Building Better Detection with Privileged Information.

摘要: Modern detection systems use sensor outputs available in the deployment environment to probabilistically identify attacks. These are trained on past or synthetic feature vectors create a model of anomalous normal behavior. Thereafter, run-time collected compared attacks (or lack attack). While this approach has been proven be effective many environments, it is limited training only features that can reliably at test-time. Hence, they fail leverage often vast amount ancillary information from forensic analysis and post-mortem data. In short, don't train (and thus learn from) unavailable too costly collect run-time. paper, we recent advances machine learning integrate privileged --features time, but not run-time-- into algorithms. We apply three different approaches with information; knowledge transfer, influence, distillation, empirically validate their performance range domains. Our evaluation shows increase detector precision recall: observe an average 4.8% decrease error for malware traffic over system no information, 3.53% fast-flux domain bot detection, 3.33% classification, 11.2% facial user authentication. conclude by exploring limitations applications techniques systems.