Authenticating Usage Data For Processing By Machine Learning Models

Methods, apparatus, and processor-readable storage media for authenticating usage data for processing by machine learning models are provided herein. An example method includes receiving, by a machine learning application installed in a user space of an operating system of a user device, a message from a software component, wherein the software component is: configured to collect usage data associated with the user device; signed with using private key corresponding to a digital certificate by an application installed on the user device; and deployed in a kernel space of the operating system, and wherein the message comprises usage data signed using the private key; authenticating, by the machine learning application, the usage data based on a public key corresponding to the digital certificate; and processing, by the machine learning application in response to a result of the authenticating, at least a portion of the authenticated usage data.

FIELD

The field relates generally to information processing systems, and more particularly to securing data processed by such systems.

BACKGROUND

A machine learning (ML) model generally refers to a computer-implemented process that is trained on historical data to make a prediction or decision based on one or more inputs. ML models are used in a variety of technologies, including self-driving cars, computer vision, natural language processing, and automated fraud detection, for example.

SUMMARY

Illustrative embodiments of the disclosure provide techniques for authenticating usage data for processing by machine learning models. An exemplary computer-implemented method includes receiving, by at least one machine learning application installed in a user space of an operating system of a user device, a message from a software component, wherein the software component is: (i) configured to collect usage data associated with the user device, (ii) signed, by an application installed on the user device, using a private key corresponding to a digital certificate, and (iii) deployed at least in part in a kernel space of the operating system based at least in part on an evaluation of the digital certificate, and wherein the message comprises usage data collected by the software component signed using the private key corresponding to the digital certificate; authenticating, by the at least one machine learning application, the usage data based at least in part on a public key corresponding to the digital certificate; and processing, by the at least one machine learning application in response to a result of the authenticating, at least a portion of the authenticated usage data.

Illustrative embodiments can provide significant advantages relative to conventional security techniques for machine learning systems. For example, technical challenges associated with securing machine learning systems are mitigated in one or more embodiments through a process that authenticates input data and software components that collect the input data to prevent tampered data from being processed by one or more machine learning models.

DETAILED DESCRIPTION

Illustrative embodiments will be described herein with reference to exemplary computer networks and associated computers, servers, network devices or other types of processing devices. It is to be appreciated, however, that these and other embodiments are not restricted to use with the particular illustrative network and device configurations shown. Accordingly, the term “computer network” as used herein is intended to be broadly construed, so as to encompass, for example, any system comprising multiple networked processing devices.

An adversarial example attack refers to a type of attack that can be used against a machine learning system. Generally, an adversarial example attack includes designing one or more inputs (referred to as adversarial examples) that cause a machine learning system to make a mistake. For example, an adversarial example for an image classification model can include making perturbations to a real image (which are often imperceptible to the user) that cause the model to misclassify the image. Machine learning systems are increasingly being deployed to perform a variety of tasks on different systems, which increases the threat of such attacks.

By way of example, consider a machine learning system, related to a given system, that is trained to improve a performance of the given system based on collected usage data associated with the given system. An adversarial example attack could be carried out by installing malware on the given system that: (i) tampers with how the usage data is obtained, or (ii) impersonates a software component that collects the usage data so that the machine learning system is provided with fake input. This can cause the machine learning system to shut down one or more hardware components and/or to restart one or more applications, for example. In some situations, such issues can cause a denial-of-service (DoS) condition, where the given system at least temporality becomes unusable.

Conventional approaches to defending against such attacks include using software detectors to identify adversarial examples. Such detectors are generally designed for image classification models where there is a strong correlation between pixels, but they are not as effective when the correlation among inputs is weaker (e.g., between usage data metrics). Also, conventional approaches often fail as the attacks become more sophisticated.

One or more embodiments described herein include techniques for defending against adversarial example attacks, as well as other forms of attacks, by authenticating input data of machine learning models and for authenticating software components that collect the input data.

FIG.1shows a computer network (also referred to herein as an information processing system)100configured for authenticating usage data for processing by machine learning models in accordance with an illustrative embodiment. The computer network100comprises a plurality of user devices102-1, . . .102-M, collectively referred to herein as user devices102. The user devices102are coupled to a network104, where the network104in this embodiment is assumed to represent a sub-network or other related portion of the larger computer network100. Accordingly, elements100and104are both referred to herein as examples of “networks,” but the latter is assumed to be a component of the former in the context of theFIG.1embodiment. Also coupled to network104is a deployment system105.

The user devices102may comprise, for example, servers and/or portions of one or more server systems, as well as devices such as edge devices, storage appliances, mobile telephones, laptop computers, tablet computers, desktop computers or other types of computing devices. Such devices are examples of what are more generally referred to herein as “processing devices.” Some of these processing devices are also generally referred to herein as “computers.”

Additionally, the user devices102and/or the deployment system105can have at least one associated database106configured to store data pertaining to, for example, digital certificates and/or system usage data.

An example database106, such as depicted in the present embodiment, can be implemented using one or more storage systems associated with the user devices102and/or the deployment system105. Such storage systems can comprise any of a variety of different types of storage including network-attached storage (NAS), storage area networks (SANs), direct-attached storage (DAS) and distributed DAS, as well as combinations of these and other storage types, including software-defined storage.

Also associated with the deployment system105are one or more input-output devices, which illustratively comprise keyboards, displays or other types of input-output devices in any combination. Such input-output devices can be used, for example, to support one or more user interfaces to the deployment system105, as well as to support communication between deployment system105and other related systems and devices not explicitly shown. At least some of the user devices102can also implement one or more input-output devices in a similar manner as the deployment system105.

Additionally, each of the user devices102and/or the deployment system105in theFIG.1embodiment are assumed to be implemented using at least one processing device. Each such processing device generally comprises at least one processor and an associated memory, and implements one or more functional modules for controlling certain features of the user devices102and/or the deployment system105.

More particularly, each user device102and/or the deployment system105in this embodiment can comprise a processor coupled to a memory and a network interface.

The network interface allows communication among each user device102and/or the deployment system105over the network104, and illustratively comprises one or more conventional transceivers.

In the example shown inFIG.1, user device102-1further comprises at least one data collector112, a data collector authenticator114, a data authenticator116, and machine learning framework118; and the deployment system105further comprises a data collector deployment module120and a certificate signature module122. One or more of the other user devices102can also include elements112,114,116, and118(not explicitly shown inFIG.1).

Generally, the at least one data collector112is configured to collect data for hardware and/or software associated with the user device102-1. In some embodiments, the at least one data collector112can be executed within a kernel space of an operating system. The data collector authenticator114authenticates the at least one data collector112based on a digital certificate, as explained in more detail elsewhere herein. The data authenticator116verifies the integrity of the data collected by the at least one data collector112, as explained in more detail in conjunctionFIG.3, for example.

The machine learning framework118can be configured to initiate and/or perform one or more actions by processing data obtained from the at least one data collector112. As a non-limiting example, the machine learning framework118can correspond to software that improves the functionality of the user device102-1based at least in part on one or more machine learning models that process the hardware and/or software usage data collected by the at least one data collector112. For example, the machine learning framework118can automatically make one or more adjustments to improve the performance of the user device102-1. The adjustments can include, for example, adjusting resource allocations, stopping or starting one or more applications, and/or performing a system restart. Alternatively, or additionally, the adjustments can improve the usability of the user device102-1for a given user, such as by automatically customizing application settings, battery settings, security settings, and/or audio settings. In some embodiments, the machine learning framework118can be implemented on a user space of the operating system. It is to be appreciated that the machine learning framework118is to be broadly construed so as to encompass, for example, one or more additional software applications installed on the user device102.

In some embodiments, update software is optionally preinstalled on the user device102-1. The update software can be used to obtain the at least one data collector112from the data collector deployment module120of the deployment system105. As an example, the update software can be preinstalled by a manufacturer and/or distributor associated with the deployment system105and the user device102-1. The certificate signature module122can digitally sign the update software with a root certificate when the update software is installed. The root certificate can then be used by the data collector authenticator114to authenticate the data collector112, as explained in more detail elsewhere herein.

It is to be appreciated that this particular arrangement of elements112,114,116and118illustrated in the client device102-1and elements120and122illustrated in the deployment system105of theFIG.1embodiment is presented by way of example only, and alternative arrangements can be used in other embodiments. For example, the functionality associated with the elements112,114,116and118and/or elements120and122in other embodiments can be combined into a single module, or separated across a larger number of modules. As another example, multiple distinct processors can be used to implement different ones of the elements112,114,116and118and/or elements120and122or portions thereof.

At least portions of elements112,114,116,118and/or elements120and122may be implemented at least in part in the form of software that is stored in memory and executed by a processor.

It is to be understood that the particular set of elements shown inFIG.1for the deployment system105involving user devices102of computer network100is presented by way of illustrative example only, and in other embodiments additional or alternative elements may be used. Thus, another embodiment includes additional or alternative systems, devices and other network entities, as well as different arrangements of modules and other components. For example, in at least one embodiment, one or more of the deployment system105, at least one of the user devices102, and database(s)106can be on and/or part of the same processing platform.

An exemplary process utilizing elements112,114,116and118of an example user device in computer network100will be described in more detail with reference to, for example, the flow diagram ofFIG.4.

FIG.2shows a data collector authentication process in an illustrative embodiment. Step200includes installing software that is signed using a root certificate on a device. Optionally, the software can be preinstalled on the device (e.g., user device102-1) and signed using a private key corresponding to the root certificate (e.g., by a manufacturer or distributor) prior to providing the device to a user.

Step202includes installing a data collector on the device and signing it using the root certificate. For example, the data collector can be signed by the software from step200using the private key of the same root certificate. Step204includes authenticating the root certificate of the data collector. For example, an operating system on the device can track a chain of the root certificate. In some embodiments, the root certificate of the data collector can be stored in a trusted certificate database of the operating system (e.g., a Windows Certificate Database). It is to be appreciated that, in some embodiments, signing the data collector may include signing a designated portion of the data collector and/or signing a hash value associated with the data collector, as non-limiting examples.

Step206includes a test that checks whether the root certificate is authenticated. If yes, then step208includes deploying the data collector as a virtual device driver. For example, the virtual device driver can be deployed in a kernel space of the operating system. Accordingly, the operating system kernel can verify the integrity of the virtual device drive using the signature. If the data collector is not authenticated, then step210includes preventing the data collector from being deployed.

The process inFIG.2, for example, can verify that the data collector that is deployed in the kernel space has not been tampered with based at least in part on the certificate that is stored in the trusted certificate database.

Referring now toFIG.3, this figure shows a communication diagram for authenticating usage data in an illustrative embodiment. In this example, it is assumed that a data collector302is installed in a kernel space300of an operating system304(e.g., based on the process described in conjunction withFIG.2) of a device.

The data collector302sends a certificate request310to the operating system304, and in response, the operating system304sends the data collector302a private key312.

A machine learning system306running in a user space301of the operating system304sends a certificate request314for the data collector302. The certificate request314can be triggered upon startup of the machine learning system306, for example. In response, the operating system304sends the machine learning system306a public key316of the data collector302.

The data collector302periodically collects hardware and/or software usage data associated with the device, as indicated by block318.

In some embodiments, the hardware usage data can comprise readings from one or more hardware components of the device. The hardware readings can comprise a set of metrics for at least some of the hardware components. For example, the set of metrics can correspond to temperature, voltage, fan speed, battery power, and/or any other types of metrics relevant to the machine learning system306. In one example, the software and/or hardware usage data can be obtained from readings residing in a file system of the operating system304(e.g., /proc in Linux, or register table entries in Windows).

In some examples, the hardware readings can be read from input-output registers by interacting with the device drivers of the respective hardware components. The software usage data, for example, can be collected from the operating system kernel data structures (e.g., a Windows Kernel Data Structure), or from an operating system kernel application programming interface (API) (e.g., Windows Kernel API). The software usage data may comprise a set of metrics corresponding to: memory and/or disk space, processor load, network input-output operations, network latency, and/or other types of software usage metrics relevant to the machine learning system306.

The data collector302sends the collected data320to the machine learning system306. As an example, the data collector302can create a message by concatenating the collected software and/or hardware usage data. In some embodiments, the message can also include a timestamp corresponding to the message. The data collector302can generate a message authentication code (MAC) for the message and sign the message with its private key312. In some embodiments, the collected data320is sent as a message via a kernel-user space communication mechanism (e.g., Windows Message Mailbox).

In response to receiving the collected data320, the machine learning system306verifies the collected data320based at least on the public key316of the data collector302, as indicated by block322. For example, the machine learning system306can check, using the public key316, that the collected data320is signed by the data collector302. If the collected data320is sent as a message with a timestamp and a MAC, then the machine learning system306can also verify that the MAC code is correct (based on the message contents) and that the timestamp is valid (e.g., based on whether it was received within a specified time period corresponding to the timestamp). If the collected data is verified, then the data is considered trusted and can be used as an input to the machine learning system306. Otherwise, the collected data320can be discarded, for example.

Some embodiments are described herein with reference to particular operating systems and types of machine learning models, however, this is not intended to limiting. Such embodiments are also applicable to other operating systems (e.g., mobile operating systems, Unix, and/or Unix-like operating systems) and/or other types of machine learning models (e.g., machine learning models for computer vision, self-driving vehicles, image classification, network intrusion detection etc.).

FIG.4is a flow diagram of a process for authenticating usage data for processing by machine learning models in an illustrative embodiment. It is to be understood that this particular process is only an example, and additional or alternative processes can be carried out in other embodiments.

In this embodiment, the process includes steps400through404. These steps are assumed to be performed by the user device102-1utilizing at least a portion of its elements112,114,116, and118.

Step400includes receiving, by at least one machine learning application installed in a user space of an operating system of a user device, a message from a software component, wherein the software component is: (i) configured to collect usage data associated with the user device, (ii) signed, by an application installed on the user device, using a private key corresponding to a digital certificate, and (iii) deployed at least in part in a kernel space of the operating system based at least in part on an evaluation of the digital certificate, and wherein the message comprises usage data collected by the software component signed using the private key corresponding to the digital certificate.

Step402includes authenticating, by the at least one machine learning application, the usage data based at least in part on a public key corresponding to the digital certificate.

Step404includes processing, by the at least one machine learning application in response to a result of the authenticating, at least a portion of the authenticated usage data.

The authenticating may be based at least in part on at least one of: one or more timestamps associated with the message and a message authentication code associated with the message. The message may be sent using a kernel-user space communication. The software component may be deployed as a virtual device driver in the kernel space. The usage data may include at least one of: hardware usage data collected from one or more input-output registers associated with one or more hardware devices; and software usage data collected from at least one of: one or more data structures corresponding to the kernel space and one or more application programming interfaces corresponding to the kernel space. The digital certificate may be stored in a certificate database of the operating system. The public key may be obtained from the operating system. The process may include a step of initiating one or more automated adjustments to one or more settings associated with the user device based on one or more outputs that are generated by the processing the at least the portion of the authenticated usage data. The application may be preinstalled on the user device with the digital certificate.

The above-described illustrative embodiments provide significant advantages relative to conventional approaches. For example, some embodiments are configured to prevent adversarial example attacks on machine learning systems. These and other embodiments can effectively overcome problems associated with conventional approaches that, for example, rely on software detectors to identify adversarial examples. For example, some embodiments are configured to authenticate input data for machine learning models as well as software components that collect the input data to prevent adversarial examples from being processed by a machine learning system. These and other embodiments can effectively improve the security of machine learning systems relative to conventional approaches.

Illustrative embodiments of processing platforms will now be described in greater detail with reference toFIGS.5and6. Although described in the context of system100, these platforms may also be used to implement at least portions of other information processing systems in other embodiments.

FIG.5shows an example processing platform comprising cloud infrastructure500. The cloud infrastructure500comprises a combination of physical and virtual processing resources that are utilized to implement at least a portion of the information processing system100. The cloud infrastructure500comprises multiple virtual machines (VMs) and/or container sets502-1,502-2, . . .502-L implemented using virtualization infrastructure504. The virtualization infrastructure504runs on physical infrastructure505, and illustratively comprises one or more hypervisors and/or operating system level virtualization infrastructure. The operating system level virtualization infrastructure illustratively comprises kernel control groups of a Linux operating system or other type of operating system.

The cloud infrastructure500further comprises sets of applications510-1,510-2, . . .510-L running on respective ones of the VMs/container sets502-1,502-2, . . .502-L under the control of the virtualization infrastructure504. The VMs/container sets502comprise respective VMs, respective sets of one or more containers, or respective sets of one or more containers running in VMs. In some implementations of theFIG.5embodiment, the VMs/container sets502comprise respective VMs implemented using virtualization infrastructure504that comprises at least one hypervisor.

A hypervisor platform may be used to implement a hypervisor within the virtualization infrastructure504, wherein the hypervisor platform has an associated virtual infrastructure management system. The underlying physical machines comprise one or more distributed processing platforms that include one or more storage systems.

In other implementations of theFIG.5embodiment, the VMs/container sets502comprise respective containers implemented using virtualization infrastructure504that provides operating system level virtualization functionality, such as support for Docker containers running on bare metal hosts, or Docker containers running on VMs. The containers are illustratively implemented using respective kernel control groups of the operating system.

The processing platform600in this embodiment comprises a portion of system100and includes a plurality of processing devices, denoted602-1,602-2,602-3, . . .602-K, which communicate with one another over a network604.

The processing device602-1in the processing platform600comprises a processor610coupled to a memory612.

The processor610comprises a microprocessor, a microcontroller, an ASIC, an FPGA or other type of processing circuitry, as well as portions or combinations of such circuitry elements.

The memory612comprises RAM, ROM or other types of memory, in any combination. The memory612and other memories disclosed herein should be viewed as illustrative examples of what are more generally referred to as “processor-readable storage media” storing executable program code of one or more software programs.

Also included in the processing device602-1is network interface circuitry614, which is used to interface the processing device with the network604and other system components, and may comprise conventional transceivers.

The other processing devices602of the processing platform600are assumed to be configured in a manner similar to that shown for processing device602-1in the figure.

For example, particular types of storage products that can be used in implementing a given storage system of a distributed processing system in an illustrative embodiment include all-flash and hybrid flash storage arrays, scale-out all-flash storage arrays, scale-out NAS clusters, or other types of storage arrays. Combinations of multiple ones of these and other storage products can also be used in implementing a given storage system in an illustrative embodiment.