rui.bib

%Entries

@inproceedings{xiao2015feature,
  title={Is feature selection secure against training data poisoning?},
  author={Xiao, Huang and Biggio, Battista and Brown, Gavin and Fumera, Giorgio and Eckert, Claudia and Roli, Fabio},
  booktitle={International Conference on Machine Learning},
  pages={1689--1698},
  year={2015}
}

@article{yuan2019adversarial,
  title={Adversarial examples: Attacks and defenses for deep learning},
  author={Yuan, Xiaoyong and He, Pan and Zhu, Qile and Li, Xiaolin},
  journal={IEEE transactions on neural networks and learning systems},
  volume={30},
  number={9},
  pages={2805--2824},
  year={2019},
  publisher={IEEE}
}

@article{pitropakis2019taxonomy,
  title={A taxonomy and survey of attacks against machine learning},
  author={Pitropakis, Nikolaos and Panaousis, Emmanouil and Giannetsos, Thanassis and Anastasiadis, Eleftherios and Loukas, George},
  journal={Computer Science Review},
  volume={34},
  pages={100199},
  year={2019},
  publisher={Elsevier}
}

@article{tsipras2018robustness,
  title={Robustness may be at odds with accuracy},
  author={Tsipras, Dimitris and Santurkar, Shibani and Engstrom, Logan and Turner, Alexander and Madry, Aleksander},
  journal={arXiv preprint arXiv:1805.12152},
  year={2018}
}

@inproceedings{thomas2018adversarial,
  title={Adversarial machine learning: A literature review},
  author={Thomas, Sam and Tabrizi, Nasseh},
  booktitle={International Conference on Machine Learning and Data Mining in Pattern Recognition},
  pages={324--334},
  year={2018},
  organization={Springer}
}

@inproceedings{schmidt2018adversarially,
  title={Adversarially robust generalization requires more data},
  author={Schmidt, Ludwig and Santurkar, Shibani and Tsipras, Dimitris and Talwar, Kunal and Madry, Aleksander},
  booktitle={Advances in Neural Information Processing Systems},
  pages={5014--5026},
  year={2018}
}

@article{papernot2018deep,
  title={Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning},
  author={Papernot, Nicolas and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1803.04765},
  year={2018}
}

@article{liu2018survey,
  title={A survey on security threats and defensive techniques of machine learning: A data driven view},
  author={Liu, Qiang and Li, Pan and Zhao, Wentao and Cai, Wei and Yu, Shui and Leung, Victor CM},
  journal={IEEE access},
  volume={6},
  pages={12103--12117},
  year={2018},
  publisher={IEEE}
}

@article{lei2018discrete,
  title={Discrete adversarial attacks and submodular optimization with applications to text classification},
  author={Lei, Qi and Wu, Lingfei and Chen, Pin-Yu and Dimakis, Alexandros G and Dhillon, Inderjit S and Witbrock, Michael},
  journal={arXiv preprint arXiv:1812.00151},
  year={2018}
}

@inproceedings{jagielski2018manipulating,
  title={Manipulating machine learning: Poisoning attacks and countermeasures for regression learning},
  author={Jagielski, Matthew and Oprea, Alina and Biggio, Battista and Liu, Chang and Nita-Rotaru, Cristina and Li, Bo},
  booktitle={2018 IEEE Symposium on Security and Privacy (SP)},
  pages={19--35},
  year={2018},
  organization={IEEE}
}

@inproceedings{gao2018black,
  title={Black-box generation of adversarial text sequences to evade deep learning classifiers},
  author={Gao, Ji and Lanchantin, Jack and Soffa, Mary Lou and Qi, Yanjun},
  booktitle={2018 IEEE Security and Privacy Workshops (SPW)},
  pages={50--56},
  year={2018},
  organization={IEEE}
}

@article{finlayson2018adversarial,
  title={Adversarial attacks against medical deep learning systems},
  author={Finlayson, Samuel G and Chung, Hyung Won and Kohane, Isaac S and Beam, Andrew L},
  journal={arXiv preprint arXiv:1804.05296},
  year={2018}
}

@article{bubeck2018adversarial,
  title={Adversarial examples from computational constraints},
  author={Bubeck, S{\'e}bastien and Price, Eric and Razenshteyn, Ilya},
  journal={arXiv preprint arXiv:1805.10204},
  year={2018}
}

@article{brendel2017decision,
  title={Decision-based adversarial attacks: Reliable attacks against black-box machine learning models},
  author={Brendel, Wieland and Rauber, Jonas and Bethge, Matthias},
  journal={arXiv preprint arXiv:1712.04248},
  year={2017}
}

@inproceedings{arnab2018robustness,
  title={On the robustness of semantic segmentation models to adversarial attacks},
  author={Arnab, Anurag and Miksik, Ondrej and Torr, Philip HS},
  booktitle={Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition},
  pages={888--897},
  year={2018}
}

@inproceedings{DBLP:conf/iclr/BrendelRB18,
  author    = {Wieland Brendel and
               Jonas Rauber and
               Matthias Bethge},
  title     = {Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box
               Machine Learning Models},
  booktitle = {6th International Conference on Learning Representations, {ICLR} 2018,
               Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings}
}

@inproceedings{demontis2019adversarial,
  title={Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks},
  author={Demontis, Ambra and Melis, Marco and Pintor, Maura and Jagielski, Matthew and Biggio, Battista and Oprea, Alina and Nita-Rotaru, Cristina and Roli, Fabio},
  booktitle={28th $\{$USENIX$\}$ Security Symposium ($\{$USENIX$\}$ Security 19)},
  pages={321--338},
  year={2019}
}

@inproceedings{arp2014drebin,
  title={Drebin: Effective and explainable detection of android malware in your pocket.},
  author={Arp, Daniel and Spreitzenbarth, Michael and Hubner, Malte and Gascon, Hugo and Rieck, Konrad and Siemens, CERT},
  booktitle={Ndss},
  volume={14},
  pages={23--26},
  year={2014}
}

@inproceedings{michael2013mobilesandbox,
  title={Mobilesandbox: Looking deeper into android applications},
  author={Michael, Spreitzenbarth and Florian, Echtler and Thomas, Schreck and Felix, C Freiling and Hoffmann, Johannes},
  booktitle={Proceedings of the 28th International ACM Symposium on Applied Computing (SAC)},
  year={2013}
}

@misc{nsl-kdd,
  author = {{C}anadian {I}nstitute for {C}ybersecurity},
  title = {{NSL-KDD dataset}},
  year = 2009,
  howpublished = "\url{https://www.unb.ca/cic/datasets/nsl.html}",
  note = "[Online; accessed 6th-September-2020]"
}

@misc{ARC,
  author = {{N}orth {C}arolina {S}tate {U}niversity},
  title = {{ARC}: {A} {R}oot {C}luster for {R}esearch into {S}calable {C}omputer {S}ystems},
  year = 2020,
  howpublished = "\url{https://arcb.csc.ncsu.edu/~mueller/cluster/arc/}",
  note = "[Online; accessed 6th-September-2020]"
}

@misc{contagio-pdf,
  author = {Contagio},
  title = {{Contagio Malware Dump}},
  year = 2020,
  howpublished = "\url{http://contagiodump.blogspot.com/}",
  note = "[Online; accessed 6th-September-2020]"
}

@article{papernot2016technical,
  title={Technical report on the cleverhans v2. 1.0 adversarial examples library},
  author={Papernot, Nicolas and Faghri, Fartash and Carlini, Nicholas and Goodfellow, Ian and Feinman, Reuben and Kurakin, Alexey and Xie, Cihang and Sharma, Yash and Brown, Tom and Roy, Aurko and others},
  journal={arXiv preprint arXiv:1610.00768},
  year={2016}
}


@inproceedings{tavallaee2009detailed,
  title={A detailed analysis of the KDD CUP 99 data set},
  author={Tavallaee, Mahbod and Bagheri, Ebrahim and Lu, Wei and Ghorbani, Ali A},
  booktitle={2009 IEEE symposium on computational intelligence for security and defense applications},
  pages={1--6},
  year={2009},
  organization={IEEE}
}

@inproceedings{barreno2006can,
  title={Can machine learning be secure?},
  author={Barreno, Marco and Nelson, Blaine and Sears, Russell and Joseph, Anthony D and Tygar, J Doug},
  booktitle={Proceedings of the 2006 ACM Symposium on Information, computer and communications security},
  pages={16--25},
  year={2006}
}

@inproceedings{alzantot2019genattack,
  title={Genattack: Practical black-box attacks with gradient-free optimization},
  author={Alzantot, Moustafa and Sharma, Yash and Chakraborty, Supriyo and Zhang, Huan and Hsieh, Cho-Jui and Srivastava, Mani B},
  booktitle={Proceedings of the Genetic and Evolutionary Computation Conference},
  pages={1111--1119},
  year={2019}
}

@inproceedings{DBLP:conf/iclr/ChengLCZYH19,
  author    = {Minhao Cheng and
               Thong Le and
               Pin{-}Yu Chen and
               Huan Zhang and
               Jinfeng Yi and
               Cho{-}Jui Hsieh},
  title     = {Query-Efficient Hard-label Black-box Attack: An Optimization-based
               Approach},
  booktitle = {7th International Conference on Learning Representations, {ICLR} 2019,
               New Orleans, LA, USA, May 6-9, 2019}
}

@inproceedings{DBLP:conf/iclr/IlyasEM19,
  author    = {Andrew Ilyas and
               Logan Engstrom and
               Aleksander Madry},
  title     = {Prior Convictions: Black-box Adversarial Attacks with Bandits and
               Priors},
  booktitle = {7th International Conference on Learning Representations, {ICLR} 2019,
               New Orleans, LA, USA, May 6-9, 2019}
}

@inproceedings{DBLP:conf/ndss/Xu0Q18,
  author    = {Weilin Xu and
               David Evans and
               Yanjun Qi},
  title     = {Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks},
  booktitle = {25th Annual Network and Distributed System Security Symposium, {NDSS}
               2018, San Diego, California, USA, February 18-21, 2018},
  publisher = {The Internet Society}
}

@article{DBLP:journals/pr/BiggioR18,
  author    = {Battista Biggio and
               Fabio Roli},
  title     = {Wild patterns: Ten years after the rise of adversarial machine learning},
  journal   = {Pattern Recognition.},
  volume    = {84},
  pages     = {317--331},
  year      = {2018}}
}



@article{DBLP:journals/corr/GrosseMP0M17,
  author    = {Kathrin Grosse and
               Praveen Manoharan and
               Nicolas Papernot and
               Michael Backes and
               Patrick D. McDaniel},
  title     = {On the (Statistical) Detection of Adversarial Examples},
  journal   = {CoRR},
  volume    = {abs/1702.06280},
  year      = {2017}
}


@article{DBLP:journals/corr/GrossePM0M16,
  author    = {Kathrin Grosse and
               Nicolas Papernot and
               Praveen Manoharan and
               Michael Backes and
               Patrick D. McDaniel},
  title     = {Adversarial Perturbations Against Deep Neural Networks for Malware
               Classification},
  journal   = {CoRR},
  volume    = {abs/1606.04435},
  year      = {2016}
}

@article{hu2017generating,
  title={Generating adversarial malware examples for black-box attacks based on gan},
  author={Hu, Weiwei and Tan, Ying},
  journal={arXiv preprint arXiv:1702.05983},
  year={2017}
}

@inproceedings{sharafaldin2018toward,
  title={Toward generating a new intrusion detection dataset and intrusion traffic characterization.},
  author={Sharafaldin, Iman and Lashkari, Arash Habibi and Ghorbani, Ali A},
  booktitle={ICISSP},
  pages={108--116},
  year={2018}
}

@inproceedings{lashkari2018toward,
  title={Toward developing a systematic approach to generate benchmark android malware datasets and classification},
  author={Lashkari, Arash Habibi and Kadir, Andi Fitriah A and Taheri, Laya and Ghorbani, Ali A},
  booktitle={2018 International Carnahan Conference on Security Technology (ICCST)},
  pages={1--7},
  year={2018},
  organization={IEEE}
}

@inproceedings{biggio2013evasion,
  title={Evasion attacks against machine learning at test time},
  author={Biggio, Battista and Corona, Igino and Maiorca, Davide and Nelson, Blaine and {\v{S}}rndi{\'c}, Nedim and Laskov, Pavel and Giacinto, Giorgio and Roli, Fabio},
  booktitle={Joint European conference on machine learning and knowledge discovery in databases},
  pages={387--402},
  year={2013},
  organization={Springer}
}

@inproceedings{xu2016automatically,
  title={Automatically evading classifiers},
  author={Xu, Weilin and Qi, Yanjun and Evans, David},
  booktitle={Proceedings of the 2016 network and distributed systems symposium},
  volume={10},
  year={2016}
}

@inproceedings{laskov2014practical,
  title={Practical evasion of a learning-based classifier: A case study},
  author={Laskov, Pavel and others},
  booktitle={2014 IEEE symposium on security and privacy},
  pages={197--211},
  year={2014},
  organization={IEEE}
}

@inproceedings{dang2017evading,
  title={Evading classifiers by morphing in the dark},
  author={Dang, Hung and Huang, Yue and Chang, Ee-Chien},
  booktitle={Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security},
  pages={119--133},
  year={2017}
}

@inproceedings{maiorca2013looking,
  title={Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious pdf files detection},
  author={Maiorca, Davide and Corona, Igino and Giacinto, Giorgio},
  booktitle={Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security},
  pages={119--130},
  year={2013}
}

@inproceedings{smutz2012malicious,
  title={Malicious PDF detection using metadata and structural features},
  author={Smutz, Charles and Stavrou, Angelos},
  booktitle={Proceedings of the 28th annual computer security applications conference},
  pages={239--248},
  year={2012}
}


@inproceedings{khasawneh2017rhmd,
  title={RHMD: evasion-resilient hardware malware detectors},
  author={Khasawneh, Khaled N and Abu-Ghazaleh, Nael and Ponomarev, Dmitry and Yu, Lei},
  booktitle={Proceedings of the 50th Annual IEEE/ACM International Symposium on Microarchitecture},
  pages={315--327},
  year={2017}
}

@inproceedings{biggio2014poisoning,
  title={Poisoning behavioral malware clustering},
  author={Biggio, Battista and Rieck, Konrad and Ariu, Davide and Wressnegger, Christian and Corona, Igino and Giacinto, Giorgio and Roli, Fabio},
  booktitle={Proceedings of the 2014 workshop on artificial intelligent and security workshop},
  pages={27--36},
  year={2014}
}


@inproceedings{zhou2012adversarial,
  title={Adversarial support vector machine learning},
  author={Zhou, Yan and Kantarcioglu, Murat and Thuraisingham, Bhavani and Xi, Bowei},
  booktitle={Proceedings of the 18th ACM SIGKDD international conference on Knowledge discovery and data mining},
  pages={1059--1067},
  year={2012}
}

@article{nelson2008exploiting,
  title={Exploiting Machine Learning to Subvert Your Spam Filter.},
  author={Nelson, Blaine and Barreno, Marco and Chi, Fuching Jack and Joseph, Anthony D and Rubinstein, Benjamin IP and Saini, Udam and Sutton, Charles A and Tygar, J Doug and Xia, Kai},
  journal={LEET},
  volume={8},
  pages={1--9},
  year={2008}
}

@inproceedings{papernot2016distillation,
  title={Distillation as a defense to adversarial perturbations against deep neural networks},
  author={Papernot, Nicolas and McDaniel, Patrick and Wu, Xi and Jha, Somesh and Swami, Ananthram},
  booktitle={2016 IEEE Symposium on Security and Privacy (SP)},
  pages={582--597},
  year={2016},
  organization={IEEE}
}

@article{zhang2015adversarial,
  title={Adversarial feature selection against evasion attacks},
  author={Zhang, Fei and Chan, Patrick PK and Biggio, Battista and Yeung, Daniel S and Roli, Fabio},
  journal={IEEE transactions on cybernetics},
  volume={46},
  number={3},
  pages={766--777},
  year={2015},
  publisher={IEEE}
}

@article{ye2017survey,
  title={A survey on malware detection using data mining techniques},
  author={Ye, Yanfang and Li, Tao and Adjeroh, Donald and Iyengar, S Sitharama},
  journal={ACM Computing Surveys (CSUR)},
  volume={50},
  number={3},
  pages={1--40},
  year={2017},
  publisher={ACM New York, NY, USA}
}

@article{tramer2017space,
  title={The space of transferable adversarial examples},
  author={Tram{\`e}r, Florian and Papernot, Nicolas and Goodfellow, Ian and Boneh, Dan and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1704.03453},
  year={2017}
}

@inproceedings{suciu2018does,
  title={When does machine learning $\{$FAIL$\}$? generalized transferability for evasion and poisoning attacks},
  author={Suciu, Octavian and Marginean, Radu and Kaya, Yigitcan and Daume III, Hal and Dumitras, Tudor},
  booktitle={27th $\{$USENIX$\}$ Security Symposium ($\{$USENIX$\}$ Security 18)},
  pages={1299--1316},
  year={2018}
}

@inproceedings{grosse2017adversarial,
  title={Adversarial examples for malware detection},
  author={Grosse, Kathrin and Papernot, Nicolas and Manoharan, Praveen and Backes, Michael and McDaniel, Patrick},
  booktitle={European Symposium on Research in Computer Security},
  pages={62--79},
  year={2017},
  organization={Springer}
}

@inproceedings{ghotra2015revisiting,
  title={Revisiting the impact of classification techniques on the performance of defect prediction models},
  author={Ghotra, Baljinder and McIntosh, Shane and Hassan, Ahmed E},
  booktitle={2015 IEEE/ACM 37th IEEE International Conference on Software Engineering},
  volume={1},
  pages={789--800},
  year={2015},
  organization={IEEE}
}

@article{mittas2012ranking,
  title={Ranking and clustering software cost estimation models through a multiple comparisons algorithm},
  author={Mittas, Nikolaos and Angelis, Lefteris},
  journal={IEEE Transactions on software engineering},
  volume={39},
  number={4},
  pages={537--551},
  year={2012},
  publisher={IEEE}
}

@inproceedings{arcuri2011practical,
  title={A practical guide for using statistical tests to assess randomized algorithms in software engineering},
  author={Arcuri, Andrea and Briand, Lionel},
  booktitle={2011 33rd International Conference on Software Engineering (ICSE)},
  pages={1--10},
  year={2011},
  organization={IEEE}
}

@article{bergstra2012random,
  title={Random search for hyper-parameter optimization},
  author={Bergstra, James and Bengio, Yoshua},
  journal={Journal of Machine Learning Research},
  volume={13},
  number={Feb},
  pages={281--305},
  year={2012}
}

@article{shahriari2015taking,
  title={Taking the human out of the loop: A review of Bayesian optimization},
  author={Shahriari, Bobak and Swersky, Kevin and Wang, Ziyu and Adams, Ryan P and De Freitas, Nando},
  journal={Proceedings of the IEEE},
  volume={104},
  number={1},
  pages={148--175},
  year={2015},
  publisher={IEEE}
}

@inproceedings{snoek2012practical,
  title={Practical bayesian optimization of machine learning algorithms},
  author={Snoek, Jasper and Larochelle, Hugo and Adams, Ryan P},
  booktitle={Advances in neural information processing systems},
  pages={2951--2959},
  year={2012}
}

@inproceedings{bergstra2011algorithms,
  title={Algorithms for hyper-parameter optimization},
  author={Bergstra, James S and Bardenet, R{\'e}mi and Bengio, Yoshua and K{\'e}gl, Bal{\'a}zs},
  booktitle={Advances in neural information processing systems},
  pages={2546--2554},
  year={2011}
}

@inproceedings{KurakinGB17a,
  author    = {Alexey Kurakin and
               Ian J. Goodfellow and
               Samy Bengio},
  title     = {Adversarial examples in the physical world},
  booktitle = {5th International Conference on Learning Representations, {ICLR} 2017,
               Toulon, France, April 24-26, 2017, Workshop Track Proceedings},
  year      = {2017}
}

@inproceedings{papernot2016limitations,
  title={The limitations of deep learning in adversarial settings},
  author={Papernot, Nicolas and McDaniel, Patrick and Jha, Somesh and Fredrikson, Matt and Celik, Z Berkay and Swami, Ananthram},
  booktitle={2016 IEEE European symposium on security and privacy (EuroS\&P)},
  pages={372--387},
  year={2016},
  organization={IEEE}
}

@article{gower1971general,
  title={A general coefficient of similarity and some of its properties},
  author={Gower, John C},
  journal={Biometrics},
  pages={857--871},
  year={1971},
  publisher={JSTOR}
}

@inproceedings{DBLP:conf/icml/BiggioNL12,
  author    = {Battista Biggio and
               Blaine Nelson and
               Pavel Laskov},
  title     = {Poisoning Attacks against Support Vector Machines},
  booktitle = {Proceedings of the 29th International Conference on Machine Learning, {ICML} 2012, Edinburgh, Scotland, UK},
  year={2012}
}

@article{carlini2019evaluating,
  title={On evaluating adversarial robustness},
  author={Carlini, Nicholas and Athalye, Anish and Papernot, Nicolas and Brendel, Wieland and Rauber, Jonas and Tsipras, Dimitris and Goodfellow, Ian and Madry, Aleksander and Kurakin, Alexey},
  journal={arXiv preprint arXiv:1902.06705},
  year={2019}
}

@inproceedings{DBLP:journals/corr/GoodfellowSS14,
  author    = {Ian J. Goodfellow and
               Jonathon Shlens and
               Christian Szegedy},
  title     = {Explaining and Harnessing Adversarial Examples},
  booktitle = {3rd International Conference on Learning Representations, {ICLR} 2015,
               San Diego, CA, USA, May 7-9, 2015},
               year={2015}
}

@inproceedings{bhagoji2018practical,
  title={Practical black-box attacks on deep neural networks using efficient query mechanisms},
  author={Bhagoji, Arjun Nitin and He, Warren and Li, Bo and Song, Dawn},
  booktitle={European Conference on Computer Vision},
  pages={158--174},
  year={2018},
  organization={Springer}
}


@inproceedings{carlini2017towards,
  title={Towards evaluating the robustness of neural networks},
  author={Carlini, Nicholas and Wagner, David},
  booktitle={2017 ieee symposium on security and privacy (sp)},
  pages={39--57},
  year={2017},
  organization={IEEE}
}

@inproceedings{DBLP:conf/iclr/TramerKPGBM18,
  author    = {Florian Tram{\`{e}}r and
               Alexey Kurakin and
               Nicolas Papernot and
               Ian J. Goodfellow and
               Dan Boneh and
               Patrick D. McDaniel},
  title     = {Ensemble Adversarial Training: Attacks and Defenses},
  booktitle = {6th International Conference on Learning Representations, {ICLR} 2018,
               Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings},
               year={2018}
}

@inproceedings{DBLP:conf/iclr/ChengSCC0H20,
  author    = {Minhao Cheng and
               Simranjit Singh and
               Patrick H. Chen and
               Pin{-}Yu Chen and
               Sijia Liu and
               Cho{-}Jui Hsieh},
  title     = {Sign-OPT: {A} Query-Efficient Hard-label Adversarial Attack},
  booktitle = {8th International Conference on Learning Representations, {ICLR} 2020,
               Addis Ababa, Ethiopia, April 26-30, 2020}
}

@article{DBLP:journals/corr/abs-2006-12792,
  author    = {Jinghui Chen and
               Quanquan Gu},
  title     = {RayS: {A} Ray Searching Method for Hard-label Adversarial Attack},
  journal   = {CoRR},
  volume    = {abs/2006.12792},
  year      = {2020},
  url       = {https://arxiv.org/abs/2006.12792}
}

@inproceedings{DBLP:journals/corr/SzegedyZSBEGF13,
  author    = {Christian Szegedy and
               Wojciech Zaremba and
               Ilya Sutskever and
               Joan Bruna and
               Dumitru Erhan and
               Ian J. Goodfellow and
               Rob Fergus},
  editor    = {Yoshua Bengio and
               Yann LeCun},
  title     = {Intriguing properties of neural networks},
  booktitle = {2nd International Conference on Learning Representations, {ICLR} 2014,
               Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings},
               year={2014}
}

@article{DBLP:journals/corr/abs-1804-05296,
  author    = {Samuel G. Finlayson and
               Isaac S. Kohane and
               Andrew L. Beam},
  title     = {Adversarial Attacks Against Medical Deep Learning Systems},
  journal   = {CoRR},
  volume    = {abs/1804.05296},
  year      = {2018},
  url       = {http://arxiv.org/abs/1804.05296}
}

@inproceedings{shokri2017membership,
  title={Membership inference attacks against machine learning models},
  author={Shokri, Reza and Stronati, Marco and Song, Congzheng and Shmatikov, Vitaly},
  booktitle={2017 IEEE Symposium on Security and Privacy (SP)},
  pages={3--18},
  year={2017},
  organization={IEEE}
}

@inproceedings{tramer2016stealing,
  title={Stealing machine learning models via prediction apis},
  author={Tram{\`e}r, Florian and Zhang, Fan and Juels, Ari and Reiter, Michael K and Ristenpart, Thomas},
  booktitle={25th $\{$USENIX$\}$ Security Symposium ($\{$USENIX$\}$ Security 16)},
  pages={601--618},
  year={2016}
}

@inproceedings{DBLP:conf/iclr/PapernotSMRTE18,
  author    = {Nicolas Papernot and
               Shuang Song and
               Ilya Mironov and
               Ananth Raghunathan and
               Kunal Talwar and
               {\'{U}}lfar Erlingsson},
  title     = {Scalable Private Learning with {PATE}},
  booktitle = {6th International Conference on Learning Representations, {ICLR} 2018,
               Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings}
}

@inproceedings{fredrikson2015model,
  title={Model inversion attacks that exploit confidence information and basic countermeasures},
  author={Fredrikson, Matt and Jha, Somesh and Ristenpart, Thomas},
  booktitle={Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security},
  pages={1322--1333},
  year={2015}
}

@inproceedings{DBLP:conf/nips/SteinhardtKL17,
  author    = {Jacob Steinhardt and
               Pang Wei Koh and
               Percy Liang},
  editor    = {Isabelle Guyon and
               Ulrike von Luxburg and
               Samy Bengio and
               Hanna M. Wallach and
               Rob Fergus and
               S. V. N. Vishwanathan and
               Roman Garnett},
  title     = {Certified Defenses for Data Poisoning Attacks},
  booktitle = {Advances in Neural Information Processing Systems 30: Annual Conference
               on Neural Information Processing Systems 2017, 4-9 December 2017,
               Long Beach, CA, {USA}},
  pages     = {3517--3529},
  year={2017}
}

@inproceedings{biggio2013data,
  title={Is data clustering in adversarial settings secure?},
  author={Biggio, Battista and Pillai, Ignazio and Rota Bul{\`o}, Samuel and Ariu, Davide and Pelillo, Marcello and Roli, Fabio},
  booktitle={Proceedings of the 2013 ACM workshop on Artificial intelligence and security},
  pages={87--98},
  year={2013}
}

@inproceedings{DBLP:conf/ccs/Munoz-GonzalezB17,
  author    = {Luis Mu{\~{n}}oz{-}Gonz{\'{a}}lez and
               Battista Biggio and
               Ambra Demontis and
               Andrea Paudice and
               Vasin Wongrassamee and
               Emil C. Lupu and
               Fabio Roli},
  editor    = {Bhavani M. Thuraisingham and
               Battista Biggio and
               David Mandell Freeman and
               Brad Miller and
               Arunesh Sinha},
  title     = {Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization},
  booktitle = {Proceedings of the 10th {ACM} Workshop on Artificial Intelligence
               and Security, AISec@CCS 2017, Dallas, TX, USA, November 3, 2017},
  pages     = {27--38},
  year={2017}
}

@inproceedings{DBLP:conf/ccs/BiggioRAWCGR14,
  author    = {Battista Biggio and
               Konrad Rieck and
               Davide Ariu and
               Christian Wressnegger and
               Igino Corona and
               Giorgio Giacinto and
               Fabio Roli},
  editor    = {Christos Dimitrakakis and
               Aikaterini Mitrokotsa and
               Benjamin I. P. Rubinstein and
               Gail{-}Joon Ahn},
  title     = {Poisoning behavioral malware clustering},
  booktitle = {Proceedings of the 2014 Workshop on Artificial Intelligent and Security
               Workshop, AISec 2014, Scottsdale, AZ, USA, November 7, 2014},
  pages     = {27--36},
  year={2014}
}

@inproceedings{DBLP:conf/icml/XiaoBBFER15,
  author    = {Huang Xiao and
               Battista Biggio and
               Gavin Brown and
               Giorgio Fumera and
               Claudia Eckert and
               Fabio Roli},
  editor    = {Francis R. Bach and
               David M. Blei},
  title     = {Is Feature Selection Secure against Training Data Poisoning?},
  booktitle = {Proceedings of the 32nd International Conference on Machine Learning,
               {ICML} 2015, Lille, France, 6-11 July 2015},
  series    = {{JMLR} Workshop and Conference Proceedings},
  volume    = {37},
  pages     = {1689--1698},
  year={2015}
}

@inproceedings{DBLP:conf/ccs/PapernotMGJCS17,
  author    = {Nicolas Papernot and
               Patrick D. McDaniel and
               Ian J. Goodfellow and
               Somesh Jha and
               Z. Berkay Celik and
               Ananthram Swami},
  editor    = {Ramesh Karri and
               Ozgur Sinanoglu and
               Ahmad{-}Reza Sadeghi and
               Xun Yi},
  title     = {Practical Black-Box Attacks against Machine Learning},
  booktitle = {Proceedings of the 2017 {ACM} on Asia Conference on Computer and Communications
               Security, AsiaCCS 2017, Abu Dhabi, United Arab Emirates, April 2-6,
               2017},
  pages     = {506--519},
  year={2017}
}


@inproceedings{DBLP:conf/nips/IlyasSTETM19,
  author    = {Andrew Ilyas and
               Shibani Santurkar and
               Dimitris Tsipras and
               Logan Engstrom and
               Brandon Tran and
               Aleksander Madry},
  editor    = {Hanna M. Wallach and
               Hugo Larochelle and
               Alina Beygelzimer and
               Florence d'Alch{\'{e}}{-}Buc and
               Emily B. Fox and
               Roman Garnett},
  title     = {Adversarial Examples Are Not Bugs, They Are Features},
  booktitle = {Advances in Neural Information Processing Systems 32: Annual Conference
               on Neural Information Processing Systems 2019, NeurIPS 2019, 8-14
               December 2019, Vancouver, BC, Canada},
  pages     = {125--136}
}

@article{DBLP:journals/corr/PapernotMG16,
  author    = {Nicolas Papernot and
               Patrick D. McDaniel and
               Ian J. Goodfellow},
  title     = {Transferability in Machine Learning: from Phenomena to Black-Box Attacks
               using Adversarial Samples},
  journal   = {CoRR},
  volume    = {abs/1605.07277},
  year      = {2016}
}

@inproceedings{DBLP:conf/ccs/Carlini017,
  author    = {Nicholas Carlini and
               David A. Wagner},
  editor    = {Bhavani M. Thuraisingham and
               Battista Biggio and
               David Mandell Freeman and
               Brad Miller and
               Arunesh Sinha},
  title     = {Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection
               Methods},
  booktitle = {Proceedings of the 10th {ACM} Workshop on Artificial Intelligence
               and Security, AISec@CCS 2017, Dallas, TX, USA, November 3, 2017},
  pages     = {3--14},
  year={2017}
}

@inproceedings{DBLP:conf/iclr/NaKM18,
  author    = {Taesik Na and
               Jong Hwan Ko and
               Saibal Mukhopadhyay},
  title     = {Cascade Adversarial Machine Learning Regularized with a Unified Embedding},
  booktitle = {6th International Conference on Learning Representations, {ICLR} 2018,
               Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings},
  publisher = {OpenReview.net},
  year={2018}
}

@inproceedings{DBLP:conf/iclr/MadryMSTV18,
  author    = {Aleksander Madry and
               Aleksandar Makelov and
               Ludwig Schmidt and
               Dimitris Tsipras and
               Adrian Vladu},
  title     = {Towards Deep Learning Models Resistant to Adversarial Attacks},
  booktitle = {6th International Conference on Learning Representations, {ICLR} 2018,
               Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings},
               year={2018}
}

@inproceedings{DBLP:conf/iclr/FarniaZT19,
  author    = {Farzan Farnia and
               Jesse M. Zhang and
               David Tse},
  title     = {Generalizable Adversarial Training via Spectral Normalization},
  booktitle = {7th International Conference on Learning Representations, {ICLR} 2019,
               New Orleans, LA, USA, May 6-9, 2019},
               year={2019}
}

@article{DBLP:journals/corr/CarliniW16,
  author    = {Nicholas Carlini and
               David A. Wagner},
  title     = {Defensive Distillation is Not Robust to Adversarial Examples},
  journal   = {CoRR},
  volume    = {abs/1607.04311},
  year      = {2016}
}

@inproceedings{DBLP:journals/corr/GuR14,
  author    = {Shixiang Gu and
               Luca Rigazio},
  editor    = {Yoshua Bengio and
               Yann LeCun},
  title     = {Towards Deep Neural Network Architectures Robust to Adversarial Examples},
  booktitle = {3rd International Conference on Learning Representations, {ICLR} 2015,
               San Diego, CA, USA, May 7-9, 2015, Workshop Track Proceedings}
}

@inproceedings{DBLP:conf/cvpr/LiaoLDPH018,
  author    = {Fangzhou Liao and
               Ming Liang and
               Yinpeng Dong and
               Tianyu Pang and
               Xiaolin Hu and
               Jun Zhu},
  title     = {Defense Against Adversarial Attacks Using High-Level Representation
               Guided Denoiser},
  booktitle = {2018 {IEEE} Conference on Computer Vision and Pattern Recognition,
               {CVPR} 2018, Salt Lake City, UT, USA, June 18-22, 2018},
  pages     = {1778--1787}
}

@inproceedings{DBLP:conf/ccs/MengC17,
  author    = {Dongyu Meng and
               Hao Chen},
  editor    = {Bhavani M. Thuraisingham and
               David Evans and
               Tal Malkin and
               Dongyan Xu},
  title     = {MagNet: {A} Two-Pronged Defense against Adversarial Examples},
  booktitle = {Proceedings of the 2017 {ACM} {SIGSAC} Conference on Computer and
               Communications Security, {CCS} 2017, Dallas, TX, USA, October 30 -
               November 03, 2017},
  pages     = {135--147}
}

@inproceedings{DBLP:conf/iclr/MetzenGFB17,
  author    = {Jan Hendrik Metzen and
               Tim Genewein and
               Volker Fischer and
               Bastian Bischoff},
  title     = {On Detecting Adversarial Perturbations},
  booktitle = {5th International Conference on Learning Representations, {ICLR} 2017,
               Toulon, France, April 24-26, 2017, Conference Track Proceedings},
               year={2017}
}


@inproceedings{DBLP:conf/iccv/LiL17,
  author    = {Xin Li and
               Fuxin Li},
  title     = {Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics},
  booktitle = {{IEEE} International Conference on Computer Vision, {ICCV} 2017, Venice, Italy, October 22-29, 2017},
  pages     = {5775--5783},
  year={2017}
}

@inproceedings{DBLP:conf/iccv/LuIF17,
  author    = {Jiajun Lu and
               Theerasit Issaranon and
               David A. Forsyth},
  title     = {SafetyNet: Detecting and Rejecting Adversarial Examples Robustly},
  booktitle = {{IEEE} International Conference on Computer Vision, {ICCV} 2017, Venice,
               Italy, October 22-29, 2017},
  pages     = {446--454},
  year={2017}
}

@article{DBLP:journals/ijsn/AtenieseMSVVF15,
  author    = {Giuseppe Ateniese and
               Luigi V. Mancini and
               Angelo Spognardi and
               Antonio Villani and
               Domenico Vitali and
               Giovanni Felici},
  title     = {Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers},
  journal   = {Int. J. Secur. Networks},
  volume    = {10},
  number    = {3},
  pages     = {137--150},
  year      = {2015}
}

@article{dietterich2002ensemble,
  title={Ensemble learning},
  author={Dietterich, Thomas G and others},
  journal={The handbook of brain theory and neural networks},
  volume={2},
  pages={110--125},
  year={2002},
  publisher={MIT press Cambridge, Massachusetts}
}

@incollection{feurer2019hyperparameter,
  title={Hyperparameter optimization},
  author={Feurer, Matthias and Hutter, Frank},
  booktitle={Automated Machine Learning},
  pages={3--33},
  year={2019},
  publisher={Springer, Cham}
}

@book{price2006differential,
  title={Differential evolution: a practical approach to global optimization},
  author={Price, Kenneth and Storn, Rainer M and Lampinen, Jouni A},
  year={2006},
  publisher={Springer Science \& Business Media}
}

@inproceedings{fredrikson2014privacy,
  title={Privacy in pharmacogenetics: An end-to-end case study of personalized warfarin dosing},
  author={Fredrikson, Matthew and Lantz, Eric and Jha, Somesh and Lin, Simon and Page, David and Ristenpart, Thomas},
  booktitle={23rd $\{$USENIX$\}$ Security Symposium ($\{$USENIX$\}$ Security 14)},
  pages={17--32},
  year={2014}
}

@article{biggio2010multiple,
  title={Multiple classifier systems for robust classifier design in adversarial environments},
  author={Biggio, Battista and Fumera, Giorgio and Roli, Fabio},
  journal={International Journal of Machine Learning and Cybernetics},
  volume={1},
  number={1-4},
  pages={27--41},
  year={2010},
  publisher={Springer}
}

@inproceedings{papernot2018sok,
  title={SoK: Security and privacy in machine learning},
  author={Papernot, Nicolas and McDaniel, Patrick and Sinha, Arunesh and Wellman, Michael P},
  booktitle={2018 IEEE European Symposium on Security and Privacy (EuroS\&P)},
  pages={399--414},
  year={2018},
  organization={IEEE}
}


@inproceedings{young2015optimizing,
  title={Optimizing deep learning hyper-parameters through an evolutionary algorithm},
  author={Young, Steven R and Rose, Derek C and Karnowski, Thomas P and Lim, Seung-Hwan and Patton, Robert M},
  booktitle={Proceedings of the Workshop on Machine Learning in High-Performance Computing Environments},
  pages={1--5},
  year={2015}
}

@article{storn1997differential,
  title={Differential evolution--a simple and efficient heuristic for global optimization over continuous spaces},
  author={Storn, Rainer and Price, Kenneth},
  journal={Journal of global optimization},
  volume={11},
  number={4},
  pages={341--359},
  year={1997},
  publisher={Springer}
}

@inproceedings{moosavi2016deepfool,
  title={Deepfool: a simple and accurate method to fool deep neural networks},
  author={Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Frossard, Pascal},
  booktitle={Proceedings of the IEEE conference on computer vision and pattern recognition},
  pages={2574--2582},
  year={2016}
}

@article{DBLP:journals/corr/abs-1709-03423,
  author    = {Thilo Strauss and
               Markus Hanselmann and
               Andrej Junginger and
               Holger Ulmer},
  title     = {Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks},
  journal   = {CoRR},
  volume    = {abs/1709.03423},
  year      = {2017}
}

@article{gong2019diversity,
  title={Diversity in machine learning},
  author={Gong, Zhiqiang and Zhong, Ping and Hu, Weidong},
  journal={IEEE Access},
  volume={7},
  pages={64323--64350},
  year={2019},
  publisher={IEEE}
}

@article{kittur2007power,
  title={Power of the few vs. wisdom of the crowd: Wikipedia and the rise of the bourgeoisie},
  author={Kittur, Aniket and Chi, Ed and Pendleton, Bryan A and Suh, Bongwon and Mytkowicz, Todd},
  journal={World wide web},
  volume={1},
  number={2},
  pages={19},
  year={2007}
}

@book{page2010diversity,
  title={Diversity and complexity},
  author={Page, Scott E},
  volume={2},
  year={2010},
  publisher={Princeton University Press}
}

@article{dhanabal2015study,
  title={A study on NSL-KDD dataset for intrusion detection system based on classification algorithms},
  author={Dhanabal, L and Shantharajah, SP},
  journal={International Journal of Advanced Research in Computer and Communication Engineering},
  volume={4},
  number={6},
  pages={446--452},
  year={2015}
}

@article{bagnall2017training,
  title={Training ensembles to detect adversarial examples},
  author={Bagnall, Alexander and Bunescu, Razvan and Stewart, Gordon},
  journal={arXiv preprint arXiv:1712.04006},
  year={2017}
}

@article{bhagoji2017dimensionality,
  title={Dimensionality reduction as a defense against evasion attacks on machine learning classifiers},
  author={Bhagoji, Arjun Nitin and Cullina, Daniel and Mittal, Prateek},
  journal={arXiv preprint arXiv:1704.02654},
  volume={2},
  year={2017}
}

@article{chen2018automated,
  title={Automated poisoning attacks and defenses in malware detection systems: An adversarial machine learning approach},
  author={Chen, Sen and Xue, Minhui and Fan, Lingling and Hao, Shuang and Xu, Lihua and Zhu, Haojin and Li, Bo},
  journal={computers \& security},
  volume={73},
  pages={326--344},
  year={2018},
  publisher={Elsevier}
}

@article{chakraborty2018adversarial,
  title={Adversarial attacks and defences: A survey},
  author={Chakraborty, Anirban and Alam, Manaar and Dey, Vishal and Chattopadhyay, Anupam and Mukhopadhyay, Debdeep},
  journal={arXiv preprint arXiv:1810.00069},
  year={2018}
}

@misc{cormacktrec,
  title={TREC 2007 Spam Track Overview, 2007},
  author={Cormack, GV}
}

@article{biggio2010multiple,
  title={Multiple classifier systems for robust classifier design in adversarial environments},
  author={Biggio, Battista and Fumera, Giorgio and Roli, Fabio},
  journal={International Journal of Machine Learning and Cybernetics},
  volume={1},
  number={1-4},
  pages={27--41},
  year={2010},
  publisher={Springer}
}

@inproceedings{smutz2012malicious,
  title={Malicious PDF detection using metadata and structural features},
  author={Smutz, Charles and Stavrou, Angelos},
  booktitle={Proceedings of the 28th annual computer security applications conference},
  pages={239--248},
  year={2012}
}
@inproceedings{biggio2013evasion,
  title={Evasion attacks against machine learning at test time},
  author={Biggio, Battista and Corona, Igino and Maiorca, Davide and Nelson, Blaine and {\v{S}}rndi{\'c}, Nedim and Laskov, Pavel and Giacinto, Giorgio and Roli, Fabio},
  booktitle={Joint European conference on machine learning and knowledge discovery in databases},
  pages={387--402},
  year={2013},
  organization={Springer}
}

@inproceedings{laskov2014practical,
  title={Practical evasion of a learning-based classifier: A case study},
  author={Laskov, Pavel and others},
  booktitle={2014 IEEE symposium on security and privacy},
  pages={197--211},
  year={2014},
  organization={IEEE}
}

@inproceedings{xu2016automatically,
  title={Automatically evading classifiers},
  author={Xu, Weilin and Qi, Yanjun and Evans, David},
  booktitle={Proceedings of the 2016 network and distributed systems symposium},
  volume={10},
  year={2016}
}

@inproceedings{zhou2012adversarial,
  title={Adversarial support vector machine learning},
  author={Zhou, Yan and Kantarcioglu, Murat and Thuraisingham, Bhavani and Xi, Bowei},
  booktitle={Proceedings of the 18th ACM SIGKDD international conference on Knowledge discovery and data mining},
  pages={1059--1067},
  year={2012}
}

@inproceedings{arp2014drebin,
  title={Drebin: Effective and explainable detection of android malware in your pocket.},
  author={Arp, Daniel and Spreitzenbarth, Michael and Hubner, Malte and Gascon, Hugo and Rieck, Konrad and Siemens, CERT},
  booktitle={Ndss},
  volume={14},
  pages={23--26},
  year={2014}
}

@inproceedings{dang2017evading,
  title={Evading classifiers by morphing in the dark},
  author={Dang, Hung and Huang, Yue and Chang, Ee-Chien},
  booktitle={Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security},
  pages={119--133},
  year={2017}
}

@article{grosse2017statistical,
  title={On the (statistical) detection of adversarial examples},
  author={Grosse, Kathrin and Manoharan, Praveen and Papernot, Nicolas and Backes, Michael and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1702.06280},
  year={2017}
}

@inproceedings{grosse2017adversarial,
  title={Adversarial examples for malware detection},
  author={Grosse, Kathrin and Papernot, Nicolas and Manoharan, Praveen and Backes, Michael and McDaniel, Patrick},
  booktitle={European Symposium on Research in Computer Security},
  pages={62--79},
  year={2017},
  organization={Springer}
}

@inproceedings{khasawneh2017rhmd,
  title={RHMD: Evasion-resilient hardware malware detectors},
  author={Khasawneh, Khaled N and Abu-Ghazaleh, Nael and Ponomarev, Dmitry and Yu, Lei},
  booktitle={Proceedings of the 50th Annual IEEE/ACM International Symposium on Microarchitecture},
  pages={315--327},
  year={2017}
}

@inproceedings{liu2017robust,
  title={Robust linear regression against training data poisoning},
  author={Liu, Chang and Li, Bo and Vorobeychik, Yevgeniy and Oprea, Alina},
  booktitle={Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security},
  pages={91--102},
  year={2017}
}

@inproceedings{munoz2017towards,
  title={Towards poisoning of deep learning algorithms with back-gradient optimization},
  author={Mu{\~n}oz-Gonz{\'a}lez, Luis and Biggio, Battista and Demontis, Ambra and Paudice, Andrea and Wongrassamee, Vasin and Lupu, Emil C and Roli, Fabio},
  booktitle={Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security},
  pages={27--38},
  year={2017}
}

@article{sgandurra2016automated,
  title={Automated dynamic analysis of ransomware: Benefits, limitations and use for detection},
  author={Sgandurra, Daniele and Mu{\~n}oz-Gonz{\'a}lez, Luis and Mohsen, Rabih and Lupu, Emil C},
  journal={arXiv preprint arXiv:1609.03020},
  year={2016}
}

@article{tramer2017space,
  title={The space of transferable adversarial examples},
  author={Tram{\`e}r, Florian and Papernot, Nicolas and Goodfellow, Ian and Boneh, Dan and McDaniel, Patrick},
  journal={arXiv preprint arXiv:1704.03453},
  year={2017}
}

@inproceedings{al2018adversarial,
  title={Adversarial deep learning for robust detection of binary encoded malware},
  author={Al-Dujaili, Abdullah and Huang, Alex and Hemberg, Erik and O’Reilly, Una-May},
  booktitle={2018 IEEE Security and Privacy Workshops (SPW)},
  pages={76--82},
  year={2018},
  organization={IEEE}
}

@inproceedings{gao2018black,
  title={Black-box generation of adversarial text sequences to evade deep learning classifiers},
  author={Gao, Ji and Lanchantin, Jack and Soffa, Mary Lou and Qi, Yanjun},
  booktitle={2018 IEEE Security and Privacy Workshops (SPW)},
  pages={50--56},
  year={2018},
  organization={IEEE}
}

@inproceedings{metsis2006spam,
  title={Spam filtering with naive bayes-which naive bayes?},
  author={Metsis, Vangelis and Androutsopoulos, Ion and Paliouras, Georgios},
  booktitle={CEAS},
  volume={17},
  pages={28--69},
  year={2006},
  organization={Mountain View, CA}
}

@inproceedings{hendler2018detecting,
  title={Detecting malicious PowerShell commands using deep neural networks},
  author={Hendler, Danny and Kels, Shay and Rubin, Amir},
  booktitle={Proceedings of the 2018 on Asia Conference on Computer and Communications Security},
  pages={187--197},
  year={2018}
}

@article{chen2019few,
  title={Few-Features Attack to Fool Machine Learning Models through Mask-Based GAN},
  author={Chen, Feng and Shang, Yunkai and Xu, Bo and Hu, Jincheng},
  journal={arXiv preprint arXiv:1911.06269},
  year={2019}
}

@inproceedings{hashemi2019towards,
  title={Towards Evaluation of NIDSs in Adversarial Setting},
  author={Hashemi, Mohammad J and Cusack, Greg and Keller, Eric},
  booktitle={Proceedings of the 3rd ACM CoNEXT Workshop on Big DAta, Machine Learning and Artificial Intelligence for Data Communication Networks},
  pages={14--21},
  year={2019}
}

@inproceedings{taheri2019extensible,
  title={Extensible android malware detection and family classification using network-flows and api-calls},
  author={Taheri, Laya and Kadir, Andi Fitriah Abdul and Lashkari, Arash Habibi},
  booktitle={2019 International Carnahan Conference on Security Technology (ICCST)},
  pages={1--8},
  year={2019},
  organization={IEEE}
}

@article{alhajjar2020adversarial,
  title={Adversarial Machine Learning in Network Intrusion Detection Systems},
  author={Alhajjar, Elie and Maxwell, Paul and Bastian, Nathaniel D},
  journal={arXiv preprint arXiv:2004.11898},
  year={2020}
}