Active defense method and device for backdoor attacks in edge computing scenarios

Abstract

The present application discloses a method and device for active defense against backdoor attacks in edge computing scenarios, wherein the method includes: generating an initial set of optional operations based on optional operations for improving the generalization capability of a model, and constructing a configuration parameter set for each operation in the set; screening out a first subset of optional operations whose configuration parameters of the optional operations and the accuracy curve of the model present a monotonically decreasing concave function characteristic; screening out a second subset of optional operations whose configuration parameters of the optional operations and the curve of the probability of a successful backdoor attack on the model present a monotonically decreasing convex function characteristic, and constructing a corresponding mutation characteristic set; determining the final parameter setting value of the optional operation to actively defend against possible backdoor attacks. The method of the embodiment of the present application can effectively improve network security in edge computing scenarios, has the characteristics of high stability and strong resistance, and is more suitable for deployment and application in real scenarios.

Description

Technical Field

[0001] The present application relates to the field of Internet security technology, and in particular to a method and device for active defense against backdoor attacks in edge computing scenarios. Background Art

[0002] Thanks to the rapid development of mobile internet and wireless communication technologies, the relevant theories and technologies for edge computing networks have matured, further promoting their widespread adoption. At the same time, a large number of network anomalies, such as traffic anomalies caused by SYN flooding attacks, are currently present. To protect against potential attacks at the edge network and reduce the risk of attacks on the backbone network, many anomaly detection models based on deep learning are deployed on edge nodes in edge networks. However, compared to cloud computing, edge nodes have significantly limited device resources, such as poor computing performance and storage capacity, making it difficult to meet the computing power and data requirements for deep learning training. Furthermore, edge nodes have limited access to a limited number of anomaly samples, and their training data may contain private information that is difficult to disclose. Through collaborative learning, edge nodes in an edge computing network can not only reduce the data volume and computing power requirements, but also eliminate the need to disclose their own training data. Edge nodes simply share trained models with other edge nodes to obtain intelligent models capable of processing all data samples (including their own training data and that of other edge nodes), thereby benefiting from the performance improvements brought by the training data of other edge nodes.

[0003] However, since each edge node in an edge computing network is independent, once compromised by a malicious attacker, other edge nodes remain unaware. Without other edge nodes' knowledge, an attacker can modify the training data of the attacked edge node to implant a backdoor into the deep learning model, thereby carrying out a backdoor attack. A backdoor attack, as described here, involves tampering with certain features of the training data to create a trigger for the attack and simultaneously changing the labels of the training data to specific, incorrect labels. The malicious attacker then manipulates the attacked edge node and uses the tampered data to train the model. Once the backdoored model is synchronized to other unattacked edge nodes, the deep learning models of those other edge nodes will also be backdoored. The deep learning model functions normally when it encounters no samples containing the trigger. However, when it encounters a sample containing the trigger, the model will output an incorrect result specified by the attacker. Therefore, backdoor attacks targeting collaborative learning in edge computing scenarios are extremely difficult to detect.

[0004] Application Contents

[0005] The present application aims to solve one of the technical problems in the related art at least to a certain extent.

[0006] To this end, the first purpose of this application is to propose an active defense method for backdoor attacks in edge computing scenarios. This method can effectively improve network security in edge computing scenarios, has the characteristics of high stability and strong resistance, and is more suitable for deployment and application in real scenarios.

[0007] The second purpose of this application is to propose an active defense device for backdoor attacks in edge computing scenarios.

[0008] The third objective of this application is to provide an electronic device.

[0009] The fourth object of this application is to provide a computer-readable storage medium.

[0010] To achieve the above-mentioned objectives, the first embodiment of the present application proposes a method for active defense against backdoor attacks in an edge computing scenario, comprising the following steps: generating an initial optional operation set based on optional operations used to improve the generalization capability of the model, and constructing a configuration parameter set for each operation in the set; screening out a first optional operation subset from the initial optional operation set, in which the curve between the configuration parameters of the optional operation and the accuracy of the model presents a monotonically decreasing concave function characteristic; screening out a second optional operation subset from the initial optional operation set, in which the curve between the configuration parameters of the optional operation and the probability of successful backdoor attack on the model presents a monotonically decreasing convex function characteristic; constructing a corresponding mutation characteristic set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula; for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, determining the final parameter setting value of the optional operation according to its corresponding mutation characteristic set, so as to actively defend against possible backdoor attacks.

[0011] The active defense method for backdoor attacks in edge computing scenarios in the embodiments of the present application can proactively defend against backdoor attacks against collaborative learning in edge computing scenarios by finding qualified hyperparameters based on a specific formula without human intervention. This method does not require the cooperation of other edge nodes, nor does it require knowledge of which edge nodes have been manipulated by the attacker as malicious edge nodes. This method is highly stable and resilient in proactively defending against backdoor attacks against collaborative learning in edge computing scenarios, effectively improving network security in edge computing scenarios and making it more suitable for deployment and application in real-world scenarios.

[0012] In addition, the method for actively defending against backdoor attacks in edge computing scenarios according to the above-mentioned embodiments of the present application may also have the following additional technical features:

[0013] Optionally, in one embodiment of the present application, an initial set of optional operations is generated based on optional operations for improving the generalization capability of the model, and a configuration parameter set is constructed for each operation in the set, including: constructing an initial set of optional operations related to the generalization capability of the model; and constructing a configuration parameter set for each optional operation.

[0014] Optionally, in one embodiment of the present application, the first optional operation subset whose configuration parameters of the optional operations and the accuracy curve of the model present a monotonically decreasing concave function characteristic is screened out from the initial optional operation set, including: constructing a set of two-tuples of configuration parameters and model accuracy; screening the optional operation subset that conforms to the preset monotonically decreasing concave function characteristic.

[0015] Optionally, in one embodiment of the present application, the second optional operation subset filtered out from the initial optional operation set, wherein the curve between the configuration parameters of the optional operations and the probability of the model being successfully attacked by a backdoor presents a monotonically decreasing convex function characteristic, includes: constructing a set of two-tuples of configuration parameters and the probability of the model being successfully attacked by a backdoor; and filtering the optional operation subset that conforms to the preset monotonically decreasing convex function characteristic.

[0016] Optionally, in one embodiment of the present application, constructing a corresponding mutation feature set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula includes: constructing a final selected optional operation set; for each operation in the final selected optional operation set, constructing a set of two-tuples of configuration parameters and an upper bound of the model generalization error; for each operation in the final selected optional operation set, constructing the corresponding mutation feature set.

[0017] Optionally, in one embodiment of the present application, for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, the final parameter setting value of the optional operation is determined according to its corresponding mutation characteristic set, including: for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, the mutation characteristic set associated with each optional operation is gradually increased according to a preset strategy, and when it is detected that it is greater than a preset threshold, the final parameter setting value is determined; for each collaborative learning edge node in the edge computing scenario, when training the model, the parameters of each finally selected optional operation are set to the final parameter setting value.

[0018] To achieve the above-mentioned objectives, the second embodiment of the present application proposes an active defense device for backdoor attacks in an edge computing scenario, including: a first construction module, used to generate an initial optional operation set based on optional operations used to improve the generalization ability of the model, and construct a configuration parameter set for each operation in the set; a first screening module, used to screen out a first optional operation subset from the initial optional operation set, whose configuration parameters of the optional operation and the accuracy curve of the model present a monotonically decreasing concave function characteristic; a second screening module, used to screen out a second optional operation subset from the initial optional operation set, whose configuration parameters of the optional operation and the curve of the probability of successful backdoor attack of the model present a monotonically decreasing convex function characteristic; a second construction module, used to construct a corresponding mutation characteristic set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula; a defense module, used to determine the final parameter setting value of the optional operation for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to its corresponding mutation characteristic set, so as to actively defend against possible backdoor attacks.

[0019] The active backdoor attack defense device in edge computing scenarios of the present application embodiment can proactively defend against backdoor attacks targeting collaborative learning in edge computing scenarios by finding qualified hyperparameters based on a specific formula without human intervention. The device does not require the cooperation of other edge nodes, nor does it need to know which edge nodes have been manipulated by attackers to be malicious. In terms of proactively defending against backdoor attacks targeting collaborative learning in edge computing scenarios, this device is highly stable and robust, effectively improving network security in edge computing scenarios and making it more suitable for deployment and application in real-world scenarios.

[0020] In addition, the backdoor attack active defense device in the edge computing scenario according to the above embodiment of the present application may also have the following additional technical features:

[0021] Optionally, in one embodiment of the present application, the defense module is specifically used to gradually increase the set of mutation characteristics associated with each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset strategy, and when it is detected that the value is greater than a preset threshold, determine the final parameter setting value; for each collaborative learning edge node in the edge computing scenario, when training the model, the parameters of each finally selected optional operation are set to the final parameter setting value.

[0022] The third aspect of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the active defense method for backdoor attacks in the edge computing scenario as described in the above embodiment.

[0023] The fourth aspect of the present application provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the active defense method for backdoor attacks in the edge computing scenario as described in the above embodiment.

[0024] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0026] Figure 1 This is a flowchart of a method for actively defending against backdoor attacks in an edge computing scenario according to an embodiment of the present application;

[0027] Figure 2 Schematic diagram of a backdoor attack active defense device in an edge computing scenario according to an embodiment of the present application;

[0028] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0030] The following describes the active defense method and device for backdoor attacks in edge computing scenarios proposed according to the embodiments of the present application with reference to the accompanying drawings. First, the active defense method for backdoor attacks in edge computing scenarios proposed according to the embodiments of the present application will be described with reference to the accompanying drawings.

[0031] Figure 1 This is a flowchart of a method for actively defending against backdoor attacks in an edge computing scenario according to an embodiment of the present application.

[0032] like Figure 1As shown, the active backdoor attack defense method in this edge computing scenario includes the following steps:

[0033] In step S101 , an initial set of optional operations is generated according to optional operations for improving the generalization capability of the model, and a set of configuration parameters is constructed for each operation in the set.

[0034] As a possible implementation method, the embodiment of the present application is mainly used in a system in which multiple edge nodes in an edge computing scenario achieve network intelligence through collaborative learning. Therefore, in view of the current situation where deep learning models have multiple optional operations to improve the generalization ability of the model, the embodiment of the present application first forms an initial optional operation set of the optional operations selected to improve the generalization ability of the model, and constructs a configuration parameter set for each operation in the set.

[0035] Optionally, in one embodiment of the present application, an initial set of optional operations is generated based on optional operations used to improve model generalization capabilities, and a set of configuration parameters is constructed for each operation in the set, including: constructing an initial set of optional operations related to model generalization capabilities; and constructing a set of configuration parameters for each optional operation. Subsequently, the embodiment of the present application uses different configuration parameters to train multiple models for each optional operation.

[0036] For example, in step S1, considering that a deep learning model has multiple optional operations to improve the generalization ability of the model, and that the generalization ability of the deep learning model changes as the configuration parameters of the optional operations change, the optional operations used to improve the generalization ability of the model are optionally formed into an initial optional operation set, and a configuration parameter set is constructed for each operation in the set.

[0037] In actual implementation, step S1 may include:

[0038] Step S11: Construct an initial set of optional operations related to the generalization ability of the model. When training deep learning models, there are a large number of optional operations, such as dropout (a certain proportion of network structures are not updated during training), regularization, gradient clipping, etc. Optional early operations constitute an initial optional operation set, consisting of express.

[0039] Step S12: Construct a configuration parameter set for each optional operation. Each optional operation in , there is an optional parameter configuration range, which is determined by Indicates that , is the minimum optional configuration parameter, is the maximum optional configuration parameter. Within the optional parameter configuration range, uniform selection parameters (including and ), that is, the parameter interval can be expressed as , the specific calculation method is as follows:

[0040] ,

[0041] Finally, each optional operation There will be a set of configuration parameters, represented as ,in .

[0042] In step S102 , a first subset of optional operations is selected from the initial set of optional operations, wherein the curves of the configuration parameters of the optional operations and the accuracy of the model present a monotonically decreasing concave function characteristic.

[0043] It can be understood that in terms of configuration parameters and model accuracy, a subset of optional operations that meets the characteristics of a monotonically decreasing concave function is screened.

[0044] Optionally, in one embodiment of the present application, a first subset of optional operations is screened out from the initial set of optional operations, in which the configuration parameters of the optional operations and the accuracy curve of the model present a monotonically decreasing concave function characteristic, including: constructing a set of two-tuples of configuration parameters and model accuracy; and screening the subset of optional operations that conforms to the preset monotonically decreasing concave function characteristic.

[0045] For example, step S2: screening out a subset of optional operations whose configuration parameters of the optional operations and the accuracy curve of the model present a monotonically decreasing concave function characteristic.

[0046] In actual implementation, step S2 may include:

[0047] Step S21: Construct a set of two tuples of configuration parameters and model accuracy. Each optional operation in , respectively, with the corresponding configuration parameter set Each element in To train the model. After training is completed, test the model to get the accuracy of the model , thereby constructing a pair of configuration parameters and model accuracy, namely . All pairs of compose a set, namely .

[0048] Step S22: Filter the optional operation subset that meets the characteristics of the monotonically decreasing concave function. Each optional operation in , using its two-tuple set Construct a curve between configuration parameters and model accuracy, and fit an approximate curve function . All curve functions that meet the characteristics of monotone decreasing concave function Corresponding operations Constitute a specific subset, expressed as ,in Here and It is just to illustrate the monotonicity and concavity of the function and has no practical significance.

[0049] In step S103, a second subset of optional operations is selected from the initial set of optional operations, wherein the curves of the configuration parameters of the optional operations and the probability of the model being attacked successfully by a backdoor present a monotonically decreasing convex function characteristic.

[0050] It can be understood that the embodiment of the present application selects a subset of optional operations that conforms to the characteristics of a monotonically decreasing convex function in terms of configuration parameters and the probability of a model being successfully attacked by a backdoor.

[0051] Optionally, in one embodiment of the present application, a second subset of optional operations is screened out from the initial set of optional operations, in which the curve between the configuration parameters of the optional operations and the probability of a successful backdoor attack on the model presents a monotonically decreasing convex function characteristic, including: constructing a set of two-tuples of configuration parameters and the probability of a successful backdoor attack on the model; and screening the subset of optional operations that conforms to the preset monotonically decreasing convex function characteristic.

[0052] For example, step S3: filter out a subset of optional operations whose curves between the configuration parameters of the optional operations and the probability of a model being successfully attacked by a backdoor present a monotonically decreasing convex function characteristic.

[0053] In actual implementation, step S3 may include:

[0054] Step S31: Construct a set of two-tuples of configuration parameters and the probability of the model being successfully attacked by a backdoor. The probability of the model being successfully attacked by a backdoor here refers to the probability that the model mistakenly identifies a sample with a backdoor attack trigger. Each optional operation in , respectively, with the corresponding configuration parameter set Each element in To train the model. After the training is completed, the model is tested using samples with backdoor attack triggers to obtain the probability of the model being successfully attacked by the backdoor , thereby constructing a binary pair of configuration parameters and the probability of the model being successfully attacked by the backdoor, that is, . All pairs of compose a set, namely .

[0055] Step S32: Filter the optional operation subset that meets the characteristics of monotonically decreasing convex function. Each optional operation in , using its two-tuple set Construct a curve between configuration parameters and the probability of successful backdoor attack on the model, and fit an approximate curve function . All curve functions that meet the characteristics of monotone decreasing convex function Corresponding operations Constitute a specific subset, expressed as ,in It should be noted that here and It is just to illustrate the monotonicity and concavity of the function and has no practical significance.

[0056] In step S104, a corresponding mutation characteristic set is constructed for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula.

[0057] That is, the embodiment of the present application takes the intersection of the above two subsets to form a new set of finally selected optional operations for actively defending against possible backdoor attacks.

[0058] Optionally, in one embodiment of the present application, a mutation feature set is constructed for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula, including: constructing a final selected optional operation set; for each operation in the final selected optional operation set, constructing a set of two-tuples of configuration parameters and the upper bound of the model generalization error; for each operation in the final selected optional operation set, constructing a corresponding mutation feature set.

[0059] For example, step S4: construct a mutation feature set for each optional operation in the intersection of the two subsets obtained in step S2 and step S3 according to a specified formula.

[0060] In actual implementation, step S4 may include:

[0061] Step S41: Construct the final selected set of optional operations. After completing steps S2 and S3, the optional operation subsets obtained in the two steps are combined, that is, .

[0062] Step S42: For each operation in the final selected optional operation set , construct a set of two-tuples of configuration parameters and the upper bound of the model generalization error. The upper bound of the model generalization error here can express the generalization ability of the model. Specifically, there is optionally a benign dataset , all samples do not contain triggers for backdoor attacks. Take out a certain proportion of samples to form a benign subset ,in For the benign subset , add backdoor attack triggers to all its samples and tamper with the real labels to form a backdoor attack subset . Construct two data sets for training and . Separately in and Train two models on two datasets and For the dataset Each sample in , respectively calculate the sample in the two trained models and The loss value on and The absolute value of the difference, that is The upper bound of the model generalization error can be expressed as , the specific calculation method is as follows:

[0063] ,

[0064] For optional operation sets Each optional operation in , respectively, with the corresponding configuration parameter set Each element in To calculate the upper bound of the model generalization error , thereby constructing a pair of configuration parameters and the upper bound of the model generalization error, namely . All pairs of compose a set, namely .

[0065] Step S43: For each operation in the final selected optional operation set, construct a corresponding mutation feature set. Each element in , define the mutation characteristics of the binary group as , the specific calculation method is as follows:

[0066] ,

[0067] in, is an integer hyperparameter greater than or equal to 1. So, Corresponding optional operations The mutation feature set .Will Start from 1 and gradually increase.

[0068] In step S105, for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, a final parameter setting value of the optional operation is determined according to its corresponding mutation characteristic set to proactively defend against possible backdoor attacks.

[0069] In summary, the embodiments of the present application construct a corresponding mutation characteristic set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset (that is, the final selected optional operation set) based on the upper bound of the model generalization error, so as to select the final parameter setting value for each optional operation through the relationship between the elements in the mutation characteristic set and the pre-set threshold, thereby actively defending against possible backdoor attacks.

[0070] It should be noted that the threshold value can be set by those skilled in the art according to actual conditions and is not specifically limited here.

[0071] In the embodiments of the present application, the cooperation of other edge nodes is not required, nor is it necessary to know whether other edge nodes have been attacked by backdoors. This can effectively improve network security in edge computing scenarios, which is of far-reaching significance for real-world deployment and application.

[0072] Optionally, in one embodiment of the present application, for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, the final parameter setting value of the optional operation is determined according to its corresponding mutation characteristic set, including: for the mutation characteristic set associated with each optional operation in the intersection of the first optional operation subset and the second optional operation subset, gradually increasing according to a preset strategy, and determining the final parameter setting value when detecting that it is greater than a preset threshold; for each collaborative learning edge node in the edge computing scenario, when training the model, the parameters of each finally selected optional operation are set to the final parameter setting value.

[0073] For example, step S5: according to the optional operation finally selected for each in step S4 The mutation feature set , determine the optional operations The final parameter setting value is used to proactively defend against possible backdoor attacks.

[0074] In actual implementation, step S5 may include:

[0075] Step S51: For each optional operation finally selected The associated mutation feature set , optionally according to Starting from 1 and increasing by 1, compare With artificially set thresholds The size of the When , stop the comparison and record the time The corresponding parameter value , which can optionally be expressed as .

[0076] Step S52: For each collaborative learning edge node in the edge computing scenario, when training the model, each of the finally selected optional operations The parameters are set to , thereby proactively defending against possible backdoor attacks.

[0077] It should be understood by those skilled in the art that, considering the correlation between the stability of the deep learning model and the success probability of a backdoor attack, the embodiment of the present application can perform a stability analysis on the deep learning model in the edge computing scenario. Subsequently, based on the results of the stability analysis, the embodiment of the present application can find the hyperparameter corresponding to the inflection point of the model generalization ability change according to the formula. The inflection point mentioned here has the following characteristics. When the value of the hyperparameter is less than the hyperparameter corresponding to the inflection point, as the hyperparameter increases, the accuracy of the deep learning model in the edge computing scenario slowly decreases, but the probability of the deep learning model being embedded with an effective backdoor is significantly reduced; when the value of the hyperparameter is greater than the hyperparameter corresponding to the inflection point, as the hyperparameter increases, the accuracy of the deep learning model in the edge computing scenario significantly decreases, but the probability of the deep learning model being embedded with an effective backdoor is slowly reduced. This method does not require human intervention and can find qualified hyperparameters based on a specific formula to actively defend against backdoor attacks for collaborative learning in edge computing scenarios. Moreover, the embodiment of the present application does not require the cooperation of other edge nodes, nor does it need to know which edge nodes are manipulated by the attacker as malicious edge nodes. In general, this method and device have the characteristics of high stability and strong resistance in actively defending against backdoor attacks on collaborative learning in edge computing scenarios, and are more suitable for deployment and application in real-world scenarios.

[0078] In summary, the widespread deployment of edge computing networks has promoted the further development of collaborative learning among edge nodes. However, individual edge nodes cannot know whether the training data of other edge nodes has been tampered with by malicious attackers to generate samples with backdoor attack triggers. In such a scenario, a backdoor attack can spread from one or more edge nodes controlled by a malicious attacker to other benign edge nodes, embedding backdoors in the deep learning models of all edge nodes participating in collaborative learning. This will cause the deep learning models to exhibit the attacker's desired erroneous behavior when encountering samples with backdoor attack triggers, posing potential security risks to edge nodes, the edge computing networks in which they reside, and related devices. Backdoor attacks launched for collaborative learning in edge computing scenarios are difficult to detect and only exhibit malicious behavior when encountering specific backdoor attack triggers. To this end, a method and device for active backdoor attack defense in edge computing scenarios are proposed to effectively and proactively defend against potential backdoor attacks.

[0079] The embodiments of the present application solve the problem of backdoor attacks being difficult to detect in edge computing scenarios. At the same time, each edge node can independently and proactively defend against backdoor attacks against collaborative learning in edge computing scenarios in accordance with the present invention. This does not require the edge nodes to cooperate with each other for joint defense, nor does it require knowing whether any edge nodes have been controlled by malicious attackers. In addition, this solution does not require human intervention. After each edge node is configured with the hyperparameters required by the present invention, it automatically deploys defenses in accordance with the present invention.

[0080] According to the active defense method for backdoor attacks in edge computing scenarios in the embodiments of the present application, no human intervention is required, and qualified hyperparameters can be found according to a specific formula to actively defend against backdoor attacks in edge computing scenarios. It does not require the cooperation of other edge nodes, nor does it need to know which edge nodes are manipulated by attackers as malicious edge nodes. In terms of actively defending against backdoor attacks in edge computing scenarios, it has the characteristics of high stability and strong resistance, effectively improving network security in edge computing scenarios, and is more suitable for deployment and application in real scenarios.

[0081] Next, the active defense device for backdoor attacks in the edge computing scenario proposed in the embodiment of the present application will be described with reference to the accompanying drawings.

[0082] Figure 2 It is a block diagram of an active backdoor attack defense device in an edge computing scenario of an embodiment of the present application.

[0083] like Figure 2 As shown, the backdoor attack active defense device 10 in the edge computing scenario includes: a first construction module 100, a first screening module 200, a second screening module 300, a second construction module 400 and a defense module 500.

[0084] Specifically, the first construction module 100 is used to generate an initial optional operation set according to optional operations for improving the generalization ability of the model, and to construct a configuration parameter set for each operation in the set.

[0085] The first screening module 200 is configured to screen out, from the initial set of optional operations, a first subset of optional operations whose configuration parameters of the optional operations and the accuracy curve of the model present a monotonically decreasing concave function characteristic.

[0086] The second screening module 300 is used to screen out a second subset of optional operations from the initial set of optional operations, wherein the curve between the configuration parameters of the optional operations and the probability of a successful backdoor attack on the model presents a monotonically decreasing convex function characteristic.

[0087] The second construction module 400 is configured to construct a corresponding mutation characteristic set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula.

[0088] The defense module 500 is used to determine the final parameter setting value of each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to its corresponding mutation characteristic set, so as to actively defend against possible backdoor attacks.

[0089] In one embodiment of the present application, the defense module 500 is specifically used to gradually increase the set of mutation characteristics associated with each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset strategy, and when it is detected that it is greater than a preset threshold, determine the final parameter setting value; for each collaborative learning edge node in the edge computing scenario, when training the model, the parameters of each finally selected optional operation are set to the final parameter setting value.

[0090] It should be noted that the above explanation of the embodiment of the active defense method for backdoor attacks in the edge computing scenario is also applicable to the active defense device for backdoor attacks in the edge computing scenario of this embodiment, and will not be repeated here.

[0091] According to the embodiment of the present application, the active defense device for backdoor attacks in edge computing scenarios can find qualified hyperparameters based on a specific formula to actively defend against backdoor attacks against collaborative learning in edge computing scenarios without human intervention. Furthermore, the device does not require the cooperation of other edge nodes, nor does it need to know which edge nodes have been manipulated by attackers to be malicious. In terms of actively defending against backdoor attacks against collaborative learning in edge computing scenarios, the device is highly stable and has strong resistance capabilities, effectively improving network security in edge computing scenarios and making it more suitable for deployment and application in real-world scenarios.

[0092] Figure 3This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:

[0093] A memory 1201 , a processor 1202 , and a computer program stored in the memory 1201 and executable on the processor 1202 .

[0094] When the processor 1202 executes the program, the active backdoor attack defense method in the edge computing scenario provided in the above embodiment is implemented.

[0095] Furthermore, the electronic device further includes:

[0096] The communication interface 1203 is used for communication between the memory 1201 and the processor 1202 .

[0097] The memory 1201 is used to store computer programs that can be run on the processor 1202 .

[0098] The memory 1201 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0099] If the memory 1201, processor 1202, and communication interface 1203 are implemented independently, the communication interface 1203, memory 1201, and processor 1202 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0100] Optionally, in a specific implementation, if the memory 1201, the processor 1202 and the communication interface 1203 are integrated on a chip, the memory 1201, the processor 1202 and the communication interface 1203 can communicate with each other through an internal interface.

[0101] The processor 1202 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0102] This embodiment also provides a computer-readable storage medium on which a computer program is stored, characterized in that when the program is executed by a processor, it implements the above-mentioned active defense method for backdoor attacks in the edge computing scenario.

[0103] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of such features. Throughout the description of this application, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0104] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0105] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for active defense against backdoor attacks in edge computing scenarios, characterized in that: The following steps are involved: Generate an initial set of optional operations according to the optional operations for improving the generalization ability of the model, and construct a configuration parameter set for each operation in the set; Filtering out a first subset of optional operations from the initial set of optional operations, wherein the curves of the configuration parameters of the optional operations and the accuracy of the model present a monotonically decreasing concave function characteristic; Filtering from the initial set of optional operations a second subset of optional operations, wherein a curve between configuration parameters of the optional operations and the probability of a model being successfully attacked by a backdoor presents a monotonically decreasing convex function characteristic; Constructing a corresponding mutation characteristic set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula; For each optional operation in the intersection of the first optional operation subset and the second optional operation subset, determining a final parameter setting value for the optional operation according to its corresponding mutation characteristic set, so as to proactively defend against possible backdoor attacks; The step of constructing a corresponding mutation characteristic set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula includes: Construct the final set of selected optional operations; For each operation in the finally selected set of optional operations, construct a set of two-tuples of configuration parameters and an upper bound of the model generalization error; For each operation in the finally selected optional operation set, construct the corresponding mutation characteristic set; The determining, for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, according to its corresponding mutation characteristic set, a final parameter setting value of the optional operation includes: For each optional operation in the intersection of the first optional operation subset and the second optional operation subset, gradually increase the mutation characteristic set according to a preset strategy, and when it is detected that the mutation characteristic set is greater than a preset threshold, determine the final parameter setting value; For each collaborative learning edge node in the edge computing scenario, when training the model, the parameters of each finally selected optional operation are set to the final parameter setting value.

2. The method according to claim 1, characterized in that The generating of an initial set of optional operations according to the optional operations for improving the generalization capability of the model, and constructing a set of configuration parameters for each operation in the set, includes: Construct an initial set of optional operations related to the model's generalization capabilities; Construct a set of configuration parameters for each optional operation.

3. The method according to claim 1, characterized in that The first optional operation subset selected from the initial optional operation set, wherein the configuration parameters of the optional operations and the accuracy curve of the model present a monotonically decreasing concave function characteristic, includes: Construct a set of two-tuples of configuration parameters and model accuracy; Filter the subset of optional operations that meet the pre-set monotonically decreasing concave function characteristics.

4. The method according to claim 1, wherein The second subset of optional operations selected from the initial set of optional operations, wherein the curve between the configuration parameters of the optional operations and the probability of a successful backdoor attack on the model presents a monotonically decreasing convex function characteristic, includes: Construct a set of two-tuples of configuration parameters and the probability of successful backdoor attack on the model; Filter the subset of optional operations that meet the pre-set monotonically decreasing convex function properties.

5. An active defense device for backdoor attacks in edge computing scenarios, characterized in that: include: A first construction module is configured to generate an initial set of optional operations according to optional operations for improving the generalization capability of the model, and to construct a configuration parameter set for each operation in the set; A first screening module is configured to screen out, from the initial set of optional operations, a first subset of optional operations whose configuration parameters of the optional operations and the accuracy curve of the model present a monotonically decreasing concave function characteristic; A second screening module is configured to screen out, from the initial set of optional operations, a second subset of optional operations for which a curve showing a monotonically decreasing convex function characteristic between the configuration parameters of the optional operations and the probability of a successful backdoor attack on the model is present; A second construction module is configured to construct a corresponding mutation characteristic set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula; a defense module, configured to determine, for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, a final parameter setting value of the optional operation according to its corresponding mutation characteristic set, so as to proactively defend against possible backdoor attacks; The defense module is specifically used to gradually increase the set of mutation characteristics associated with each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset strategy, and when it is detected that the value is greater than a preset threshold, determine the final parameter setting value; for each collaborative learning edge node in the edge computing scenario, when training the model, the parameters of each finally selected optional operation are set to the final parameter setting value.

6. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the active defense method for backdoor attacks in an edge computing scenario as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the active defense method for backdoor attacks in an edge computing scenario as described in any one of claims 1-4.

Images