PROJECT TITLE :

Key-Recovery Attacks on KIDS, a Keyed Anomaly Detection System

ABSTRACT:

Most anomaly detection systems depend upon machine learning algorithms to derive a model of normality that's later used to detect suspicious events. Some works conducted over the last years have realized that such algorithms are typically vulnerable to deception, notably in the form of attacks carefully constructed to evade detection. Numerous learning schemes are proposed to overcome this weakness. One such system is Keyed IDS (KIDS), introduced at DIMVA “10. KIDS” core plan is appreciate the functioning of some cryptographic primitives, specifically to introduce a secret part (the key) into the scheme therefore that some operations are infeasible while not knowing it. In KIDS the learned model and therefore the computation of the anomaly score are each key-dependent, a reality that presumably prevents an attacker from creating evasion attacks. In this work we have a tendency to show that recovering the secret is very straightforward provided that the attacker will interact with KIDS and obtain feedback regarding probing requests. We present realistic attacks for two totally different adversarial settings and show that recovering the key needs solely a small quantity of queries, which indicates that KIDS will not meet the claimed security properties. We have a tendency to finally revisit KIDS' central idea and provide heuristic arguments concerning its suitability and limitations.