Cost utility adversarial training defends IoT models against evasion attacks
Evasion Attacks on Cost-Utility-Based Adversarial Training for Online AutoML in IoT Networks
Cryptography and SecurityMachine Learning
Summary
When devices in the Internet of Things send data, attackers can trick AI models by changing inputs slightly to make wrong decisions without being noticed. The authors studied how well a special kind of AI training, called cost-utility-based adversarial training, protects online learning algorithms from these sneaky attacks. They tested several learning methods and found that some protected models can maintain high accuracy even when faced with attacks, losing less than 1% accuracy. They also checked how models detect changes in data patterns over time.
What this means in practice
- •For iot network operators: Improve security of IoT anomaly detection systems by adopting cost-utility adversarial training for online models to resist evasion attacks.
- •For network security engineers: Apply adversarial training to streaming machine learning models to maintain reliable intrusion detection under adversarial conditions.
Authors
Chukwunonso Henry Nwokoye, Wajiha Zaheer, Khalil El-Khatib, Li Yang
Abstract
As Internet of Things (IoT) networks increasingly depend on machine learning for anomaly, malware, intrusion detection, and network monitoring, such systems have become attractive targets for evasion attacks. Evasion attacks pose a major security risk because an adversary intentionally modifies input data to mislead a trained model into producing incorrect predictions while evading detection. This study evaluates the impact of black-box evasion attacks on a cost-utility-based adversarial training defense strategy in an Online AutoML context for IoT networks. Specifically, evasion attacks were applied to online learners, including Hoeffding Tree (HT), Leveraging Bagging (LB), Streaming Random Patches (SRP), Hoeffding Adaptive Tree (HAT), and Adaptive Random Forest (ARF). By developing naive and adversarially trained (AT) versions of these online learners, we generated clean and adversarial accuracies for each model. The results show that the AT versions of LB and SRP performed best, achieving the highest adversarial accuracy (0.985) and high clean accuracy (0.993) at the highest cost budget of 1.00, with a maximum accuracy reduction of only 0.8%. Finally, drift detection was conducted using the Early Drift Detection Method (EDDM).