Amilab IJCB 2011 Poster

•

0 gefällt mir•573 views

The document summarizes a multi-clue approach for detecting photo-based face spoofing attacks in face recognition systems. It fuses analysis of both static visual characteristics and video clues, such as motion and eye blinking. For static analysis, it extracts several visual representations from frames to compute scores. Video analysis examines motion and blinks. The scores are fused using different combination methods depending on the level of detected motion. Experimental results on a standard spoofing database show the fused approach is more effective and robust than static analysis alone, especially for higher quality spoofing attacks.

Technologie News & Politik

Fusion of multiple clues for photo-attack detection in face
recognition systems
Roberto Tronci , Daniele Muntoni , Gianluca Fadda , Maurizio Pili , Nicola Sirena , Marco Ristori ,
1,2 1,2 1 1 1 1

Gabriele Murgia , Fabio Roli
1 2

1
Ambient Intelligence Lab, Sardinia DistrICT, Sardegna Ricerche, ITALY
2
DIEE, Dept. Electric and Electronic Engineering, University of Cagliari, ITALY
{roberto.tronci, muntoni, fadda, maurizio.pili, sirena, gabriele.murgia, ristori}@sardegnaricerche.it
{roberto.tronci, daniele.muntoni, roli}diee.unica.it

Introduction
SARDEGNA
RICERCHE We faced the problem of detecting 2-D face spoofing attacks performed by
placing a printed photo of a real user in front of the camera.
For this type of attack it is not possible to relay just on the face
movements as a clue of vitality because the attacker can easily simulate
IJCB2011
such a case, and also because real users often show a “low vitality” during
the authentication session.
In this paper, we perform both video and static analysis in order to employ
complementary information about motion, texture and liveness and
consequently to obtain a more robust classification.

Our approach Classification
AmILab's Spoof Detector implements a multi-clue approach. At classification stage scores are computed over a sliding window of a few
seconds of video.
Static analysis tackles the visual characteristics of a photo attack. Within this window, static analysis results in FxN scores (F frames and N
The visual representations that we propose to use are: Color and Edge visual representations). A unique score is computed through a DSC
Directivity Descriptor, Fuzzy Color and Texture Histogram, MPEG-7 algorithm. :
Descriptors (like Scalable Color and Edge Histogram), Gabor Texture, S sa = 1− ⋅min { S i , f }⋅max { S i , f } i∈[1, N ] , f ∈[1, F ]
Tamura Texture, RGB and HSV Histograms, and JPEG Histogram.
For each frame, each of the above mentioned visual representations result Finally, fusion between static and video analysis is performed as:
in a specific score.

Video analysis aims to detect vitality clues. Clues examined in this work
are motion analysis of the scene and the number of eye blinks that are
S =
{ ⋅S sa1 −  ⋅S bl ,
 1⋅S sa  2⋅S bl  3⋅S m ,
if S m is high
if S m is low
represented by two independent scores.
S sa
Still Frame Characteristic analysis

D S
S
S bl C
Blink detection

Sm LOW?
Global motion Yes

Experimental results: the face spoof competition
For our experiments we used the Print-Attack Replay Database developed
for the IJCB 2011 Competition on counter measures to 2D facial spoofing
attacks from the Idiap Research Institute.
Although static analysis alone easily achieves a perfect separation in
the test set, we enhanced its classification with the video analysis in
order to grant performances even with higher quality printed photos or
high quality displays (smart-phones, tablets and other modern portable¿

devices). ¿
¿
¿
¿
¿
¿
¿
¿
¿
¿
¿
¿
¿
−¿= f k  x i  omega −¿ ,
i
s¿
ik
−¿=¿
¿= f k  x i  omega¿ , S ¿
k
i
s¿
ik
¿=¿
S ¿k

Introduction of video analysis results in lower performances in terms of
separation of scores' distributions. However, the proposed fusion scheme
still proved to be very effective and robust.
The contribution of video analysis in terms of robust classification will be
further investigated in future works.

Contacts

Ambient Intelligence Lab - Edificio 1, Loc. Piscinamanna, 09010 Pula (CA), Italy - Tel. +39 070 9243 2682
http://prag.diee.unica.it/amilab/ labiam@sardegnaricerche.it

Weitere ähnliche Inhalte

Mehr von Pluribus One

Wild Patterns: A Half-day Tutorial on Adversarial Machine Learning. ICMLC 201...

Pluribus One

Wild patterns - Ten years after the rise of Adversarial Machine Learning - Ne...

Pluribus One

WILD PATTERNS - Introduction to Adversarial Machine Learning - ITASEC 2019

Pluribus One

Is Deep Learning Safe for Robot Vision? Adversarial Examples against the iCub...

Pluribus One

On Security and Sparsity of Linear Classifiers for Adversarial Settings

Pluribus One

Secure Kernel Machines against Evasion Attacks

Pluribus One

Machine Learning under Attack: Vulnerability Exploitation and Security Measures

Pluribus One

Learning in adversarial settings is becoming an important task for application domains where attackers may inject malicious data into the training set to subvert normal operation of data-driven technologies. Feature selection has been widely used in machine learning for security applications to improve generalization and computational efficiency, although it is not clear whether its use may be beneficial or even counterproductive when training data are poisoned by intelligent attackers. In this work, we shed light on this issue by providing a framework to investigate the robustness of popular feature selection methods, including LASSO, ridge regression and the elastic net. Our results on malware detection show that feature selection methods can be significantly compromised under attack (we can reduce LASSO to almost random choices of feature sets by careful insertion of less than 5% poisoned training samples), highlighting the need for specific countermeasures.

Battista Biggio @ ICML 2015 - "Is Feature Selection Secure against Training D...

Pluribus One

Pattern classifiers have been widely used in adversarial settings like spam and malware detection, although they have not been originally designed to cope with intelligent attackers that manipulate data at test time to evade detection. While a number of adversary-aware learning algorithms have been proposed, they are computationally demanding and aim to counter specific kinds of adversarial data manipulation. In this work, we overcome these limitations by proposing a multiple classifier system capable of improving security against evasion attacks at test time by learning a decision function that more tightly encloses the legitimate samples in feature space, without significantly compromising accuracy in the absence of attack. Since we combine a set of one-class and two-class classifiers to this end, we name our approach one-and-a-half-class (1.5C) classification. Our proposal is general and it can be used to improve the security of any classifier against evasion attacks at test time, as shown by the reported experiments on spam and malware detection.

Battista Biggio @ MCS 2015, June 29 - July 1, Guenzburg, Germany: "1.5-class ...

Pluribus One

Many modern face verification algorithms use a small set of reference templates to save memory and computational resources. However, both the reference templates and the combination of the corresponding matching scores are heuristically chosen. In this paper, we propose a well- principled approach, named sparse support faces, that can outperform state-of-the-art methods both in terms of recognition accuracy and number of required face templates, by jointly learning an optimal combination of matching scores and the corresponding subset of face templates. For each client, our method learns a support vector machine using the given matching algorithm as the kernel function, and de- termines a set of reference templates, that we call support faces, corresponding to its support vectors. It then dras- tically reduces the number of templates, without affecting recognition accuracy, by learning a set of virtual faces as well-principled transformations of the initial support faces. The use of a very small set of support face templates makes the decisions of our approach also easily interpretable for designers and end users of the face verification system.

Sparse Support Faces - Battista Biggio - Int'l Conf. Biometrics, ICB 2015, Ph...

Pluribus One

Learning and recognition of secure patterns is a well-known problem in nature. Mimicry and camouflage are widely-spread techniques in the arms race between predators and preys. All of the information acquired by our senses is therefore not necessarily secure or reliable. In machine learning and pattern recognition systems, we have started investigating these issues only recently, with the goal of learning to discriminate between secure and hostile patterns. This phenomenon has been especially observed in the context of adversarial settings like biometric recognition, malware detection and spam filtering, in which data can be adversely manipulated by humans to undermine the outcomes of an automatic analysis. As current pattern recognition methods are not natively designed to deal with the intrinsic, adversarial nature of these problems, they exhibit specific vulnerabilities that an adversary may exploit either to mislead learning or to avoid detection. Identifying these vulnerabilities and analyzing the impact of the corresponding attacks on pattern classifiers is one of the main open issues in the novel research field of adversarial machine learning. In the first part of this talk, I introduce a general framework that encompasses and unifies previous work in the field, allowing one to systematically evaluate classifier security against different, potential attacks. As an example of application of this framework, in the second part of the talk, I discuss evasion attacks, where malicious samples are manipulated at test time to avoid detection. I then show how carefully-designed poisoning attacks can mislead learning of support vector machines by manipulating a small fraction of their training data, and how to poison adaptive biometric verification systems to compromise the biometric templates (face images) of the enrolled clients. Finally, I briefly discuss our ongoing work on attacks against clustering algorithms, and sketch some possible future research directions.

Battista Biggio, Invited Keynote @ AISec 2014 - On Learning and Recognition o...

Pluribus One

Clustering algorithms have become a popular tool in computer security to analyze the behavior of malware variants, identify novel malware families, and generate signatures for antivirus systems. However, the suitability of clustering algorithms for security-sensitive settings has been recently questioned by showing that they can be significantly compromised if an attacker can exercise some control over the input data. In this paper, we revisit this problem by focusing on behavioral malware clustering approaches, and investigate whether and to what extent an attacker may be able to subvert these approaches through a careful injection of samples with poisoning behavior. To this end, we present a case study on Malheur, an open-source tool for behavioral malware clustering. Our experiments not only demonstrate that this tool is vulnerable to poisoning attacks, but also that it can be significantly compromised even if the attacker can only inject a very small percentage of attacks into the input data. As a remedy, we discuss possible countermeasures and highlight the need for more secure clustering algorithms.

Battista Biggio @ AISec 2014 - Poisoning Behavioral Malware Clustering

Pluribus One

Battista Biggio @ S+SSPR2014, Joensuu, Finland -- Poisoning Complete-Linkage ...

Pluribus One

Clustering algorithms have been increasingly adopted in security applications to spot dangerous or illicit activities. However, they have not been originally devised to deal with deliberate attack attempts that may aim to subvert the clustering process itself. Whether clustering can be safely adopted in such settings remains thus questionable. In this work we propose a general framework that allows one to identify potential attacks against clustering algorithms, and to evaluate their impact, by making specific assumptions on the adversary's goal, knowledge of the attacked system, and capabilities of manipulating the input data. We show that an attacker may significantly poison the whole clustering process by adding a relatively small percentage of attack samples to the input data, and that some attack samples may be obfuscated to be hidden within some existing clusters. We present a case study on single-linkage hierarchical clustering, and report experiments on clustering of malware samples and handwritten digits.

Battista Biggio @ AISec 2013 - Is Data Clustering in Adversarial Settings Sec...

Pluribus One

Battista Biggio @ ECML PKDD 2013 - Evasion attacks against machine learning a...

Pluribus One

Battista Biggio @ ICML2012: "Poisoning attacks against support vector machines"

Pluribus One

Zahid Akhtar - Ph.D. Defense Slides

Pluribus One

Design of robust classifiers for adversarial environments - Systems, Man, and...

Pluribus One

Robustness of multimodal biometric verification systems under realistic spoof...

Pluribus One

Support Vector Machines Under Adversarial Label Noise (ACML 2011) - Battista ...

Pluribus One

Mehr von Pluribus One (20)