Feature Cross-Substitution in Adversarial Classification