论文标题
Unbus：在存在扰动样品的情况下，不确定性意识到深僵尸网络检测系统
UNBUS: Uncertainty-aware Deep Botnet Detection System in Presence of Perturbed Samples
论文作者
论文摘要
使用深度学习体系结构成功检测到了数量不断增加的僵尸网络家族。尽管攻击的多样性增加，但这些体系结构应该对攻击变得更加强大。事实证明，它们对输入中的小但结构良好的扰动非常敏感。僵尸网络检测需要极低的假阳性率（FPR），这在当代深度学习中通常无法实现。攻击者试图通过制作中毒样本来增加FPR。最近的大多数研究都集中在使用模型损失函数来构建对抗性示例和强大的模型。在本文中，提出了两种基于LSTM的分类算法，用于僵尸网络分类，精度高于98％。然后，提出了对抗性攻击，将准确性降低到约30％。然后，通过检查计算不确定性的方法，提出了防御方法将准确性提高到约70％。通过使用深层和随机的平均定量方法，已经研究了所提出方法中准确性的不确定性。
A rising number of botnet families have been successfully detected using deep learning architectures. While the variety of attacks increases, these architectures should become more robust against attacks. They have been proven to be very sensitive to small but well constructed perturbations in the input. Botnet detection requires extremely low false-positive rates (FPR), which are not commonly attainable in contemporary deep learning. Attackers try to increase the FPRs by making poisoned samples. The majority of recent research has focused on the use of model loss functions to build adversarial examples and robust models. In this paper, two LSTM-based classification algorithms for botnet classification with an accuracy higher than 98% are presented. Then, the adversarial attack is proposed, which reduces the accuracy to about 30%. Then, by examining the methods for computing the uncertainty, the defense method is proposed to increase the accuracy to about 70%. By using the deep ensemble and stochastic weight averaging quantification methods it has been investigated the uncertainty of the accuracy in the proposed methods.
