面向隐私数据保护的支持向量机新方法及其抗攻击模型研究

Since the current researches of support vector machines(SVM) either focus on performance improvement more, or track a segregated way from information security, their achievements can hardly meet the requirements of intellisense and privacy preserving learning in real privacy protection scene. Furthermore, they are vulnerable to attacks, such as data poisoning, classifier evasion, etc. The goal of this research is to explore innovations of SVM with attack resistant models for privacy protection. The main contents lie in the following aspects. Based on support vector data description, we construct a manageable linear problem and novel prototype finding methods. By introducing the complementary characteristics of supervised and unsupervised SVM, an optimized partition closely related to distribution structure for feature space will be investigated under data-driven, which is expected to be utilized for perceiving unknown and tiny patterns in seriously imbalanced data. In terms of cryptology and non-cryptology, we will achieve a series of novel approaches of SVM with provable security bounds, i.e., privacy preserving publishing, privacy preserving learning, confidential learning on encrypted data, etc. Furthermore, we will establish a formal analysis theory for vulnerability of SVMs, finish the evaluation criterions, and then systematically propose a minimum cost of attack immunization strategy for them which are with independent intellectual property rights and able to resist known attacks. Finally， we will implement the achievements in a situational security assessment system which supports the simulation of various attack behaviors. We mainly focus on getting breakthrough developments on ensemble method of SVM and cryptology, security analysis and assessment theory, and attack immunization mechanism, then the original achievements obtained by this research will provide critical theoretical basis, technical support and effective analysis tool for secure machine learning researches and applications in either privacy protection solution or others.

当前的支持向量机(SVM)理论研究或多关注模型性能，或与信息安全研究分离，难适应真实隐私保护场景对模式感知和保密学习的需求，且易受数据中毒、分类器规避等攻击。本项目旨在研究面向隐私保护的SVM新方法及其抗攻击模型，内容包括：基于支持向量数据描述思想，构造易解的线性问题和新原型方法；利用有/无监督SVM的互补特性，构建数据驱动下分布结构相关的SVM最优特征空间划分新方法，解决严重不均衡数据中"微小新模式"感知问题；从(非)密码学两个角度，形成一系列具有可证明安全界的隐私数据发布、保护隐私学习和保密学习协议的SVM新方法；构建SVM脆弱性形式化分析理论，完善抗攻击能力评价指标体系，提出产权自主和抗已有攻击的SVM最小代价攻击免疫策略；实现支持攻击行为模拟，情景化安全性评估原型系统。期望在密码学集成、安全分析与评估理论、攻击免疫策略上取得突破，为隐私保护、安全机器学习研究提供理论支撑和分析工具。

以具有数据分布描述能力的支持向量为核心的支持向量机（SVM），存在非均衡新模式感知、关键信息构造决策函数、小样本迁移模型等关系性能、隐私保护和模型安全的挑战性问题。为此，项目组从“可转化”的角度分析并利用SVM优缺点，围绕“大规模数据的新模式感知模型”、“保护隐私的学习方法”、“模型迁移关键因素及安全性”开展研究，取得了重要进展。包括：（1）利用数据空间分布结构，提出基于边界样本重构的快速支持向量聚类模型，明确了凸包与距离分析对非均衡分布问题的作用；（2）面向隐私保护的功能外包，设计了不直接携带支持向量构建决策函数的非平行SVM及其快速训练方法；（3）以在线流式数据分析为背景，探索小样本对模型迁移关键因素的影响及评估，提出了基于代表样本筛选、分布中心偏移感知的攻击模式识别方案，为从约束性主动学习角度构建抗攻击SVM奠定了基础；（4）从数据分布描述与一致性评估的角度，探索数据层评价模型迁移与安全问题，建立了具有冗余分量抑制能力的变分学习模型；（5）提出知识抽取、网络流行为、安全协议及敏感信息分类匿名等方法，为项目持续性研究在理论、数据及应用方面提供了便利；（6）在SVM与同态加密融合研究的几个关键问题上取得了重要进展。目前，项目组共发表和录用学术论文15篇、申报发明专利3项，其中：1）在国际重要学术刊物《Knowledge and Information Systems》上发表1篇、《Neural Networks》1篇、《Neurocomputing》2篇、《Computers & Security》1篇、《The Journal of China Universities of Posts and Telecommunications》1篇；2）在国内重要学术刊物《软件学报》上发表1篇、《北京邮电大学学报》2篇、《电子学报》1篇；3）发表的论文已经被国内外学者Google引用44次，其中发表在《Neural Networks》、《Computers & Security》和《Knowledge and Information Systems》期刊论文分别被单篇引用19、8和4次；4）发表的论文中，SCI收录6篇、EI收录12篇。辅助培养博士研究生4名，提升了青年教师的科研能力。以项目研究的不断推进为依托，吸纳4名新成员，构建了稳定、可持续的、有活力的青年科研团队。