# Defacement Detection with Passive Adversaries
## 3 Keyed Learning of a Defacement Detector  
Many security challenges have been addressed by means of adaptive techniques, involving both supervised learning and clustering. These include one step and especially continuous authentication, network intrusion detection, spam filtering, defacement response and malware analysis (see, e.g., [29, 30]). In such applications examples are often continuously generated, and online learning methods are needed. In anomaly detection challenges, a security adversary may avoid defense mechanisms by influencing or predicting the output of every learning phase. Following the seminal paper by [PERSON] and [PERSON] [31], and more recent work [18, 20, 21, 22, 23, 24, 25, 32, 33, 34, 35], a new field of research has emerged, known as adversarial learning. As a large number of examples, both real and malicious, may be generated, the term \"adversarial data mining\" has also been used [36]. Defacement response has not been directly studied in an adversarial context, except for the inspiring discussion in the final section of [6]. However, it should be: our adversary is willing to deface our application, and will maximize success by trying to pass undetected through our defacement detection component. This can involve two lines of action: (1) influencing the learning system, e.g., by injecting malicious examples, so that it will be ineffective, or (2) predicting the alarm system behavior, and use a defacement instance that will stay below a criticality level requiring human intervention. In order to frame these considerations in a more precise context, we will use the classification of adversarial learning proposed by [PERSON] et al. (2018), and apply it to defacement detection as follows:  
1. Defacement detection is exposed to _exploratory_ attacks. In fact, it may be difficult to inject examples, as this would amount to causing real defacements, the very goal our adversary is seeking. Our adversary will likely be limited to an exploratory approach, observing application evolution and content over time. 2. For defacement detection we address _targeted_ adversarial models. In fact our adversary has a precise, targeted, goal: inserting a defacement that will be noticed, not just any change in a Web page. For example, a change in one long text page, where just one word is deleted, cannot be considered as a successful attack. 3. Defacement detection faces _integrity_ attacks. If even just one defacement goes undetected, our adversary wins. On the other hand, it would be difficult to make the whole detection system unstable, as injecting training data (defacement examples) has a high probability of being detected, causing the used vulnerability to be fixed, and preventing further adversary action. In summary, defacement detection should be addressed in an exploratory, targeted, and integrity context. Similarly, defacement detection naturally falls within the framework of evasion attacks that are performed at test time ([PERSON] et al., 2016), and we will generally speak of anomaly detection with passive adversaries, who will not be able to manipulate examples in the learning set. In fact, for adversarial applications like defacement detection, the main objective of our adversary is to predict the learned classifier. The adversary will then attack at test time with an anomalous vector that will escape detection, and yet represent a meaningful and substantial change, that will achieve some practical purpose. In the case of defacement, the adversary will simulate or predict the learning phase, and then deface the application while avoiding an above-threshold alarm to be raised. What we then want is a learning system that is unpredictable. One way to do this would be to hide all relevant information, or even the presence of an adaptive component--a form of \"security through obscurity\".