ANTIDOTE: understanding and defending against poisoning of anomaly detectors
Abstract
Statistical machine learning techniques have recently garnered increased popularity as a means to improve network design and security. For intrusion detection, such methods build a model for normal behavior from training data and detect attacks as deviations from that model. This process invites adversaries to manipulate the training data so that the learned model fails to detect subsequent attacks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
A campaign that ramps up slowly poisons every detector's calibration.
“a campaign that ramps up slowly poisons every detector's calibration”
From The Limits of Query Monitoring against Distributed Model Extraction (2026) · cites this paper as Rubinstein et al., 2009
Ramping a campaign up through the eight calibration weeks poisoned the reference and the thresholds, cutting detection from 0.95 to 0.12.
“And ramping a campaign up through the eight calibration weeks poisoned the reference and the thresholds, cutting detection from 0.95 to 0.12-the boiling-frog attack on anomaly detectors (Rubinstein et al., 2009).”
From The Limits of Query Monitoring against Distributed Model Extraction (2026) · cites this paper as Rubinstein et al., 2009
This is the 'boiling frog' poisoning known from PCA-based traffic anomaly detection.
“This is the 'boiling frog' poisoning known from PCA-based traffic anomaly detection (Rubinstein et al., 2009).”
From The Limits of Query Monitoring against Distributed Model Extraction (2026) · cites this paper as Rubinstein et al., 2009
Mimicry attacks on intrusion detectors and boiling-frog poisoning of PCA anomaly detectors are the ancestors of the paper's padding and ramp attacks.
“Mimicry attacks on intrusion detectors (Wagner & Soto, 2002) and boiling-frog poisoning of PCA anomaly detectors (Rubinstein et al., 2009) are the ancestors of our padding and ramp attacks.”
From The Limits of Query Monitoring against Distributed Model Extraction (2026) · cites this paper as Rubinstein et al., 2009
Somewhat homomorphic encryption and partially homomorphic encryption are more efficient but are specified by a limited number of operations.
“On the other hand, somewhat homomorphic encryption and partially homomorphic encryption are more efficient but are specified by a limited number of operations [97], [98], [91], [90].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [98]
The citation lists haven’t been fetched yet
References 34 · Cited by 331
- Authors
- Rubinstein, B. I. P., Nelson, B., Huang, L., Joseph, A. D., Lau, S.-H., Rao, S., Taft, N., & Tygar, J. D.
- Affiliations
- University of California, Berkeley (US)
- Intel (United States) (US)
- Venue
- Proceedings of the 9th ACM SIGCOMM conference on Internet measurement
- Publisher
- ACM
- Published
- 2009-11-04
- Pages
- 1-14
- OpenAlex
- W2007562169
- Cited by
- 331
- References
- 34
- Citations by year
- 2026: 1 · 2025: 9 · 2024: 14 · 2023: 19 · 2022: 22 · 2021: 41 · 2020: 34 · 2019: 58 · 2018: 33 · 2017: 23 · 2016: 11 · 2015: 14 · 2014: 13 · 2013: 11 · 2012: 12
- FWCI
- 6.57
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- antidotes, statistical machine learning, intrusion detection, attack detection, network security, model robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
