree is consistent with the target classification result type;

The shortest path algorithm is used to find the shortest path of the first target in the first type of decision tree to obtain the shortest path set of the first target. At the same time, the shortest path algorithm is used to find the shortest target of the second type of decision tree. Path, the shortest path set of the second target is obtained.
The evasion attack method for the ensemble tree classifier according to claim 3, wherein the weights assigned to the features in the first target shortest path set are positive numbers, and the second target shortest path set is The assigned weight of the feature is negative;

The step of accumulating the weight of each feature and comparing the cumulative weight of each feature to obtain the optimal modified feature is specifically:

The weight of each feature is accumulated and the cumulative weight of each feature is compared, and the feature with the largest cumulative weight is found as the optimal modified feature.
The evasion attack method for the ensemble tree classifier according to claim 4, wherein the features in the shortest path set of the first target are weighted according to the formula 1/10 n-1 , where n represents the The position order of the feature relative to the decision path.
An evasion attack device for an integrated tree classifier, which is characterized by comprising a data acquisition module, a replacement classifier training module, a feature modification module, and an evasion attack detection module; wherein,

The data acquisition module is used to acquire original input samples, a replacement data set, and a learning model of a target classifier, where the replacement data set is a data set that has consistent distribution characteristics with the target classifier training data;

The alternative classifier training module is configured to train according to the alternative data set and the learning model to obtain an alternative classifier;

The feature modification module is used to determine whether the current feature modification times reach the preset maximum modification times threshold; if not, according to the alternative classifier, the shortest path algorithm and the preset evasion attack strategy are used to find the optimal modification feature , And modify the corresponding feature of the original input sample according to the optimal modification feature to generate a trial sample; if yes, end the operation;

The evasion attack detection module is used to classify the trial sample by using the target classifier to obtain a trial classification result, and determine whether the trial classification result is consistent with the prestored original classification result; if so, repeat the feature modification process If not, output the trial sample; wherein the original classification result is the result of the target classifier classifying the original input sample.
The evasion attack device for the ensemble tree classifier according to claim 6, characterized in that, according to the alternative classifier, the shortest path algorithm and a preset evasion attack strategy are used to find the optimal modification feature, specifically:

Determine the target classification result type that needs to be obtained according to the classification result type obtained by classifying the input sample by the alternative classifier;

Using the shortest path algorithm, search for the shortest target decision path of each decision tree according to the target classification result type, and obtain the shortest path set of the target;

Assigning weights to each feature in the shortest path set of the target according to the preset evasion attack strategy;

The weights of each feature are accumulated and the accumulated weights of each feature are compared to obtain the optimal modified feature.
The evasion attack device for the integrated tree classifier according to claim 7, wherein the shortest path set of the target includes a shortest path set of a first target and a shortest path set of a second target;

The shortest path algorithm is used to search the target shortest decision path of each decision tree according to the target classification result type to obtain the target shortest path set, specifically:

According to the target classification result type, the alternative classifier is divided into a first type decision tree and a second type decision tree; wherein the decision value of the first type decision tree is inconsistent with the target classification result type, the The decision value of the second type of decision tree is consistent with the target classification result type;

The shortest path algorithm is used to find the shortest path of the first target in the first type of decision tree to obtain the shortest path set of the first target. At the same time, the shortest path algorithm is used to find the shortest target of the second type of decision tree. Path, the shortest path set of the second target is obtained.
The evasion attack device for the ensemble tree classifier according to claim 8, wherein the weights assigned to the features in the first target shortest path set are positive numbers, and the second target shortest path set is The assigned weight of the feature is negative;

The step of accumulating the weight of each feature and comparing the cumulative weight of each feature to obtain the optimal modified feature is specifically:

The weight of each feature is accumulated and the cumulative weight of each feature is compared, and the feature with the largest cumulative weight is found as the optimal modified feature.
The evasion attack device for the ensemble tree classifier according to claim 9, wherein the features in the shortest path set of the first target are weighted according to the formula 1/10 n-1 , where n represents the The position order of the feature relative to the decision path.