Model theft attack query detection method for machine learning based network intrusion detection system

Abstract

The application relates to a model stealing attack query detection method for a machine learning-based network intrusion detection system and relates to the technical field of network attack detection.The application aims to solve the technical problem of combining query samples and model responses for comprehensive analysis, adopting a combination of decision boundary leakage evaluation and reconstruction error evaluation to quickly identify model stealing attacks with a small amount of query samples.The technical points are as follows: the prediction results of the query samples are used to construct a cumulative distribution function, the model uncertainty is measured, and potential boundary detection behaviors are detected; the reconstruction error loss of the query samples is calculated by using an automatic encoder, potential abnormal queries deviating from the normal distribution but not showing obvious malicious characteristics are identified; based on the results of the decision boundary leakage evaluation and the reconstruction error evaluation, a model safety coefficient is calculated to comprehensively evaluate the possibility of whether the model is subjected to a model stealing attack in a set period of time.The application is suitable for scenes where the ML-NIDS needs to be quickly detected and real-timely defended.

Description

Technical Field

[0001] This invention relates to the field of network attack detection technology, and more specifically to a model stealing query detection method for machine learning-based intrusion detection systems. Background Technology

[0002] As cyberattack methods continue to evolve, traditional rule-based Network Intrusion Detection Systems (NIDS) face challenges. The introduction of machine learning (ML), especially deep learning, has made machine learning-based network intrusion detection systems (ML-NIDS) superior in detecting complex and unknown attacks, becoming an important component of modern cybersecurity defenses. However, ML-NIDS inherits the security issues of deep learning algorithms, particularly its vulnerability to model theft attacks. Model theft attacks are a serious security vulnerability. Attackers can use synthetic data or public datasets to perform numerous queries on ML-NIDS, and by analyzing the model's output, gradually infer its internal decision-making logic, thereby training a clone model that replicates its predictive behavior. This cloned model can not only bypass ML-NIDS's defense mechanisms but may also be used by attackers to evade detection, launch more targeted adversarial attacks, or even directly steal ML-NIDS's core capabilities, causing serious security risks. Compared to traditional adversarial attacks or data poisoning attacks, model theft attacks do not require direct access to ML-NIDS's training data or internal parameters; they can be implemented solely through the query interface, making them more covert and harmful. Therefore, research on model theft defense against ML-NIDS is crucial, and there is an urgent need to explore efficient and low-cost defense solutions to improve the system's ability to resist model theft attacks while ensuring detection performance.

[0003] In recent years, research on defense against model theft attacks has increased significantly. For example, document CN118606938A presents a comprehensive defense method against model theft attacks, which includes adversarial training, malicious query detection, adaptive response, and ownership verification steps. During the training phase, adversarial training is applied to obtain a more robust model and weaken the effectiveness of model theft attacks, forcing attackers to submit more malicious queries to achieve their intended attack goals. Following this, malicious query detection is used to detect and identify malicious queries and label malicious users. Then, for malicious users, the defender employs an adaptive response strategy, responding to malicious users with perturbed results. These perturbations not only weaken the effectiveness of model theft attacks but also prepare for the subsequent model ownership verification step. Finally, model ownership verification is performed using the perturbed result set. This existing technique improves the detection accuracy of model theft attacks, and the multiple defensive measures at each stage mutually reinforce each other to achieve optimal overall defense.

[0004] Currently, defense strategies against model theft attacks mainly fall into three categories: model watermarking, prediction perturbation, and behavior detection. While model watermarking can claim model ownership, it cannot prevent attackers from extracting model information. Prediction perturbation adds noise to interfere with attackers' acquisition of valuable data, but it may affect the detection accuracy of ML-NIDS, thus weakening its security defense capabilities. In contrast, behavior detection-based methods identify attackers by analyzing query samples and are considered a more feasible defense solution. However, existing behavior detection methods typically rely on a large number of query samples to improve detection accuracy, while ML-NIDS, as a critical security defense system, needs to detect attackers as early as possible, thus failing to meet this assumption. Furthermore, traditional behavior detection methods often require analyzing all historical queries to estimate distribution differences, leading to system response delays, which is unacceptable in scenarios where ML-NIDS requires rapid detection and real-time defense. Therefore, there is an urgent need to design an efficient query behavior detection method suitable for ML-NIDS, enabling it to quickly identify model theft attacks with a small number of queries, while ensuring detection accuracy and real-time performance. Summary of the Invention

[0005] The technical problem to be solved by this invention is as follows: This invention proposes a query detection method for model theft attacks in machine learning-based network intrusion detection systems. This method is a multi-module query behavior detection method for ML-NIDS, which combines query samples and model responses for comprehensive analysis. It adopts a combination of decision boundary leakage assessment and reconstruction error assessment to quickly identify model theft attacks with a small number of query samples.

[0006] The technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows:

[0007] A query detection method for model theft attacks in machine learning-based network intrusion detection systems is provided. This method minimizes cost and maximizes extracted information to reveal information about the victim model by using a query sample generation method. The method includes:

[0008] (1) Decision boundary leakage assessment process: The cumulative distribution function is constructed using the prediction results of the query samples to measure model uncertainty and detect potential boundary probing behavior;

[0009] (2) Reconstruction error assessment process: The reconstruction error loss of the query sample is calculated using an autoencoder to identify potential abnormal queries that deviate from the normal distribution but do not show obvious malicious characteristics;

[0010] (3) Model security risk assessment process: Based on the results of decision boundary leakage assessment and reconstruction error assessment, the model security coefficient is calculated to comprehensively assess the possibility of the model being subjected to model theft attack within a set period of time.

[0011] Furthermore, the decision boundary leakage assessment process is specifically as follows:

[0012] A model decision boundary leakage assessment method based on maximum softmax probability (MSP) is used to detect malicious probing queries approaching the model decision boundary.

[0013] This method considers the integral of the cumulative distribution function (CDF) of the model response over a certain period as a measure of sample uncertainty. It quantitatively analyzes the distribution characteristics of the sample sequence within that time interval by calculating the integral of the CDF. The shape of the CDF, i.e., steep or flat, reflects the dispersion of the prediction probability. A flat CDF curve indicates a more dispersed probability distribution, suggesting lower confidence in many predictions and reflecting higher uncertainty. The higher the uncertainty measurement result, the closer the query sample sequence is to the decision boundary, and the higher the possibility that the model is vulnerable to extraction attacks.

[0014] Propose uncertainty The concept, given the target model All possible prediction probabilities cumulative distribution function Uncertainty Defined as In the probability interval The higher the uncertainty, the closer the query is to the decision boundary, and the higher the probability of it being a model-stealing attack.

[0015]

[0016] The risk of privacy breach is calculated by analyzing sample query sequences over a specified time interval.

[0017] For each category of samples, the uncertainty value is calculated separately to address the adversary who may iteratively refine their method to precisely map the decision boundary for a particular category. The uncertainty value is calculated for each category in the query sequence. Uncertainty value and the reference uncertainty value of the victim dataset. By comparing the results, we can obtain an assessment of the victim's condition. Then, a weighted sum is performed to obtain the comprehensive evaluation result of the entire query sequence. , A smaller value indicates a lower security level for the model, suggesting that ML-NIDS is more vulnerable to model theft attacks.

[0018] .

[0019] Furthermore, the reconstruction error evaluation process specifically includes:

[0020] Based on the significant differences in sample distribution between normal users and attackers, a "reconstruction error evaluation" defense mechanism is designed as another module of Cerberus to identify potential anomalous queries. This mechanism introduces an autoencoder to calculate the low-dimensional manifold representation of the data and monitor its reconstruction error loss. By calculating the error between the original input and the reconstructed input, anomalous query samples are detected, and the reconstruction error is defined. The concept, assumption This is the input query sample. If the output sample is reconstructed by an autoencoder, then the reconstruction error is... It can be defined as:

[0021]

[0022] Cerberus trained an additional autoencoder for the victim's ML-NIDS model, which consisted of two parts: an encoder f and a decoder g; during the preparation phase, Cerberus first used the private training set of ML-NIDS. The autoencoder is trained, and the parameters of the encoder f and decoder g are jointly optimized based on gradient descent; after training, Cerberus uses the victim's test set. Calculate the average reconstruction error for each category i This establishes a baseline for reconstruction error under normal query conditions. During the query detection phase, Cerberus calculates the reconstruction error for each category of samples in the query sequence. Cerberus then calculates the probability of anomalies by comparing and summing the weighted average reconstruction error of each category in the query sequence with the baseline reconstruction error. Used to identify potentially abnormal query behavior:

[0023] .

[0024] Furthermore, the model security risk assessment process is specifically as follows:

[0025] Based on the output of the Model Decision Boundary Leakage Assessment and Reconstruction Error Assessment modules, Cerberus calculates a security coefficient S representing the risk of privacy leakage. This coefficient comprehensively reflects the vulnerability of ML-NIDS to model theft attacks. A decrease in the S value indicates an increased vulnerability of ML-NIDS to model theft attacks and a higher potential risk. The security coefficient S can be defined as follows:

[0026]

[0027] This represents the safety factor calculated by the model decision boundary leakage assessment module, while This represents the safety factor calculated by the reconstruction error assessment module, and the parameters are... and These are two weighted hyperparameters used to reflect the defender's trade-off of importance to these two modules during the defense process;

[0028] Set a security threshold When the overall safety factor S is lower than At that time, it was believed that the system was under attack by a model theft attack. The value of is related to different model security deployment scenarios.

[0029] Furthermore, the safety threshold The specific determination process is as follows:

[0030] Safety threshold The decision boundary leakage assessment value is adaptively determined by the statistical distribution of normal query behavior. First, M groups of normal query sequences are collected, and the decision boundary leakage assessment value corresponding to each group of query sequences is calculated. Compared with the reconstruction error evaluation value This allows us to obtain the comprehensive security coefficient for the m-th group of normal query sequences.

[0031]

[0032] Based on this, calculate the mean of the set of normal query safety coefficients. with standard deviation And set the security threshold to

[0033]

[0034] Where λ is the threshold adjustment parameter. For the query sequence to be detected, if its comprehensive security coefficient S satisfies... If the query sequence is deemed to pose a risk of model theft attack, it is considered a normal query.

[0035] The present invention has the following beneficial technical effects:

[0036] This invention combines query samples and model responses for comprehensive analysis, employing a combination of decision boundary leakage assessment and reconstruction error assessment. It rapidly identifies model-stealing attacks with a small number of query samples, making it a highly efficient query behavior detection method perfectly suited for ML-NIDS. This allows for rapid identification of model-stealing attacks with a limited number of queries, while ensuring accuracy and real-time performance without incurring system response latency. It is suitable for scenarios requiring rapid detection and real-time defense in ML-NIDS. Experimental results show that, compared to existing methods, Cerberus demonstrates superior defense performance without interfering with the normal operation of the Machine Learning Network Intrusion Detection System (ML-NIDS). Cerberus improves the detection rate by 26.82% and the utility rate by 22.65% with a smaller query volume. With increasing query volume, the overall detection rate increases by 5.1%, and the response latency is reduced by up to 82.42%. Attached Figure Description

[0037] Figure 1 This is a schematic diagram illustrating the principle of a model-based query theft detection method that integrates query samples and model responses.

[0038] Figure 2 A schematic diagram illustrating the model theft attack framework for Cerberus detection in ML-NIDS;

[0039] Figure 3 A bar chart comparing the detection rates under the different functions of IdsMonitor modules;

[0040] Figure 4 A performance evaluation chart comparing defense methods based on the IDS2018 and DDoS2019 datasets;

[0041] Figure 5 This is a test graph comparing the response latency of different defense methods. Detailed Implementation

[0042] Combined with appendix Figure 1-5 The implementation of the model theft query detection method for machine learning-based intrusion detection systems described in this invention is explained as follows:

[0043] like Figure 1As shown, this invention proposes a multi-module query behavior detection method for ML-NIDS. It combines query samples and model responses for comprehensive analysis, employing a combination of decision boundary leakage assessment and reconstruction error assessment to achieve the technical effect of rapidly identifying model theft attacks with a small number of query samples. The constructed model theft attack query detection method for network intrusion detection systems includes the construction of the overall system model and the construction of various modules, mainly including: a decision boundary leakage assessment module, a reconstruction error assessment module, and a model security risk assessment module.

[0044] This invention proposes a query behavior detection method called Cerberus, which can effectively detect such attacks with only a small number of queries without affecting model performance. Cerberus is based on the insight that when real data availability is limited, adversaries will focus on probing decision boundaries. This invention aims to minimize costs and maximize extracted information by using query sample generation methods such as generative adversarial networks or iterative optimization. Query samples close to the decision boundary lead to higher prediction uncertainty, thus revealing more information about the victimized model. Based on this idea, as shown in Figure 2, the query detection process of Cerberus includes three main components: (1) Decision boundary leakage assessment. This module uses the prediction results of query samples to construct a cumulative distribution function, measure model uncertainty, and detect potential boundary probing behavior. (2) Reconstruction error assessment. This module uses an autoencoder to calculate the reconstruction error loss of query samples and identify potential abnormal queries that deviate from the normal distribution but do not show obvious malicious characteristics. (3) Model security risk assessment. Based on the results of decision boundary leakage assessment and reconstruction error assessment, the model security coefficient is calculated to comprehensively assess the possibility that the model has been subjected to model theft attacks over a period of time.

[0045] 1. Decision Boundary Leakage Assessment Module

[0046] This method proposes a defense mechanism called Model Decision Boundary Leakage Assessment, as a module of Cerberus. The core idea of ​​the Decision Boundary Leakage Assessment defense strategy is that existing model theft attacks typically use fine-tuned queries close to the model's decision boundary to maximize the extraction of model information. This allows defenders to monitor the model's output to prevent the leakage of decision boundary information. To accurately detect malicious probe queries close to the model's decision boundary, this method proposes a model decision boundary leakage assessment method based on Maximum Softmax Probability (MSP). This method considers the integral of the cumulative distribution function (CDF) of the model's response over a certain period as a measure of sample uncertainty, quantitatively analyzing the distribution characteristics of the sample sequence within that time interval by calculating the integral of its CDF. The shape of the CDF (e.g., steep or flat) reflects the dispersion of the predicted probabilities. A flat CDF curve indicates a more dispersed probability distribution, suggesting lower confidence in many predictions and thus reflecting higher uncertainty. The higher the uncertainty measurement, the closer the query sample sequence is to the decision boundary, and the higher the likelihood that the model is vulnerable to extraction attacks. This method proposes uncertainty... The concept, given the target model All possible prediction probabilities cumulative distribution function Uncertainty Defined as In the probability interval The higher the uncertainty, the closer the query is to the decision boundary, and the higher the probability of it being a model-stealing attack.

[0047]

[0048] Unlike traditional methods that rely solely on MSP values ​​to determine or quantify the distance between a sample and the decision boundary, this method incorporates global features of the probability distribution, thus providing a more comprehensive assessment of the confidence distribution of query samples. This method calculates the risk of privacy breach by analyzing sample query sequences over specified time intervals. Algorithm 1 provides a detailed description of the decision boundary breach assessment process. For samples of each category, uncertainty values ​​are calculated individually to address adversaries who may iteratively refine their methods to precisely map the decision boundary for a specific category. This method calculates the risk of privacy breach for each category in the query sequence. Uncertainty value and the reference uncertainty value of the victim dataset. By comparing the results, we can obtain an assessment of the victim's condition. Then, a weighted sum is performed to obtain the comprehensive evaluation result of the entire query sequence. . A smaller value indicates a lower security level for the model, suggesting that ML-NIDS is more vulnerable to model theft attacks.

[0049]

[0050] Algorithm 1: Decision Boundary Leakage Assessment Algorithm Input query sequence ML-NIDS Sample category Query probability set Reference uncertainty Output evaluation results 1) for do 2） 3） 4） 5) end for 6) for do 7) Based on category query probability set Calculate uncertainty 8） 9） 10) end while

[0051] 2. Reconstruction Error Evaluation Module

[0052] While decision boundary leakage assessment methods can effectively detect model theft with only a few queries, not all model theft attacks rely on carefully tuned queries close to the model's decision boundary. In fact, some queries that deviate from the normal distribution but do not exhibit obvious malicious characteristics may go undetected. This observation highlights the necessity of introducing an additional detection module. Given the significant difference in sample distribution between normal users and attackers, this method designs a "reconstruction error assessment" defense mechanism as another module of Cerberus to identify potentially anomalous queries. Existing detection methods based on sample distribution relationships typically require access to the user's entire historical query history to estimate the distribution difference, which places a significant burden on the computational resources of real-time defense strategies and increases response latency. The "reconstruction error assessment" defense mechanism provides a more efficient detection strategy by introducing an autoencoder to compute a low-dimensional manifold representation of the data and monitor its reconstruction error loss. The autoencoder learns low-dimensional representations generated from the input data during normal operation and attempts to reconstruct the input from these representations. Anomalous query samples are detected by calculating the error between the original input and the reconstructed input. This method proposes a reconstruction error... The concept, assumption This is the input query sample. If the output sample is reconstructed by an autoencoder, then the reconstruction error is... It can be defined as:

[0053]

[0054] Algorithm 2 details the construction method of the reconstruction error evaluation process. Cerberus trains an additional autoencoder for the victim's ML-NIDS model, which consists of two parts: an encoder f and a decoder g. In the preparation phase, Cerberus first uses the private training set of ML-NIDS. The autoencoder is trained, and the parameters of the encoder f and decoder g are jointly optimized based on gradient descent. After training, Cerberus uses the victim's test set. Calculate the average reconstruction error for each category i This establishes a baseline for reconstruction error under normal query conditions. During the query detection phase, Cerberus calculates the reconstruction error for each category of samples in the query sequence. Cerberus calculates the probability of anomalies by comparing and summing the weighted average reconstruction errors of each category in the query sequence with the baseline reconstruction error. This is used to identify potentially abnormal query behavior.

[0055]

[0056] Algorithm 2: Reconstruction Error Evaluation Algorithm Input query sequence ML-NIDS Privacy datasets Automatic encoder Output evaluation results 1) for do 2） 3) 4) Update the autoencoder Model parameters 5) end for 6) for do 7） 8） 9) end for 10） 11)for do12) 13) 14)endfor15) 16)

[0057] 3. Model Safety Risk Assessment Module

[0058] To effectively detect and defend against model theft attacks, this method integrates two modules: model decision boundary leakage assessment and reconstruction error assessment. The collaborative work of these two modules enhances the detection capability of potential attack behaviors and constructs a comprehensive security assessment framework. This is a fast and broad-coverage method for detecting potential model theft threats in query behavior within a specific time interval. Cerberus focuses on the relationships between consecutive queries within this time interval, enabling it to identify model extraction attacks conducted collaboratively across users, effectively improving the defense against complex attack behaviors.

[0059] Specifically, Cerberus calculates a security coefficient S representing the risk of privacy leakage based on the output of its model decision boundary leakage assessment and reconstruction error assessment modules. This coefficient comprehensively reflects the vulnerability of ML-NIDS to model theft attacks. A lower S value indicates increased vulnerability of ML-NIDS to model theft attacks and a higher potential risk. The security coefficient S can be defined as:

[0060]

[0061] This represents the safety factor calculated by the model decision boundary leakage assessment module, while This represents the safety factor calculated by the reconstruction error assessment module. (Parameter) and These are two weighted hyperparameters used to reflect the defender's trade-off of importance towards these two modules during the defense process. This method sets a security threshold. When the overall safety factor S is lower than When this happens, it can be assumed that the system is under attack by a model theft attack. In different model security deployment scenarios, The value may vary.

[0062] Safety threshold The decision boundary leakage assessment value is adaptively determined by the statistical distribution of normal query behavior. First, M groups of normal query sequences are collected, and the decision boundary leakage assessment value corresponding to each group of query sequences is calculated. Compared with the reconstruction error evaluation value This allows us to obtain the comprehensive security coefficient for the m-th group of normal query sequences.

[0063]

[0064] Based on this, calculate the mean of the set of normal query safety coefficients. with standard deviation And set the security threshold to

[0065]

[0066] Where λ is the threshold adjustment parameter. For the query sequence to be detected, if its comprehensive security coefficient S satisfies... If the query sequence is deemed to pose a risk of model theft attack, it is considered a normal query.

[0067] Technical effect verification of the present invention:

[0068] 1. Test Experiment Setup

[0069] (1) Datasets and Victim Models: This method was tested on two commonly used network intrusion detection datasets, CSE-CIC-IDS2018 and CIC-DDoS2019. The CSE-CIC-IDS2018 dataset covers a wide range of real network traffic and attack behaviors, including various security threats such as DoS, Heartbleed, Web attacks, and Patator attacks. The CIC-DDoS2019 dataset is designed specifically for DDoS attack detection research and simulates various DDoS attack scenarios, such as common UDP Flood and SYN Flood. Since these two datasets use different feature extraction methods, this method does not use traditional machine learning techniques based on feature engineering, but directly processes network traffic packets, using the network packet load as the model input. Different network packet load thresholds were set for the IDS2018 and DDoS2019 datasets to ensure the comprehensiveness and effectiveness of the experiments. On the aforementioned dataset, victim models were trained using various model architectures, including DNN, LeNet, VGG, ResNet, MobileNet, and ShuffleNet.

[0070] (2) Attack Methods: For model theft attacks, three attack methods were selected to simulate attacker attacks: ActiveThief, Knockoff, and JBDA-TR. These methods have the advantage of low-cost query sample generation, are suitable for multi-source collaborative model theft attacks, and can be coordinated and executed among multiple users. Although some attack methods may perform better in terms of cloned model accuracy, their sample generation cost is significantly higher. Attackers are assumed to know the approximate distribution of the private data used by the target model, thus enabling them to choose appropriate sample initialization methods or select approximate public datasets for generating query samples.

[0071] (3) Evaluation Method: This method uses two main indicators to evaluate the performance of Cerberus: Detection Rate (DR) and Utility Rate (UR). These two indicators not only measure the system's detection capability, but also evaluate its impact on normal user operations, thereby achieving a comprehensive evaluation of its usability.

[0072] 2. Test Results and Analysis

[0073] Experiment 1 Method Effectiveness Evaluation: Experiment 1 aims to comprehensively evaluate Cerberus, a behavior detection framework for defending against model theft attacks. The evaluation focuses on two key metrics: detection rate (DR) and utility rate (UR).

[0074] Experiment 1 Results: 1 provides statistical data on the average detection rate and utility rate for six different model architectures. These results demonstrate Cerberus's strong generalization ability in diverse attack scenarios, showing its ability to adapt to different victim model architectures, and its ability to effectively detect attacks with low query volume, while improving detection rate and utility rate as query volume increases.

[0075] Table 1. Average detection rate and utility rate of Cerberus under different datasets and query sizes.

[0076]

[0077] Experiment 1 Analysis: Experimental results show that Cerberus exhibits broad applicability across different victim model architectures. On the IDS2018 dataset, the average detection rate across all models reached 98.82% with a query volume of 1k. Similarly, on the DDoS2019 dataset, Cerberus achieved an average detection rate of 95.05%. These results confirm Cerberus's adaptability and robustness across different model architectures and datasets, demonstrating its high generalization ability. Furthermore, Cerberus achieves satisfactory detection results even with a small number of queries. With only 100 query samples, the detection rates on the IDS2018 and DDoS2019 datasets were 81.07% and 62.17%, respectively, demonstrating Cerberus's ability to quickly identify malicious query features and perform effective detection. As the number of query samples increases, Cerberus's detection rate and usability continue to improve.

[0078] Experiment 2 Ablation Experiment: Experiment 2 aimed to conduct detailed ablation experiments on two main modules of Cerberus—Model Decision Boundary Leakage Assessment (DBL) and Reconstruction Error Assessment (RE). For example... Figure 3 As shown, the effectiveness of each module is evaluated by comparing the detection rates of the three models of theft attacks.

[0079] Experiment 2 Analysis: The DBL module aims to evaluate the protection of the model's decision boundary. It detects potential attacks by analyzing whether queries attempt to probe the decision boundary. This module is particularly effective in identifying low-confidence queries that deviate from normal patterns. For JBDA-TR queries, the DBL module achieved a 100% detection rate on the IDS2018 dataset with a query volume of 1k. On the DDoS2019 dataset, its detection rate also significantly increased with the query volume, from 42.46% to 97.85%. However, for Knockoff queries, even with a query volume of 1k on the DDoS2019 dataset, the DBL module's detection rate was only 5.85%. Knockoff attacks select samples from similar public datasets as queries, which often produce high-confidence predictions, making it difficult for the DBL module to distinguish them from normal queries. Secondly, the RE module evaluates query behavior by utilizing sample distribution information, focusing on behaviors that deviate from normal patterns, and is independent of specific model structures. For example, in the case of a knockoff attack, the RE module achieves near 100% detection rate across all query levels because the attack samples are typically derived from public datasets with distributions similar to but subtly different from the training data. However, its detection capability against JBDA-TR attacks is limited. In the IDS2018 dataset, the detection rate increases from 7.58% to 18.26% as the query volume increases from 0.1k to 1k. In the DDoS2019 dataset, the detection rate is even lower, increasing only from 1.62% to 5.89%. This indicates that the JBDA-TR attack, by iteratively generating query samples based on private seed data, produces reconstruction errors that are difficult to distinguish from normal samples, thus limiting the detection performance of the RE module.

[0080] Experiment 3 Timeliness Test: Experiment 3 aims to compare the detection rate (DR) and utility rate (UR) of four model theft prevention methods on the IDS2018 and DDoS2019 datasets. Figure 4 As shown, Cerberus demonstrates significant detection performance even with low query volumes; for example, it achieved a DR of 81.07% on the IDS2018 dataset with only 100 queries, far exceeding PRADA's 18.65%, SEAT's 12.39%, and SeInspect's 34.25%. As the number of queries increases, Cerberus consistently maintains the highest DR across all tests, for instance, maintaining a stable DR of 98.82% with 1000 queries, demonstrating its rapid response capabilities and effective long-term defense performance.

[0081] Experiment 3 Analysis: Cerberus combines prediction confidence and sample reconstruction error to detect malicious queries. It effectively identifies attacks that conform to a benign distribution but deviate from the private data distribution. This makes Cerberus more flexible and stronger in combating various model-stealing attacks, highlighting its advantage in a comprehensive defense strategy across diverse attack environments. Utility Ratio (UR) reflects the stable operation of the system by measuring the degree to which benign queries pass without being falsely flagged. In this respect, Cerberus performs exceptionally well. Cerberus's UR rapidly increases from an initial 95.91% to a near-perfect 99%. This indicates that as the number of queries increases, Cerberus becomes better at distinguishing between normal and malicious queries, reducing false positives and thus not interfering with normal user operations. In contrast, other defense methods exhibit slower growth and lower utility ratio values ​​in the early stages of query performance.

[0082] Experiment 4 Response Latency Test: Experiment 4 aims to comprehensively compare the response latency of this method with other advanced defense methods. For example... Figure 5 As shown, a scenario with a fixed query volume and a changing proportion of attack queries was examined.

[0083] Experiment 4 Analysis: Due to the longer network packet load of DDoS2019 compared to IDS2018 in the experimental setup, all four methods exhibited higher response latency on DDoS2019, although their performance remained consistent across both datasets. Cerberus achieved the lowest response latency, reducing latency by approximately 82.42% compared to the PRADA method. PRADA requires accumulating query samples and using the Shapiro-Wilk test to calculate the deviation from the normal distribution, thus resulting in the highest response latency. SEAT calculates pairwise similarity between query samples, with a time complexity of O(n^2), leading to higher response latency than SeInspect and our proposed method. Furthermore, increasing the sample dimensionality significantly increases SEAT's response latency. SeInspect's response latency is close to our proposed method, but due to its design, the latency gradually increases with the proportion of attack queries. These results demonstrate that our proposed method relies solely on model inference for computation, ensuring fast response and effectively reducing response latency.

[0084] Experimental Summary: Experimental results demonstrate that Cerberus exhibits superior defensive performance compared to existing methods, without interfering with the normal operation of the Machine Learning Network Intrusion Detection System (ML-NIDS). Cerberus improves the detection rate by 26.82% and the utility rate by 22.65% with lower query volume. As query volume increases, the overall detection rate improves by 5.1%, and response latency is reduced by up to 82.42%.

[0085] The method described in this invention has been verified through simulation experiments and practical applications, demonstrating the technical effects claimed by this invention.

[0086] The algorithm (method) proposed in this invention is the underlying technical core of this invention, and various products can be derived based on the algorithm.

[0087] Based on the algorithm (method) proposed in this invention, a model theft attack query and detection system for machine learning-based network intrusion detection systems is developed using a programming language. This system has program modules corresponding to the steps of the above-mentioned technical solution, and executes the steps in the above-mentioned model theft attack query and detection method for machine learning-based network intrusion detection systems during runtime.

[0088] The developed system (software) computer program is stored on a computer-readable storage medium. This computer program is configured to implement the steps of the aforementioned model-stealing attack query detection method for a machine learning-based network intrusion detection system when invoked by a processor. In other words, the invention is materialized on a carrier, becoming a computer program product.

[0089] Various implementations of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, application-specific integrated circuits (ASICs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0090] The computational programs (also referred to as programs, software, software applications, or code) of this invention include machine instructions of a programmable processor and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device PLD) for providing machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0091] It should be understood that the various processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, they are all within the protection scope of this invention.

Claims

1. A model theft attack query detection method for machine learning based network intrusion detection systems, said method minimizes cost and maximizes extracted information to reveal information about the victim model by using a query sample generation method, characterized in that, The method includes: (1) Decision boundary leakage assessment process: The cumulative distribution function is constructed using the prediction results of the query samples to measure model uncertainty and detect potential boundary probing behavior; (2) Reconstruction error assessment process: The reconstruction error loss of the query sample is calculated using an autoencoder to identify potential abnormal queries that deviate from the normal distribution but do not show obvious malicious characteristics; (3) Model security risk assessment process: Based on the results of decision boundary leakage assessment and reconstruction error assessment, the model security coefficient is calculated to comprehensively assess the possibility of the model being subjected to model theft attack within a set period of time. 2.The model theft attack query detection method for machine learning based network intrusion detection system of claim 1, wherein, The decision boundary leakage assessment process is specifically as follows: A model decision boundary leakage assessment method based on maximum softmax probability (MSP) is used to detect malicious probing queries approaching the model decision boundary. This method considers the integral of the cumulative distribution function (CDF) of the model response over a certain period as a measure of sample uncertainty. It quantitatively analyzes the distribution characteristics of the sample sequence within that time interval by calculating the integral of the CDF. The shape of the CDF, i.e., steep or flat, reflects the dispersion of the prediction probability. A flat CDF curve indicates a more dispersed probability distribution, suggesting lower confidence in many predictions and reflecting higher uncertainty. The higher the uncertainty measurement result, the closer the query sample sequence is to the decision boundary, and the higher the possibility that the model is vulnerable to extraction attacks. The concept of uncertainty is proposed, given the cumulative distribution function of all possible prediction probabilities of a target model , uncertainty is defined as the integral over the probability interval ; the higher the uncertainty, the closer the query is to the decision boundary, and the higher the probability of a model stealing attack; The risk of privacy breach is calculated by analyzing sample query sequences over a specified time interval. For each category of samples, the uncertainty value is calculated separately to address the adversary who may iteratively refine their method to precisely map the decision boundary for a particular category. The uncertainty value is calculated for each category in the query sequence. Uncertainty value and the reference uncertainty value of the victim dataset. By comparing the results, we can obtain an assessment of the victim's condition. Then, a weighted sum is performed to obtain the comprehensive evaluation result of the entire query sequence. , A smaller value indicates a lower security level for the model, suggesting that ML-NIDS is more vulnerable to model theft attacks. 。 3. The method for detecting model theft attacks in a machine learning-based network intrusion detection system according to claim 1 or 2, characterized in that, The reconstruction error evaluation process is specifically as follows: Based on the significant differences in sample distribution between normal users and attackers, a "reconstruction error evaluation" defense mechanism is designed as another module of Cerberus to identify potential anomalous queries. This mechanism introduces an autoencoder to calculate the low-dimensional manifold representation of the data and monitor its reconstruction error loss. By calculating the error between the original input and the reconstructed input, anomalous query samples are detected, and the reconstruction error is defined. The concept, the assumption This is the input query sample. If the output sample is reconstructed by an autoencoder, then the reconstruction error is... It can be defined as: Cerberus trained an additional autoencoder for the victim's ML-NIDS model, which consisted of two parts: an encoder f and a decoder g; during the preparation phase, Cerberus first used the private training set of ML-NIDS. The autoencoder is trained, and the parameters of the encoder f and decoder g are jointly optimized based on gradient descent; after training, Cerberus uses the victim's test set. Calculate the average reconstruction error for each category i This establishes a baseline for reconstruction error under normal query conditions. During the query detection phase, Cerberus calculates the reconstruction error for each category of samples in the query sequence. Cerberus then calculates the probability of anomalies by comparing and summing the weighted average reconstruction error of each category in the query sequence with the baseline reconstruction error. Used to identify potentially abnormal query behavior: 。 4. The model theft attack query detection method for a machine learning based network intrusion detection system according to claim 3, characterized in that, The specific process for assessing the security risks of the model is as follows: Based on the output of the Model Decision Boundary Leakage Assessment and Reconstruction Error Assessment modules, Cerberus calculates a security coefficient S representing the risk of privacy leakage. This coefficient comprehensively reflects the vulnerability of ML-NIDS to model theft attacks. A decrease in the S value indicates an increased vulnerability of ML-NIDS to model theft attacks and a higher potential risk. The security coefficient S can be defined as follows: This represents the safety factor calculated by the model decision boundary leakage assessment module, while This represents the safety factor calculated by the reconstruction error assessment module, and the parameters are... and These are two weighted hyperparameters used to reflect the defender's trade-off of importance to these two modules during the defense process; Set a security threshold When the overall safety factor S is lower than At that time, it was believed that the system was under attack by a model theft attack. The value of is related to different model security deployment scenarios.

5. The model theft attack query detection method for machine learning-based network intrusion detection systems according to claim 4, with a security threshold. The specific determination process is as follows: Safety threshold The decision boundary leakage assessment value is adaptively determined by the statistical distribution of normal query behavior. First, M groups of normal query sequences are collected, and the decision boundary leakage assessment value corresponding to each group of query sequences is calculated. Compared with the reconstruction error evaluation value This allows us to obtain the comprehensive security coefficient for the m-th group of normal query sequences. On this basis, the mean value of the normal query security coefficient set is calculated and the security threshold is set as ​ wherein, λ is a threshold adjustment parameter, for a query sequence to be detected, if its comprehensive security coefficient S satisfies then it is determined that the query sequence has a model stealing attack risk; otherwise, it is determined as normal query behavior.

6. A model theft attack query detection system for a machine learning based network intrusion detection system, characterized in that: The system has a program module corresponding to the steps of any one of claims 1-5, and executes the steps in the model theft attack query detection method for a machine learning-based network intrusion detection system when it runs.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to, when invoked by a processor, implement the steps of the model theft attack query detection method for a machine learning-based network intrusion detection system as described in any one of claims 1-5.

Images