text:
Archive from category "Branding"
Category: Branding
LOGO UNRAVEL: THE SPAR FIR
Friday, 15 February 2019 by mapemond
One of the most visited places in the city of Port Harcourt is SPAR. During the last festive season, there was a frightening mammoth crowd pressing in at the mall's entry point, insistent on patronizing their services and products. It won't be far-fetched to assume that 5 out of 100 persons in Port Harcourt patronized SPAR last Christmas. The building itself was crammed up with all caliber of people similar to the scenario as was reported in various SPAR outlets within the country. This shows the popularity and far reaching effects this brand has on its customers. In fact, it is now a household name in Nigeria, found on the lips of many regular shoppers.
Surprisingly, we discovered that SPAR is an old player in the retail industry with international operations since the last 86years. The company started out being called DESPAR which is a Dutch acronym for Door Eendrachtag Samenwerken Profiteren Allen Regelmatig (In English meaning – "All benefits from joint co-operation"). This interpretation gives a summary of the SPAR brand story.
SPAR is a multinational firm which manages several individual retail stores and partners doing business under the SPAR brand name. It was founded in Netherlands by Adriaan van Well in 1932 on the premise that when marketers do business as individual entities they yield lesser results as compared to several individual wholesalers and retailers coming together in partnership to form a huge market network. They meet a wide range of consumers' needs making very huge impacts by leveraging on the ensuing large customer base.
In 2009, SPAR International gave license to Artee Industries Limited to operate SPAR in Nigeria. SPAR stores in Nigeria are built on hypermarket retail format. Presently, SPAR is operating 10 stores across Port Harcourt, Abuja, Lagos, and Calabar accruing more than 34,000m2 of retail space, hence making it the largest chain of retail stores in Nigeria. They offer an ample variety of products in the class of Grocery, Fruits & Vegetables, Bakery, Butchery, Hot Meals, Wine & Spirits, Fast Moving Consumer Goods, Consumer Electronics, Small Home Appliances, Laptops & Tablets, Mobile Phones, Perfumes, Watches and Jewelry.
Amazingly, even when most persons aren't aware of the business and historical facts surrounding this retail brand, they could readily recognize the brand's logo on any item and on Ads most especially due to its constant appearance on the brands packaging materials. SPAR's visual identity as concerns its logo, has over the years communicated the brand's story, essence, and culture as it is proven through the successes recorded by the brand in the business world. Currently SPAR which started as one single Dutch store has over 12,770 stores in over 45 countries on four continents; meeting the needs of over 13.5 million consumers every day. Join us as we delve into the brand story of its simple but unique logo.
HISTORY OF THE LOGO
In 1932, at the inception of the organization, the symbol chosen to represent the brand and give it an identity in the hearts of its customers was the Christmas tree. Amazingly, the brands name "DE SPAR" means "The Fir" also known as the Christmas fir tree. The logo had the fir tree symbol centered boldly and the brand's name written at its base. The debut logo also had a Dutch inscription "Koopen bijde De Spar is Sparen Bijde koop" meaning buying at the De spar is saving on buying. Eight years later, the Dutch inscription taken off but the rest of the design left as it were. To emphasize consistency in branding and identity, SPAR maintained the same logo design in all its stores worldwide.
In the late 1940s, the brands name was abbreviated from DESPAR to SPAR and so the existing logo was modified to capture this change. As years went by, other modifications in the design was made. This time, the fir tree symbol was resized to fit within the red circular band.
Increasing its Europe presence and entering into Africa and Asia, triggered the need for a more sophisticated logo to enhance its marketing strategy. So in 1968, the logo which is currently in use and can be seen in SPAR's outlets and packaging material was introduced. The fir tree symbol had a refined outlook like an arrowhead enclosed within a green circular band and also having the SPAR element scripted within a red block base.
LOGO SPECIFICATIONS
Logo Description
SPAR runs its business under four (4) store formats – SPAR, SPAR Express, EUROSPAR supermarket and INTERSPAR Hypermarket – and each of these store formats has its brand logo.
The SPAR Express logo communicates the identity of the SPAR Express store format which is to provide service and products to on-the-go shoppers in petrol stations, airports, railways and city centres. It has the smallest sales area.
The SPAR logo has the original design format and thus represents the parent brand. It is used in communications describing the retail firm as an organization having several partners. This brand comes after the Express logo in sales area and accommodates products that satisfy consumers' needs on daily basis.
EUROSPAR logo describes the EUROSPAR Supermarket brand which has a larger sales area than the earlier mentioned store formats. This Supermarket format is designed to cover items and purchases of consumers on weekly basis and thus caters for more needs than the earlier mentioned brands.
INTERSPAR Hypermarket logo represents SPARs biggest store format – the Hypermarket brand. This brand has the largest sales area of more than 3000m2. It was established to meet a wider range of consumer's needs than all its other store formats. Its purpose is for it to be a one-stop shop for consumers.
Logotype colour specification
An excerpt from the Spars online logo manual says:
"The area outside the symbol and the name style is an integral part of SPAR's identity and should always remain white.
The logotype is printed in two colours on a white background and it is critical to SPAR's identity that the colours are interpreted correctly and consistently. The green symbol is (Pantone Matching System) 356 while the red name carrier PMS 185.
Also, the identity should always be printed onto a white background".
LOGO MEANING
Symbol meaning
The logo encapsulates the symbol of fir tree which stands for 'SPAR" in Dutch. The fir is popular for its Christmas tree species. Christmas is a festive season of celebration, shopping and gift unraveling. Hence, the fir Christmas tree symbolizes same. We also know that SPAR is an abbreviated Dutch acronym for DESPAR meaning "All benefit from joint co-operation" and this describes the SPAR concept.
The fir symbol also takes the shape of an arrow head signifying force, direction, movement, power and direction, speed, accelerating growth rates and expansion of SPAR in the retail industry.
Colours meaning
The logo has both Red and Green colours. The green colour which is the colour of the fir tree signifies; life, growth of the business, freshness of its food retail products and services. Red has always been an attractive and captivating colour. It represents excitement, passion, energy and has a strong effect on human metabolism and stimulates appetite hence drawing customers to the brand.
Written By Rejoice Emmanuel
Do you need an expressive logo for your brand? We would love to work with you. Shoot an email to wecare@mapemond.com
Brand StoryBrandingLogoSPARVisual Identity
Published in Branding, Marketing, Stories
BRAND REVIEW: PEAK MILK, STILL LEADING
Tuesday, 12 February 2019 by mapemond
Brands choose to tell their stories any way they please but the ones that stand out are those who tell stories that resonate with the communities they serve. For sixty years plus now PEAK MILK has maintained the story of Africa through its symbolic pic story and visual identity elements of the palm tree, locals in a canoe, trade interaction with merchants, and so on.
With its rich creamy taste, Peak Milk has continued to live up to its name, and has gained the reputation of the number one brand in the dairy industry in Nigeria. Over the years, the brand has been recognised for its quality and leadership in the market. These remarkable attributes piqued our interest to do a review on this legendary brand. Sail with us to the wonderland of this iconic dairy brand.
While most people seem to know the product, only a few are familiar with the company behind the brand, Friesland Campina. The company which was founded from two great Dutch dairy companies, Friesland Foods and Campina, began its journey in the dairy industry in 1871.
Friesland Campina is a company birthed from a rich history. From its name Friesland which is a region in the north of the Netherlands characterised by the green meadows, blue skies, many lakes and splendid Frisian dairy herds and then Campina is also a wooded region of grasslands and meadows in the south of the Netherlands, it can be perceived that the company is a product of the Netherland culture.
The global company is well rooted in the culture and commerce of the Netherlands, Germany, and Belgium. Still it has its focus on reaching local communities and customers with its products. Asides the European countries, Friesland Campina also have a dominant presence in Asia, Africa and the Middle-East. Their factories and products continue to get established all over the world.
Way back in 1954, while Nigeria was still under the British colony, Friesland Campina sailed its way from Netherlands through several oceans to Nigeria. Having surveyed and seen the potentials in the Nigerian market, the company introduced its first brand, Peak Milk. Since then the dairy product has evolved and has maintained a strong leader position.
However it was not until April 1973 the company was incorporated as West Africa Milk Company (WAMCO) and finally commenced operation in 1975 making it an affiliate of Royal Friesland Campina of the Netherlands. Friesland Campina WAMCO Nigeria has its headquarters located in Ikeja Industrial Area of Lagos and is recorded to be one of the largest dairy cooperative in the world. Since it began operations in Nigeria it has made extensive distribution to all the states.
With its strong influence, the company continues to retain its leadership in the production, processing, packaging, marketing, and distribution of its dairy products in Nigeria. In 2015, it was recorded to have made a turnover of twelve billion naira.
BRAND EVOLUTION
At the inception, Peak Milk was seen as product for wealthy people and couldn't be afforded by the common man. Knowing what they stood to lose with the rising of other milk brands, the company adjusted its product in order to accommodate everyone. This led to the introduction of different sizes even down to sachets.
The company behind Peak Milk ties its vision to the purpose they refer to as nourishing by nature. This stands for better nutrition for the world, a good living for farmers, now and for generations to come.
BRAND MISSION STATEMENT
From its mission statement, Nourishing Nigeria with Quality Dairy Nutrition, it is obvious the brand is driven by the need to nourish its consumers.
The strategy behind this exceptional brand is quite straight to the point which is to add value; from its nutrition, to nature, to both young and old people, to consumers and customers, to citizen and down to the society. This value adding mind-set has been transferred to all their employees worldwide.
The company has broken down its plan into the following;
Win with nutrition
Serve the 24/7 consumer and customer
Lead with sustainability
Elevate our essentials
BRAND CAMPAIGNS AND PROJECTS
Most recently, the brand has been running a campaign it named PECADOMO which is an acronym for 'Peak Can Do More'. The idea is to gain new markets by highlighting several other things that the milk product can be used asides regular usage like Tea, Cereals, etc. The brand has actively be urging those into cooking that milk can be used to create so many tasty meals, and they seem to have gained tremendous traction with the campaign.
Peak Milk is one brand that has made a strong impression in Nigeria with its involvement and commitment to nation building and community development. Severally in the past it has supported charity projects, schools and communities through its corporate citizenship programme which kicked off in 2004.
The programme has seen the commissioning of over 41 solar boreholes, supported over 18 public secondary schools amongst many other projects.
With a well mapped out and structured brand like Peak, we can bank on the fact that it will be here for more years to come and may probably still be leading the dairy industry here in Nigeria. It points to the need to build a brand that transcends the founders.
Key Takeaway: Regardless of its leadership position in the market, PEAK is not relenting in its drive to remain a relevant, readily available and trustworthy brand. This is a vital lessons for beginners and the likes, do not allow your successes stop you from pushing the boundaries and frontiers.
Do you need help in gaining better distribution or visibility for your brand? We are your guys! Shoot an email to wecare@mapemond.com
Brand Storybrand visibilityBrandingMarketingMarketing CommunicationsPeak Milk
LOGO UNRAVEL: THE TOYOTA IDENTITY
One of the famous and oldest automobile brands in the world which stands out for the quality, durable and reliable vehicles they create is Toyota. Established in 1933 by the Toyoda family as a subsidiary of the Toyoda Automatic Loom works, they started out producing automatic loom works and textiles before diversifying into automobile production with the production of the model AA passenger car in 1936. Headquartered in Toyota city, Aichi Japan, earliest productions were directed by the founder's son, Kiichiro Toyoda and the company was named after the family's name – TOYODA.
However, it was later renamed TOYOTA in 1936 after a competition which had 27,000 design entries was held in that effect. The design entry bearing the Toyota name was chosen and the TOYOTA brand incorporated as the company's name. This was because whilst Toyoda took 10 Japanese strokes to write, Toyota took 8 strokes which in Japanese culture signify luck and good fortune.
Remarkably, the Toyota brand was introduced into the Nigerian automobile market 32 years after it was founded through various distributing outlets. Later on Toyota (Nigeria) Limited was incorporated as the sole distributor of the Toyota Motor Corporation.
The Toyota brand has over the years endeared themselves to the heart of their customers especially through its visual identity system specifically the well-known Toyota 3-ellipses logo. This has contributed greatly to the successes recorded by the Toyota brand. As little children we could remember playing with this emblem on our parents Toyota cars. This article aims to unravel the wonder behind this globally recognized logo.
The debut logo was designed in 1935 bearing the company's name as at the time – TOYODA. It had the shape of an octagon with the TOYODA inscribed in bold uppercase red font. This was seen on the AA model car and G1 truck produced in 1936.
The first logo…
With the renaming of its name from TOYODA to TOYOTA, a new logo was designed to capture this effect. However, this new design had TOYOTA transcribed into Japanese language and centered in a red circular background.
Japanese inscription logo…
After about 10 years later, the logo design was further re-designed. This time, it had the brand name inscribed in English language; scripted similarly with "Times New Roman" in a bold uppercase black font colour.
The Times New Roman style logo…
Later on, the succeeding logo font was modified using the "Bold Toyota Type" font and inscribed in black font colour.
The Toyota typeface logo…
This font colour was later changed into an attractive red colour which is today known as the Toyota Red. This had a captivating feel, attracting more customers to the brand.
The Toyota red logo…
Conclusively, the well-known 3-ellipes logo was introduced at the 50th anniversary of Toyota Motors Corporation on the 2nd of October, 1989. The previous red logo element was added to the 3-ellipses emblem forming one of the most popular automobile logo in the world today seen on all Toyota vehicles. Subsequent years have seen various modifications in typography, colour, staging platform and visual dimensions being made to the Toyota logo.
As part of showing their value and enthusiasm in promoting their visibility and acceptance, Toyota has a website exclusively dedicated to provide detailed information on their Visual Identity System (VIS) covering these six core elements – logos, tagline, typography, photography styles, colour palette and design layouts. Certainly, their visual identity matters a great to them, like it should be for every other brand.
Source: Toyota
TOYOTA LOGO SPECIFICATIONS
Toyota Motors Corporation is visually identified using any of these 3 logo types: (i) the Toyota Brand logo (ii) the Let's Go Places logo and (iii) the Vehicle logo.
The Brand logo is used to represent the parent brand and is also used when more than one Toyota product is advertised. In addition, it appears where the slogan (tagline) is used as a headline in a publication. Still, it is not used were the vehicle logo appears.
The vehicle logo is used when marketing a particular Toyota vehicle. Some of Toyota's vehicle brand includes; Corolla, Camry, Sienna, TACOMA, RAV4, Highlander, 4RUNNER, SEQUOIA, TUNDRA, C-HR, Land Cruiser, Avalon etc. This logo however, is not used alongside other logos or elements.
The Let's Go Places Logo conveys the brand essence and culture. It is not used without the staging platform when used as a logo. Also, it comes in three forms; the horizontal stacked, horizontal and vertical.
Logo Elements
Toyota logos comprises of 3 elements: (i) the typography i.e. font size, font style etc., (ii) the Toyota symbol and (iii) the staging platform which could also be called the background fill.
Size measurements
The minimum size that the Toyota logo can be reduced to – in both Print and Digital – is 9mm and 24 pixels respectively. This also tells the minimum height that the staging platform can be. In addition, on publications, all logo designs carry a little clear space around them. This clear space is measured in X unit. This is derived by dividing the staging platform into 6 rows and 6 columns. Each cell represents X unit. Two units (2X) of this measurement tell the amount of space that is left both horizontally and vertically around the logo design in a communication.
Dimension and spacing…
Toyota's logo font style is the 'Bold Toyota type font'. The Font colour could be black or red depending on the background of the publication whilst size and space dimensions are stipulated in Toyota's VIS manual.
When the staging platform is in Toyota Red and the typography in black, the logo is placed on a light or white background while when the staging platform is on a dark publication background, the typography becomes white but the staging platform remains red. The Toyota VIS makes provisions for 1-colour designs with no other colours apart from black, red and white.
Logo Colour Palette
Toyota colour palette comprises of Red, White and Black with the primary colour as Red. Red represents energy, visibility, passion, excitement and the Toyota taste for adventure. White stands for clarity showing Toyota's sincerity in creating an impressionable product to its customers.
MEANING OF THE LOGO
The Logo Symbol
According to online sources, the two inner intercepting ellipses in the Toyota symbol represents the unification of the hearts of Toyota customers with the heart of Toyota products while the largest oval encapsulating the inner ellipses, represents the world embracing Toyota. The background space in the Toyota symbol spells Toyota's technological advancement and the boundless opportunities ahead of them.
Also, in another explanation, the two inner ovals that overlap to form a "T" stand for Toyota and the centered oval forms the shape of a steering wheel which represents the Toyota vehicle itself.
Furthermore, recent discoveries shows that upon a closer look at the Toyota 3-ellipses symbol, it is seen that all the letters that spell the word TOYOTA are found in it.
INCORRECT USE OF TOYOTA LOGO
In order to maintain consistency and encourage sustained brand awareness, Toyota advocates for the correct use of their logos on all communication platforms. Some possible misuse of Toyota logos are:
Using the 3-D logo in brand communications
Changing the logo colour
Distorting the shape of the logo shape
Filling up the staging platform with an image
Adding a shadow to the logo
Altering the logo artwork
Changing the shape of the staging platform
Using the logo within text
Changing the logo typography style
Changing the type size or colour of the tagline.
Source: Toyota Visual Identity System
There is obviously more to a logo beyond – it preserves a brand's history, tells its story, and expresses its culture in ways unique to the brand alone. We hope you found this insightful for your own brand?
brand visibilityBrandingLogoToyotaVisual Identity
Published in Branding, Marketing
BRAND REVIEW: THE MTN BRIGHT STRATEGY
Think of a network service provider that has helped most Nigerians connect with people far and near, and MTN pops up! Think of the largest telecommunication company in Nigeria and MTN comes ringing its yellow bells. Due to its wide reach and years of consistency, MTN remains one of the most recommendable mobile Telco brands. Today we take a deeper look at this prodigious brand.
MTN is a multinational mobile telecommunications company under the MTN Group Limited which has its headquarters located in Johannesburg, the capital of South Africa. It was established in 1994 during the new era of democracy as one of the tools for transformation. In the quest to spread its reach and enlarge its customer base, MTN, extended its hands to Nigeria as one of the countries it found fit to do business in. Taking advantage of an auction opportunity conducted by Nigeria Communication Commission in January 2001, MTN automatically became the very first mobile network to make a call.
Following this, MTN launched full commercial operation in August 2001 starting with major cities like Lagos, Abuja and Port Harcourt. From that period, its services have spread across Nigeria covering over 223 cities and towns, more than 10,000 villages and communities, and practically spanning the 36 states in Nigeria with over 52 million subscribers to boast of. Since its inception, the brand has grown and is currently recognised as the eleventh largest mobile network operator in the world and the largest in Africa. It has operational branches in over 22 countries in Africa, Asia and Europe. In June 2016, MTN was recorded to have over 232.6 million subscribers in these various countries.
MTN continues to exist to provide solution to connectivity, communication and collaboration problems in all the countries it operates in. It leverages technology in order to give its customers a good experience. From its track record, MTN is known to be the largest privately owned mobile operator in Africa, Europe and the Middle East.
A trait that is predominant among every successful brand is a clear vision. MTN is one of such brands that has their eyes on the ball and this is what they see themselves becoming, "Our vision is to lead the delivery of a bold, new digital world to our customers."
From their tenacity and never giving-up spirit, it is obvious MTN is on a mission. In their own words, "Our mission is to make our customers' lives a whole lot BRIGHTER. We do this by delivering relevant, accessible, high quality telecommunications solutions that put them in control."
BRAND SLOGAN
Beyond its bright yellow colour, another remarkable attribute that seem to keep MTN in the minds of customers is its unforgettable slogan, "Everywhere you go". This slogan has become part of its identity and continues to pass the brand's message.
The company is driven by some core values such as;
Can-do
MTN operates with a well-defined brand strategy which they refer to as BRIGHT. They see this strategy as six pillars on which the brand is built upon.
B- Best customer experience
R- Returns and efficiency focus
I- Ignite commercial performance
G- Growth through data and digital
H- Hearts and minds
T- Technology
THE BRIGHT STRATEGY…
Here are some facts you may not know about this prominent brand.
The brand was formerly known as M-cell
MTN stands for Mobile Telecommunication network
The first phone call was made in Maritime House, Apapa
One-third of MTN revenues comes from Nigeria
It changes its number range whenever a particular range is full. This is the reason why they've changed from 0803, to 0703, to 0706, to 0810, to 0813, to 0814, 0816 and now 0903
Dreaming of starting a business that will become a well-known brand? Shoot an email to wecare@mapemond.com
Brand EssenceBrand Storybrand strategyBrandingMTNTelecommunications
Published in Branding
LOGO UNRAVEL: THE BIG ELEPHANT
Beyond the obvious fact that a logo becomes a company's identity, it can also be referred to as the custodian of a brand's history and culture. It reminds both the staff and customers the journey the brand has travelled so far and the milestones it has accomplished over the years.
With its historical attributes, the FirstBank logo can be seen as a symbol holding so much more than what meets the eyes. To the common man it may look like a simple blend of elements and colours but to those who work behind the scenes, its meaning is deeper.
THE LOGO JOURNEY
Being one of the oldest banks in Nigeria since 1894, FirstBank's identity has become a household symbol and is one that is easily recognisable by all. It has earned itself a grand reputation for consistency and as a result has gained a huge popularity to the point anytime one sees an emblem with an elephant inscribed on it, one of the first thoughts that crosses the mind is the FirstBank brand.
The logo transition…
With many decades gone by and as a way of commemorating the brand's 120th year anniversary, they felt the necessity to redesign their legendary logo in order to reflect the new strategic direction the company was taking. The bank unveiled their new identity in January 27th, 2014, informing the general public about their new brand position.
THE LOGO ICON
The African Elephant
The old logo…
One icon that has always been associated with the FirstBank logo is the famous African elephant. For the brand, this icon symbolises their strength and growth. It is also an indicator that the brand is a leader in the financial industry. With this single icon, the bank has continued to earn respect and visibility.
Though this element was retained, there were some slight modifications to its appearance which were made to communicate the evolution the bank was going through in order to remain relevant in the financial sector.
The new logo…
A Raised Head – While the elephant in the old logo had a straight face, the new logo bears an elephant with a raised head. This they indicated was a way to reassure their customers about their commitment no matter the challenge. It is a promise that says they will face any financial challenge with their head held high.
A Raised Foot – The raised foot in the new logo is a reminder that they will always put their best foot forward for their customers.
THE LOGO COLOURS
From a lighter shade of blue to a deep blue colour, the FirstBank logo took on a new feel. The deep blue colour signifies a heritage of trust and distinction. The colour also represents their brand principles of momentum, innovation and evolution. These principles ensure that the bank strives to continuously develop solutions.
One significant change in the new logo was the infusion of gold. This rich colour represents a promise to set the gold standard of value and excellence in their services as a financial establishment.
LOGO IMPACT
Through its logo the brand has continued to fulfil the promise it made to its customers which is to always deliver the ultimate gold standard of value and excellence. Merely viewing the logo reminds their customers and partners about their position as one of the first and leading brands in the banking field.
The logo, images, fonts, patterns, icons, colours, symbols, words, all combine to visually communicate the brand's corporate identity and brand language. The colours are also a reflection of the brand's personality and their tone of voice towards their customers.
Do you need a logo that sets your company apart? We can help you design a unique logo. Reach out to us at wecare@mapemond.com
Brand IdentityLogoMarketing CommunicationsVisual Identity
BRAND REVIEW: KILIMANJARO – THE RISING FOOD GIANT
Tuesday, 29 January 2019 by mapemond
When people think of major Restaurants in Port Harcourt and Nigeria at large, the list would be incomplete if Kilimanjaro isn't mentioned. This is so because Kilimanjaro has succeeded in creating a popular and appealing brand among quick service restaurants in Nigeria. Going from its appetizing and tasteful food packages, serene and hygienic environment as well as its endearing customer service, it has retained its position amongst the top brands sought-after by customers. Above all, the brand has remained a much focused business entity, last year alone we learnt that they made a whooping profit of 950m Naira after tax, that's huge and very promising! You surely would love to know more about this exceptional brand.
THE BRAND HISTORY
Kilimanjaro is the thriving restaurant brand under Sundry Foods Limited, an integrated food services company that proffers hospitality solutions through a wide range of products and services involving catering, restaurants and bakeries. Specifically, the primary brands of Sundry Foods Limited are; Kilimanjaro, Nibbles bakery, SFL catering services, Pizza jungle, and KiliSharwarma. Same group also owns and operates MarketSquare, a supermarket chain under the company Sundry Markets Limited.
Sundry Foods Limited was established in 2004 by Ebele Enunwa, a chartered accountant and former Regional Manager of Stanbic IBTC bank Port Harcourt, who resigned to pursue his dream as an entrepreneur and obtained a Masters of Management in Hospitality degree from Cornell University, USA.
Recording exponential successes in acceptance and sales, Kilimanjaro stands out as the fastest growing and most successful brand of SFL. It has over 31 outlets across the country and is the leading food service provider in two major cities in Nigeria – Port Harcourt and Abuja. They offer a wide range of wholesome and tasty local, African and Intercontinental dishes as well as both corporate and home delivery services. This is done under hygienic conditions, in an attractive manner whilst patiently capturing consumers' needs during service delivery.
Buttressing this, Kilimanjaro deliver tasty meals on time in good quality and quantity and also make payments easy by providing varied payment options for their customers through its cashless POS service. Ping-a-Meal; an online delivery service, provides customers with the opportunity to place their orders at the comfort of their homes and offices and have them delivered promptly. With Kilimanjaro you can never run out of cash because they offer CashBack services. Out of cash? Just go into any of its outlets. All these and many more has contributed in making Kilimanjaro a competitive brand, highly endearing to hearts of consumers. Little wonder some customers would argue that their meals are the best and are fascinated and really do enjoy Kilimanjaro's Nibbles coconut, strawberry and chocolate ice-cream mix. These can only be gotten from Kilimanjaro.
THE BRAND VISION
"Better Food, Better Service, Better People"
To be the foremost integrated food services company in the country providing the complete food service solutions to a select strata of clientele.
THE BRAND MISSION
To build a world class organization worthy of association and to create exceptional value for their shareholders by:
providing an intellectually stimulating work environment where employees can achieve job and career satisfaction,
providing the best products and service possible in an exciting environment giving the customer an unforgettable experience, while
positively impacting on our environment and the community at large.
THE SERVICES PROVIDED
Quick service restaurant serving both local and continental cuisines, Nibbles ice cream, shawarma, pizza, bread and confectionaries such as doughnuts, cakes, small chops, desserts, pastries; ping-a-meal service, Office and Home delivery services, industrial catering, events catering services.
THE BRAND CULTURE
Kilimanjaro has the culture of ensuring that the food needs of their customers are met by making available wholesome sumptuous and tasty meals on time and every time in good quality, quantity even at the comfort of their homes and offices. They are critical and very careful in employing staff and hire based on the brands core values of providing tasty meals and quality services to people. In their very own words,
"We know that what we offer has a direct relationship with the quality of materials we use as well as the quality of people we use to provide our services. We therefore take extra caution in hand picking our people and materials in order to ensure that we meet and exceed customer expectations on time, every time."
Enjoyed this article? Share your thoughts…
We here to serve you insightful ideas that will help you build an exceptional brand. Send us an email at wecare@mapemond.com
Do Business Better
brand cultureBrand StoryKilimanjaroRestaurant
Published in Branding, Research, Stories
BRAND REVIEW: THE SHARP BLADES OF GILLETTE
One brand that has gained dominance as a personal grooming product in different continents of the world is Gillette. The brand's stability and clearly defined brand proposition has added to its uniqueness. There are so many lessons to glean from this top brand.
Join us and let's take a tour into the Gillette world…
HISTORY OF THE BRAND
In 1895, Gillette King, a successful travel sales man got irritated by the fact that his shaving blade frequently became blunt and needed regular sharpening. So, he thought of designing a new type of razor which could be quickly used and replaced regularly. He pictured a shaving stick with a handle, having a disposable double-edged blade that could be used and reused until it was dull. And so, he got to work on his idea, drawing different designs and models of safety razors for six good years afterwards.
Finally, on the 28th of September 1901, Gillette founded the American Safety Razor Company which he later changed to Gillette Safety Razor Company in July of the following year. He obtained his company's trademark registration and began production in 1903 were he sold 51 razors and 168 blades.
Spurred by successes in sales, Gillette introduced the "new improved" Gillette razor superseding and replacing the old-style razor – the silver Brownie razor in 1921. Further witnessing a series of expansion and growth, 68 years later Gillette developed the Sensor Shaving System which had thinner blades and better features. This caused sales to rise as this brand appealed to consumers and thus the Lady Sensor followed shortly.
With further research, marketing strategy, and expansion, a major innovation was introduced in 1998 to drive sales further up. The MACH 3, so called, had a third blade and its blades were set at an angle that made shaving easier with fewer strokes giving a smoother and comfortable feel.
Surviving, three takeover attempts, the company continued to grow and expand into various brands such as the Bic pen, Duracell batteries, Oral-B and other toiletries. Finally, on October 1st 2005, Gillette and Procter & Gamble merged companies. This ended the existence of Gillette Company as a business entity but culminated in creating the biggest brand in personal grooming and house care products in the world.
To build total brand value by innovating to deliver consumer value and customer leadership faster, better and more completely than our competition.
A globally focused consumer products marketer that seeks competitive advantage in quality, value-added personal car and personal use products.
THEIR PRODUCTS
Gillette offers a wide range of products such as 2,3,5- bladed disposable razors, trimmers and blades, shave preps like foams, shave gels, shave lotions, after-shave balms and personal care products which includes deodorants, anti-perspirants, and body washes.
Subsequently, the company witnessed growth in sales and expanded to different parts of the world. In 1917, Gillette had the contract of supplying safety shaving blades to American soldiers during World War I which was funded by the government. Successive years saw the company evolving through a series of leadership profiles with men like John, Giasman, Gerard, Samuel, Stampleman, Spangler Jr., Gilbert and Colman Mockler at the helm of affairs.
BRAND CULTURE
The brand could be said to be a male product since it is mostly used by males for different shaving purposes. One culture this brand has retained over the years is their position on grooming more responsible men. Following a recent campaign against the usual "boys will be boys" attitude that encourages the nasty behavior of some male folks, Gillette made its stand clear. They believe and are working towards instilling better manners in the males.
With all these, the brand's growth can be linked to the quality of its product, its leadership and also strong publicity. This way they have remained in the hearts many consumers all over the world.
What's your take away from the Gillette story? Please share in the comment section.
Need help with developing a business plan and branding your business? We can help! Send us an email at wecare@mapemond.com
Brand StoryGilletteHistoryThe best a man can get
Published in Branding, Stories
LOGO UNRAVEL: The Coca-Cola Script
Friday, 18 January 2019 by mapemond
Logos have always been a vital part of a brand. They gradually become the company's identity as time goes on. Deciding on an emblem that would represent your company could be quite a daunting job and would sometimes go through several refining process before getting the final piece.
Even after the final craft is done, it continues to undergo reviews from time to time. This has been the case for the oldest drink of all time, Coca-Cola. Tag along as we take a ride through time from how the famous brand got its logo and how well it has represented the brand so far.
Logo History
For a brand that has journeyed for 130years, Coca-Cola has gone beyond being a mere brand to becoming a legend. Without a doubt it has become one of the most prominent drinks accepted all over the world. Nonetheless this great brand has been through many transformations from the shape of its bottle, to its CEOs and also its logo. For the purpose of this article, we will dwell on the logo transformations.
Though the Coca-Cola brand has been recognised worldwide for its outstanding logo which is simply the combination of two words, "Coca" and "Cola", it will be interesting to know that the logo has been modified severally. Its famous name was given to it in 8 May 1886 by Frank M. Robinson who happened to be Dr John S Pemberton's bookkeeper.
Very old rendition of the logo.
Frank M Robinson felt the blend of the two "C"s would be good in terms of advertising the product. Robinson's idea worked exactly as planned and the logo gradually became easily recognisable by consumers.
Logo Transition
The Coca-Cola logo was first scripted by Frank M. Robinson in 1886. It was written in a popular writing style called Spencerian. Since then the logo has undergone series of changes and may continue to transform as the years go by.
The following year being 1887, a slight touch was added to the logo. The words "Trade Mark" were added to the tail of the first 'C'.
Moving on to 1890, the logo was redesigned with extra swirls added which made it a bit dramatic. This little twist gave the logo a face lift.
The logo further transited in 1914 to gain a new identity. In this new logo the words "Trademark Registered" was written below.
Red disc…
In 1947 a red disc shape version of the logo was used to advertise the brand and afterwards became an outdoor signage. This red disc images were strategically used to decorate business places to boost advertisement.
Fishy shape…
The next form the logo took in 1958 was a fishy shape. The script was inserted in an Arciform shape which was similar to an arch. The Arciform sign is also known as the Fishtail sign. This design was used as the company's identity and was used in copy, signage and on vending machines.
The logo took a wavy appearance in 1969. The Coca-Cola script was now underlined with a white wave design also known as Dynamic Ribbon Device.
In 1982 the logo was redesigned to a slab serif font. This happened exactly when Diet coke was introduced to the market. Also in that year slogans such as "Coke is it" was used.
2003 came with a new feel to the Dynamic Ribbon Device as some touch of yellow and some bubbles were added to the logo.
While in 2007 the logo was made simpler and bolder with just a touch of a white ribbon added to it.
125Years Celebration….
To celebrate the brand's 125years birthday in 2011, the logo was modified with bubbles bursting from the contour bottle. This was used to describe a celebration of the different seasons, past, present and future, the brand has gone through.
In 2013, to promote a campaign called "Share a Coke", the logo was again adjusted. The Coca-Cola logo was replaced with a typeface was named "You". This was a marketing strategy to connect with the consumers better.
It was the first time the company's packaging changed. Gradually it evolved with different names customised on the bottles.
Finally in 2016, with the theme "Taste the Feeling", a synergy was created for all the products of the brand. This campaign initiated "One Brand" for all Coca-Cola's flavours from Coca-Cola Classic, Diet Coke, Coke Zero and Coke with Stevia.
The new logo design united all the flavours under the classic Red Disc and also brought about the use of the contour glass bottle. The idea behind the new design was to indicate that no matter how different the flavours may be, they are all under the main Coca-Cola brand.
Logo Colour
The regular colours used in most of Coca-Cola's logo and products are red and white. These two are applied to simplify the designs and appeal to the eyes of customers. There is also a welcoming feel to it.
The red colour is also used to represent the brand's powerful marketing position. Little wonder why it has remained a giant in its field.
Does your company have a known identity? We can help you create one that stands out. Reach out to us via email at wecare@mapemond.com
Brand StoryHistoryLogoVisual Identity
BRAND REVIEW: NESTLE MILO
From the stable of Nestle factory came one of the most nutritious chocolate malt beverages in the world, Milo. And it is consumed by virtually every member of society regardless of social status or class. Due to both its popularity and fast preparation with either hot or cold water, Milo can be referred to as your go-to drink.
Developed in the year 1930 by Thomas Mayne in Australia but launched in 1934, Milo has since then retained its relevance in the beverage industry. The brand has spread its distribution chain across different continents such as; Asia, Africa and Oceania. Though a foreign brand, Milo has dug its tasty root deep into the Nigerian market and has earned a reputation as one of the best in its category.
Milo is a nutritional supplement enriched with vitamins and minerals. It is made from malted barley, and cocoa, and is high in protein, calcium, and iron amongst others. Overtime, the brand has been seen as a drink for mostly children and athletes.
MISSION OF THE BRAND
Like all Nestle products, Milo runs with the general company's mission which is to become, 'the world's leading nutrition, health and Wellness Company. Their mission of "Good Food, Good Life" is to provide consumers with the best tasting, most nutritious choices in a wide range of food and beverage categories and eating occasions, from morning to night.'
VISION OF THE BRAND
Nestle sees itself becoming "a leading, competitive, Nutrition, Health and Wellness Company delivering improved shareholder value by being a preferred corporate citizen, preferred employer, and preferred supplier selling preferred products."
Like many world standard brands that have solid values, the Milo brand under Nestle isn't left out. Here are some of its values;
Milo is a youth centered brand, expressed with so much energy and vibrancy. It is a sporty and also a health conscious brand.
The product has positioned itself as an active brand in sports using strong elements like athletes and sporting personalities on the body of the tin and sachet. This is the reason why most adverts try to promote the importance of sports.
It is regularly promoted as a drink that enables healthy growth in young people especially children.
It has become known for its rich green colour which is used for all their advertisement, from TV to billboards.
The Milo brand is produced in different sizes in order to make the product affordable and purchasable to people of different class.
Though Milo's dominance in the beverage industry is high, it is however not flawless. Based on our research, we have identified some weaknesses related to the brand. The following are some;
Its target market is restricted to an extent since it is popularly seen as a drink for children and athletes
No popular social media presence
That Milo has no unique global taste; the recipe varies slightly in order to suit the taste and expectations of a particular region.
BRAND INSIGHT
The Milo brand has consistently built a solid reputation from its rich delicious taste to its sport awareness campaigns and down to the regular adverts. This keeps them in the minds of most consumers and continues to increase their visibility. With their business approach, we are sure Milo will remain in the market for long.
Let us help you build a sustainable brand, send us an email at wecare@mapemond.com
Do Business Better.
Brand StoryHistoryMiloNestleStorytelling
LOGO UNRAVEL: STERLING BANK'S RISING SUN
From what looks like a rocket heading to the moon inside a red circle, to what has now been redesigned to represent a rising sun still inside a red circle, Sterling Bank is certainly on the move to something new. Through their different branding approaches, it could be perceived that they are on a mission to increase their visibility and customer base. With proper observation, this branding strategy seems to be working for them as they have gotten more people engaged on their social media platform and a lot of new accounts being opened.
Sterling Bank, usually referred to as the one-customer bank, has travelled for as long as fifty eight years in the banking industry but recently felt it was time to change the strategic position of their brand. The bank which was founded in the year 1960 as the First Merchant Bank has continued to evolve over the years to becoming one of the fastest growing commercial banks in Nigeria. In recent times, one of the evolutions the bank has undergone is the revamping of their logo.
The old logo showed their previous brand position which was "aiming for the moon". This concept was associated to their desire to reach the stars and it reflected in the type of services they rendered to their customers, their values and the brand disposition in general.
DEFINITION OF THE NEW LOGO
Contrary to the old logo, the new Sterling bank logo took a new dimension. They say their new logo represents the evolution of their new identity as "The Rising Sun". This, they reported to mean the alignment of their brand to the current strategic positioning of the bank.
The new logo which has now become their identity is said to reflect their progression from the traditional banking to a new and agile force that delivers forward-moving disruptive solutions.
This is what has informed their journey from the previous "aiming for the moon" to the present "The Rising Sun". Also for them, this means growth. This could be observed in their leverage on technology and delivery of some of the most innovative and market-disruptive solutions. Some of the solutions they have provided include; Specta- Nigeria's fastest consumer lending platform, FarePayB- Africa's 1st contactless Transport Card, and I-Invest- World's Mobile 1st Treasury Bill App.
BRAND VISIBILITY
Asides the buzz Sterling Bank ignited on social media about their new logo, the bank went further to make their new logo more visible by partnering ride hailing services like Taxify and Uber. They branded some of the vehicles which can be seen on various roads, silently putting the bank's identity in the minds of consumers.
Due to this strategic move, Sterling Bank seems to be stronger, in their word "agile", more innovative and relevant to their customers. With their visibility and new brand position, they are definitely giving other banks a run for their customers.
Although, in brand sense, the concept of a new identity is a welcomed development, the concern remains, will Sterling Bank be able to maintain this new position and deliver as much as they have promised. Like we educate people all the time, branding goes beyond logo designs and outward appearance. Nevertheless, we hope they get it right,
Want to grow a sustainable brand? Reach out to us at wecare@mapemond.com
This year, "do business better"
Share your thoughts with us, leave a comment.
brand visibilityLogorebrandingVisual Identity


text:
Singing at Sea Cruise – 2019 In Review!
Royal Caribbean's Brilliance Of The Seas sat anchored at the cruise terminal in Tampa Bay. In just a few hours, the ship would be filled with over 2,000 Gospel music fans for the 45th annual Singing At Sea Cruise; and I couldn't be happier to leave all the cold temps and snow at home for…
Singing At Sea Cruise | Friday
It's the last day of a cruise, how do you spend your time? Plan every hour down to the minute and pack in as much as you can? Find a chair on deck and relax? I've found that the answer varies from cruise to cruise, and this year, I took a more relaxed pace on…
Singing At Sea Cruise | Thursday
Thursday morning, my alarm went off at an ungodly hour. The only thing that kept me from hitting the snooze button was three excursion tickets to Chichen Itza predominantly displayed on the counter in front of the mirror. Now that was worth getting up for… Unfortunately, the Windjammer wasn't open at 6:00 am to eat…
Singing At Sea Cruise | Chichen Itza
There's something about touring an ancient ruin that can cause your heart to skip a beat. The reality of walking among the same structures that a civilization built with their hands thousands of years ago, wondering what the people who lived there would think if they saw a bus load of tourists walking around their…
Singing At Sea Cruise | Wednesday
Sea days. Some like to sleep in, some like the fact that you don't have to be anywhere and can just relax, and then some like to use the extra hours on the water to see as much singing as they can. This year, the latter was me. My host group had a private concert…
Singing at Sea | Tuesday
Tuesday dawned. It was the first full day of my fifth Singing at Sea cruise and I was looking forward to the first port of call on the trip – Key West, Florida. But before we could explore the southernmost point of the U.S., my mom and I went up to the Windjammer and had…
Singing At Sea Cruise | Key West
This year, my February cruise took me to the ports of Key West, Florida and Cozumel, Mexico. Our first stop was in Key West, via Royal Caribbean's Brilliance of the Seas. We came into port at 11:30 am and were cleared to leave the ship by noon. During the afternoon, we visited the Southernmost Point,…
Singing At Sea Cruise | Monday
Tampa, Florida dawned bright and sunny the day I boarded Brilliance Of The Seas for the 2018 Singing At Sea cruise. Though it felt strange to be wearing a sleeveless blouse in February, it felt rather good to be somewhere hot. (When I left home that week, it was 15 degrees.) I've been a big…
Sea Days
The murky water below churned as the ms Paradise glided through the dark waves. Along the horizon, the sky and water only had one color. Black. It was just after six o'clock in the morning and I was determined to see that orange ball pop over the horizon on Tuesday. Being early in the week,…
Ahoy Mates! Paradise Is Waiting…
The elevator "dinged," the doors slid open and my sister and I walked into the bustling lobby of our hotel filled with cruise passengers. Lining the walls and keeping a hand on their carry-on bags, people waited for their shuttle to take them to the cruise terminal. If you go on the Singing at Sea…

redpajama_set_name: RedPajamaCommonCrawl


text:
\section{Introduction}
\label{introduction}

Machine learning is being increasingly used in security-sensitive
applications such as spam filtering, malware detection, and network
intrusion detection
\cite{biggio-IJMLC10,biggio13-tkde,dalvi04,fogla06,huang11,kloft10,kolcz09,lowd05,nelson08}.
Due to their intrinsic adversarial nature, these applications differ
from the classical machine learning setting in which the underlying
data distribution is assumed to be \emph{stationary}.  To the
contrary, in security-sensitive applications, samples (and, thus,
their distribution) can be actively manipulated by an intelligent,
adaptive adversary to confound learning; \emph{e.g.}, to avoid
detection, spam emails are often modified by obfuscating common spam
words or inserting words associated with legitimate
emails~\cite{biggio-IJMLC10,dalvi04,kolcz09,lowd05}.  This has led to
an arms race between the designers of learning systems and their
adversaries, which is evidenced by the increasing complexity of
modern attacks and countermeasures.  For these reasons, classical
performance evaluation techniques are not suitable to reliably assess
the security of learning algorithms, \emph{i.e.}, the performance degradation
caused by carefully crafted attacks~\cite{biggio13-tkde}.

To better understand the security properties of machine learning
systems in adversarial settings, paradigms from security
engineering and cryptography have been adapted to the machine
learning field~\cite{barreno-ASIACCS06,biggio13-tkde,huang11}.
Following common
security protocols, the learning system designer should use \emph{proactive} protection mechanisms that
anticipate
and prevent the adversarial impact.
This requires (\emph{i})
finding potential vulnerabilities of learning \emph{before} they are
exploited by the adversary; (\emph{ii}) investigating the
impact of the corresponding attacks (\emph{i.e.}, evaluating classifier
security); and (\emph{iii}) devising appropriate countermeasures if an attack is
found to significantly degrade the classifier's performance.

Two approaches have previously addressed security
issues in learning.
The min-max approach assumes the learner and attacker's loss functions are antagonistic, which yields relatively simple
optimization problems~\cite{dekel10,globerson-ICML06}.
A more general game-theoretic approach applies
for non-antagonistic losses;
\emph{e.g.}, a spam filter wants to accurately identify legitimate email
while a spammer seeks to boost his spam's appeal.
Under certain conditions, such problems can be solved using a Nash equilibrium
approach~\cite{BruSch11,brueckner12}.
Both approaches provide a
\emph{secure} counterpart to their respective learning problems; \emph{i.e.}, an optimal anticipatory classifier.

Realistic constraints, however, are too complex and multi-faceted to be incorporated into existing game-theoretic approaches. Instead, we investigate the vulnerabilities of classification algorithms by deriving \emph{evasion attacks} in which the adversary aims to avoid detection by manipulating malicious test samples.\footnote{Note that other kinds of attacks are possible, \emph{e.g.}, if the adversary can manipulate the training data. A comprehensive taxonomy of attacks can be found in \cite{barreno-ASIACCS06,huang11}.}
We systematically assess classifier security in attack scenarios that exhibit increasing risk levels, simulated by increasing the attacker's knowledge of the system and her ability to manipulate attack samples.
Our analysis allows a classifier designer to understand how the
classification performance of each considered model degrades under attack,
and thus, to make more informed design choices.

The problem of evasion at test time was addressed in
prior work, but limited to linear
and convex-inducing
classifiers~\cite{dalvi04,lowd05,nelson12-jmlr}.
In contrast, the methods presented
in Sections~\ref{sect:optimal-evasion} and \ref{sect:gradient-descent}
can generally evade linear or non-linear classifiers using a gradient-descent approach inspired by
Golland's discriminative directions technique~\cite{Gol02}.
Although we focus our analysis on widely-used classifiers such as Support Vector Machines (SVMs) and neural networks, our approach is applicable to any classifier with a differentiable discriminant function.

This paper is organized as follows.  We present
the evasion problem in Section~\ref{sect:optimal-evasion} and
our gradient-descent approach in Section~\ref{sect:gradient-descent}.
In Section~\ref{sect:experiments} we first
visually demonstrate our attack on the task of
handwritten digit recognition, and then show its effectiveness
on a realistic application related to the detection of PDF malware.
Finally in Section~\ref{sect:conclusions}, we summarize our
contributions, discuss possibilities for improving security,
and suggest future extensions of this work.

\section{Optimal evasion at test time}
\label{sect:optimal-evasion}

\newcommand{\classifierLBL}[1][]{\ensuremath{y^c_{#1}}}

We consider a classification algorithm $f : \mathcal X \mapsto \mathcal Y$ that assigns samples represented in some feature space $\mathbf x \in \mathcal X$ to a label in the set of predefined classes $y \in \mathcal Y = \{-1,+1\}$, where $-1$ ($+1$) represents the legitimate (malicious) class.
The classifier $f$ is trained on a dataset $\mathcal D = \{\mathbf x_{i}, y_{i}\}_{i=1}^{n}$ sampled from an underlying distribution $p(\mathbf X,Y)$.
The label $\classifierLBL = f(\mathbf x)$ given by a classifier is typically obtained by thresholding a continuous discriminant function $g : \mathcal X \mapsto \mathbb{R}$. In the sequel, we use $\classifierLBL$ to refer to the label assigned by the classifier as opposed to the true label $y$. We further assume that $f(\mathbf x) = -1$ if $g(\mathbf x) < 0$, and $+1$ otherwise.

\subsection{Adversary model}\label{subsect:adv-model}

To motivate the optimal attack strategy for evasion, it is necessary
to disclose one's assumptions of the adversary's knowledge and
ability to manipulate the data.  To this end, we exploit a general
model of the adversary that elucidates specific assumptions
about adversary's goal, knowledge of the system, and capability to
modify the underlying data distribution. The considered model is part
of a more general framework investigated in our recent work~\cite{biggio13-tkde},
which subsumes evasion and other attack scenarios. This model can
incorporate application-specific constraints in the definition of the
adversary's capability, and can thus be exploited to derive practical
guidelines for developing the optimal attack strategy.

\medskip
\noindent \textbf{Adversary's goal}.  As suggested by Laskov and Kloft \cite{laskov09}, the
adversary's goal should be defined in terms of a utility (loss)
function that the adversary seeks to maximize (minimize). In the
evasion setting, the attacker's goal is to manipulate a single (without
loss of generality, positive) sample that should be
misclassified.
Strictly speaking, it would suffice
to find a sample $\mathbf x$ such that $g(\mathbf x) < -\epsilon$ for any
$\epsilon > 0$; \emph{i.e.}, the attack sample only just crosses
the decision boundary.\footnote{This is also the setting adopted in
  previous work \cite{dalvi04,lowd05,nelson12-jmlr}.}  Such attacks,
however, are easily thwarted by slightly adjusting the decision threshold.  A better strategy for an attacker
would thus be to create a sample that is misclassified with high
confidence; \emph{i.e.}, a sample minimizing the value of the classifier's
discriminant function, $g(\mathbf x)$, subject to some feasibility constraints.

\medskip
\noindent \textbf{Adversary's knowledge}. The adversary's knowledge about her targeted
learning system may vary significantly. Such
knowledge may include:
\begin{itemize}
\item \label{know-1} the training set or part of it;
\item\label{know-2} the feature representation of each sample;
  \emph{i.e.}, how \emph{real} objects such as emails, network packets
  are mapped into the classifier's feature space;
\item\label{know-3} the type of a learning algorithm and the form of
  its decision function;
\item\label{know-4} the (trained) classifier model; \emph{e.g.}, weights of a linear classifier;
\item\label{know-5} or feedback from the classifier; \emph{e.g.}, classifier labels for samples chosen by the adversary.
\end{itemize}

\medskip
\noindent \textbf{Adversary's capability}. In the evasion scenario, the
adversary's capability is limited to modifications of test data; \emph{i.e.} altering
the training data is not allowed. However, under this restriction, variations in attacker's power may include:

\begin{itemize}
\item modifications to the input data (limited or unlimited);
\item modifications to the feature vectors (limited or unlimited);
\item or independent modifications to specific features (the semantics of the
  input data may dictate that certain features are interdependent).
\end{itemize}

Most of the previous work on evasion attacks assumes that the attacker can
arbitrarily change every feature~\cite{brueckner12,dekel10,globerson-ICML06},
but they constrain the degree of manipulation, \emph{e.g.}, limiting the number of modifications, or their total cost. However, many real domains impose stricter restrictions.
For example, in the task of PDF malware detection~\cite{maiorca,Smutz,Srndic},
removal of content is not feasible, and content addition may cause correlated changes in the feature vectors.

\subsection{Attack scenarios}

In the sequel, we consider two attack scenarios characterized by
different levels of adversary's knowledge of the attacked system discussed below.

\medskip
\noindent \textbf{Perfect knowledge (PK).} In this setting, we assume that the adversary's goal is to minimize
$g(\mathbf x)$, and that she has perfect knowledge of the targeted
classifier; \emph{i.e.}, the adversary knows the feature space, the type of the classifier,
and the trained model. The adversary can transform attack points in the test data but must remain within a maximum distance of $d_{\rm max}$ from the original attack sample.
We use $d_{\rm max}$ as parameter in our evaluation to simulate
increasingly pessimistic attack scenarios by giving the adversary
greater freedom to alter the data.

The choice of a suitable distance measure $d : \mathcal X \times \mathcal X \mapsto \mathbb{R}^{+}$ is application specific~\cite{dalvi04,lowd05,nelson12-jmlr}.
Such a distance measure
should reflect the adversary's effort required to manipulate samples
or the cost of these manipulations.
For example, in spam filtering, the attacker may be bounded by a certain
number of words she can manipulate, so as not to lose the semantics
of the spam message.

\medskip
\noindent \textbf{Limited knowledge (LK).} Here, we again assume that the adversary aims to minimize the
discriminant function $g(\mathbf x)$ under the same constraint that
each transformed attack point must remain within a maximum distance of $d_{\rm max}$ from the corresponding original attack sample.
We further assume that the attacker knows the feature
representation and the type of the classifier,
but does not know either the learned classifier $f$ or its training data $\mathcal D$,
and hence can not directly compute $g(\mathbf x)$.
However, we assume that she can collect a surrogate dataset $\mathcal D^{\prime} = \{\hat{\mathbf x}_{i}, \hat y_{i}\}_{i=1}^{n_{q}}$ of $n_{q}$ samples drawn from the same underlying distribution $p(\mathbf X,Y)$ from which $\mathcal D$ was drawn.
This data may be collected by an adversary in
several ways; \emph{e.g.}, by sniffing some network traffic during the
classifier operation, or by collecting legitimate and spam
emails from an alternate source.

Under this scenario, the adversary proceeds by approximating the
discriminant function $g(\mathbf x)$ as $\hat g(\mathbf x)$, where $\hat g(\mathbf x)$ is the discriminant function of a surrogate classifier $\hat f$ learnt on $\mathcal D^{\prime}$. The amount of the surrogate data, $n_{q}$, is an attack parameter in our experiments.
Since the adversary wants her surrogate $\hat f$ to closely approximate the
targeted classifier $f$, it stands to reason that she should learn
$\hat f$ using the labels assigned by the targeted classifier $f$, when such feedback is available. In this case, instead of using the true class labels $\hat y_{i}$ to train $\hat f$, the adversary can query $f$ with the samples of $\mathcal D^{\prime}$ and subsequently learn using the labels $\hat{y}^{c}_{i} = f(\hat{\mathbf x}_{i})$ for each ${\mathbf x}_{i}$.

\subsection{Attack strategy}
\label{sect:attack-strategy}

Under the above assumptions, for any target malicious sample $\mathbf x^{0}$ (the adversary's desired instance), an optimal attack strategy finds a sample $\mathbf x^{\ast}$ to minimize $g(\cdot)$ or its estimate $\hat g(\cdot)$, subject to a bound on its distance\footnote{One can also incorporate additional application-specific constraints on the attack samples. For instance, the box constraint $0 \leq x_f \leq 1$ can be imposed if the \nth{f}{th} feature is normalized in $[0,1]$, or $x^{0}_f \leq x_f$ can be used if the \nth{f}{th} feature of the target $\mathbf x^{0}$ can be only incremented.} from $\mathbf x^{0}$:
\begin{eqnarray}
\label{eq:evasion-obj} \mathbf x^{\ast} = \arg \min_{\mathbf x} & \; & \hat g(\mathbf x)  \\
\nonumber \rm{s.t.} & \; & d(\mathbf x,\mathbf x^{0}) \leq d_{\rm max}.
\end{eqnarray}

Generally, this is a non-linear optimization problem. One may approach
it with many well-known techniques, like gradient descent, or
quadratic techniques such as Newton's method, BFGS, or L-BFGS. We
choose a gradient-descent procedure. However, $\hat g(\mathbf x)$ may
be non-convex and descent approaches may not achieve a global optima.
Instead, the descent path may lead to a flat region (local minimum)
outside of the samples' support (\emph{i.e.}, where $p(\mathbf x) \approx 0$)
where the attack sample may or may not evade depending on the behavior
of $g$ in this unsupported region (see left and middle plots in
Figure~\ref{fig:attack-strategy}).

\begin{figure}[htb]
\begin{center}
\includegraphics[width=0.49\textwidth]{fig/gradient-success.pdf}
\includegraphics[width=0.49\textwidth]{fig/gradient-failure.pdf}
\includegraphics[width=0.49\textwidth]{fig/mimicry.pdf}
\caption{Different scenarios for gradient-descent-based evasion procedures. In each, the function $g(\mathbf x)$ of the learned classifier is plotted with a color map with high values (red-orange-yellow) for the malicious class, and low values (green-cyan-blue) for the legitimate class. The decision boundary is shown in black. For every malicious sample, we plot the gradient descent path against a classifier with a closed boundary around the malicious class (\textbf{top-left}) and against a classifier with a closed boundary around the benign class (\textbf{top-right}). Finally, we plot the modified objective function of Eq.~\eqref{eq:obj-function} and the resulting descent paths against a classifier with a closed boundary around the benign class (\textbf{bottom}).}
\label{fig:attack-strategy}
\end{center}
\end{figure}

Locally optimizing $\hat{g}(\mathbf x)$ with gradient descent is
particularly susceptible to failure due to the nature of a discriminant function.
Besides its shape, for many classifiers, $g(\mathbf x)$ is equivalent
to a posterior estimate $p(\classifierLBL=-1 | \mathbf x)$; \emph{e.g.}, for
neural networks, and SVMs \cite{platt99}.
The discriminant function does not incorporate the evidence we have
about the data distribution, $p(\mathbf x)$, and thus, using gradient
descent to optimize Eq.~\ref{eq:evasion-obj} may lead into unsupported
regions ($p(\mathbf x) \approx 0$).
Because of the insignificance of these regions, the value of $g$ is relatively unconstrained by criteria such as risk minimization.
This problem is compounded by our finite (and possibly small) training set, since it provides little evidence in these regions to constrain the shape of $g$.
Thus, when our gradient descent procedure produces an evasion example
in these regions, the attacker cannot be confident that this sample
will actually evade the corresponding classifier.
Therefore, to increase the probability of successful evasion, the
attacker should favor attack points from densely populated regions of
legitimate points, where the estimate $\hat g(\mathbf x)$ is more reliable
(closer to the real $g(\mathbf x)$), and tends to become negative in value.

To overcome this shortcoming, we introduce an additional component into our attack objective, which estimates $p(\mathbf x | \classifierLBL=-1)$ using a density estimator. This term acts as a penalizer for $\mathbf x$ in low density regions and is weighted by a parameter $\lambda \ge 0$ yielding the following modified optimization problem:
\begin{eqnarray}
\label{eq:obj-function}
\arg \min_x & &  F(\mathbf x) = \hat g(\mathbf x) - \frac{\lambda}{n} \sum_{i | \classifierLBL[i] = -1} k \left( \tfrac{\mathbf x-\mathbf x_{i}}{h} \right) \\
\label{eq:constraint}
\rm{s.t.} & & d(\mathbf x,\mathbf x^{0}) \leq d_{\rm max} \enspace,
\end{eqnarray}
where $h$ is a bandwidth parameter for a kernel density estimator (KDE), and $n$ is the number of benign samples ($\classifierLBL=-1$) available to the adversary.
This alternate objective trades off between minimizing $\hat g(\mathbf x)$ (or $p(\classifierLBL=-1 | \mathbf x)$) and maximizing the estimated density $p(\mathbf x | \classifierLBL=-1)$.
The extra component favors attack points that imitate features of known legitimate samples.
In doing so, it reshapes the objective function and thereby biases the resulting gradient descent towards regions where the negative class is concentrated (see the bottom plot in Fig.~\ref{fig:attack-strategy}).
This produces a similar effect to that shown by \emph{mimicry} attacks in network intrusion detection~\cite{fogla06}.\footnote{Mimicry attacks \cite{fogla06} consist of camouflaging malicious network packets to evade anomaly-based intrusion detection systems by mimicking the characteristics of the legitimate traffic distribution.}
For this reason, although our setting is rather different, in the sequel we refer to this extra term as the \emph{mimicry} component.

Finally, we point out that, when mimicry is used ($\lambda > 0$), our gradient descent clearly follows a suboptimal path compared to the case when only $g(\mathbf x)$ is minimized ($\lambda = 0$). Therefore, more modifications may be required to reach the same value of $g(\mathbf x)$ attained when $\lambda=0$. However, as previously discussed, when $\lambda=0$, our descent approach may terminate at a local minimum where $g(\mathbf x)>0$, without successfully evading detection. This behavior can thus be qualitatively regarded as a trade-off between the probability of evading the targeted classifier and the number of times that the adversary must modify her samples.

\section{Gradient descent attacks}
\label{sect:gradient-descent}

Algorithm~\ref{lab:attack} solves the optimization problem in Eq.~\ref{eq:obj-function} via gradient descent. We assume $g(\mathbf x)$ to be differentiable almost everywhere (subgradients may be used at discontinuities).
However, note that if $g$ is non-differentiable or insufficiently smooth,
one may still use the mimicry / KDE term of Eq.~\eqref{eq:obj-function} as a search heuristic. This investigation is left to future work.

\begin{algorithm}[t]
  \caption{Gradient-descent evasion attack}
  \textbf{Input:} $\mathbf x^{0}$, the initial attack point; $t$, the step size; $\lambda$, the trade-off parameter; $\epsilon > 0$ a small constant.\\
  \textbf{Output:} $\mathbf x^{*}$, the final attack point.
  \begin{algorithmic}[1]
    \STATE{$m \gets 0$.}
    \REPEAT
          \STATE{$m \gets m + 1$}
      \STATE{Set $\nabla F(\mathbf x^{m-1})$ to a unit vector aligned
      with $\nabla g(\mathbf x^{m-1}) - \lambda \nabla{p(\mathbf x^{m-1} | \classifierLBL=-1)}$.}
     \STATE{$\mathbf x^{m} \leftarrow \mathbf x^{m-1} - t \nabla F(\mathbf x^{m-1})$}
     \IF{$d(\mathbf x^{m},\mathbf x^{0}) > d_{\rm max}$}
     \STATE{Project $\mathbf x^{m}$ onto the boundary of the feasible region.}
     \ENDIF
      \UNTIL{$F\left(\mathbf x^{m}\right) - F\left( \mathbf x^{m-1}\right) < \epsilon$}
      \STATE{\textbf{return:} $\mathbf x^{*} = \mathbf x^{m}$}
  \end{algorithmic}\label{lab:attack}
\end{algorithm}

\subsection{Gradients of discriminant functions}
\label{sect:gradient-disc}

\bigskip
\noindent \textbf{Linear classifiers.} Linear discriminant functions are $g(\mathbf x) = \langle \mathbf w, \mathbf x \rangle + b$ where $\mathbf w \in \mathbb{R}^{d}$ is the feature weights and $b \in \mathbb{R}$ is the bias. Its gradient is $\nabla g(\mathbf x) = \mathbf w$.

\bigskip
\noindent \textbf{Support vector machines.} For SVMs, $g(\mathbf x) = \sum_i \alpha_i y_i k(\mathbf x,\mathbf x_{i}) + b$. The gradient is thus $\nabla g(\mathbf x) = \sum_i \alpha_i y_i \nabla k(\mathbf x,\mathbf x_{i})$. In this case, the feasibility of our
approach depends on whether the kernel gradient $\nabla k(\mathbf x,\mathbf x_{i})$ is computable as it is for many numeric kernels. For instance, the gradient of the RBF kernel, $k(\mathbf x,\mathbf x_{i}) = \exp\{-\gamma \|\mathbf x-\mathbf x_{i}\|^2\}$, is $\nabla k(\mathbf x,\mathbf x_{i}) = -2 \gamma \exp\{-\gamma \|\mathbf x-\mathbf x_{i}\|^2\}(\mathbf x-\mathbf x_{i})$, and for the polynomial kernel, $k(\mathbf x,\mathbf x_{i}) = (\langle \mathbf x, \mathbf x_{i} \rangle + c)^{p}$, it is $\nabla k(\mathbf x,\mathbf x_{i}) = p(\langle \mathbf x, \mathbf x_{i} \rangle + c)^{p-1}\mathbf x_{i}$.

\bigskip
\noindent \textbf{Neural networks.} For a multi-layer perceptron with a single hidden layer of $m$ neurons and a sigmoidal activation function, we decompose its discriminant function $g$ as follows (see Fig.~\ref{fig:nnet}):
 $g(\mathbf x) = (1+e^{-h(\mathbf x)})^{-1}$, $h(\mathbf x) = \sum_{k=1}^{m} w_{k} \delta_{k}(\mathbf x) + b$, $\delta_{k}(\mathbf x) = (1+e^{-h_{k}(\mathbf x)})^{-1}$,
 $h_{k}(\mathbf x) = \sum_{j=1}^{d} v_{kj} x_{j} + b_{k}$. From the chain rule, the $i^\textrm{th}$ component of $\nabla g(\mathbf x)$ is thus given by:
\[
\tfrac{\partial g}{\partial x_{i}} = \tfrac{\partial g}{\partial h} \textstyle\sum_{k=1}^{m} \tfrac{\partial h}{\partial \delta_{k}}  \tfrac{\partial \delta_{k}}{\partial h_{k}} \tfrac{\partial h_{k}}{\partial x_{i}}=
g(\mathbf x)(1- g(\mathbf x)) \textstyle\sum_{k=1}^{m} w_{k} \delta_{k}(\mathbf x) (1-\delta_{k}(\mathbf x)) v_{ki}
\enspace.
\]

\begin{figure}[t]
\begin{center}
\includegraphics[width=0.4\textwidth]{fig/mlp_arch.pdf}
\caption{The architecture of a multi-layer perceptron with a single hidden layer.}
\label{fig:nnet}
\end{center}
\end{figure}

\subsection{Gradients of kernel density estimators}
\label{sect:gradients-kde}

Similarly to SVMs, the gradient of kernel density estimators depends on the kernel gradient.
We consider generalized RBF kernels of the form $k \left (\frac{\mathbf x-\mathbf x_{i}}{h} \right ) = \exp{\left (  -\frac{d(\mathbf x,\mathbf x_{i})}{h}\right )}$, where $d(\cdot,\cdot)$ is any suitable distance function.
Here we use the same distance $d(\cdot,\cdot)$ defined in Eq.~\eqref{eq:constraint},
but, in general, they can be different.
For $\ell_{2}$- and $\ell_{1}$-norms (\emph{i.e.}, RBF and Laplacian kernels), the KDE (sub)gradients are respectively given by:
\begin{eqnarray*}
-\tfrac{2}{n h} \textstyle\sum_{i | \classifierLBL[i] = -1}  \exp{\left (  -\tfrac{ \|\mathbf x-\mathbf x_{i}\|^{2}_2 }{h}\right )} (\mathbf x - \mathbf x_{i}) \enspace, \\
-\tfrac{1}{n h} \textstyle\sum_{i | \classifierLBL[i] = -1}  \exp{\left (  -\tfrac{ \|\mathbf x-\mathbf x_{i}\|_1}{h}\right )} (\mathbf x - \mathbf x_{i}) \enspace.
\end{eqnarray*}

Note that the scaling factor here is proportional to $O(\frac{1}{nh})$.
Therefore, to influence gradient descent with a significant mimicking effect, the value of $\lambda$ in the objective function should be chosen such that the value of $\frac{\lambda}{nh}$ is comparable with (or higher than) the range of values of the discriminant function $\hat g(\mathbf x)$.

\subsection{Descent in discrete spaces}

In discrete spaces, gradient approaches travel through
infeasible portions of the feature space. In such cases, we need to find
a feasible neighbor $\mathbf x$ that
maximally decrease $F(\mathbf x)$.  A simple approach to this problem is to
probe $F$ at every point in a small neighborhood of $\mathbf x$,
which would however require a large number of queries. For classifiers
with a differentiable decision function, we can instead select the neighbor
whose change best aligns with $\nabla F(\mathbf x)$ and decreases the objective function; \emph{i.e.}, to prevent overshooting a minimum.

\section{Experiments}
\label{sect:experiments}

In this section, we first report a toy example from the
MNIST handwritten digit classification task
\cite{LeCun95} to visually demonstrate how the
proposed algorithm modifies digits to mislead classification.
We then show the effectiveness of the proposed attack on a more
realistic and practical scenario: the detection of malware in PDF
files.

\subsection{A toy example on handwritten digits}
\label{sect:toy-example}

Similar to Globerson and Roweis~\cite{globerson-ICML06}, we consider
discriminating between two distinct digits from the MNIST
dataset~\cite{LeCun95}.  Each digit example is represented as a
gray-scale image of $28 \times 28$ pixels
arranged in raster-scan-order to give feature vectors of $d = 28 \times 28 = 784$ values.  We normalized each feature (pixel)
$\mathbf x \in [0,1]^{d}$ by dividing its value by $255$, and we
constrained the attack samples to this range.  Accordingly, we
optimized Eq.~\eqref{eq:obj-function}
subject to $0 \leq x_f \leq 1$ for all $f$.

\begin{figure}[t]
\begin{center}
\includegraphics[width=0.78\textwidth]{fig/3_vs_7_lin_0.pdf}\\
\includegraphics[width=0.78\textwidth]{fig/3_vs_7_lin_10.pdf}
\caption{Illustration of the gradient attack on the digit data, for $\lambda = 0$ (\textbf{top row}) and $\lambda=10$ (\textbf{bottom row}). Without a mimicry component ($\lambda = 0$) gradient descent quickly decreases $g$ but the resulting attack image does not resemble a ``7''. In contrast, the attack minimizes $g$ slower when mimicry is applied ($\lambda = 0$) but the final attack image closely resembles a mixture between ``3'' and ``7'', as the term ``mimicry'' suggests.
}
\label{fig:mnist}
\end{center}
\end{figure}

We only consider the perfect knowledge (PK) attack scenario.
We used the \emph{Manhattan} distance ($\ell_{1}$-norm), $d$, both for the kernel density
estimator (\emph{i.e.}, a Laplacian kernel) and for the
constraint $d(\mathbf x,\mathbf x^{0}) \leq d_{\rm max}$ in Eq.~\eqref{eq:constraint},
which bounds the total difference between the gray level
values of the original image $\mathbf x^{0}$ and the attack image $\mathbf x$.
We used $d_{\rm max} = \frac{5000}{255}$ to limit
the total gray-level change to $5000$. At
each iteration, we increased the $\ell_{1}$-norm value of $\mathbf x-\mathbf x^{0}$ by
$\frac{10}{255}$, or equivalently, we changed the total gray level by $10$. This is effectively the gradient step size.
The targeted classifier was an SVM with the linear kernel and $C=1$. We randomly chose $100$ training samples and applied the attacks to a correctly-classified positive sample.

In Fig.~\ref{fig:mnist} we illustrate gradient attacks in which a ``3'' is to be
misclassified as a ``7''.
The left image shows the initial attack point, the middle image shows
the first attack image misclassified as legitimate, and the right
image shows the attack point after 500 iterations.  When $\lambda=0$,
the attack images exhibit only a weak resemblance to the target class
``7'' but are, nevertheless, reliably misclassified. This is the same
effect demonstrated in the top-left plot of
Fig.~\ref{fig:attack-strategy}: the classifier is evaded by making
the attack sample sufficiently dissimilar from the malicious class.  Conversely, when $\lambda=10$, the attack images strongly resemble the target class
because the mimicry term favors samples that are more similar to the
target class. This is the same effect seen in the bottom
plot of Fig.~\ref{fig:attack-strategy}.

Finally note that, as expected, $g(\mathbf x)$ tends to decrease more gracefully when mimicry is used, as we follow a suboptimal descent path.
Since the targeted classifier can be easily evaded when $\lambda=0$, exploiting the mimicry component would not be the optimal choice in this case. However, in the case of limited knowledge, as discussed at the end of Section~\ref{sect:attack-strategy}, mimicry may allow us to trade for a higher probability of evading the targeted classifier, at the expense of a higher number of modifications.

\subsection{Malware detection in PDF files}
\label{sect:malware-pdf}

We now focus on the task of discriminating between legitimate and
malicious PDF files, a popular medium for disseminating
malware~\cite{IBM}. PDF files are excellent vectors for
malicious-code, due to their flexible \emph{logical structure}, which
can described by a hierarchy of interconnected objects.
As a result, an attack can
be easily hidden in a PDF to circumvent file-type filtering.
The PDF format further allows a wide variety of
resources to be embedded in the document including \texttt{JavaScript},
\texttt{Flash}, and even binary programs. The type of the
embedded object is specified by \emph{keywords}, and its content is in
a \emph{data stream}.  Several recent works proposed machine-learning
techniques for detecting malicious PDFs using the file's logical
structure to accurately identify the malware~\cite{maiorca,Smutz,Srndic}.
In this case study, we use the feature representation
of Maiorca~\emph{et al.}~\cite{maiorca} in which each feature corresponds to the tally of occurrences of a given keyword.

The PDF structure imposes natural constraints on attacks.  Although
it is difficult to \emph{remove} an embedded object (and
its keywords) from a PDF without corrupting the PDF's file
structure, it is rather easy to \emph{insert} new objects (and, thus,
keywords) through the addition of a new \emph{version} to the PDF
file~\cite{Refer}.  In our feature representation, this is equivalent
to allowing only feature increments, \emph{i.e.}, requiring $\mathbf x^{0} \leq \mathbf x$ as
an additional constraint in the optimization problem given by
Eq.~\eqref{eq:obj-function}.  Further, the total difference in keyword
counts between two samples is their
\emph{Manhattan} distance, which we again use for the kernel
density estimator and the constraint in
Eq.~\eqref{eq:constraint}. Accordingly, $d_{\rm max}$ is the
maximum number of additional keywords that an attacker
can add to the original $\mathbf x^{0}$.

\medskip
\noindent \textbf{Experimental setup.} For experiments, we used a PDF corpus with
500 malicious samples from the \emph{Contagio}
dataset\footnote{\url{http://contagiodump.blogspot.it}} and 500 benign
samples collected from the web. We randomly split the data into five
pairs of training and testing sets with 500 samples each to average
the final results. The features (keywords) were extracted from each
training set as described in \cite{maiorca}. On average, $100$ keywords were found in each run.
Further, we also bounded the maximum value of each feature to $100$, as this value was found to be close to the $95^{\rm th}$ percentile for each feature. This limited the influence of outlying samples.

We simulated the \emph{perfect} knowledge (PK) and the \emph{limited} knowledge (LK) scenarios described in Section~\ref{subsect:adv-model}. In the LK case, we set the number of samples used to learn the surrogate classifier to $n_{g} =100$. The reason is to demonstrate that even with a dataset as small as the 20\% of the original training set size, the adversary may be able to evade the targeted classifier with high reliability.
Further, we assumed that the adversary uses feedback from the \emph{targeted} classifier $f$; \emph{i.e.}, the labels $\hat y^{c}_{i} =  f(\hat{\mathbf x}_{i})$ for each surrogate sample $\hat {\mathbf x}_{i} \in \mathcal D^{\prime}$.\footnote{Similar results were also obtained using the true labels (without relabeling), since the targeted classifiers correctly classified almost all samples in the test set.}

As discussed in Section~\ref{sect:gradients-kde}, the value of $\lambda$ is chosen according to the scale of the discriminant function $g(\mathbf x)$, the bandwidth parameter $h$ of the kernel density estimator, and the number of legitimate samples $n$ in the surrogate training set.
For computational reasons, to estimate the value of the KDE at $\mathbf x$, we only consider the $50$ nearest (legitimate) training samples to $\mathbf x$; therefore, $n \leq 50$ in our case.
The bandwidth parameter was set to $h=10$, as this value provided a proper rescaling of the Manhattan distances observed in our dataset for the KDE. We thus set $\lambda = 500$ to be comparable with $O(nh)$.

For each targeted classifier and training/testing pair, we learned five surrogate classifiers by randomly selecting $n_{g}$ samples from the test set, and we averaged their results.
For SVMs, we sought a surrogate classifier that would correctly match the labels from the targeted classifier; thus, we used parameters $C=100$, and $\gamma=0.1$ (for the RBF kernel) to heavily penalize training errors.

\begin{figure}[htbp]
\begin{center}
\includegraphics[width=0.495\textwidth]{fig/linear.pdf}
\includegraphics[width=0.495\textwidth]{fig/linear_mimicry.pdf}
\includegraphics[width=0.495\textwidth]{fig/rbf.pdf}
\includegraphics[width=0.495\textwidth]{fig/rbf_mimicry.pdf}
\includegraphics[width=0.495\textwidth]{fig/mlp.pdf}
\includegraphics[width=0.495\textwidth]{fig/mlp_mimicry.pdf}
\caption{Experimental results for SVMs with linear and RBF kernel (first and second row), and for neural networks (third row). We report the FN values (attained at FP=0.5\%) for increasing $d_{\rm max}$. For the sake of readability, we report the average FN value $\pm$ half standard deviation (shown with error bars). Results for perfect (PK) and limited (LK) knowledge attacks with $\lambda=0$ (without mimicry) are shown in the first column, while results with $\lambda=500$ (with mimicry) are shown in the second column. In each plot we considered different values of the classifier parameters, \emph{i.e.}, the regularization parameter $C$ for the linear SVM, the kernel parameter $\gamma$ for the SVM with RBF kernel, and the number of neurons $m$ in the hidden layer for the neural network, as reported in the plot title and legend.}
\label{fig:results}
\end{center}
\end{figure}

\medskip
\noindent \textbf{Experimental results.} We report our results in Figure~\ref{fig:results}, in terms of the
false negative (FN) rate attained by the targeted classifiers
as a function of the maximum allowable number of modifications, $d_{\rm max} \in [0, 50]$. We compute the FN rate corresponding to a fixed false positive (FP) rate of FP$=0.5\%$. For $d_{\rm max}=0$, the FN rate
corresponds to a standard performance evaluation
using unmodified PDFs.
As expected, the FN rate increases with $d_{\rm max}$ as the PDF is increasingly modified. Accordingly, a more secure classifier will exhibit a more
graceful increase of the FN rate.

\smallskip
\noindent \textit{Results for $\lambda=0$.} We first investigate the effect of the proposed attack in the PK case,
without considering the mimicry component (Figure~\ref{fig:results},
first column), for varying parameters of the considered classifiers.
The linear SVM (Figure~\ref{fig:results}, top-left plot) is almost
always evaded with as few as $5$ to $10$ modifications, independent of the
regularization parameter $C$.
It is worth noting that attacking a linear classifier
amounts to always incrementing the value of the same highest-weighted feature (corresponding to the \texttt{/Linearized} keyword in the majority of the cases) until it reaches its upper bound.
This continues with the next highest weighted non-bounded feature until termination. This occurs simply because the gradient of $g(\mathbf x)$ does not depend on $\mathbf x$ for a linear classifier (see Section~\ref{sect:gradient-disc}).
With the RBF kernel (Figure~\ref{fig:results}, middle-left plot), SVMs
exhibit a similar behavior with $C=1$ and various values of its
$\gamma$ parameter,\footnote{We also conducted experiments using $C=0.1$ and
  $C=100$, but did not find significant differences compared to the
  presented results using $C=1$.} and the RBF SVM provides a higher degree of security compared
to linear SVMs (\emph{cf.} top-left plot and middle-left plot in
Figure~\ref{fig:results}). Interestingly, compared to SVMs, neural networks  (Figure~\ref{fig:results}, bottom-left plot) seem to be much more robust against the proposed evasion attack. This behavior can be explained by observing that the decision function of neural networks may be characterized by flat regions (\emph{i.e.}, regions where the gradient of $g(\mathbf x)$ is close to zero). Hence, the gradient descent algorithm based solely on $g(\mathbf x)$ essentially stops after few attack iterations for most of the malicious samples, without being able to find a suitable attack.

In the LK case, without mimicry, classifiers are evaded with a probability only \emph{slightly} lower than that found in the PK case, even
when only $n_{g}=100$ surrogate samples are used to learn the surrogate classifier. This aspect highlights the threat posed by a skilled adversary with incomplete knowledge: only a small set of samples may be required to successfully attack the target classifier using the proposed algorithm.

\smallskip
\noindent \textit{Results for $\lambda=500$.} When mimicry is used (Figure~\ref{fig:results}, second column), the success of the evasion of linear SVMs (with $C=1$) decreases both in the PK
 (\emph{e.g.}, compare the blue curve in the top-left plot with the solid blue curve in the top-right plot)
and LK case
 (\emph{e.g.}, compare the dashed red curve in the top-left plot with the dashed blue curve in the top-right plot).
The reason is that the computed direction tends to lead to a slower descent; \emph{i.e.}, a less direct path that often requires more modifications to evade the classifier.
In the non-linear case (Figure~\ref{fig:results}, middle-right and bottom-right plot), instead, mimicking exhibits some beneficial aspects for the attacker, although the constraint on feature addition may make it difficult to properly mimic legitimate samples. In particular, note how the targeted SVMs with RBF kernel (with $C=1$ and $\gamma=1$) in the PK case (\emph{e.g.}, compare the solid blue curve in the middle-left plot with the solid blue curve in the middle-right plot) is evaded with a significantly higher probability than in the case of $\lambda=0$.
The reason is that, as explained at the end of Section~\ref{sect:attack-strategy}, a pure descent strategy on $g(\mathbf x)$ may find local minima (\emph{i.e.}, attack samples) that do not evade detection, while the mimicry component biases the descent towards regions of the feature space more densely populated by legitimate samples, where $g(\mathbf x)$ eventually attains lower values.
For neural networks, this aspect is even more evident, in both the PK and LK settings (compare the dashed/solid curves in the bottom-left plot with those in the bottom-right plot), since $g(\mathbf x)$ is essentially flat far from the decision boundary, and thus pure gradient descent on $g$ can not even commence for many malicious samples, as previously mentioned. In this case, the mimicry term is thus critical for finding a reasonable descent path to evasion.

\medskip
\noindent \textbf{Discussion.} Our attacks raise questions about the feasibility of detecting
malicious PDFs solely based on logical structure. We found that \texttt{/Linearized}, \texttt{/OpenAction}, \texttt{/Comment}, \texttt{/Root} and \texttt{/PageLayout} were among the most commonly manipulated keywords. They indeed are found mainly in
legitimate PDFs, but can be easily added to malicious PDFs by the
versioning mechanism. The attacker can simply insert comments inside
the malicious PDF file to augment its \texttt{/Comment} count.
Similarly, she can embed \emph{legitimate} OpenAction code to add
\texttt{/OpenAction} keywords or  add new pages to insert
\texttt{/PageLayout} keywords.

\section{Conclusions, limitations and future work}
\label{sect:conclusions}

In this work we proposed a simple algorithm for evasion of classifiers
with differentiable discriminant functions. We investigated the attack
effectiveness in the case of perfect and limited knowledge of the
attacked system, and empirically showed that very popular
classification algorithms (in particular, SVMs and neural networks)
can still be evaded with high probability even if the adversary can
only learn a copy of the classifier from a small surrogate dataset.
Thus, our investigation raises important questions on whether such
algorithms can be reliably employed in security-sensitive
applications.

We believe that the proposed attack formulation can be extended to classifiers with non-differentiable discriminant functions as well, such as decision trees and $k$-nearest neighbors; \emph{e.g.}, by defining suitable search heuristics similar to our mimicry term to minimize $g(\mathbf x)$.

Interestingly our analysis also suggests improvements for classifier
security.  From Fig.~\ref{fig:attack-strategy}, it is clear that a
tighter \emph{enclosure} of the legitimate samples increasingly forces
the adversary to mimic the legitimate class, which may not always be
possible; \emph{e.g.}, malicious network packets or PDF files must contain a
valid exploit for the attack to be successful.
Accordingly, more secure classifiers can be designed by employing
regularization terms that promote
enclosure of the legitimate class; \emph{e.g.}, by penalizing ``blind spots''
- regions with low $p(\mathbf x)$ - classified as legitimate.
Alternatively, one may explicitly model the attack distribution, as in \cite{biggio11-smc};
or add the generated attack samples to the training set.
Nevertheless, improving
security probably must be balanced with a higher FP rate.

In our example applications, the feature representations could be \emph{inverted} to obtain a corresponding real-world objects (\emph{e.g.}, spam emails, or PDF files); \emph{i.e.}, it is straightforward to manipulate the given real-world object to obtain the desired feature vector $\mathbf x^{*}$ of the \emph{optimal} attack.
However, in practice some complex feature mappings can not be easily inverted; \emph{e.g.}, $n$-gram features~\cite{fogla06}.
Another idea would be to modify the real-world object at each step of the gradient descent to obtain a sample in the feature space which is as close as possible to the sample that would be obtained at the next attack iteration. A similar technique has been already exploited by \cite{biggio12-icml} to overcome the pre-image problem.

Other interesting extensions of our work may be to (\emph{i}) consider
more effective strategies such as those proposed by
\cite{lowd05,nelson12-jmlr} to build a small but representative set of
surrogate data; and (\emph{ii}) improve the classifier estimate $\hat
g(\mathbf x)$. To this end, one may exploit ensemble techniques such
as bagging or the random subspace method to train several classifiers
and then average their output.

\subsubsection*{Acknowledgments.} This work has been partly supported by the project CRP-18293, L.R. 7/2007, Bando 2009, and by the project ``Advanced and secure sharing of multimedia data over social networks in the future Internet'' (CUP F71J11000690002), both funded by Regione Autonoma della Sardegna. Davide Maiorca gratefully acknowledges Regione Autonoma della Sardegna for the financial support of his PhD scholarship. Blaine Nelson thanks the Alexander von Humboldt Foundation for providing additional financial support. The opinions expressed in this paper are solely those of the authors and do not necessarily reflect the opinions of any sponsor.

redpajama_set_name: RedPajamaArXiv