{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T07:18:02Z","timestamp":1779175082285,"version":"3.51.4"},"reference-count":97,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2021,11,30]],"date-time":"2021-11-30T00:00:00Z","timestamp":1638230400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,11,30]],"date-time":"2021-11-30T00:00:00Z","timestamp":1638230400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1909516"],"award-info":[{"award-number":["1909516"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2022,1]]},"DOI":"10.1007\/s10664-021-10064-8","type":"journal-article","created":{"date-parts":[[2021,11,30]],"date-time":"2021-11-30T17:21:10Z","timestamp":1638292870000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":12,"title":["Omni: automated ensemble with unexpected models against adversarial evasion attack"],"prefix":"10.1007","volume":"27","author":[{"given":"Rui","family":"Shu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tianpei","family":"Xia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Laurie","family":"Williams","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5040-3196","authenticated-orcid":false,"given":"Tim","family":"Menzies","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2021,11,30]]},"reference":[{"key":"10064_CR1","doi-asserted-by":"crossref","unstructured":"Arp D, Spreitzenbarth M, Hubner M, Gascon H, Rieck K, Siemens C (2014) Drebin: Effective and explainable detection of android malware in your pocket. In: Ndss, vol 14, pp 23\u201326","DOI":"10.14722\/ndss.2014.23247"},{"key":"10064_CR2","unstructured":"Athalye A, Carlini N, Wagner DA (2018) Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: Dy JG, Krause A (eds) Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsma\u0307ssan, Stockholm, Sweden, July 10-15, 2018"},{"key":"10064_CR3","doi-asserted-by":"crossref","unstructured":"Barreno M, Nelson B, Sears R, Joseph AD, Tygar JD (2006) Can machine learning be secure?. In: Proceedings of the 2006 ACM Symposium on Information, computer and communications security, pp 16\u201325","DOI":"10.1145\/1128817.1128824"},{"issue":"Feb","key":"10064_CR4","first-page":"281","volume":"13","author":"J Bergstra","year":"2012","unstructured":"Bergstra J, Bengio Y (2012) Random search for hyper-parameter optimization. J Mach Learn Res 13(Feb):281\u2013305","journal-title":"J Mach Learn Res"},{"key":"10064_CR5","unstructured":"Bergstra JS, Bardenet R, Bengio Y, K\u00e9gl B (2011) Algorithms for hyper-parameter optimization. In: Advances in neural information processing systems. pp 2546\u20132554"},{"issue":"1","key":"10064_CR6","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3301285","volume":"52","author":"P Bhat","year":"2019","unstructured":"Bhat P, Dutta K (2019) A survey on various threats and current state of security in android platform. ACM Comput Surv (CSUR) 52(1):1\u201335","journal-title":"ACM Comput Surv (CSUR)"},{"key":"10064_CR7","doi-asserted-by":"publisher","first-page":"317","DOI":"10.1016\/j.patcog.2018.07.023","volume":"84","author":"B Biggio","year":"2018","unstructured":"Biggio B, Roli F (2018) Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recogn 84:317\u2013331","journal-title":"Pattern Recogn"},{"issue":"1-4","key":"10064_CR8","doi-asserted-by":"publisher","first-page":"27","DOI":"10.1007\/s13042-010-0007-7","volume":"1","author":"B Biggio","year":"2010","unstructured":"Biggio B, Fumera G, Roli F (2010) Multiple classifier systems for robust classifier design in adversarial environments. Int J Mach Learn Cybern 1 (1-4):27\u201341","journal-title":"Int J Mach Learn Cybern"},{"key":"10064_CR9","doi-asserted-by":"crossref","unstructured":"Biggio B, Corona I, Maiorca D, Nelson B, \u0160rndi\u0107 N, Laskov P, Giacinto G, Roli F (2013a) Evasion attacks against machine learning at test time. In: Joint European conference on machine learning and knowledge discovery in databases. Springer, pp 387\u2013402","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"10064_CR10","doi-asserted-by":"crossref","unstructured":"Biggio B, Pillai I, Rota Bul\u00f2 S, Ariu D, Pelillo M, Roli F (2013b) Is data clustering in adversarial settings secure?. In: Proceedings of the 2013 ACM workshop on Artificial intelligence and security. pp 87\u201398","DOI":"10.1145\/2517312.2517321"},{"key":"10064_CR11","doi-asserted-by":"crossref","unstructured":"Biggio B, Rieck K, Ariu D, Wressnegger C, Corona I, Giacinto G, Roli F (2014) Poisoning behavioral malware clustering. In: Dimitrakakis C, Mitrokotsa A, Rubinstein BIP, Ahn G (eds) Proceedings of the 2014 workshop on artificial intelligent and security workshop, AISec 2014, Scottsdale, AZ, USA, November 7, 2014, pp 27\u201336","DOI":"10.1145\/2666652.2666666"},{"key":"10064_CR12","unstructured":"Bissell K, LaSalle R, Dal Cin P (2019) The cost of cybercrime\u2014ninth annual cost of cybercrime study. Tech. rep., Technical report, Accenture 2019"},{"key":"10064_CR13","doi-asserted-by":"crossref","unstructured":"Canali D, Cova M, Vigna G, Kruegel C (2011) Prophiler: a fast filter for the large-scale detection of malicious web pages. In: Proceedings of the 20th international conference on World wide web, pp 197\u2013206","DOI":"10.1145\/1963405.1963436"},{"key":"10064_CR14","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017a) Towards evaluating the robustness of neural networks. In: 2017 ieee symposium on security and privacy (sp), IEEE, pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"10064_CR15","unstructured":"Carlini N, Wagner DA (2016) Defensive distillation is not robust to adversarial examples. arXiv:1607.04311"},{"key":"10064_CR16","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner DA (2017b) Adversarial examples are not easily detected: Bypassing ten detection methods. In: Thuraisingham BM, Biggio B, Freeman DM, Miller B, Sinha A (eds) Proceedings of the 10th ACM workshop on artificial intelligence and security, AISec@CCS 2017, Dallas, TX, USA, November 3, 2017. pp 3\u201314","DOI":"10.1145\/3128572.3140444"},{"key":"10064_CR17","unstructured":"Carlini N, Athalye A, Papernot N, Brendel W, Rauber J, Tsipras D, Goodfellow I, Madry A, Kurakin A (2019) On evaluating adversarial robustness. arXiv:190206705"},{"key":"10064_CR18","unstructured":"Chang C, Wenming S, Wei Z, Changki P, Kontovas C (2019) Evaluating cybersecurity risks in the maritime industry: a literature review. In: Proceedings of the international association of Maritime Universities (IAMU) Conference"},{"key":"10064_CR19","doi-asserted-by":"publisher","first-page":"326","DOI":"10.1016\/j.cose.2017.11.007","volume":"73","author":"S Chen","year":"2018","unstructured":"Chen S, Xue M, Fan L, Hao S, Xu L, Zhu H, Li B (2018) Automated poisoning attacks and defenses in malware detection systems: An adversarial machine learning approach. Comput Secur 73:326\u2013344","journal-title":"Comput Secur"},{"key":"10064_CR20","unstructured":"Contagio (2020) Contagio Malware Dump. http:\/\/contagiodump.blogspot.com\/, [Online; accessed 6th-September-2020]"},{"issue":"3","key":"10064_CR21","first-page":"273","volume":"20","author":"C Cortes","year":"1995","unstructured":"Cortes C, Vapnik V (1995) Support-vector networks. Mach Learn 20(3):273\u2013297","journal-title":"Mach Learn"},{"key":"10064_CR22","unstructured":"Canadian Institute for Cybersecurity (2009) NSL-KDD dataset. https:\/\/www.unb.ca\/cic\/datasets\/nsl.html, [Online; accessed 6th-September-2020]"},{"key":"10064_CR23","doi-asserted-by":"crossref","unstructured":"Dalvi N, Domingos P, Sanghai S, Verma D (2004) Adversarial classification. In: Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining. pp 99\u2013108","DOI":"10.1145\/1014052.1014066"},{"key":"10064_CR24","doi-asserted-by":"crossref","unstructured":"Dang H, Huang Y, Chang EC (2017) Evading classifiers by morphing in the dark. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. pp 119\u2013133","DOI":"10.1145\/3133956.3133978"},{"key":"10064_CR25","unstructured":"Demontis A, Melis M, Pintor M, Jagielski M, Biggio B, Oprea A, Nita-Rotaru C, Roli F (2019) Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In: 28th {USENIX} Security Symposium ({USENIX} security, vol 19, pp 321\u2013338"},{"key":"10064_CR26","unstructured":"Dietterich TG, et al. (2002) Ensemble learning. In: The handbook of brain theory and neural networks, vol 2, pp 110\u2013125"},{"key":"10064_CR27","doi-asserted-by":"crossref","unstructured":"Eshete B, Villafiorita A, Weldemariam K (2012) Binspect: Holistic analysis and detection of malicious web pages. In: International conference on security and privacy in communication systems. Springer, pp 149\u2013166","DOI":"10.1007\/978-3-642-36883-7_10"},{"key":"10064_CR28","unstructured":"Farnia F, Zhang JM, Tse D (2019) Generalizable adversarial training via spectral normalization. In: 7th international conference on learning representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019"},{"key":"10064_CR29","doi-asserted-by":"crossref","unstructured":"Feurer M, Hutter F (2019) Hyperparameter optimization. In: Automated machine learning. Springer, Cham, pp 3\u201333","DOI":"10.1007\/978-3-030-05318-5_1"},{"key":"10064_CR30","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: 3rd international conference on learning representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015"},{"key":"10064_CR31","doi-asserted-by":"crossref","unstructured":"Gower JC (1971) A general coefficient of similarity and some of its properties. Biometrics: 857\u2013871","DOI":"10.2307\/2528823"},{"key":"10064_CR32","doi-asserted-by":"crossref","unstructured":"Grosse K, Papernot N, Manoharan P, Backes M, McDaniel PD (2016) Adversarial perturbations against deep neural networks for malware classification. arXiv:1606.04435","DOI":"10.1109\/SP.2016.41"},{"key":"10064_CR33","unstructured":"Grosse K, Manoharan P, Papernot N, Backes M, McDaniel PD (2017a) On the (statistical) detection of adversarial examples. arXiv:1702.06280"},{"key":"10064_CR34","doi-asserted-by":"crossref","unstructured":"Grosse K, Papernot N, Manoharan P, Backes M, McDaniel P (2017b) Adversarial examples for malware detection. In: European symposium on research in computer security. Springer, pp 62\u201379","DOI":"10.1007\/978-3-319-66399-9_4"},{"key":"10064_CR35","unstructured":"He W, Wei J, Chen X, Carlini N, Song D (2017) Adversarial example defense: Ensembles of weak defenses are not strong. In: 11th {USENIX} workshop on offensive technologies ({WOOT} 17)"},{"key":"10064_CR36","doi-asserted-by":"crossref","unstructured":"Hendler D, Kels S, Rubin A (2018) Detecting malicious powershell commands using deep neural networks. In: Proceedings of the 2018 on Asia conference on computer and communications security. pp 187\u2013197","DOI":"10.1145\/3196494.3196511"},{"issue":"5","key":"10064_CR37","doi-asserted-by":"publisher","first-page":"1323","DOI":"10.1016\/j.patcog.2012.10.021","volume":"46","author":"D Hern\u00e1ndez-Lobato","year":"2013","unstructured":"Hern\u00e1ndez-Lobato D, Mart\u00ednez-Mu\u00f1Oz G, Su\u00e1rez A (2013) How large should ensembles of classifiers be? Pattern Recognit 46(5):1323\u20131336","journal-title":"Pattern Recognit"},{"key":"10064_CR38","unstructured":"Hu W, Tan Y (2017) Generating adversarial malware examples for black-box attacks based on gan. arXiv:170205983"},{"issue":"5","key":"10064_CR39","doi-asserted-by":"publisher","first-page":"973","DOI":"10.1016\/j.jcss.2014.02.005","volume":"80","author":"J Jang-Jaccard","year":"2014","unstructured":"Jang-Jaccard J, Nepal S (2014) A survey of emerging threats in cybersecurity. J Comput Syst Sci 80(5):973\u2013993","journal-title":"J Comput Syst Sci"},{"key":"10064_CR40","doi-asserted-by":"crossref","unstructured":"Juuti M, Szyller S, Marchal S, Asokan N (2019) Prada: protecting against dnn model stealing attacks. In: 2019 IEEE European symposium on security and privacy (EuroS&P). IEEE, pp 512\u2013527","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"10064_CR41","unstructured":"Kantchelian A, Tygar JD, Joseph A (2016) Evasion and hardening of tree ensemble classifiers. In: International conference on machine learning. pp 2387\u20132396"},{"key":"10064_CR42","unstructured":"Kariyappa S, Qureshi MK (2019) Improving adversarial robustness of ensembles with diversity training. arXiv:190109981"},{"key":"10064_CR43","doi-asserted-by":"crossref","unstructured":"Khasawneh KN, Abu-Ghazaleh N, Ponomarev D, Yu L (2017) Rhmd: evasion-resilient hardware malware detectors. In: Proceedings of the 50th Annual IEEE\/ACM international symposium on microarchitecture. pp 315\u2013327","DOI":"10.1145\/3123939.3123972"},{"key":"10064_CR44","unstructured":"Kurakin A, Goodfellow IJ, Bengio S (2017) Adversarial examples in the physical world. In: 5th international conference on learning representations, ICLR 2017, Toulon, France, April 24-26, 2017, Workshop Track Proceedings"},{"key":"10064_CR45","doi-asserted-by":"publisher","first-page":"46084","DOI":"10.1109\/ACCESS.2018.2866197","volume":"6","author":"H Kwon","year":"2018","unstructured":"Kwon H, Kim Y, Park KW, Yoon H, Choi D (2018) Multi-targeted adversarial example in evasion attack on deep neural network. IEEE Access 6:46084\u201346096","journal-title":"IEEE Access"},{"issue":"3","key":"10064_CR46","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1109\/MSP.2011.67","volume":"9","author":"R Langner","year":"2011","unstructured":"Langner R (2011) Stuxnet: Dissecting a cyberwarfare weapon. IEEE Secur Privacy 9(3):49\u201351","journal-title":"IEEE Secur Privacy"},{"key":"10064_CR47","doi-asserted-by":"crossref","unstructured":"Lashkari AH, Kadir AFA, Taheri L, Ghorbani AA (2018) Toward developing a systematic approach to generate benchmark android malware datasets and classification, IEEE","DOI":"10.1109\/CCST.2018.8585560"},{"key":"10064_CR48","unstructured":"Laskov P et al (2014) Practical evasion of a learning-based classifier: A case study. In: 2014 IEEE symposium on security and privacy. IEEE, pp 197\u2013211"},{"key":"10064_CR49","doi-asserted-by":"crossref","unstructured":"Liu C, Li B, Vorobeychik Y, Oprea A (2017) Robust linear regression against training data poisoning. In: Proceedings of the 10th ACM workshop on artificial intelligence and security. pp 91\u2013102","DOI":"10.1145\/3128572.3140447"},{"key":"10064_CR50","doi-asserted-by":"crossref","unstructured":"Lowd D, Meek C (2005a) Adversarial learning. In: Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining. pp 641\u2013647","DOI":"10.1145\/1081870.1081950"},{"key":"10064_CR51","unstructured":"Lowd D, Meek C (2005b) Good word attacks on statistical spam filters. In: CEAS 2005"},{"key":"10064_CR52","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2018) Towards deep learning models resistant to adversarial attacks. In: 6th international conference on learning representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings"},{"key":"10064_CR53","doi-asserted-by":"crossref","unstructured":"Maiorca D, Corona I, Giacinto G (2013) Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious pdf files detection. In: Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security. pp 119\u2013130","DOI":"10.1145\/2484313.2484327"},{"key":"10064_CR54","doi-asserted-by":"crossref","unstructured":"Monshizadeh M, Yan Z (2014) Security related data mining. In: 2014 IEEE international conference on computer and information technology. IEEE, pp 775\u2013782","DOI":"10.1109\/CIT.2014.130"},{"key":"10064_CR55","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli SM, Fawzi A, Frossard P (2016) Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 2574\u20132582","DOI":"10.1109\/CVPR.2016.282"},{"key":"10064_CR56","unstructured":"Morgan S (2019) Official annual cybercrime report, Sausalito, Cybersecurity Ventures"},{"key":"10064_CR57","doi-asserted-by":"crossref","unstructured":"Mu\u00f1oz-Gonz\u00e1lez L, Biggio B, Demontis A, Paudice A, Wongrassamee V, Lupu EC, Roli F (2017) Towards poisoning of deep learning algorithms with back-gradient optimization. In: Proceedings of the 10th ACM workshop on artificial intelligence and security. pp 27\u201338","DOI":"10.1145\/3128572.3140451"},{"key":"10064_CR58","unstructured":"Na T, Ko JH, Mukhopadhyay S (2018) Cascade adversarial machine learning regularized with a unified embedding. In: 6th international conference on learning representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings, OpenReview.net"},{"key":"10064_CR59","first-page":"935","volume":"75","author":"DW Opderbeck","year":"2015","unstructured":"Opderbeck DW (2015) Cybersecurity, data breaches, and the economic loss doctrine in the payment card industry. Md L Rev 75:935","journal-title":"Md L Rev"},{"key":"10064_CR60","unstructured":"Pang T, Xu K, Du C, Chen N, Zhu J (2019) Improving adversarial robustness via promoting ensemble diversity. In: Chaudhuri K, Salakhutdinov R (eds) Proceedings of the 36th international conference on machine learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA, PMLR, Proceedings of Machine Learning Research, vol 97, pp 4970\u20134979"},{"key":"10064_CR61","unstructured":"Papernot N, Faghri F, Carlini N, Goodfellow I, Feinman R, Kurakin A, Xie C, Sharma Y, Brown T, Roy A et al (2016a) Technical report on the cleverhans v2. 1.0 adversarial examples library. arXiv:161000768"},{"key":"10064_CR62","unstructured":"Papernot N, McDaniel P, Goodfellow I (2016b) Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv:160507277"},{"key":"10064_CR63","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Jha S, Fredrikson M, Celik ZB, Swami A (2016c) The limitations of deep learning in adversarial settings. In: 2016 IEEE European symposium on security and privacy (EuroS&P). IEEE, pp 372\u2013387","DOI":"10.1109\/EuroSP.2016.36"},{"key":"10064_CR64","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Wu X, Jha S, Swami A (2016d) Distillation as a defense to adversarial perturbations against deep neural networks. In: 2016 IEEE symposium on security and privacy (SP), IEEE, pp 582\u2013597","DOI":"10.1109\/SP.2016.41"},{"key":"10064_CR65","unstructured":"Papernot N, McDaniel PD, Goodfellow IJ (2016e) Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv:1605.07277"},{"key":"10064_CR66","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Goodfellow I, Jha S, Celik ZB, Swami A (2017a) Practical black-box attacks against machine learning. In: Proceedings of the 2017 ACM on Asia conference on computer and communications security. pp 506\u2013519","DOI":"10.1145\/3052973.3053009"},{"key":"10064_CR67","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel PD, Goodfellow IJ, Jha S, Celik ZB, Swami A (2017b) Practical black-box attacks against machine learning. In: Karri R, Sinanoglu O, Sadeghi A, Yi X (eds) Proceedings of the 2017 ACM on Asia conference on computer and communications security, AsiaCCS 2017, Abu Dhabi, United Arab Emirates, April 2-6, 2017, pp 506\u2013519","DOI":"10.1145\/3052973.3053009"},{"key":"10064_CR68","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Sinha A, Wellman MP (2018) Sok: Security and privacy in machine learning. In: 2018 IEEE European symposium on security and privacy (EuroS&P). IEEE, pp 399\u2013414","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"10064_CR69","unstructured":"Queenie Wong LH (2018) Facebook says hackers stole personal info on 29 million users. https:\/\/www.cnet.com\/news\/facebook-e-mails-phone-numbers-and-other-personal-information-accessed-during-breach\/, [Online; accessed 6th-July-2021]"},{"key":"10064_CR70","unstructured":"Rigaki M, Garcia S (2020) A survey of privacy attacks in machine learning. arXiv:200707646"},{"key":"10064_CR71","doi-asserted-by":"crossref","unstructured":"Ro\u0161kot M, Wanasika I, Kroupova ZK (2020) Cybercrime in europe: surprising results of an expensive lapse. J Bus Strat","DOI":"10.1108\/JBS-12-2019-0235"},{"issue":"2","key":"10064_CR72","doi-asserted-by":"publisher","first-page":"45","DOI":"10.12948\/issn14531305\/23.2.2019.05","volume":"23","author":"S Sechel","year":"2019","unstructured":"Sechel S (2019) A comparative assessment of obfuscated ransomware detection methods. Informatica Economica 23(2):45\u201362","journal-title":"Informatica Economica"},{"key":"10064_CR73","unstructured":"Shafahi A, Najibi M, Ghiasi A, Xu Z, Dickerson JP, Studer C, Davis LS, Taylor G, Goldstein T, d\u2019Alch\u0117-Buc F, Fox EB, Garnett R (2019) Adversarial training for free!. In: Wallach H M, Larochelle H, Beygelzimer A (eds) Advances in neural information processing systems 32: Annual conference on neural information processing systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp 3353\u20133364"},{"issue":"1","key":"10064_CR74","doi-asserted-by":"publisher","first-page":"148","DOI":"10.1109\/JPROC.2015.2494218","volume":"104","author":"B Shahriari","year":"2015","unstructured":"Shahriari B, Swersky K, Wang Z, Adams RP, De Freitas N (2015) Taking the human out of the loop: A review of bayesian optimization. Proc IEEE 104(1):148\u2013175","journal-title":"Proc IEEE"},{"key":"10064_CR75","doi-asserted-by":"crossref","unstructured":"Sharafaldin I, Lashkari AH, Ghorbani AA (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: ICISSP, pp 108\u2013116","DOI":"10.5220\/0006639801080116"},{"key":"10064_CR76","unstructured":"Smith R (2001) Adobe pdf files can be used as virus carriers. http:\/\/lwn.net\/2001\/0809\/a\/adobe-pdf-vul.php3"},{"key":"10064_CR77","doi-asserted-by":"crossref","unstructured":"Smutz C, Stavrou A (2012) Malicious pdf detection using metadata and structural features. In: Proceedings of the 28th annual computer security applications conference. pp 239\u2013248","DOI":"10.1145\/2420950.2420987"},{"key":"10064_CR78","doi-asserted-by":"crossref","unstructured":"Smutz C, Stavrou A (2016) When a tree falls: Using diversity in ensemble classifiers to identify evasion in malware detectors. In: NDSS","DOI":"10.14722\/ndss.2016.23078"},{"key":"10064_CR79","unstructured":"Snoek J, Larochelle H, Adams RP (2012) Practical bayesian optimization of machine learning algorithms. In: Advances in neural information processing systems. pp 2951\u20132959"},{"issue":"4","key":"10064_CR80","doi-asserted-by":"publisher","first-page":"341","DOI":"10.1023\/A:1008202821328","volume":"11","author":"R Storn","year":"1997","unstructured":"Storn R, Price K (1997) Differential evolution\u2013a simple and efficient heuristic for global optimization over continuous spaces. J Global Optim 11(4):341\u2013359","journal-title":"J Global Optim"},{"key":"10064_CR81","unstructured":"Strauss T, Hanselmann M, Junginger A, Ulmer H (2017) Ensemble methods as a defense to adversarial perturbations against deep neural networks. arXiv:1709.03423"},{"key":"10064_CR82","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2013) Intriguing properties of neural networks. arXiv:13126199"},{"key":"10064_CR83","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow IJ, Fergus R (2014) Intriguing properties of neural networks. In: Bengio Y, LeCun Y (eds) 2nd international conference on learning representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings"},{"key":"10064_CR84","doi-asserted-by":"crossref","unstructured":"Tavallaee M, Bagheri E, Lu W, Ghorbani AA (2009) A detailed analysis of the kdd cup 99 data set. In: 2009 IEEE symposium on computational intelligence for security and defense applications, IEEE, pp 1\u20136","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"10064_CR85","unstructured":"Tram\u00e8r F, Zhang F, Juels A, Reiter MK, Ristenpart T (2016) Stealing machine learning models via prediction apis. In: 25th {USENIX} Security Symposium ({USENIX} security, vol 16, pp 601\u2013618"},{"key":"10064_CR86","unstructured":"Tram\u00e8r F, Kurakin A, Papernot N, Goodfellow IJ, Boneh D, McDaniel PD (2018) Ensemble adversarial training: Attacks and defenses. In: 6th international conference on learning representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018"},{"key":"10064_CR87","unstructured":"Tram\u00e8r F, Carlini N, Brendel W, Madry A (2020) On adaptive attacks to adversarial example defenses. In: Larochelle H, Ranzato M, Hadsell R, Balcan M, Lin H (eds) Advances in neural information processing systems 33: annual conference on neural information processing systems 2020, NeurIPS 2020, December 6-12, 2020, virtual"},{"key":"10064_CR88","unstructured":"North Carolina State University (2020) ARC: A Root Cluster for Research into Scalable Computer Systems. https:\/\/arcb.csc.ncsu.edu\/mueller\/cluster\/arc\/, [Online; accessed 6th-September-2020]"},{"key":"10064_CR89","doi-asserted-by":"crossref","unstructured":"Valiant L (1984) A theory of the learnable. Commun ACM (27)","DOI":"10.1145\/1968.1972"},{"key":"10064_CR90","unstructured":"Xiao H, Biggio B, Brown G, Fumera G, Eckert C, Roli F (2015) Is feature selection secure against training data poisoning?. In: Bach FR, Blei DM (eds) Proceedings of the 32nd international conference on machine learning, ICML 2015, Lille, France, 6-11 July 2015, JMLR Workshop and Conference Proceedings, vol 37, pp 1689\u20131698"},{"key":"10064_CR91","unstructured":"Xu W, Qi Y, Evans D (2016) Automatically evading classifiers. In: Proceedings of the 2016 network and distributed systems symposium, vol 10"},{"key":"10064_CR92","unstructured":"Yin X, Kolouri S, Rohde GK (2019) Adversarial example detection and classification with asymmetrical adversarial training. arXiv:190511475"},{"key":"10064_CR93","doi-asserted-by":"crossref","unstructured":"Young SR, Rose DC, Karnowski TP, Lim SH, Patton RM (2015) Optimizing deep learning hyper-parameters through an evolutionary algorithm. In: Proceedings of the workshop on machine learning in high-performance computing environments. pp 1\u20135","DOI":"10.1145\/2834892.2834896"},{"issue":"3","key":"10064_CR94","doi-asserted-by":"publisher","first-page":"766","DOI":"10.1109\/TCYB.2015.2415032","volume":"46","author":"F Zhang","year":"2015","unstructured":"Zhang F, Chan PP, Biggio B, Yeung DS, Roli F (2015) Adversarial feature selection against evasion attacks. IEEE Trans Cybern 46(3):766\u2013777","journal-title":"IEEE Trans Cybern"},{"key":"10064_CR95","doi-asserted-by":"crossref","unstructured":"Zhang F, Wang Y, Wang H (2018) Gradient correlation: Are ensemble classifiers more robust against evasion attacks in practical settings?. In: International conference on web information systems engineering. Springer, pp 96\u2013110","DOI":"10.1007\/978-3-030-02922-7_7"},{"key":"10064_CR96","doi-asserted-by":"crossref","unstructured":"Zhang F, Wang Y, Liu S, Wang H (2020) Decision-based evasion attacks on tree ensemble classifiers. World Wide Web: 1\u201321","DOI":"10.1007\/s11280-020-00813-y"},{"key":"10064_CR97","doi-asserted-by":"crossref","unstructured":"Zhou Y, Kantarcioglu M, Thuraisingham B, Xi B (2012) Adversarial support vector machine learning. In: Proceedings of the 18th ACM SIGKDD international conference on Knowledge discovery and data mining. pp 1059\u20131067","DOI":"10.1145\/2339530.2339697"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-021-10064-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10664-021-10064-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-021-10064-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,1,26]],"date-time":"2022-01-26T08:12:44Z","timestamp":1643184764000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10664-021-10064-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,30]]},"references-count":97,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2022,1]]}},"alternative-id":["10064"],"URL":"https:\/\/doi.org\/10.1007\/s10664-021-10064-8","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,11,30]]},"assertion":[{"value":"11 October 2021","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"30 November 2021","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"26"}}