Search

Adversarial deep learning is the field of study which analyzes deep learning in the presence of adversarial entities. This entails understanding the capabilities, objectives, and attack scenarios available to the adversary to develop defensive mechanisms and avenues of robustness available to the benign parties. Understanding this facet of deep learning helps us improve the safety of the deep learning systems against external threats from adversaries. However, of equal importance, this perspective also helps the industry understand and respond to critical failures in the technology. The expectation of future success has driven significant interest in developing this technology broadly. Adversarial deep learning stands as a balancing force to ensure these developments remain grounded in the real-world and proceed along a responsible trajectory. Recently, the growth of deep learning has begun intersecting with the computer hardware domain to improve performance and efficiency for resource constrained application domains. The works investigated in this dissertation constitute our pioneering efforts in migrating adversarial deep learning into the hardware domain alongside its parent field of research.

Sensors have been widely used in robots, Internet of Things and automobiles. The data sent from sensor is used to detect objects, measure environment and make decision or conclusion. Since the sensor data is so critical for the system, the data from sensors must be authenticated before it is processed. The obvious approach is to use encryption. But this approach is not suitable for real-time streaming and may fail because of the noise or lossy compression. Besides, the receiver side must decrypt the data before displaying it and the encryption and decryption takes time when the data is huge, e.g. video streaming. In this paper, we propose an approach which combines encryption and watermarking to authenticate the sensor data. It has two phases and is spatial, invisible and blind-detected. We designed the approach carefully and try to achieve real-time performance. The experiment shows it is robust and fast.

Safeguarding creative content in a digital form has become increasingly difficult. It is progressively easier to copy, modify and redistribute digital media, which causes great declines in business profits. For example, the International Federation of the Phonographic Industry estimates that in 2001 the worldwide sales of pirated music CDs were 475 million US dollars. While a large amount of time and money is committed to creating intellectual property, legal means have not proven to be sufficient for the protection of this property. Digital watermarking is a steganographic technique that has been proposed as a possible solution to this problem. A digital watermark hides embedded information about the origin, status, owner and/or destination of the data, often without the knowledge of the viewer or user. This dissertation examines a technique for digital watermarking which utilizes properties of the Discrete Wavelet Transform (DWT). Research has been done in this field, but which wavelet family is superior is not adequately addressed. This dissertation studies the influence of the wavelet family when using a blind, nonvisible watermark in digital media. The digital watermarking algorithm uses a database of multiple images with diverse properties. Various watermarks are embedded. Eight different families of wavelets with dissimilar properties are compared. How effective is each wavelet? To objectively measure the success of the algorithm, the influence of the mother wavelet, the imperceptibility of the embedded watermark and the readability of the extracted watermark, the Peak Signal-to-Noise Ratio and the Image Quality Index for each wavelet family and image are obtained. Two common categories of digital watermarking attacks are removing the watermark and rendering the watermark undetectable. To simulate and examine the effect of attacks on the images, noise is added to the image data. Also, to test the effect of reducing an image in size, each image containing the embedded watermark is compressed. The dissertation asks the questions: “Is the wavelet family chosen to implement the algorithm for a blind, nonvisible watermark in digital images of consequence? If so, which family is superior?” This dissertation conclusively shows that the Haar transform is the best for blind, non-visible digital watermarking.

The purpose of the research is to study the active timing based techniques used for attack attribution through stepping stone computers, where attackers sequentially connect through multiple intermediate hosts to hide their traces. The difficulties of tracing back such attacks come from not only the normal operations of networks and stepping stones, but also the intentional interference of the attackers. Encryption, repacketization, timing perturbation, and meaningless chaff packets could all significantly affect attribution result. In this thesis, I have investigated multiple research problems related to the active timing based attack attribution. First, I present a correlation scheme that can successfully identify stepping stone connections even if both chaff packets and timing perturbations are introduced by attackers simultaneously. In this scheme, we enhance the existing active watermark schemes and focus on identifying the possible corresponding packets in the flows to be correlated. We develop a series of algorithms to effectively and efficiently decode the embedded watermarks when chaff packets are inserted, and use theoretical analysis and experimental evaluation to validate these algorithms. We also investigate how our correlation scheme can be used to deal with the countermeasure when stepping stone connections are split and then merged, and propose an approach to mitigate the problem of packet loss and retransmission. Next, I present the research on the secrecy issues of the quantization based watermark scheme. We propose an attacking approach based on analyzing the one-way packet transit delays between adjacent stepping stones. Our attack contains several techniques that can infer important watermark parameters and remove/duplicate the embedded watermarks. These techniques enable an attacker to defeat the watermarking system in certain cases by removing watermarks from the stepping stone connections, or replicating watermarks to non-stepping stone connections. We have also developed techniques to detect in realtime whether a stepping stone connection is being watermarked for trace-back purpose. Experiments using real-world data are performed and the results demonstrate that for the quantization based watermark scheme, (1) embedded watermarks can be successfully recovered and duplicated when the watermark parameters are not chosen carefully, and (2) the watermark existence in a network flow can be quickly detected. Third, I present the research result on the secrecy of the probabilistic watermark scheme. Following the ideas of analyzing the quantization based watermark scheme, we propose attacks that can detect the watermark existence, recovery important watermark parameters, and remove/duplicate watermark to effectively defeat the watermark scheme. We also investigate the problem of realtime watermark recovery and removal, and propose an online attacking algorithm. Experiments are then conducted to validate our analysis. Finally, I investigate the secrecy issues of the interval based watermark scheme and propose several security enhancements to deter possible timing analysis attacks. I demonstrate that the interval based scheme is not robust against several attacks we construct, which can quickly detect watermark existence, recover watermark parameters and defeat the watermark scheme. Through experiment, we validate that the improved scheme with security enhancements will significantly increase the resistance to all of these severe attacks.