# Poisoning Attacks against Communication and Computing Task Classification and Detection Techniques
## 5 Poisoning Attacks in 2C ML-Based Classification  
Most machine learning algorithms are designed to work on a specific issue, known as artificial narrow intelligence (ANI) [41], and little modifications in the operating environment or operational data impact the effectiveness of ML algorithms. Here, we propose two attacks to demonstrate the security issues ML approaches may face. The attacks are channel-independent, and thus the channel characteristics and transmission medium were not considered. By carefully inserting new examples into the dataset, the attacks aim to alter the behavior of the ML model. The objective of the ML technique is to group data points that are related together or classify them. In a poisoning attack, malicious data points are purposefully added to the dataset in an attempt to affect the results of the ML algorithm. The attacks aim to interrupt the clustering process, the classification process, or both. This can be achieved by fooling the system into forming improper clusters, classifying new examples correctly, or starting new clusters by intentionally grouping poisoned data points. The proposed attacks are named _attack1_ and _attack2_. _Attack1_ inserts several poisoning examples that form uncorrelated poisoning data points into the 3D feature plan. The targeted examples were chosen to be in the decision regions between the legitimate clusters. By the decision regions, we mean the regions where the ML algorithms were sensitive to either clustering or classification, such as the regions between two adjacent centroids. To target the examples and the decision regions, we assumed that the attacker had full knowledge of the clustering process. This could be achieved using exploratory attacks. The attack aims to widen the legitimate clusters, and hence the classification will be affected later. For _attack2_, the scenario is different. The attacker impersonates a legitimate identity to transmit as a legitimate source. Then, the poisoning examples are grouped (correlated) to form a cluster called a _malicious cluster_. This _malicious cluster_ has a mean represented by an example (centroid) located randomly in the 3D features plan and a variance. The purpose of this attack is to fool the whole clustering process. The assigned 2C link may not satisfy the evaluation constraints of the wrongly clustered examples or the next ones for classification. In addition, servers can be overloaded if they process some heavy tasks in terms of computational complexity. Both attacks were simplified in a 2D plane for representation in Figure 3.  
Figure 3: The _attack1_ and _attack2_ 2D representations. Note that _attack1_ targets the features (altering the examples and labels), and thus the attack is said to be feature poisoning. On the other hand, _attack2_ targets the clustering itself, and it is said to be cluster poisoning. Both attack examples were launched using _MITRE_[42] tactics and techniques into the system. The launch time instances followed the same distribution (Poisson) as the legitimate sources' transmission distribution. This was achieved by the combination shown in Figure 4 using cyber security _MITRE matrices_ with the tactics listed in Table 3. The execution tactic was performed using the Python technique (T1059.006), where scripts were used to execute all the tactics. For better understanding, both attacks started by (I) gathering information for future operations using AML.TA0002 on the machine learning model and TA0043 on the network nodes. The next step (II) was to gain access to both the machine learning system and the edge computing model. To achieve this, AML.TA0004 and TA0001 were applied, respectively. After this step, the attacks differentiated. Starting with _attack1_, (\(III_{attack1}\)) it gained access to the machine learning model using AML.TA0000. After that, (\(IV_{attack1}\)) the attacker poisoned the dataset using AML.TA0001. The attacker chose the regions between the clusters since full knowledge about the ML model and system was gained.