Accepting that whole research careers are devoted to Statistics alone, and journals only devoted to Statistics continuously produce new publications, how can a student, scientist or teacher from any research domain become expert in statistical analysis and verify that statistical output from complicated statistical software packages have not been affected by computer viruses? Any experiences or advice?
There is little chance that a statistical software gets compromised by a virus/malware/exploit, and the reason for this is simply economical. It takes time and money to develop a good computer virus that can bypass antivirus and other defensive software. If you are a hacker and decide to invest your efforts on that you will expect a benefit from it (i.e. stealing bank accounts, sensitive information, etc.), which is hardly acquired by hacking a statistical software, at least at a non-corporative user level. On the other hand, it is more common to experience bugs (as in any other kind of software) that potentially could lead you to the wrong analysis. I think that the best advices to avoid this is to use a software package whose code is continuously checked by developers and where you can check the source yourself (i.e., use R), so the chance of detecting bugs is higher than in "black box" software. In addition, knowing what you are doing and looking for in your statistical analysis is probably the best general protection against bugs, since you can check whether the results make sense or not.
Usually, there are steps that you can apply to check that the statistical results from a software do sense and correct or not.
It will depend on the type of virus and malware and the data that is used. I have successfully compromised programs (mainly machine learning and image processing algorithms but statistical software can also be susceptible to the types of attacks that I have done and also susceptible to other types of malware) for which the output may be identical to the output of the program. The answer to your question from my experience is that all researcher should only rely on code that they can audit and verify their output.
I would encourage all researchers to become familiar with security of their software since the value and importance of the scientist work is usually underestimated. Attackers have much to gain from such compromises and scientists need to be prepared
There is little chance that a statistical software gets compromised by a virus/malware/exploit, and the reason for this is simply economical. It takes time and money to develop a good computer virus that can bypass antivirus and other defensive software. If you are a hacker and decide to invest your efforts on that you will expect a benefit from it (i.e. stealing bank accounts, sensitive information, etc.), which is hardly acquired by hacking a statistical software, at least at a non-corporative user level. On the other hand, it is more common to experience bugs (as in any other kind of software) that potentially could lead you to the wrong analysis. I think that the best advices to avoid this is to use a software package whose code is continuously checked by developers and where you can check the source yourself (i.e., use R), so the chance of detecting bugs is higher than in "black box" software. In addition, knowing what you are doing and looking for in your statistical analysis is probably the best general protection against bugs, since you can check whether the results make sense or not.
Three scenarios come to mind where researchers can be targeted whether by Trojans, APT's or other focused attack:
1) To win a bidding of a proposals the attacker can target the results of other groups to discredit them (there is no direct financial gain but indirect ones). An example of this is given in [1] where they target a spam filter, but why not target all the competitions work?
2) Attacks towards databases(take for example a conserted attack database like EMBL,Genbank and DDBJ that contain nucleotide sequences) by a terrorist group. The attack would not be economically motivated but ideological. while I do not know their security, I am concerned of this type of targeted attack.
3) change data(such as epidemiological data)to cause mass panic. this is also a possible atack targetted at discrediting and causing confusion to carry out more advanced attacks.
I think that the value of scientific data is highly underestimated by attacker and this may change at anytime.
[1]Nelson, B., Barreno, M., Chi, F. J., Joseph, A. D., Rubinstein, B. I., Saini, U., . . . Xia, K. (2008). Exploiting machine learning to subvert your spam filter. LEET , 8 , 1–9.
In an experimentalist way one can use different programs issuing from different compagny not using the same code source.
At best you can also use some test samples where all the statistical properties are known say analytically. You make them process with the program and you check what is the result of the code towards the anlytical one. The point is to use many calibrated samples so that you can have one close to the one you are studiing. This is the method which is used in interpretation in experimental physics. It may be somewhat time consumming but it has the advantage of making the analysis under a reasonnable control. It is better not to be confident in the outputs of any computations. You always get a result whether the code works well or not.By this way you detect the issues in the program you use. Note that an error in a code can be as a problem as a corrupted file.
- Badges
- Science topic
- Similar topics
- Mathematical Sciences
- Statistics
- Statistical Software