Robustness of multimodal biometric verification systems under realistic spoofing attacks - G.L. Marcialis @ IJCB2011

•

1 gefällt mir•709 views

Pluribus One

Bildung Technologie

Pattern Recognition and Applications group
Department of Electrical and Electronic Engineering (DIEE)
University of Cagliari, Italy

Robustness of multi-modal biometric
verification systems under realistic
spoofing attacks

Battista Biggio, Zahid Akthar, Giorgio Fumera,
Gian Luca Marcialis, and Fabio Roli

Int’l Joint Conf. On Biometrics, IJCB 2011

Biometrics
• Examples of body traits that can be used for biometric recognition

Face Fingerprint Iris Hand geometry

Palmprint Signature Voice Gait

• Enrollment and verification phases in biometric system
User User Identity

Feature XTemplate
Enrollment Sensor
Extractor
Database

User Claimed Identity
XQuery XTemplate
Sensor Feature Matcher Database
Verification Extractor
score

Decision Genuine/Impostor

12-11-2011 G.L. Marcialis, IJCB 2011 2

Biometric systems
• Multi-modal biometric verification systems

DB
true
genuine
s1
Sensor Face matcher
s
Score fusion rule s ≥ s∗
s2 f (s1 , s2 )
Sensor Fingerprint matcher
false
impostor

DB

– more accurate than unimodal
– more robust to spoof attacks?

12-11-2011 G.L. Marcialis, IJCB 2011 3

Direct (spoofing) attacks
• Spoofing attacks
– attacks at the user interface (sensor)
– fake biometric traits

• Countermeasures
– liveness detection
– multi-modal biometric systems

12-11-2011 G.L. Marcialis, IJCB 2011 4

Motivation and goal of this work
• Open problems
– Estimation of the FAR under spoof attacks for multi-modal
systems
– Construction of fake biometric traits (cumbersome task)

• State-of-the-art
– Fake scores are simulated under a worst-case scenario, re-
sampling genuine user scores

sifake : p(si | G) (when the i-th matcher is spoofed)

• Our goal
– To experimentally verify if this worst-case assumption holds
under realistic spoofing attacks

12-11-2011 G.L. Marcialis, IJCB 2011 5

Experiments
• Multi-modal system with face and fingerprint matchers
– Bozorth3 (fingerprint)
– Elastic Bunch Graph Matching, EBGM (face)

true
genuine
s1
Sensor Face matcher
s
Score fusion rule s ≥ s∗
s2 f (s1 , s2 )
Sensor Fingerprint matcher
false
impostor

12-11-2011 G.L. Marcialis, IJCB 2011 6

Experiments
score fusion rules

1. product s = s1 ⋅ s2

2. weighted sum (LDA) s = w0 + w1s1 + w2 s2

3. likelihood ratio (LLR) s = p(s1 , s2 | G) / p(s1 , s2 | I )

4. extended LLR* explicitly models the distribution of
[Rodrigues et al., JVLC 2009] spoof attacks (worst-case)

12-11-2011 G.L. Marcialis, IJCB 2011 7

Experiments
Fake biometric traits

• Fake fingerprints by “consensual method”
– mould: plasticine-like materials
– cast: latex, silicon, and two-compound mixture of liquid silicon

live fake (latex) fake (silicon)
• Fake faces by “photo attack” and “personal photo attack”
– Photo displayed on a laptop screen to camera
– Personal photos (like those appearing on social networks)

live fake (photo) fake (personal)
12-11-2011 G.L. Marcialis, IJCB 2011 8

Experiments
Data sets

12-11-2011 G.L. Marcialis, IJCB 2011 9

Experiments
Results
• Fakes: latex (fingerprints) and photo (faces)
• Worst case assumption (dashed lines) holds to some extent

12-11-2011 G.L. Marcialis, IJCB 2011 10

Experiments
Results
• Fakes: latex (fingerprints) and photo (faces)
• Worst case assumption (dashed lines) does not hold

12-11-2011 G.L. Marcialis, IJCB 2011 11

Experiments
Extended LLR can be less robust than LLR
Results
to realistic fingerprint spoof attacks!
• Fakes: latex (fingerprints) and photo (faces)
• Worst case assumption (dashed lines) does not hold

12-11-2011 G.L. Marcialis, IJCB 2011 12

Experiments
Results

• Fakes: silicone (fingerprint) and personal photos (face)

12-11-2011 G.L. Marcialis, IJCB 2011 13

Conclusions and future work
• Crucial issue
– performance evaluation of multimodal biometric systems under
spoofing attacks

• State-of-the-art: “worst-case” scenario

• Our results
– it may not provide an accurate model for fake score simulation
– Score fusion rules designed under this assumption may worsen the
system’s robustness!

• Future work
– experimental analysis involving other spoofing attacks
– more accurate modelling and simulation of fake score distributions

12-11-2011 G.L. Marcialis, IJCB 2011 14

Weitere ähnliche Inhalte

Mehr von Pluribus One

Is Deep Learning Safe for Robot Vision? Adversarial Examples against the iCub...

Pluribus One

On Security and Sparsity of Linear Classifiers for Adversarial Settings

Pluribus One

Secure Kernel Machines against Evasion Attacks

Pluribus One

Machine Learning under Attack: Vulnerability Exploitation and Security Measures

Pluribus One

Learning in adversarial settings is becoming an important task for application domains where attackers may inject malicious data into the training set to subvert normal operation of data-driven technologies. Feature selection has been widely used in machine learning for security applications to improve generalization and computational efficiency, although it is not clear whether its use may be beneficial or even counterproductive when training data are poisoned by intelligent attackers. In this work, we shed light on this issue by providing a framework to investigate the robustness of popular feature selection methods, including LASSO, ridge regression and the elastic net. Our results on malware detection show that feature selection methods can be significantly compromised under attack (we can reduce LASSO to almost random choices of feature sets by careful insertion of less than 5% poisoned training samples), highlighting the need for specific countermeasures.

Battista Biggio @ ICML 2015 - "Is Feature Selection Secure against Training D...

Pluribus One

Pattern classifiers have been widely used in adversarial settings like spam and malware detection, although they have not been originally designed to cope with intelligent attackers that manipulate data at test time to evade detection. While a number of adversary-aware learning algorithms have been proposed, they are computationally demanding and aim to counter specific kinds of adversarial data manipulation. In this work, we overcome these limitations by proposing a multiple classifier system capable of improving security against evasion attacks at test time by learning a decision function that more tightly encloses the legitimate samples in feature space, without significantly compromising accuracy in the absence of attack. Since we combine a set of one-class and two-class classifiers to this end, we name our approach one-and-a-half-class (1.5C) classification. Our proposal is general and it can be used to improve the security of any classifier against evasion attacks at test time, as shown by the reported experiments on spam and malware detection.

Battista Biggio @ MCS 2015, June 29 - July 1, Guenzburg, Germany: "1.5-class ...

Pluribus One

Many modern face verification algorithms use a small set of reference templates to save memory and computational resources. However, both the reference templates and the combination of the corresponding matching scores are heuristically chosen. In this paper, we propose a well- principled approach, named sparse support faces, that can outperform state-of-the-art methods both in terms of recognition accuracy and number of required face templates, by jointly learning an optimal combination of matching scores and the corresponding subset of face templates. For each client, our method learns a support vector machine using the given matching algorithm as the kernel function, and de- termines a set of reference templates, that we call support faces, corresponding to its support vectors. It then dras- tically reduces the number of templates, without affecting recognition accuracy, by learning a set of virtual faces as well-principled transformations of the initial support faces. The use of a very small set of support face templates makes the decisions of our approach also easily interpretable for designers and end users of the face verification system.

Sparse Support Faces - Battista Biggio - Int'l Conf. Biometrics, ICB 2015, Ph...

Pluribus One

Learning and recognition of secure patterns is a well-known problem in nature. Mimicry and camouflage are widely-spread techniques in the arms race between predators and preys. All of the information acquired by our senses is therefore not necessarily secure or reliable. In machine learning and pattern recognition systems, we have started investigating these issues only recently, with the goal of learning to discriminate between secure and hostile patterns. This phenomenon has been especially observed in the context of adversarial settings like biometric recognition, malware detection and spam filtering, in which data can be adversely manipulated by humans to undermine the outcomes of an automatic analysis. As current pattern recognition methods are not natively designed to deal with the intrinsic, adversarial nature of these problems, they exhibit specific vulnerabilities that an adversary may exploit either to mislead learning or to avoid detection. Identifying these vulnerabilities and analyzing the impact of the corresponding attacks on pattern classifiers is one of the main open issues in the novel research field of adversarial machine learning. In the first part of this talk, I introduce a general framework that encompasses and unifies previous work in the field, allowing one to systematically evaluate classifier security against different, potential attacks. As an example of application of this framework, in the second part of the talk, I discuss evasion attacks, where malicious samples are manipulated at test time to avoid detection. I then show how carefully-designed poisoning attacks can mislead learning of support vector machines by manipulating a small fraction of their training data, and how to poison adaptive biometric verification systems to compromise the biometric templates (face images) of the enrolled clients. Finally, I briefly discuss our ongoing work on attacks against clustering algorithms, and sketch some possible future research directions.

Battista Biggio, Invited Keynote @ AISec 2014 - On Learning and Recognition o...

Pluribus One

Clustering algorithms have become a popular tool in computer security to analyze the behavior of malware variants, identify novel malware families, and generate signatures for antivirus systems. However, the suitability of clustering algorithms for security-sensitive settings has been recently questioned by showing that they can be significantly compromised if an attacker can exercise some control over the input data. In this paper, we revisit this problem by focusing on behavioral malware clustering approaches, and investigate whether and to what extent an attacker may be able to subvert these approaches through a careful injection of samples with poisoning behavior. To this end, we present a case study on Malheur, an open-source tool for behavioral malware clustering. Our experiments not only demonstrate that this tool is vulnerable to poisoning attacks, but also that it can be significantly compromised even if the attacker can only inject a very small percentage of attacks into the input data. As a remedy, we discuss possible countermeasures and highlight the need for more secure clustering algorithms.

Battista Biggio @ AISec 2014 - Poisoning Behavioral Malware Clustering

Pluribus One

Battista Biggio @ S+SSPR2014, Joensuu, Finland -- Poisoning Complete-Linkage ...

Pluribus One

Clustering algorithms have been increasingly adopted in security applications to spot dangerous or illicit activities. However, they have not been originally devised to deal with deliberate attack attempts that may aim to subvert the clustering process itself. Whether clustering can be safely adopted in such settings remains thus questionable. In this work we propose a general framework that allows one to identify potential attacks against clustering algorithms, and to evaluate their impact, by making specific assumptions on the adversary's goal, knowledge of the attacked system, and capabilities of manipulating the input data. We show that an attacker may significantly poison the whole clustering process by adding a relatively small percentage of attack samples to the input data, and that some attack samples may be obfuscated to be hidden within some existing clusters. We present a case study on single-linkage hierarchical clustering, and report experiments on clustering of malware samples and handwritten digits.

Battista Biggio @ AISec 2013 - Is Data Clustering in Adversarial Settings Sec...

Pluribus One

Battista Biggio @ ECML PKDD 2013 - Evasion attacks against machine learning a...

Pluribus One

Battista Biggio @ ICML2012: "Poisoning attacks against support vector machines"

Pluribus One

Zahid Akhtar - Ph.D. Defense Slides

Pluribus One

Design of robust classifiers for adversarial environments - Systems, Man, and...

Pluribus One

Support Vector Machines Under Adversarial Label Noise (ACML 2011) - Battista ...

Pluribus One

Understanding the risk factors of learning in adversarial environments

Pluribus One

Amilab IJCB 2011 Poster

Pluribus One

Ariu - Workshop on Artificial Intelligence and Security - 2011

Pluribus One

Ariu - Workshop on Applications of Pattern Analysis 2010 - Poster

Pluribus One

Mehr von Pluribus One (20)