Developing robust AI systems that withstand adversarial attacks — across network security, mobile malware, healthcare AI, and social network manipulation.
Headline result: Robustness across security, health, and social systems.
Papers
29
Years
2018–2026
Co-authors
32
Overview
AI systems deployed in healthcare, security, and finance can be manipulated by adversarial inputs — carefully crafted perturbations that cause confident wrong predictions. We develop defenses, detection systems, and robust architectures that remain reliable even when attacked.
Research Areas
Adversarial CAPTCHAs & Usable Security — Designing CAPTCHAs that are easy for humans but hard for AI using precise noise targeting. Published at AAMAS 2026.
Encrypted Network Traffic — Detecting anomalies and classifying malicious traffic in fully encrypted streams without decryption, using contrastive learning for zero-day attacks.
Android Malware Detection — ML-based classifiers hardened against evasion attacks, maintaining accuracy even when adversaries know the detection method.
Healthcare AI Robustness — Adversarial training and certified defenses for medical diagnosis and patient prediction models under attack.
Social Network Manipulation — Detecting coordinated inauthentic behavior, bot accounts, and disinformation using graph-based anomaly detection.
Technical Approaches
Contrastive & Self-Supervised Learning — SimCSE-based methods that build robust representations effective for zero-shot detection of novel attack patterns.
Adversarial Training & Certified Defenses — Training on adversarial examples with provable robustness guarantees via randomized smoothing for safety-critical applications.
Privacy-Preserving Detection — Federated learning and differential privacy techniques that protect sensitive data while maintaining detection performance.
In plain words
Explainers of this line's papers for readers outside the field.
Ranked by joint papers in this line. The bar under each name spans their years on it, 2018 to 2026. A ring marks a student of the lab (10 of 32 co-authors here). 24 more co-authors on the Lab page
The dominance of encryption and the relentless growth of network traffic have rendered traditional deep packet inspection ineffective and made retraining-based machine learning classifiers operationally costly, as every new application or threat class requires a full model rebuild. In order to overcome this challenge, we present an ultra-fast encrypted traffic classification system based on Classification By Retrieval (CBR): each flow is represented by a fixed-length feature vector extracted from only the first few packets, indexed in a HNSW approximate nearest-neighbor structure, and classified by retrieving its nearest labeled neighbor. New classes are absorbed by inserting a handful of labeled vectors into the running index, with no retraining and no downtime, and out-of-distribution traffic is detected within the same retrieval step using a single global distance threshold. We evaluate handcrafted statistical features and learned CNN and MLP embeddings against a Random Forest baseline on the public CESNET-TLS22 dataset (184 application classes) and a proprietary cellular dataset (RADCOM). With CNN embeddings, CBR matches Random Forest accuracy (macro F1 of 0.923 versus 0.925 on CESNET) while training roughly ten times faster, adapts to new classes two to three orders of magnitude faster (seconds versus thousands of seconds), and detects out-of-distribution flows at up to 0.92 AUROC. The retrieval index is also far cheaper to keep resident than the baseline it replaces, holding 1.2 million CESNET flows in 171 MB against 1,350 MB for the serialized forest, because its size grows with the number of indexed flows rather than with the number of classes. The Random Forest remains the faster classifier per flow, so the trade-off is per-flow latency against adaptability and memory. These results show that retrieval-based classification is a practical and adaptable alternative for real-time encrypted traffic analysis in dynamic network environments.
@article{zion2026ultrafast,
author = {Zion, Yehonatan and Dvir, Amit and Hajaj, Chen and Dubin, Ran and Filber, Neriya},
title = {Ultra fast encrypted network traffic classification based on classification by retrieval powered by out-of-distribution},
journal = {Computer Networks},
year = {2026},
doi = {10.1016/j.comnet.2026.112739},
url = {https://doi.org/10.1016/j.comnet.2026.112739}
}
Real-time processing demands for massive IoT sensor data necessitate reliance on distributed microservice systems within edge clusters. However, pinpointing the root cause of anomalies within these edge microservice clusters poses a critical challenge for intelligent IoT operation and maintenance. To address the issue, a spatio-temporal graph propagation model ST-GraphRCA is proposed for root cause analysis in IoT edge environments. Our approach begins by resolving the fundamental issue of time-series asynchrony across distributed multi-source metrics. A PCA-DTW hybrid feature extraction method is introduced with a dynamic alignment strategy to mitigate the effects of random network delays and data deformation without requiring prior synchronization. Subsequently, ST-GraphRCA constructs a stream-based forward propagation graph based on the flow conservation principle. By integrating dynamic edge weights with node-level input–output anomaly scores, ST-GraphRCA precisely infers fault propagation pathways and identifies potential root cause candidates through causal reasoning. Finally, a topology-constrained high-utility mining algorithm filters these candidates. Using a constraint matrix, the algorithm filters out unreachable service combinations to locate low-frequency and high-risk root causes. Experimental results indicate that ST-GraphRCA achieves an F1-Score of 0.89, outperforming existing methods. In resource-constrained edge scenarios, its average localization time is merely 238.8 ms, representing a six-fold improvement over key benchmarks. Thus, ST-GraphRCA not only provides an efficient anomaly fault tracing solution for large-scale IoT systems but also offers technical support for the intelligent operation and maintenance of distributed microservice systems.
@inproceedings{aharon2026uncovering_microservice_faults,
doi = {10.1109/ICC59461.2026.11586787},
author = {Aharon, Udi and Dvir, Amit and Dubin, Ran and Marbel, Revital and Hajaj, Chen},
title = {Uncovering Microservice Faults: A Temporal Graph Approach to Root Cause Analysis},
booktitle = {IEEE International Conference on Communications (ICC)},
year = {2026},
month = may,
address = {Glasgow, Scotland, UK},
organization = {IEEE},
month_numeric = {5}
}
The increasing sophistication and frequency of cyberattacks have made Network Intrusion Detection Systems (NIDS) a critical component of modern cybersecurity. This work presents D-MAGIC, a novel real-time NIDS that leverages zero-shot learning and graph-based dynamic clustering to detect both known and unknown threats. Unlike traditional systems that rely on labeled datasets and predefined attack signatures, D-MAGIC operates unsupervised, identifying anomalies by detecting deviations from normal network behavior. D-MAGIC employs dynamic clustering to identify coordinated attacks and emerging threats by embedding network flow relationships into a graph structure and clustering similar patterns. Additionally, a second anomaly detection method, called SAGA, is introduced. SAGA enhances detection by using approximate nearest neighbor (ANN) analysis to evaluate isolated nodes, which clustering alone cannot classify. By leveraging information from a node’s neighbors, SAGA improves the identification of subtle or emerging threats. This hybrid approach ensures more comprehensive detection, capturing both clustered anomalies and isolated outliers. Experimental results on the CIC-IDS-2017 and CSE-CIC-IDS-2018 datasets demonstrate that D-MAGIC achieves up to 12% improvement in F1 score over state-of-the-art methods, significantly reduces false positives, and ensures rapid, real-time detection with minimal latency. Furthermore, on the CIC-IDS-2017 dataset, SAGA achieves up to a 6% improvement in accuracy, showcasing its effectiveness in handling diverse attack scenarios.
@article{simhon2026realtime_network_security,
title = {Real-Time Network Security: Integrating ANN and Dynamic Graph-Based Clustering},
author = {Simhon, Zohar and Weiss, Matan and Marbel, Revital and Hajaj, Chen and Dvir, Amit and Dubin, Ran},
journal = {Computer Networks},
year = {2026},
pages = {112016},
issn = {1389-1286},
doi = {10.1016/j.comnet.2026.112016},
keywords = {Anomaly detection, Graph Neural Network (GNN), Clustering, Real-time Network Intrusion Detection System (NIDS), Approximate Nearest Neighbor (ANN)}
}
In today’s digital landscape, ensuring the security of cloud environments is critical for organizational resilience, growth, and operational efficiency. As cloud services become more prevalent, so do sophisticated attacks targeting cloud users, making early detection essential. This paper introduces a novel time-based embedding approach for Cloud Services Graph-based Anomaly Detection (CS-GAD) that leverages a Graph Neural Network (GNN) to detect anomalous user behavior. We propose a dynamic tripartite graph to model interactions among users, actions, and cloud services over time. Using behavioral patterns, our GNN generates user embeddings to enable early detection of anomalies. We evaluate this approach on a novel dataset simulating five real-world attacks: cryptojacking, billing abuse, lateral movement, monitor exploitation, and service targeting. The dataset comprises 107,116 Application Programming Interface (API) calls over 32 days, tracking 79 AWS services, with attacks embedded within legitimate cloud traffic. Our results demonstrate that the proposed method achieves a lower false positive rate and higher detection accuracy than a prevailing method, as evidenced by improved accuracy, precision, recall, and F1-score.
@inproceedings{marbel2026cloudy_ccnc,
author = {Marbel, Revital and Cohen, Yanir Victor and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
title = {Cloudy with a Chance of Anomalies: Dynamic Graph Neural Network for Early Detection of Cloud Services' User Anomalies},
booktitle = {IEEE Consumer Communications \& Networking Conference (CCNC)},
year = {2026},
month = jan,
address = {Las Vegas, NV, USA},
organization = {IEEE},
doi = {10.1109/ccnc65079.2026.11366510},
month_numeric = {1}
}
Traditional CAPTCHAs are increasingly vulnerable to deep learning-based solvers that decode text and images with high accuracy. In this work, we propose methods to strengthen adversarial CAPTCHAs without compromising human usability. First, we introduce a Precise Gradient Method (PGM) that preserves gradient magnitude (rather than discarding it via a sign operator), producing adversarial perturbations with significantly lower perceptual noise. Second, we develop intelligent target class selection, using either dataset-level confusion structure (Class Relations Network) or image-specific softmax probabilities (Distance-Based Target), to steer adversarial perturbations more efficiently. Across multiple modern architectures (MobileNets, EfficientNets, ResNet, and Vision Transformer), our framework achieves faster convergence (fewer iterations), reduced visual distortion, and notably greater robustness under iterative adversarial retraining. Experiments show that our methods consistently reduce iteration counts and perceptual distortion while significantly increasing the difficulty for automated attacks. Our results offer a practical, scalable path toward the next generation of CAPTCHA systems and contribute new insights to the adversarial machine learning landscape focused on security and usability.
@inproceedings{litman2026_cleaner_adversarial_captchas,
doi = {10.65109/afaw3962},
author = {Litman, Meir and Hajaj, Chen},
title = {Cleaner Adversarial CAPTCHAs: Intelligent Targets and Precise Noise for Usable Security},
booktitle = {International Conference on Autonomous Agents and Multiagent Systems (AAMAS)},
year = {2026}
}
File type classification is critical in digital forensics, and file carving. However, the increasing diversity of file formats challenges accurate classification. Traditional methods rely on hand-crafted features or compact neural networks but face long training times, limited training data, and lower accuracy. This paper introduces three novel, content-based file-type classification approaches to address these challenges. These approaches improve accuracy and streamline the integration of new file types using pre-trained models, enhancing both speed and reliability. The first approach utilizes Natural Language Processing (NLP) with a transformer architecture, while the second combines statistical features with a pre-trained model via transfer learning. These methods achieved accuracy rates of 72.4 % and 69.2 %, respectively, surpassing state-of-the-art Convolutional Neural Network (CNN) models. The third approach employs one-shot learning, achieving 100 % accuracy in several scenarios, enabling efficient training with minimal data.
@inproceedings{lisker2025optimized,
title = {Optimized File Type Detection and One-Shot Retrieval},
pages = {1121--1126},
author = {Lisker, Simona and Butman, Ayelet and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
booktitle = {IEEE International Conference on Communications (ICC)},
series = {ICC},
year = {2025},
doi = {10.1109/icc52391.2025.11161523}
}
The increasing sophistication and frequency of cyberattacks have made Network Intrusion Detection Systems (NIDS) a critical component of modern cybersecurity. This work presents D-MAGIC, a novel real-time NIDS that leverages zero-shot learning and graph-based dynamic clustering to detect known and unknown threats. Unlike traditional systems that rely on labeled datasets and predefined attack signatures, D-MAGIC operates unsupervised, identifying anomalies by detecting deviations from normal network behavior. By embedding the relationships between network flows into a graph structure and dynamically clustering similar patterns, D-MAGIC can detect coordinated attacks and emerging threats with minimal delay. Experimental results on the CIC-IDS-2017 and CSE-CIC-IDS-2018 datasets demonstrate that D-MAGIC achieves an improvement of up to 12 % based on the standard F1 score compared to state-of-the-art methods, while significantly reducing false positives and ensuring rapid, real-time detection with minimal detection latency.
@inproceedings{simhon2025dmagic,
title = {A New D-MAGIC: Dynamic Model for Cybersecurity Attack Detection Using GNNs into Clustering},
author = {Simhon, Zohar and Weiss, Matan and Hajaj, Chen and Marbel, Revital and Dubin, Ran and Dvir, Amit},
booktitle = {IEEE International Conference on Communications (ICC)},
series = {ICC},
year = {2025},
doi = {10.1109/icc52391.2025.11160734}
}
Post-quantum cryptography (PQC) is expected to revolutionize secure communications in next-generation digital ecosystems. Previous and ongoing activities demonstrate that different PQC algorithms significantly impact traffic latency, but they do not yet provide a scheme to assess the existence of the PQC algorithm or its identification when encrypted traffic is analyzed for traffic engineering purposes. Hence, this work is the first to propose a novel PQClass pipeline for classifying encrypted Internet traffic of recently NIST-approved PQC algorithms. Hence, it establishes solid grounds for enabling engineers to optimize their networks and, in parallel, for cybersecurity practitioners to familiarise themselves with PQC algorithmic properties for enhancing or devising security architectures in diverse setups. Our pipeline demonstrates impressive performance on real-world data, achieving 86% accuracy in detecting the presence of a PQC algorithm and 91% and 98% accuracy in identifying the browser and OS, respectively, based on PQC-based traffic.
@inproceedings{marnerides2025pqclass,
title = {PQClass: Classification of Post-Quantum Encryption Applications in Internet Traffic},
author = {Marnerides, Angelos K. and Hajaj, Chen and Marbel, Revital and Dubin, Ran and Dvir, Amit},
booktitle = {IEEE International Conference on Communications (ICC)},
series = {ICC},
year = {2025},
doi = {10.1109/icc52391.2025.11160818}
}
The growing complexity of the digital environment has increased the need for proactive and intelligence-based approaches to cybersecurity. This study examines the role of open-source intelligence (OSINT) as a strategic tool in proactive cybersecurity operations. Drawing on a wide range of peer-reviewed literature and professional sources, it reviews definitions, operational processes, areas of application, benefits, and challenges associated with OSINT. The analysis highlights OSINT’s contribution to situational awareness, early threat detection, and cyber threat intelligence (CTI) capabilities. By using publicly accessible data from the internet and social platforms, organizations can strengthen their defensive posture against diverse cyber threats. The study outlines workflows for collecting and analyzing OSINT, with attention to its integration into organizational intelligence frameworks and cybersecurity strategies. Examples from both the public and private sectors demonstrate how OSINT supports decision-making, incident response, and preparedness for emerging threats. The review also considers OSINT’s main advantages, including cost effectiveness, accessibility, and real-time relevance, alongside its main challenges such as data reliability, legal concerns, and information overload. The findings suggest that, despite these limitations, OSINT has significant potential to enhance proactive cybersecurity measures, support compliance with standards, assist law enforcement, prevent terrorism, and contribute to business decision-making. The paper concludes with a call for further research on integration with advanced technologies, real-time data analysis, and effective intelligence collaboration.
@article{avrahami2025leveraging,
author = {Avrahami, Zafrir and Zwilling, Moti and Hajaj, Chen},
journal = {IEEE Access},
title = {Leveraging OSINT for Advanced Proactive Cybersecurity: Strategies and Solutions},
year = {2025},
volume = {13},
pages = {154229-154250},
doi = {10.1109/ACCESS.2025.3603868}
}
Web applications and APIs face constant threats from malicious actors seeking to exploit vulnerabilities for illicit gains. To defend against these threats, it is essential to have anomaly detection systems that can identify a variety of malicious behaviors. However, a significant challenge in this area is the limited availability of training data. Existing datasets often do not provide sufficient coverage of the diverse API structures, parameter formats, and usage patterns encountered in real-world scenarios. As a result, models trained on these datasets often struggle to generalize and may fail to detect less common or emerging attack vectors. To enhance detection accuracy and robustness, it is crucial to access larger and more representative datasets that capture the true variability of API traffic. To address this, we introduce a GAN-inspired learning framework that extends limited API traffic datasets through targeted, domain-aware synthesis. Drawing on techniques from Natural Language Processing (NLP), our approach leverages Transformer-based architectures, particularly RoBERTa, to enhance the contextual representation of API requests and generate realistic synthetic samples aligned with security-specific semantics. We evaluate our framework on two benchmark datasets, CSIC 2010 and ATRDF 2023, and compare it with a previous data augmentation technique to assess the importance of domain-specific synthesis. In addition, we apply our augmented data to various anomaly detection models to evaluate its impact on classification performance. Our method achieves up to a 4.94% increase in F1 score on CSIC 2010 and up to 21.10% on ATRDF 2023. The source codes of this work are available at this https URL.
@misc{aharon2024few,
url = {https://arxiv.org/abs/2405.11258},
title = {Few-Shot API Attack Detection: Overcoming Data Scarcity with GAN-Inspired Learning},
howpublished = {arXiv preprint arXiv:2405.11258},
author = {Aharon, Udi and Marbel, Revital and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
year = {2024}
}
@article{anidjar2024extending,
title = {Extending Limited Datasets with GAN-Like Self-Supervision for SMS Spam Detection},
author = {Anidjar, Or Haim and Marbel, Revital and Dubin, Ran and Dvir, Amit and Hajaj, Chen},
journal = {Computers \& Security},
volume = {145},
pages = {103998},
year = {2024},
publisher = {Elsevier Advanced Technology},
doi = {10.1016/j.cose.2024.103998}
}
Android malware is a continuously expanding threat to billions of mobile users around the globe. Detection systems are updated constantly to address these threats. However, a backlash takes the form of evasion attacks, in which an adversary changes malicious samples in the wild such that they will be misclassified as benign. This paper comprehensively inspects a well-known Android malware detection system, MaMaDroid, which analyzes the control flow graph of the application. Changes in the portion of benign samples in the training set are considered to reveal their effect on the resulting classifier. These changes in the ratio between benign and malicious samples have a clear effect on each of the models, resulting in a decrease of more than 40% in their detection rate, model confidence, and reliability. Moreover, adopted Machine Learning models were implemented as well, including 5-NN, Decision Tree, and Adaboost. Exploration of the six models showed a typical behavior in different cases, of tree-based models and distance-based models. Moreover, three novel attacks that manipulate the Control Flow Graph (CFG) are described for each of the targeted models. The attacks decrease the detection rate of most models to less than 10%, with regards to different ratios of benign to malicious apps. As a result, a new version of MaMaDroid is engineered, which fuses the CFG of the app and static analysis of features of the app. This improved model is proven to be robust against evasion attacks targeting CFG-based models and static analysis models, achieving a detection rate of ∼80%.
@article{berger2023breaking,
title = {Breaking the Structure of MaMaDroid},
author = {Berger, Harel and Dvir, Amit and Mariconti, Enrico and Hajaj, Chen},
journal = {Expert Systems with Applications},
volume = {228},
pages = {120429},
year = {2023},
publisher = {Elsevier},
doi = {10.1016/j.eswa.2023.120429}
}
Covert communication channels are a concept in which a policy-breaking method is used in order to covertly transmit data from inside an organization to an external or accessible point. VoIP and Video systems are exposed to such attacks on different layers, such as the underlying real-time transport protocol (RTP) which uses Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) packet streams to punch a hole through Network address translation (NAT). This paper presents different innovative attack methods utilizing covert communication and RTP channels to spread malware or to create a data leak channel between different organizations. The demonstrated attacks are based on a UDP punch hole created using Skype peer-to-peer video conferencing communication. The different attack methods were successfully able to transmit a small text file in an undetectable manner by observing the communication channel, and without causing interruption to the audio/video channels or creating a noticeable disturbance to the quality. While these attacks are hard to detect by the eye, we show that applying classical Machine Learning algorithms to detect these covert channels on statistical features sampled from the communication channel is effective for one type of attack.
@article{joseph2023detecting,
title = {Detecting Parallel Covert Data Transmission Channels in Video Conferencing Using Machine Learning},
author = {Joseph, Ofir and Elmalech, Avshalom and Hajaj, Chen},
journal = {Electronics},
volume = {12},
number = {5},
pages = {1091},
year = {2023},
publisher = {MDPI},
doi = {10.3390/electronics12051091}
}
Android malware is a continuously expanding threat to billions of mobile users around the globe. Detection systems are updated constantly to address these threats. However, a backlash takes the form of evasion attacks, in which an adversary changes malicious samples such that those samples will be misclassified as benign. This paper fully inspects a well-known Android malware detection system, MaMaDroid, which analyzes the control flow graph of the application. Changes to the portion of benign samples in the train set and models are considered to see their effect on the classifier. The changes in the ratio between benign and malicious samples have a clear effect on each one of the models, resulting in a decrease of more than 40% in their detection rate. Moreover, adopted ML models are implemented as well, including 5-NN, Decision Tree, and Adaboost. Exploration of the six models reveals a typical behavior in different cases, of tree-based models and distance-based models. Moreover, three novel attacks that manipulate the CFG and their detection rates are described for each one of the targeted models. The attacks decrease the detection rate of most of the models to 0%, with regards to different ratios of benign to malicious apps. As a result, a new version of MaMaDroid is engineered. This model fuses the CFG of the app and static analysis of features of the app. This improved model is proved to be robust against evasion attacks targeting both CFG-based models and static analysis models, achieving a detection rate of more than 90% against each one of the attacks.
@misc{berger2022mamadroid2,
title = {MaMaDroid2.0--The Holes of Control Flow Graphs},
howpublished = {arXiv preprint arXiv:2202.13922},
author = {Berger, Harel and Hajaj, Chen and Mariconti, Enrico and Dvir, Amit},
year = {2022},
doi = {10.48550/arxiv.2202.13922}
}
Android is the most popular OS worldwide. Therefore, it is a target for various kinds of malware. As a countermeasure, the security community works day and night to develop appropriate Android malware detection systems, with ML-based or DL-based systems considered as some of the most common types. Against these detection systems, intelligent adversaries develop a wide set of evasion attacks, in which an attacker slightly modifies a malware sample to evade its target detection system. In this survey, we address problem-space evasion attacks in the Android OS, where attackers manipulate actual APKs, rather than their extracted feature vector. We aim to explore this kind of attacks, frequently overlooked by the research community due to a lack of knowledge of the Android domain, or due to focusing on general mathematical evasion attacks - i.e., feature-space evasion attacks. We discuss the different aspects of problem-space evasion attacks, using a new taxonomy, which focuses on key ingredients of each problem-space attack, such as the attacker model, the attacker’s mode of operation, and the functional assessment of post-attack applications.
@misc{berger2022problem,
title = {Problem-Space Evasion Attacks in the Android OS: A Survey},
howpublished = {arXiv preprint arXiv:2205.14576},
author = {Berger, Harel and Hajaj, Chen and Dvir, Amit},
year = {2022},
doi = {10.48550/arXiv.2205.14576}
}
Android malware is a spreading disease in the virtual world. Anti-virus and detection systems continuously undergo patches and updates to defend against these threats. Most of the latest approaches in malware detection use Machine Learning (ML). Against the robustifying effort of detection systems, raise the evasion attacks, where an adversary changes its targeted samples so that they are misclassified as benign. This paper considers two kinds of evasion attacks: feature-space and problem-space. Feature-space attacks consider an adversary who manipulates ML features to evade the correct classification while minimizing or constraining the total manipulations. Problem-space attacks refer to evasion attacks that change the actual sample. Specifically, this paper analyzes the gap between these two types in the Android malware domain. The gap between the two types of evasion attacks is examined via the retraining process of classifiers using each one of the evasion attack types. The experiments show that the gap between these two types of retrained classifiers is dramatic and may increase to 96%. Retrained classifiers of feature-space evasion attacks have been found to be either less effective or completely ineffective against problem-space evasion attacks. Additionally, exploration of different problem-space evasion attacks shows that retraining of one problem-space evasion attack may be effective against other problem-space evasion attacks.
@misc{berger2022you,
title = {Do You Think You Can Hold Me? The Real Challenge of Problem-Space Evasion Attacks},
howpublished = {arXiv preprint arXiv:2205.04293},
author = {Berger, Harel and Dvir, Amit and Hajaj, Chen and Ronen, Rony},
year = {2022},
doi = {10.48550/arxiv.2205.04293}
}
Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., CandC, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical weak spots in the structure of defense mechanisms. Since machine learning has become one of the most prominent malware detection methods, a robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits a high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is cut by half, the performance of the classifier is still improved (an increase in the model’s F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust with regard to the adversary’s manipulation. Based on an extensive evaluation of the different feature sets and commonly used classification models, this paper shows that models based on robust features are resistant to malicious perturbations and concurrently are helpful in classifying non-manipulated data.
@article{hajaj2022less,
title = {Less Is More: Robust and Novel Features for Malicious Domain Detection},
author = {Hajaj, Chen and Hason, Nitay and Dvir, Amit},
journal = {Electronics},
volume = {11},
number = {6},
pages = {969},
year = {2022},
publisher = {MDPI},
doi = {10.3390/electronics11060969}
}
The world of malware is shifting towards using encrypted traffic. While encryption improves the privacy of users, it brings challenges in the fields of QoS, QoE, and cybersecurity. Recent state-of-the-art Deep-Learning architectures for encrypted traffic classifications demonstrated superb results in tasks of traffic categorization over encrypted traffic. In this paper, we leverage the feasibility to use such architectures for the tasks of malware detection and classification to gain insights into how well these architectures perform in the domain of malware traffic. Specifically, we present a Deep-Learning model for malware traffic detection and classification (MalDIST), which outperforms both classical ML and DL malware traffic classification models both in terms of detection and classification.
@inproceedings{bader2022maldist,
title = {MalDIST: From Encrypted Traffic Classification to Malware Traffic Detection and Classification},
author = {Bader, Ofek and Lichy, Adi and Hajaj, Chen and Dubin, Ran and Dvir, Amit},
booktitle = {IEEE Consumer Communications \& Networking Conference (CCNC)},
pages = {527--533},
year = {2022},
organization = {IEEE},
doi = {10.1109/ccnc49033.2022.9700625}
}
Android OS is one of the most popular operating systems worldwide, making it a desirable target for malware attacks. Some of the latest and most important defensive systems are based on machine learning (ML) and cybercriminals continuously search for ways to overcome the barriers posed by these systems. Thus, the focus of this work is on evasion attacks in the attempt to show the weaknesses of state of the art research and how more resilient systems can be built. Evasion attacks consist of manipulating either the actual malicious application (problem-based) or its extracted feature vector (feature-based), to avoid being detected by ML systems. This study presents a set of innovative problem-based evasion attacks against well-known Android malware detection systems, which decrease their detection rate by up to 97%. Moreover, an analysis of the effectiveness of these attacks against VirusTotal (VT) scanners was conducted, empirically showing their efficiency against well-known scanners (e.g., McAfee and Comodo) as well. The VT system proved to be a great candidate for the attacks, as in 98% of the apps, less scanners detected the manipulated apps than the original malicious apps. As not all the attacks are effective in the same manner against the VT scanners, the attack efficiency classifiers are advised. Each classifier predicts the applicability of one of the attacks. The set of classifiers creates an ensemble, which shows high success rates, allowing the attacker to decide which attack is best to use for each malicious app and defense system.
@article{berger2021crystal,
title = {Crystal Ball: From Innovative Attacks to Attack Effectiveness Classifier},
author = {Berger, Harel and Hajaj, Chen and Mariconti, Enrico and Dvir, Amit},
journal = {IEEE Access},
volume = {10},
pages = {1317--1333},
year = {2021},
publisher = {IEEE},
doi = {10.1109/access.2021.3138628}
}
AbstractDecentralized coordination is one of the fundamental challenges for societies and organizations. While extensively explored from a variety of perspectives, one issue that has received limited attention is human coordination in the presence of adversarial agents. We study this problem by situating human subjects as nodes on a network, and endowing each with a role, either regular (with the goal of achieving consensus among all regular players), or adversarial (aiming to prevent consensus among regular players). We show that adversarial nodes are, indeed, quite successful in preventing consensus. However, we demonstrate that having the ability to communicate among network neighbors can considerably improve coordination success, as well as resilience to adversarial nodes. Our analysis of communication suggests that adversarial nodes attempt to exploit this capability for their ends, but do so in a somewhat limited way, perhaps to prevent regular nodes from recognizing their intent. In addition, we show that the presence of trusted nodes generally has limited value, but does help when many adversarial nodes are present, and players can communicate. Finally, we use experimental data to develop computational models of human behavior and explore additional parametric variations: features of network topologies and densities, and placement, all using the resulting data-driven agent-based (DDAB) model.
@article{hajaj2021robust,
title = {Robust Coordination in Adversarial Social Networks: From Human Behavior to Agent-Based Modeling},
author = {Hajaj, Chen and Joveski, Zlatko and Yu, Sixie and Vorobeychik, Yevgeniy},
journal = {Network Science},
volume = {9},
number = {3},
pages = {255--290},
year = {2021},
publisher = {Cambridge University Press},
doi = {10.1017/nws.2021.5}
}
Cyber threat intelligence officers and forensics investigators often require the behavioural profiling of groups based on their online video viewing activity. It has been demonstrated that encrypted video traffic can be classified under the assumption of using a known subset of video titles based on temporal video viewing trends of particular groups. Nonetheless, composing such a subset is extremely challenging in real situations. Therefore, this work exhibits a novel profiling scheme for encrypted video traffic with no a priori assumption of a known subset of titles. It introduces a seminal synergy of Natural Language Processing (NLP) and Deep Encoder-based feature embedding algorithms with refined clustering schemes from off-the-shelf solutions, in order to group viewing profiles with unknown video streams. This study is the first to highlight the most computationally effective, accurate combinations of feature embedding and clustering using real datasets, thereby, paving the way to future forensics tools for automated behavioural profiling of malicious actors.
@article{dvir2020encrypted,
title = {Encrypted Video Traffic Clustering Demystified},
author = {Dvir, Amit and Marnerides, Angelos K. and Dubin, Ran and Golan, Nehor and Hajaj, Chen},
journal = {Computers \& Security},
volume = {96},
pages = {101917},
year = {2020},
publisher = {Elsevier Advanced Technology},
doi = {10.1016/j.cose.2020.101917}
}
A growing number of Android malware detection systems are based on Machine Learning (ML) methods. However, ML methods are often vulnerable to evasion attacks, in which an adversary manipulates malicious instances so they are classified as benign. Here, we present a novel evaluation scheme for evasion attack generation that exploits the weak spots of known Android malware detection systems. We implement an innovative evasion attack on Drebin. After our novel evasion attack, Drebin’s detection rate decreased by 12%. However, when inspecting the functionality and maliciousness of the manipulated instances, the maliciousness rate increased, whereas the functionality rate decreased by 72%. We show that non-functional apps, do not constitute a threat to users and are thus useless from an attacker’s point of view. Hence, future evaluations of attacks against Android malware detection systems should also address functionality and maliciousness tests.
@inproceedings{berger2020evasion,
title = {Evasion Is Not Enough: A Case Study of Android Malware},
doi = {10.1007/978-3-030-49785-9_11},
author = {Berger, Harel and Hajaj, Chen and Dvir, Amit},
booktitle = {International Symposium on Cyber Security, Cryptology, and Machine Learning (CSCML)},
pages = {167--174},
year = {2020},
organization = {Springer International Publishing Cham}
}
Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting these attacks, many alarming problems remain open, such as the weak spots of the defense mechanisms. Because ML has become one of the most prominent methods of malware detection, we propose a robust feature selection mechanism that results in malicious domain detection models that are resistant to black-box evasion attacks. This paper makes two main contributions. Our mechanism exhibits high performance based on data collected from 5000 benign active URLs and 1350 malicious active (attacks) URLs. We also provide an analysis of robust feature selection based on widely used features in the literature. Note that even though we cut the feature set dimensional space in half (from nine to four features), we still improve the performance of the classifier (an increase in the model’s F1-score from 92.92% to 95.81%). The fact that our models are robust to malicious perturbations but are also useful for clean data demonstrates the effectiveness of constructing a model that is solely trained on robust features.
@inproceedings{hason2020robust,
title = {Robust Malicious Domain Detection},
author = {Hason, Nitay and Dvir, Amit and Hajaj, Chen},
booktitle = {International Symposium on Cyber Security, Cryptology, and Machine Learning (CSCML)},
pages = {45--61},
year = {2020},
organization = {Springer International Publishing},
doi = {10.1007/978-3-030-49785-9_4}
}
Extensive literature exists studying decentralized coordination and consensus, with considerable attention devoted to ensuring robustness to faults and attacks. However, most of the latter literature assumes that non-malicious agents follow simple stylized rules. In reality, decentralized protocols often involve humans, and understanding how people coordinate in adversarial settings is an open problem. We initiate a study of this problem, starting with a human subjects investigation of human coordination on networks in the presence of adversarial agents, and subsequently using the resulting data to bootstrap the development of a credible agent-based model of adversarial decentralized coordination. In human subjects experiments, we observe that while adversarial nodes can successfully prevent consensus, the ability to communicate can significantly improve robustness, with the impact particularly significant in scale-free networks. On the other hand, and contrary to typical stylized models of behavior, we show that the existence of trusted nodes has limited utility. Next, we use the data collected in human subject experiments to develop a data-driven agent-based model of adversarial coordination. We show that this model successfully reproduces observed behavior in experiments, is robust to small errors in individual agent models, and illustrate its utility by using it to explore the impact of optimizing network location of trusted and adversarial nodes.
@inproceedings{hajaj2019adversarial,
title = {Adversarial Coordination on Social Networks},
author = {Hajaj, Chen and Yu, Sixie and Joveski, Zlatko and Vorobeychik, Yevgeniy},
booktitle = {International Conference on Autonomous Agents and Multiagent Systems (AAMAS)},
pages = {1515--1523},
year = {2019},
doi = {10.65109/ckdj6887}
}
Machine learning (ML) techniques are increasingly common in security applications, such as malware and intrusion detection. However, ML models are often susceptible to evasion attacks, in which an adversary makes changes to the input (such as malware) in order to avoid being detected. A conventional approach to evaluate ML robustness to such attacks, as well as to design robust ML, is by considering simplified feature-space models of attacks, where the attacker changes ML features directly to effect evasion, while minimizing or constraining the magnitude of this change. We investigate the effectiveness of this approach to designing robust ML in the face of attacks that can be realized in actual malware (realizable attacks). We demonstrate that in the context of structure-based PDF malware detection, such techniques appear to have limited effectiveness, but they are effective with content-based detectors. In either case, we show that augmenting the feature space models with conserved features (those that cannot be unilaterally modified without compromising malicious functionality) significantly improves performance. Finally, we show that feature space models enable generalized robustness when faced with a variety of realizable attacks, as compared to classifiers which are tuned to be robust to a specific realizable attack.
@inproceedings{tong2019improving,
url = {https://www.usenix.org/conference/usenixsecurity19/presentation/tong},
title = {Improving Robustness of ML Classifiers Against Realizable Evasion Attacks Using Conserved Features},
author = {Tong, Liang and Li, Bo and Hajaj, Chen and Xiao, Chaowei and Zhang, Ning and Vorobeychik, Yevgeniy},
booktitle = {28th USENIX Security Symposium (USENIX Security 19)},
pages = {285--302},
year = {2019}
}
Adversarial Randomized Task Assignment
Chen Hajaj and Yevgeniy Vorobeychik
Workshop6th Day on Computational Game Theory
@inproceedings{hajaj2019randomized,
title = {Adversarial Randomized Task Assignment},
author = {Hajaj, Chen and Vorobeychik, Yevgeniy},
booktitle = {6th Day on Computational Game Theory},
year = {2019}
}
The problem of assigning tasks to workers is of long-standing fundamental importance. Examples of this include the classical problem of assigning computing tasks to nodes in a distributed computing environment, assigning jobs to robots, and crowdsourcing. Extensive research into this problem generally addresses important issues such as uncertainty and incentives. However, the problem of adversarial tampering with the task assignment process has not received as much attention. We are concerned with a particular adversarial setting where an attacker may target a set of workers in order to prevent the tasks assigned to these workers from being completed. When all tasks are homogeneous, we provide an efficient algorithm for computing the optimal assignment. When tasks are heterogeneous, we show that the adversarial assignment problem is NP-Hard, and present an algorithm for solving it approximately. Our theoretical results are accompanied by extensive experiments showing the effectiveness of our algorithms.
@inproceedings{hajaj2018adversarial,
title = {Adversarial task assignment},
author = {Hajaj, Chen and Vorobeychik, Yevgeniy},
booktitle = {International Joint Conference on Artificial Intelligence (IJCAI)},
pages = {3783--3789},
year = {2018},
doi = {10.24963/ijcai.2018/526}
}
Adversarial Coordination on Social Networks
Chen Hajaj, Sixie Yu, Zlatko Joveski, and Yevgeniy Vorobeychik
WorkshopAAMAS-IJCAI Workshop on Agents and Incentives in Artificial Intelligence (AI³)
Extensive literature exists studying decentralized coordination and consensus, with considerable attention devoted to ensuring robustness to faults and attacks. However, most of the latter literature assumes that non-malicious agents follow simple stylized rules. In reality, decentralized protocols often involve humans, and understanding how people coordinate in adversarial settings is an open problem. We initiate a study of this problem, starting with a human subjects investigation of human coordination on networks in the presence of adversarial agents, and subsequently using the resulting data to bootstrap the development of a credible agent-based model of adversarial decentralized coordination. In human subjects experiments, we observe that while adversarial nodes can successfully prevent consensus, the ability to communicate can significantly improve robustness, with the impact particularly significant in scale-free networks. On the other hand, and contrary to typical stylized models of behavior, we show that the existence of trusted nodes has limited utility. Next, we use the data collected in human subject experiments to develop a data-driven agent-based model of adversarial coordination. We show that this model successfully reproduces observed behavior in experiments, is robust to small errors in individual agent models, and illustrate its utility by using it to explore the impact of optimizing network location of trusted and adversarial nodes.
@inproceedings{hajaj2018coordination,
title = {Adversarial Coordination on Social Networks},
author = {Hajaj, Chen and Yu, Sixie and Joveski, Zlatko and Vorobeychik, Yevgeniy},
booktitle = {AAMAS-IJCAI Workshop on Agents and Incentives in Artificial Intelligence (AI³)},
year = {2018}
}
Work on this
The lab takes on PhD and MSc students and works with academic and industry partners on this line of research. Write with a short note on your background and what you would like to work on.
