I’m standing high on the Cathedral of Notre Dame, looking down over the medieval cityscape of Rouen, Normandy. It is late May, 1431: trees blossom in gardens, the fields across the Seine are lush and green, ships cluster either side of the Pont Mathilde, where cargo is hauled up the riverbanks. I can see the Abbey of Saint Ouen, caged in wooden scaffolding, where the tower and nave are under construction. To the north, I see the squat, round towers of Rouen Castle, with the crenellations of the city wall behind them; towards the west, near the river, the English are hard at work on their new fortress—later to be known as the Vieux Palais. Smoke drifts up from handsome, four-storey timbered houses in the Rue Grand-Pont, where a small crowd has gathered to watch a group of masked entertainers perform in the street. I can hear the chatter of children playing in the Cour d’Albane cloister below me, bells chiming in the distance, the ring of masons’ tools as they work the new Gothic arches at the top of the Saint Romain tower.

Taking in this panoramic view of the city, I recall the startling description of Rouen in the twelfth-century Ecclesiasti-cal History of Orderic Vitalis. After a local revolt against Robert, Duke of Normandy, in 1090, the rebel leader Conan is taken to the top of the ducal tower by Robert's brother Henry (the future Henry I of England), to be shown the wealth and beauty of the city which he has coveted.

This chapter asks questions about how we might begin to recover and interpret lost or absent medieval cityscapes, and models possible approaches through the digital and material strategies which formed elements of the “City Witness” research project in Swansea.

Dylan Thomas Comes Home

In his short radio play Return Journey, commissioned by the BBC and broadcast in 1947, poet Dylan Thomas describes a visit to his childhood home of Swansea, just a few years after the devastation of wartime air raids on the town. Thomas evokes the bombed landscape of Swansea on a cold February day: its “vanished buildings,” the “blitzed flat graves of shops,” and the “havoc’d” town centre. He walks along High Street:

Thomas's careful catalogue of absence continues; his faithful recitation of the names of lost, disappeared shops and landmarks forming a solemn reckoning of the town's destruction. Later, recounting his walk along College Street, Thomas uses the same phrase, once more listing the “remembered invisible shops” which he can still imagine in the midst of the ruined urban landscape (p. 111). The “ugly, lovely” pre-war town, described so tenderly in Thomas's Reminiscences of Childhood, has vanished, its buildings “melted” into nothing (p. 114). Yet Thomas still sees each of these familiar landmarks in his mind's eye: he assembles their names into their former rows and sequences along streets; into the remembered narratives of itineraries through the vanished town centre. For Thomas, the Swansea of his childhood is still visible, and present, even amongst the “snow and ruin” of the blitzed streets (p. 108).

Dylan Thomas's personal account of this catastrophic rupture in the landscape and history of Swansea presents another way into thinking about medieval cityscapes today, and especially the challenges and opportunities involved in engaging with lost or “invisible” historic environments.

This chapter sets out on a walk through Chester's streets, before going on to explore the historical management and representation of the city's medieval built heritage, and then moving into a broader discussion of questions of authority, legitimacy, and licence in historical scholarship, and how we might conduct engaged research which defies the threat of various “monsters.”

Walking through Chester's History

We begin our walk outside the south porch of Chester's great medieval cathedral, today dedicated to Christ and the Blessed Virgin Mary, but, in the Middle Ages, the Benedictine abbey of the city's patron saint, St. Werburgh. Beneath the red sandstone walls of the south aisle and south transept, we move through the cathedral grounds, past the city war memorial, completed in 1922 in a Gothic style which echoes its medieval surroundings, and out through a wrought-iron gate onto the pavement. Following the curve of St. Werburgh's Street, with its ornate half-timbered buildings and smart boutiques, we turn onto Eastgate Street, where a view of Chester's famous “Rows” stretches out before us. Here we jostle with crowds of shoppers, street entertainers, and buskers, and, perhaps, horserace-goers stepping out of the glossy Grosvenor Hotel in sharp suits and flamboyant hats. Today, as always, we’ll also step aside for tour groups and visitors clutching brochures and cameras, as they follow their guide's uplifted umbrella or study their tourist maps, and take in the prospect of Chester's rich and evocative built heritage.

Perhaps the most iconic feature of the city's surviving medieval fabric, the Rows of Chester run along the four main streets, where the terraced, mostly half-timbered buildings incorporate galleried public walkways at first-floor level, run-ning largely continuously along the length of the streets. Today, these galleries give access to shop fronts at this upper level, while the undercroft space below would originally have been used for storage and later, certainly by the sixteenth century, as workshops, taverns, and further shops.

I’m in Winchester to prepare for a television documentary: an episode of the series Britain's Most Historic Towns (IWC Media for Channel 4 in the UK), which will feature the city as “Britain's Most Norman Town.” The sequence I’m involved in will focus on the lost palace of William the Conqueror, so here I am, hunting for traces of the Normans in the heart of the modern city. As I walk through the streets, I’m re-tracing the paths of many other visitors and scholars, discovering fragments of history through a series of encounters with places, people, and the past.

In a chocolate shop on High Street, a wooden shelf unit laden with bags of truffles and arrays of brightly-wrapped bars partly obscures the medieval stonework on the back wall. But, unmistakably, there's a semi-circular Romanesque arch and a pillar, the wall around them filled with flintwork. The pillar is marooned up against much later brick, not obviously supporting anything very much—hints that this could be a fragment of masonry re-purposed and used in a new context. On the other side of this wall is the Church of St. Lawrence, built in the twelfth century on the site of the chapel royal of the Norman palace. The archway most likely dates from this mid-twelfth-century construction, and probably formed the original doorway onto the street. But the suggestive configuration of pillar and arch raises the possibility that this is medieval recycling: perhaps even the twelfth-century re-use of worked stone from the defunct Norman palace and chapel.

Round the corner, through the narrow passageway from the Butter Cross (a fifteenth-century market cross) to The Square, a large stone chimney breast also stands out conspicuously from the painted cement-rendered wall around it. A man who has been sleeping rough in the shelter of the passage points out to me a piece of decorative stone lower in the chimney breast: the block is worked into simple scallop shapes, overlapping like birds’ feathers or the scales of a dragon. The opportunistic medieval inhabitant of Winchester who appropriated this stone for their chimney was, of course, far from unusual.

This book uses new research to investigate the scholarly understanding, heritage management, and public interpretation of medieval cityscapes today. Drawing on two contrasting central case studies, it asks questions about approaches to medieval cityscapes in very different forms and contexts: where rich material survivals are still present in the urban landscape, associated with an established culture of her-itage tourism; and where the medieval urban environment is absent or invisible today. What research methods can scholars use to explore the medieval cityscape, in its varying forms? And what tools and techniques can enable us to engage wider communities with medieval cityscapes today?

Emerging technologies and expanding digital possibilities make these questions particularly timely and urgent today. New immersive technologies, augmented reality, and virtual historic environments are collapsing the established models and discourses of heritage research and practice, challenging us to think about place and the past in new ways. Where scholars and practitioners have relied on categories such as those of “tangible” and “intangible” heritage, new technologies instead posit an incipient, hybrid realm which merges the material, cultural, and imagined. What consti-tutes the medieval cityscape today? Is it a material phenomenon or can it be a virtual world? Is it a space of history, reality, or conceptual play? This book takes new technologies as a provocation to ask fundamental questions about how we should now understand and define historic environments in a digital age.

As well as confronting the implications of digital tools and technologies, this book also examines creative practice as a mode both for public interpretation, and for scholarly inquiry and exploration. The case studies at the core of this volume incorporate experimental, creative initiatives alongside traditional scholarly research methods in their engagement with medieval urban environments. How can projects such as a civic art commission, or development of a computer game enhance public understanding of the medieval cityscape today? And how can these approaches enlarge academic practice and prompt new questions or insights?

The mission of the “Past Imperfect” series ideally supports the aims of this study. Medieval Cityscapes Today addresses scholars across a range of disciplines—from history to archaeology to heritage science—as well as professionals in the heritage sector, creative practitioners, policy-makers, and others who are responsible for the conservation and development of our urban spaces.

Machine learning algorithms provide the ability to quickly adapt and find patterns in large diverse data sources and therefore are a potential asset to application developers in enterprise systems, networks, and security domains. They make analyzing the security implications of these tools a critical task for machine learning researchers and practitioners alike, spawning a new subfield of research into adversarial learning for security-sensitive domains. The work presented in this book advanced the state of the art in this field of study with five primary contributions: a taxonomy for qualifying the security vulnerabilities of a learner, two novel practical attack/defense scenarios for learning in real-world settings, learning algorithms with theoretical guarantees on training-data privacy preservation, and a generalization of a theoretical paradigm for evading detection of a classifier. However, research in adversarial machine learning has only begun to address the field's complex obstacles—many challenges remain. These challenges suggest several new directions for research within both fields of machine learning and computer security. In this chapter we review our contributions and list a number of open problems in the area.

Above all, we investigated both the practical and theoretical aspects of applying machine learning in security domains. To understand potential threats, we analyzed the vulnerability of learning systems to adversarial malfeasance. We studied both attacks designed to optimally affect the learning system and attacks constrained by real-world limitations on the adversary's capabilities and information.We further designed defense strategies, which we showed significantly diminish the effect of these attacks. Our research focused on learning tasks in virus, spam, and network anomaly detection, but also is broadly applicable across many systems and security domains and has farreaching implications to any system that incorporates learning. Here is a summary of the contributions of each component of this book followed by a discussion of open problems and future directions for research.

Framework for Secure Learning

The first contribution discussed in this book was a framework for assessing risks to a learner within a particular security context (see Table 3.1). The basis for this work is a taxonomy of the characteristics of potential attacks. From this taxonomy (summarized in Table 9.1), we developed security games between an attacker and defender tailored to the particular type of threat posed by the attacker.

Adversaries can also execute attacks designed to degrade the classifier's ability to distinguish between allowed and disallowed events. These Causative Availability attacks against learning algorithms cause the resulting classifiers to have unacceptably high false-positive rates; i.e., a successfully poisoned classifier will misclassify benign input as potential attacks, creating an unacceptable level of interruption in legitimate activity. This chapter provides a case study of one such attack on the SpamBayes spam detection system. We show that cleverly crafted attack messages—pernicious spam email that an uninformed human user would likely identify and label as spam—can exploit Spam- Bayes' learning algorithm, causing the learned classifier to have an unreasonably high false-positive rate. (Chapter 6 demonstrates Causative attacks that instead result in classifiers with an unreasonably high false-negative rate—these are Integrity attacks.) We also show effective defenses against these attacks and discuss the tradeoffs required to defend against them.

We examine several attacks against the SpamBayes spam filter, each of which embodies a particular insight into the vulnerability of the underlying learning technique. In doing so, we more broadly demonstrate attacks that could affect any system that uses a similar learning algorithm. The attacks we present target the learning algorithm used by the spam filter SpamBayes (spambayes.sourceforge.net), but several other filters also use the same underlying learning algorithm, including BogoFilter (bogofilter.sourceforge. net), the spam filter in Mozilla's Thunderbird email client (mozilla.org), and the machine learning component of SpamAssassin (spamassassin.apache.org). The primary difference between the learning elements of these three filters is in their tokenization methods; i.e., the learning algorithm is fundamentally identical, but each filter uses a different set of features. We demonstrate the vulnerability of the underlying algorithm for SpamBayes because it uses a pure machine learning method, it is familiar to the academic community (Meyer & Whateley 2004), and it is popular with over 700,000 downloads. Although here we only analyze SpamBayes, the fact that these other systems use the same learning algorithm suggests that other filters are also vulnerable to similar attacks. However, the overall effectiveness of the attacks would depend on how each of the other filters incorporates the learned classifier into the final filtering decision.

Adversaries can use Causative attacks to not only disrupt normal user activity (as we demonstrated in Chapter 5) but also to evade the detector by causing it to have many false negatives through an Integrity attack. In doing so, such adversaries can reduce the odds that their malicious activities are successfully detected. This chapter presents a case study of the subspace anomaly detection methods introduced by Lakhina et al. (2004b) for detecting network-wide anomalies such as denial-of-service (DoS) attacks based on the dimensionality reduction technique commonly known as principal component analysis (PCA) (Pearson 1901). We show that by injecting crafty extraneous noise, or chaff, into the network during training, the PCA-based detector can be poisoned so it is unable to effectively detect a subsequent DoS attack.We also demonstrate defenses against these attacks. Specifically, by replacing PCA with a more robust alternative subspace estimation procedure, we show that the resulting detector is resilient to poisoning and maintains a significantly lower false-positive rate when poisoned.

The PCA-based detector we analyze was first proposed by Lakhina et al. (2004b) as method for identifying volume anomalies in a backbone network. This basic technique led to a variety of extensions of the original method (e.g., Lakhina, Crovella & Diot 2004a, 2005a, 2005b) and to related techniques for addressing the problem of diagnosing large-volume network anomalies (e.g., Brauckhoff, Salamatian, & May 2009; Huang, Nguyen, Garofalakis, Jordan, Joseph, & Taft 2007; Li, Bian, Crovella, Diot, Govindan, Iannaccone, & Lakhina 2006; Ringberg, Soule, Rexford, & Diot 2007; Zhang, Ge, Greenberg, & Roughan 2005).While their subspace-based method is able to successfully detect DoS attacks in the network traffic, to do so it assumes the detector is trained on nonmalicious data (in an unsupervised fashion under the setting of anomaly detection). Instead, we consider an adversary that knows that an ISP is using a subspacebased anomaly detector and attempts to evade it by proactively poisoning the training data.

We consider an adversary whose goal is to circumvent detection by poisoning the training data; i.e., an Integrity goal to increase the detector's false-negative rate, which corresponds to the evasion success rate of the attacker's subsequent DoS attack. When trained on this poisoned data, the detector learns a distorted set of principal components that are unable to effectively discern the desired DoS attacks—a Targeted attack.

In the second part of this book, we elaborate on Causative attacks, in which an adversary actively mistrains a learner by influencing the training data. We begin in this chapter by considering a simple adversarial learning game that can be theoretically analyzed. In particular, we examine the effect of malicious data in the learning task of anomaly (or outlier) detection. Anomaly detectors are often employed for identifying novel malicious activities such as sending virus-laden email or misusing network-based resources. Because anomaly detectors often serve a role as a component of learning-based detection systems, they are a probable target for attacks. Here we analyze potential attacks specifically against hypersphere-based anomaly detectors, for which a learned hypersphere is used to define the region of normal data and all data that lies outside of this hypersphere's boundary are considered to be anomalous. Hypersphere detectors are used for anomaly detection because they provide an intuitive notion for capturing a subspace of normal points. These detectors are simple to train, and learning algorithms for hypersphere detectors can be kernelized, that is implicitly extended into higher dimensional spaces via a kernel function (Forrest et al. 1996; Rieck & Laskov 2006; Rieck & Laskov 2007; Wang & Stolfo 2004; Wang et al. 2006; Warrender et al. 1999). For our purposes in this chapter, hypersphere models provide a theoretical basis for understanding the types of attacks that can occur and their potential impact in a variety of different settings. The results we present in this chapter provide intriguing insights into the threat of causative attacks. Then, in Chapter 5 and 6, we proceed to describe practical studies of causative attacks motivated by real-world applications of machine learning algorithms.

The topic of hypersphere poisoning first arose in designing virus and intrusion detection systems for which anomaly detectors (including hypersphere detectors) have been used to identify abnormal emails or network packets, and therefor are targets for attacks. This line of work sought to investigate the vulnerability of proposed learning algorithms to adversarial contamination. The threat of an adversary systematically misleading an outlier detector led to the construction of a theoretical model for analyzing the impact of contamination. Nelson (2005) and Nelson & Joseph (2006) first analyzed a simple algorithm for anomaly detection based on bounding the normal data in a mean-centered hypersphere of fixed radius as depicted in Figure 4.1(a).

In this chapter we introduce a framework for qualitatively assessing the security of machine learning systems that captures a broad set of security characteristics common to a number of related adversarial learning settings. There has been a rich set of work that examines the security of machine learning systems; here we survey prior studies of learning in adversarial environments, attacks against learning systems, and proposals for making systems secure against attacks. We identify different classes of attacks on machine learning systems (Section 3.3), categorizing a threat in terms of three crucial properties.

We also present secure learning as a game between an attacker and a defender— the taxonomy determines the structure of the game and its cost model. Further, this taxonomy provides a basis for evaluating the resilience of the systems described by analyzing threats against them to construct defenses. The development of defensive learning techniques is more tentative, but we also discuss a variety of techniques that show promise for defending against different types of attacks.

The work we present not only provides a common language for thinking and writing about secure learning, but goes beyond that to show how the framework applies to both algorithm design and the evaluation of real-world systems. Not only does the framework elicit common themes in otherwise disparate domains but it has also motivated our study of practical machine learning systems as presented in Chapters 5, 6, and 8. These foundational principles for characterizing attacks against learning systems are an essential first step if secure machine learning is to reach its potential as a tool for use in real systems in security-sensitive domains.

This chapter builds on earlier research (Barreno, Nelson, Sears, Joseph, & Tygar 2006; Barreno, Nelson, Joseph, & Tygar 2010; Barreno 2008).

Analyzing the Phases of Learning

Attacks can occur at each of the phases of the learning process that were outlined in Section 2.2. Figure 2.1(a) depicts how data flows through each phase of learning. We briefly outline how attacks against these phases differ.

The Measuring Phase

With knowledge of the measurement process, an adversary can design malicious instances to mimic the measurements of innocuous data. After a successful attack against the measurement mechanism, the system may require expensive reinstrumentation or redesign to accomplish its task.