There are various costs for attackers to manipulate the features of security
classifiers. The costs are asymmetric across features and to the directions of
changes, which cannot be precisely captured by existing cost models based on
$L_p$-norm robustness. In this paper, we utilize such domain knowledge to
increase the attack cost of evading classifiers, specifically, tree ensemble
models that are widely used by security tasks. We propose a new cost modeling
method to capture the feature manipulation cost as constraint, and then we
integrate the cost-driven constraint into the node construction process to
train robust tree ensembles. During the training process, we use the constraint
to find data points that are likely to be perturbed given the feature
manipulation cost, and we use a new robust training algorithm to optimize the
quality of the trees. Our cost-aware training method can be applied to
different types of tree ensembles, including gradient boosted decision trees
and random forest models. Using Twitter spam detection as the case study, our
evaluation results show that we can increase the attack cost by 10.6X compared
to the baseline. Moreover, our robust training method using cost-driven
constraint can achieve higher accuracy, lower false positive rate, and stronger
cost-aware robustness than the state-of-the-art training method using
$L_\infty$-norm cost model. Our code is available at
this https URL

该论文提出了一种基于成本驱动的约束来训练鲁棒性决策树模型的成本建模方法，在 Twitter 垃圾邮件检测等场景中显示出比现有方法更高的准确性、更低的误报率和更强的成本感知鲁棒性。