## 3 Sharing ML Models as Cyber Threat Intelligence
### Sharing ML Models as Threat Intelligence
```
1{
2\"description\":\"The adversarial machine learning taxonomy was designed with the objective to create a classification scheme for sharing machine learning threats.\",
3
4\"expanded\":\"Adversarial Machine Learning\",
5\"namespace\":\"advnl\"
6\"predicates\":[
7{
8\"value\":\"input\",
9\"expanded\":\"Model input threat\"
10},
11{
12\"value\":\"model\",
13\"expanded\":\"Model threat\"
14}
151,
16\"values\":[
17{
18\"predicate\":\"input\",
19\"entry\":[
20{
21\"value\":\"unauthorized_access\",
22\"expanded\":\"Unauthorized access\",
23\"description\":\"Access to input samples was granted to unauthorized individual\"
24},
25{
26\"value\":\"adversarial\",
27\"expanded\":\"Adversarial sample intentionally designed to cause the ML model to make a mistake\"
28}
29]
30]
31{
32\"predicate\":\"model\",
33\"entry\":[
34{
35\"value\":\"unauthorized_access\",
36\"expanded\":\"Unauthorized access\". 37\"description\":\"Access to ML model was granted to unauthorized individual\"
38},
39{
40\"value\":\"shadow\",
41\"expanded\":\"Shadow model\",
42\"description\":\"Imitate existing ML model to successfully transfer adversarial examples\"
43},
44{
45\"value\":\"poison\",
46\"expanded\":\"Model poisoning\",
47\"description\":\"Poison the data set the ML model uses to identify and classify threats\"
48},
49{
50\"value\":\"revasion\",
51\"expanded\":\"Model evasion\",
52\"description\":\"Craft an adversarial example to evade online or offline detection\"
53}
54]
55]
56]
57\"version\":3
58]
```

Listing 7: MISP taxonomy for threats against machine learning models. ### Protecting Access to ML Models with CP-ABE

Our solution shares ML models and data as MISP events and attributes. These events and attributes are shared within and across communities according to the distribution mechanisms that MISP provides out of the box to limit the sharing of threat intelligence to a limited audience. As these ML models are subject to attacks, we implemented additional access control mechanisms to ensure that unauthorized individuals cannot get access to the model. We built on top of our previous work TATIS [54] to encrypt the data in the MISP database so that only authorized individuals can decrypt the ciphertext, even after sharing across communities. TATIS is a reverse proxy for MISP's REST APIs, and encrypts data with the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [55] scheme. First the attributes in the MISP event (i.e., in our case the ML models and artifacts) are encrypted with a random AES key resulting in a threat event ciphertext \(\text{CT}_{AES}\). The AES key itself is then encrypted with CP-ABE using an attribute policy provided by the MISP event or attribute producer,which results in a ciphertext \(\text{CT}_{ABE}\) that protects the AES key. These attribute policies are a boolean composition of attribute conditions in disjunctive normal form:

Figure 4:1

A MISP event consumer first obtains a private CP-ABE decryption key that is derived from user attributes. This private key is then used to decrypt the ciphertext \(\text{CT}_{ABE}\) to obtain the AES key with which each ML model and associated artifact is individually encrypted. The ciphertext \(\text{CT}_{ABE}\) can only be decrypted if the user attributes matches the policy specifying the conditions under which the ciphertext can be decrypted. In the above examples, only an analyst or Charlie at Company123 can decrypt \(\text{CT}_{ABE}\) to retrieve the AES key. The user attributes themselves are maintained in an identity and access management system against which the user needs to authenticate to make use of TATIS. The overall approach of our solution is depicted in Figure 4:2 For more details on the CP-ABE scheme itself, we refer to our previous work [56]. Our encrypted ML models and data are ingested by TheHive (cfr.