Adversarial Machine Learning Library.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "##Adversarial Machine Learning Library(Ad-lib)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Introduction\n",
    "\n",
    "### Overview\n",
    "The Adversarial Machine Learning Library(Ad-lib) is a library that models the combats between spam-email attackers and robust spam-filters, using the adversarial machine learning methods. This library includes a data processing units, several attackings algorithms such as Restrained_attacks, Cost_sensitive_attacks, and Coordinate_greedy attackers, a simple learner wrap-ups and several robust learning algorithms.\n",
    "\n",
    "### Dependencies\n",
    "Ad-lib should be operated using Python 3.5 and above. The necessary dependencies are:\n",
    "1. pyyaml\n",
    "2. numpy\n",
    "3. scipy\n",
    "4. sklearn\n",
    "5. cvxpy\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "##Data Processor\n",
    "Raw email data is collected and processed by the EmailDataset class in data_reader.dataset.py, which uses Tfidvectorizer class from sklearn.feature_extraction(please refer to http://scikit-learn.org/stable/modules/generated/sklearn.feature_extraction.text.TfidfVectorizer.html for more details). The EmailDataset also enables battle/prediction loading and saving.\n",
    "\n",
    "###Demo\n",
    "Here we demonstrate: \n",
    "1. the loading of email data \n",
    "2. load the EmailDataset into instances(with a label, and feature vector that contains either binary or real values)\n",
    "3. splitting the data into training instances and testing instances\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from data_reader.dataset import EmailDataset\n",
    "from data_reader.operations import load_dataset\n",
    "\n",
    "dataset = EmailDataset(path='./data_reader/data/raw/trec05p-1/test-400',binary= False,raw=True)\n",
    "training_, testing_ = dataset.split({'train': 60, 'test': 40})\n",
    "training_data = load_dataset(training_)\n",
    "testing_data = load_dataset(testing_)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The EmailDataset() has several parameters: \n",
    "1. binary: a boolean varaiable that specifies whether our processed instances are binary or real value. \n",
    "2. raw: is true if we process raw email data. \n",
    "3. path: specifies the location of our files. \n",
    "4. features (scipy.sparse.csr_matrix, optional): dataset feature matrix \n",
    "5. labels (numpy.ndarray, optional): dataset labels corresponding to the feature matrix.\n",
    "5. strip_accents_,ngram_range_, max_df_, min_df_, max_features_, num_instances: variables used by Tfidvectorizer."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "##Attackers \n",
    "Many attackers assume that we have a basic knowledge of the learner. To succesfully initialize an attacker, we need to know the exact parameters used in the algortihms, as well as the some learners' features. This is sometimes achieved by calling set_adversarial_params.\n",
    "\n",
    "###Attackers Demo\n",
    "The following is a general demo of the Coordinate_Greedy attacker: \n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from sklearn import svm\n",
    "from learners import SimpleLearner\n",
    "import learners as learner\n",
    "from data_reader.dataset import EmailDataset\n",
    "from data_reader.operations import load_dataset\n",
    "from adversaries.coordinate_greedy import CoordinateGreedy\n",
    "\n",
    "#data processing unit\n",
    "#the path is an index of 400 testing samples(raw email data).\n",
    "dataset = EmailDataset(path='./data_reader/data/raw/trec05p-1/test-400',binary=True,raw=True)\n",
    "training_, testing_ = dataset.split({'train': 60, 'test': 40})\n",
    "training_data = load_dataset(training_)\n",
    "testing_data = load_dataset(testing_)\n",
    "\n",
    "#setting the default learner\n",
    "#test simple learner svm\n",
    "learning_model = svm.SVC(probability=True, kernel='linear')\n",
    "learner1 = SimpleLearner(learning_model, training_data)\n",
    "learner1.train()\n",
    "\n",
    "#setting the coordinate_greedy attacker\n",
    "attacker = CoordinateGreedy()\n",
    "attacker.set_adversarial_params(learner=learner1, train_instances=training_data)\n",
    "new_testing_data = attacker.attack(testing_data)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "After the attack, the predictions of our learner model will change because we've disguised some spam emails(postivie instances) into benign\n",
    "instances. We will introduce the accuracy test in the later part."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "\n",
    "\n",
    "###Binary & Coordinate Greedy \n",
    "\n",
    "The binary and coordinate greedy algorithms are a general local search framework in which a single variable (feature) is manipulated at a time. Our implementation follows Bo Li, Yevgeniy Vorobeychik and Xinyun Chen in A General Retraining Framework for Scalable Adversarial Classification. The high-level idea is to randomly choose a feature, and greedily update the feature and increase the attacker's utility. The algorithm is proven to reach a global optimum as the number of iteration increases.\n",
    "\n",
    "Please refer to https://arxiv.org/pdf/1604.02606.pdf for more details.\n",
    "\n",
    "The general parameters of Binary_Greedy and Coordinate_Greedy algorithm includes:\n",
    "1. learner: the learner algorithm(can be an approximation if the learner is not known)\n",
    "2. max_change: maximum number of changes that can be made\n",
    "3. lambda_val: weight in quodratic distances calculation\n",
    "4. epsilon: the limit of difference between transform costs of ,xij+1, xij, and orginal x\n",
    "5. step_size: weight for coordinate descent\n",
    "\n",
    "Note: Binary Greedy algorithm only works for binary-value features, while Coordinate Greedy ony works in real-value settings.\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###Cost Sensitive \n",
    "\n",
    "The cost sensitive attacker is an attacker that modifies malicious data with the consideration of minimizing the attacker cost. It is based on the Aderversarial Classification by Dalvi, Domingos, Mausam, Sanghai, and Verma. (https://homes.cs.washington.edu/~pedrod/papers/kdd04.pdf)\n",
    "\n",
    "Given complete information about initial classifier C and an instance X, adversary finds a feature change strategy A(x) that maximizes its own utility Ua. By modeling the problem as a COP, which can be formulated as an integer linear program, the adversary finds the minimum cost camoflauge (MCC), or smallest cost of feature changes that covers the log odds gap between the classifier classifying the instance as positive and classifying it as a false negative. Only changes instances the classifier classified as positive and that can be changed without costing so much that it outweighs the utility that would be gained by C falsely classifying the instance as negative. \n",
    "\n",
    "The general parameters of Cost_Sensitive algorithm includes:\n",
    "1. Ua: Utility accreued by Adversary when the classifier classifies as yc an instance of class y. \n",
    "       U(-,+) > 0, U(+,+)<0 ,and U(-,-)= U(+,-) = 0\n",
    "2. Vi: Cost of measuring Xi\n",
    "3. Uc: Utility of classifying yc an instance with true class y.\n",
    "       Uc(+,-) <- and Uc(-,+) <0, Uc(+,+) >0, Uc(-,-) >0\n",
    "4. Wi: Cost of changing the ith feature from xi to xi_prime\n",
    "5. learner: the learner algorithm(should be a naive_bayes classifier)\n",
    "6. scenario: can select three spam filtering scenarios: add words, add length, synonym"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###Feature Deletion\n",
    "\n",
    "The feature deletion algorithm is based on Nightmare at Test Time: Robust Learning by Feature Deletion by Amir Globerson\n",
    "  and Sam Roweis.(http://people.csail.mit.edu/gamir/pubs/fdrop_camera_postfix.pdf)\n",
    "  \n",
    "It attempts to model a typical attacker that tries to delete the features with the least weights by sorting the features according to the weights and setting the features' value to zero to fool the learning algorithm. This algorithm only works for the binary-value instances.\n",
    "\n",
    "general parameters includes:\n",
    "1. learner: the learner algorithm. Note: this algorithm requires knowledge about feature weights from the learner.\n",
    "2. num_deletion: the max number that will be deleted in the attack\n",
    "3. all_malicious: if the flag is set, only features that are malicious will be deleted."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###Free Range Attack & Restrained attack\n",
    "\n",
    "The free_range attacker and restrained attacker are generalized attacking algorithms proposed by the Adversarial Support Vector Machine Learning by Yan Zhou, Murat Kantarcioglu,Bhavani Thuraisingham and Bowei Xi.(http://www.utdallas.edu/~muratk/publications/kdd2012.pdf)\n",
    "\n",
    "Both are algorithms that attempt to move the instances' features in a certain direction by some distance that is measured by how harsh the attack is. The algortihms differ in that the free_range attaker assumes that the adversary has the freedom to move anywhere in the feature space, while the restrained_attacker is more conservative. The algorithms can be used for both binary_value instances and real_value instances.\n",
    "\n",
    "general parameters includes:\n",
    "1. f_attack:float (between 0 and 1),determining the agressiveness of the attack.\n",
    "2. xj_min:minimum xj that the feature can have. If not specified, it is calculated by going over all training data.(for free_range only)\n",
    "3. xj_max:maximum xj that the feature can have. If not specified, it is calculated by going over all training data.(for free_range only)\n",
    "4. binary: True means binary features.\n",
    "5. learner: learner algorithm\n",
    "6. type: specify how to find innocuous target\n",
    "7. discount_factor:float(between 0 and 1),determing the data movement of the attack(for restrained only)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###SVM Restrained and SVM Free range learners\n",
    "\n",
    "The SVM Restrained and SVM Free range learners are robust learners algorithms proposed by the Adversarial Support Vector Machine Learning by Yan Zhou, Murat Kantarcioglu,Bhavani Thuraisingham and Bowei Xi.(http://www.utdallas.edu/~muratk/publications/kdd2012.pdf)\n",
    "\n",
    "The learers attempt to solve asymmetric dual problem: 'argmin (1/2)*⎜⎜w⎟⎟^2 + C*∑(xi0)`.\n",
    "While the SVM Restraind learners consider only the aggressiveness of the attacker and deals with Restrained_attack, SVM Free Range can be used under Freerange_attack and provides satisfactory results. By solving the convex optimization, optimal weight and bias matrices of both learners are computed to be used in the linear classification of the instances changed by the adversary.\n",
    "\n",
    "The parameters of SVM_Freerange are:\n",
    "1. c_f (float): aggressiveness assumption c_f ∈ [0.0,1.0]\n",
    "   Note: 0.0 means no attack and 1.0 is most aggressive. Default:0.5\n",
    "2. xmin (float): smallest value that a feature can take. Default:0.0\n",
    "3. xmax (float): largest value that a feature can take. Default:1.0\n",
    "\n",
    "The parameters of SVM_Restrained are:\n",
    "1. c_delta: aggressiveness assumption c_delta ∈ [0.0,1.0]. Default:0.5"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###Good Word Attack\n",
    "\n",
    "The Good Word Attack is based on Good Word Attacks on Statistical Spam Filters by Daniel Lowd and Christopher Meek.\n",
    "(http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.130.9846&rep=rep1&type=pdf)\n",
    "\n",
    "This algorithm tries to measure the weight of each words in the email lists and attempts to create a list of n good words. It starts by randomly picking two messages, each from postivie instances and negative instances. Then it builds a merely negative message and a merely positive message that differ by one words. Then it iterates to find the first-n-words and best-n-words that could be added on to disguise the filters in the passive attack described in the paper. This algorithm only applies to binary-value features.\n",
    "\n",
    "genearl parameters of the algorithms include:\n",
    "1. n: number of words needed\n",
    "2. attack_model_type: choose the best-n or first-n algorithm\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "##Robust Learners\n",
    "\n",
    "The robust learners try to correctly identify the spam emails and benign emails even with the existence of an attacker. We have also included a wrap-up for simple learner in the learners. This allows us to see and compare the efficiency of robust learning algorithms. The simple learner's underlying classfication methods can also be switched by evoking different learners from sklearn.\n",
    "\n",
    "###Robust Learners Demo\n",
    "\n",
    "The following is a demonstration of a simple learner:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "#Simple learner\n",
    "learning_model = svm.SVC(probability=True, kernel='linear')\n",
    "learner1 = SimpleLearner(learning_model, training_data)\n",
    "learner1.train()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The following is a demonstration of a robust learner of SVM_restrained:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from learners.svm_restrained import SVMRestrained\n",
    "learner2= SVMRestrained(training_instances=training_data)\n",
    "learner2.train()\n",
    "learner2.predict(testing_data)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###SVM Restrained and SVM Free range learners\n",
    "\n",
    "The SVM Restrained and SVM Free range learners are robust learners algorithms proposed by the Adversarial Support Vector Machine Learning by Yan Zhou, Murat Kantarcioglu,Bhavani Thuraisingham and Bowei Xi.(http://www.utdallas.edu/~muratk/publications/kdd2012.pdf)\n",
    "\n",
    "The learers attempt to solve asymmetric dual problem: 'argmin (1/2)*⎜⎜w⎟⎟^2 + C*∑(xi0)`.\n",
    "While the SVM Restraind learners consider only the aggressiveness of the attacker and deals with Restrained_attack, SVM Free Range can be used under Freerange_attack and provides satisfactory results. By solving the convex optimization, optimal weight and bias matrices of both learners are computed to be used in the linear classification of the instances changed by the adversary.\n",
    "\n",
    "The parameters of SVM_Freerange are:\n",
    "1. c_f (float): aggressiveness assumption c_f ∈ [0.0,1.0]\n",
    "   Note: 0.0 means no attack and 1.0 is most aggressive. Default:0.5\n",
    "2. xmin (float): smallest value that a feature can take. Default:0.0\n",
    "3. xmax (float): largest value that a feature can take. Default:1.0\n",
    "\n",
    "The parameters of SVM_Restrained are:\n",
    "1. c_delta: aggressiveness assumption c_delta ∈ [0.0,1.0]. Default:0.5"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###Adversary Aware learner\n",
    "\n",
    "The adversary aware learner is based on the Adversarial Classification By Nilesh Dalvi, Pedro Domingos, Mausam, Sumit Sanghai, Deepak Verma. \n",
    "\n",
    "This learner is set based on the assumption that the attacker is a naive bayes based attacker and uses it s optimal strategy to modify test \n",
    "instances. It considers the effect of the attacker into navie_bayes classifier.\n",
    "\n",
    "The general parameters of Adversary_aware learner are:\n",
    "1. attacker: need to be CostSensitive Attacker. Otherwise, we need to import utility of attacker or utility of learner.\n",
    "2. Utility: the utility of attacker or learner(Optional)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "###Learner Retraining\n",
    "\n",
    "The learner is iteratively retrained as we add instances generated by adversarial evasion into training data.  Our specific implementation is based on Bo Li, Yevgeniy Vorobeychik and Xinyun Chen in A General Retraining Framework for Scalable Adversarial Classification. \n",
    "\n",
    "Given a model used to train in the initial stage and access to make calls to adversarial transformation methods, proceeds by\n",
    "classifying the the given set of instances. Allows the adversary to iteratively transform the initial set of bad instances. While the\n",
    "adversary is capable of changing a negative instance to a positive instance, retrains and notifies the adversary of the change.\n",
    "\n",
    "After the improvement finishes, the underlying learner model has been updated, and can be used in the default prediction method.\n",
    "\n",
    "The parameters of Learner_retranining are:\n",
    "1.  base_model:the basic leanrer model \n",
    "2.  training_instances \n",
    "3.  attacker\n",
    "4.  iteration times\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    ""
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3.0
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.1"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 0
}