{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,24]],"date-time":"2026-02-24T18:49:46Z","timestamp":1771958986876,"version":"3.50.1"},"reference-count":6,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2009,10,16]],"date-time":"2009-10-16T00:00:00Z","timestamp":1255651200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGMETRICS Perform. Eval. Rev."],"published-print":{"date-parts":[[2009,10,16]]},"abstract":"<jats:p>We consider systems that use PCA-based detectors obtained from a comprehensive view of the network's traffic to identify anomalies in backbone networks. To assess these detectors' susceptibility to adversaries wishing to evade detection, we present and evaluate short-term and long-term data poisoning schemes that trade-off between poisoning duration and the volume of traffic injected for poisoning. Stealthy Boiling Frog attacks significantly reduce chaff volume,while only moderately increasing poisoning duration. ROC curves provide a comprehensive analysis of PCA-based detection on contaminated data, and show that even small attacks can undermine this otherwise successful anomaly detector.<\/jats:p>","DOI":"10.1145\/1639562.1639592","type":"journal-article","created":{"date-parts":[[2009,10,27]],"date-time":"2009-10-27T13:28:14Z","timestamp":1256650094000},"page":"73-74","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":24,"title":["Stealthy poisoning attacks on PCA-based anomaly detectors"],"prefix":"10.1145","volume":"37","author":[{"given":"Benjamin I.P.","family":"Rubinstein","sequence":"first","affiliation":[{"name":"University of California, Berkeley"}]},{"given":"Blaine","family":"Nelson","sequence":"additional","affiliation":[{"name":"University of California, Berkeley"}]},{"given":"Ling","family":"Huang","sequence":"additional","affiliation":[{"name":"Intel Research, Berkeley"}]},{"given":"Anthony D.","family":"Joseph","sequence":"additional","affiliation":[{"name":"University of California, Berkeley and Intel Research, Berkeley"}]},{"given":"Shing-hon","family":"Lau","sequence":"additional","affiliation":[{"name":"University of California, Berkeley"}]},{"given":"Satish","family":"Rao","sequence":"additional","affiliation":[{"name":"University of California, Berkeley"}]},{"given":"Nina","family":"Taft","sequence":"additional","affiliation":[{"name":"Intel Research, Berkeley"}]},{"given":"J. D.","family":"Tygar","sequence":"additional","affiliation":[{"name":"University of California, Berkeley"}]}],"member":"320","published-online":{"date-parts":[[2009,10,16]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128824"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1015467.1015492"},{"key":"e_1_2_1_3_1","unstructured":"T. Oetiker. The Multi Router Traffic Grapher. http:\/\/oss.oetiker.ch\/mrtg\/ 2008.  T. Oetiker. The Multi Router Traffic Grapher. http:\/\/oss.oetiker.ch\/mrtg\/ 2008."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1254882.1254895"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_23"},{"key":"e_1_2_1_7_1","first-page":"1","article-title":"Network anomography","volume":"05","author":"Zhang Y.","year":"2005","unstructured":"Y. Zhang , Z. Ge , A. Greenberg , and M. Roughan . \" Network anomography \". In Proc. IMC 05 , pages 1 -- 14 , NY, NY, USA, 2005 . Y. Zhang, Z. Ge, A. Greenberg, and M. Roughan. \"Network anomography\". In Proc. IMC 05, pages 1--14, NY, NY, USA, 2005.","journal-title":"Proc. IMC"}],"container-title":["ACM SIGMETRICS Performance Evaluation Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1639562.1639592","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1639562.1639592","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:30:27Z","timestamp":1750253427000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1639562.1639592"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,10,16]]},"references-count":6,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2009,10,16]]}},"alternative-id":["10.1145\/1639562.1639592"],"URL":"https:\/\/doi.org\/10.1145\/1639562.1639592","relation":{},"ISSN":["0163-5999"],"issn-type":[{"value":"0163-5999","type":"print"}],"subject":[],"published":{"date-parts":[[2009,10,16]]},"assertion":[{"value":"2009-10-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}