Neural network Trojan virus defense method, device, electronic device and storage medium

Abstract

The present application provides a neural network Trojan virus defense method, device, electronic device and storage medium. The method includes: obtaining a training data set of a target network, the training data set includes a certain amount of training pictures; filtering each training picture through a pre-trained effective area filter to remove the invalid area used to set the Trojan virus in each training picture, and obtaining a filtered training data set; training the target network through the filtered training data set. Before entering the target network, the invalid area is filtered out, and the Trojan virus hidden in the invalid area cannot enter the subsequent target network, effectively protecting the target network training data and the security of the target network.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and storage medium for defending against neural network Trojan viruses. Background Art

[0002] With the development of hardware devices and Internet big data, deep learning methods based on deep neural networks have gradually become the focus of attention in many fields. However, the development of neural networks has also brought security issues such as neural network Trojan viruses characterized by data poisoning.

[0003] Neural network Trojans often generate some seemingly harmless data and enter it into the training samples of the neural network. The target neural network model is adjusted according to the ideas of the Trojan designer to form a backdoor. After being adjusted by the neural network Trojan, the neural network often behaves normally when dealing with ordinary samples. However, once the Trojan designer places a designed trigger, the backdoor will be triggered, causing incalculable damage.

[0004] Based on the above situation, traditional Trojan virus defense methods cannot be applied to the field of neural networks, and the neural network Trojan virus defense methods in the existing technology are often unable to cope with a variety of backdoors and triggers. Summary of the invention

[0005] In view of this, the purpose of this application is to propose a neural network Trojan virus defense method, device, electronic device and storage medium to solve or partially solve the above-mentioned technical problems.

[0006] Based on the above objectives, the first aspect of the present application provides a neural network Trojan virus defense method, comprising:

[0007] Obtaining a training data set of a target network, wherein the training data set includes a certain amount of training images;

[0008] Filtering each of the training images by using a pre-trained valid area filter to remove invalid areas for setting Trojan viruses in each of the training images, thereby obtaining a filtered training data set;

[0009] The target network is trained using the screened training data set.

[0010] The second aspect of the present application provides a neural network Trojan virus defense device, comprising:

[0011] A training data set acquisition module is configured to acquire a training data set of a target network, wherein the training data set includes a certain amount of training images;

[0012] An effective area screening module is configured to screen each of the training images through a pre-trained effective area filter to remove an invalid area for setting a Trojan virus in each of the training images to obtain a screened training data set;

[0013] The target network training module is configured to train the target network using the screened training data set.

[0014] A third aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0015] A fourth aspect of the present application provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method described in the first aspect.

[0016] From the above description, it can be seen that the neural network Trojan virus defense method, device, electronic device and storage medium provided by the present application remove invalid areas through the effective area filter, thereby excluding Trojan viruses hidden in the invalid areas, avoiding Trojan viruses hidden in the invalid areas that are not easy to detect from triggering backdoors through triggers to cause immeasurable damage, and ensuring the security of the target neural network. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of a neural network Trojan virus defense method according to an embodiment of the present application;

[0019] Figure 2 A training flow chart of a valid area filter according to an embodiment of the present application;

[0020] Figure 3 A flowchart of a trained target network used in an embodiment of the present application;

[0021] Figure 4 This is a structural block diagram of a neural network Trojan virus defense device according to an embodiment of the present application;

[0022] Figure 5 A schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0024] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0025] In related technologies, some neural network Trojan viruses are often hidden in invalid areas of images. For example, in a picture of a dog, a flower appears on the grass that does not appear in the original picture. Such backdoor designs can often deceive the human eye because manual inspections will always give priority to areas where key information is located in the picture and automatically ignore invalid areas.

[0026] For general Trojan virus, the Trojan virus is defended by real-time scanning based on features, thereby denying access to related files or deleting them, but this Trojan virus defense method cannot be applied to the field of neural networks. In addition, the neural network Trojan virus defense method in related technologies often cannot cope with a variety of backdoors and triggers.

[0027] The embodiments of the present application provide a neural network Trojan virus defense method, which trains to form an effective area filter, and uses the effective area filter to filter out Trojan viruses hidden in invalid areas, thereby ensuring the security of the target neural network.

[0028] like Figure 1 As shown, the method of this embodiment includes:

[0029] Step 101, obtaining a training data set of a target network, wherein the training data set includes a certain amount of training images.

[0030] In this step, the target network is the neural network that needs to be ultimately protected and used, and the training data set is the data set required for training the target network. The training data set can be massively crawled by web crawlers, and the qualified data information is captured from the massive information on the Internet according to the set conditions, and then screened. There is no specific limitation on the method of obtaining the training data set here.

[0031] Step 102, screening each of the training images through a pre-trained valid area filter to remove invalid areas used to set Trojan viruses in each of the training images, and obtain a screened training data set.

[0032] In this step, the invalid area is, for example, the theme feature of the training image is a car, and all parts unrelated to the car belong to the invalid area. In the dog picture, the dog is the theme feature, and the picture also includes grass, which is not a theme feature, so the grass is an invalid area. Trojan viruses are often hidden in invalid areas. Human inspections always give priority to the areas where key information is located in the picture, and automatically ignore invalid areas. Therefore, the training images are screened before entering the target network. Each training image is screened by a pre-trained valid area filter, and the invalid areas are removed, and the valid areas are retained to obtain a training data set after removing the invalid areas.

[0033] Step 103: training the target network using the screened training data set.

[0034] In this step, the pixels in the invalid area of ​​the filtered training data set are set to 0, and the invalid area is automatically ignored when training the target network.

[0035] Through the above scheme, when the target network is trained, the training images included in the target network training data set are filtered through the pre-trained valid area filter, and the pixels in the invalid area are set to 0. They are automatically ignored when the target network is trained, thereby removing the invalid area and excluding the neural network Trojan virus that is difficult to detect hidden in the invalid area.

[0036] In some embodiments, Figure 2 As shown, the effective area filter in step 102 is trained by the following method:

[0037] Step 201 : obtaining a security data set, wherein the security data set includes a certain amount of security images that are not provided with Trojan viruses.

[0038] In this step, the security data set is the image sample data set used to train the effective area filter. The error back propagation neural network is trained to enable it to identify the characteristics of the Trojan virus signature code and obtain the signature code classification. The Trojan signature code is detected on the acquired security data set through the trained error back propagation neural network to ensure that the image sample data used for the effective area filter training is safe data without the presence of neural network Trojan virus backdoors. No specific limitation is made here on the detection method of the acquired security data set.

[0039] Step 202: segment each of the security images using a data segmentation algorithm to divide each of the security images into a valid area and an invalid area.

[0040] In this step, the data segmentation algorithm is a fully convolutional neural network. The fully convolutional neural network divides each security image into regions according to the characteristics of the pixels themselves, achieves fine pixel-level segmentation of security images, accurately delineates the specific contours of the subject features, and divides the security images used to train the effective area filter into blocks.

[0041] When classifying images at the pixel level, the fully convolutional neural network can accept input images of any size, and upsample them one step before the output to restore the output image to the same size as the input image, thereby generating a prediction for each pixel while retaining the spatial information in the original input image. Finally, pixel-by-pixel classification is performed on the upsampled feature map.

[0042] Step 203: For each of the safety pictures, the valid area of ​​the safety picture is used as a corresponding label to obtain a labeled safety data set.

[0043] In this step, the effective area of ​​the security image can be marked by a region marking algorithm or manually, thereby forming a marked security data set. The marking method is not specifically limited here.

[0044] Step 204: Use the labeled safety data set to train and obtain the valid area filter.

[0045] In this step, the security images included in the acquired security data set are taken as input, and the marked valid areas therein are taken as output, so as to train the neural network so that it can filter out the valid areas from the acquired security data set, thereby forming a valid area filter.

[0046] Through the above scheme, a security data set is obtained to ensure that there is no intrusion of Trojan viruses in the training process of the effective area filter. The security data set is divided into effective areas and invalid areas through a data segmentation algorithm, and the effective areas are marked to form a marked security data set. The security data set is used as input and the marked security data set is used as output to train a neural network to form an effective area filter, which can remove the invalid areas of the data to be used after passing through this trained effective area filter, and retain the effective areas.

[0047] In some embodiments, step 202 specifically includes:

[0048] Convolving the security image to obtain feature data;

[0049] Deconvolve the feature data to obtain a processed image having the same size as the original security image;

[0050] The effective area and the invalid area are divided according to the color of each pixel included in the processed image.

[0051] In this step, the security image is segmented using a fully convolutional neural network. During the segmentation process, the security image is convoluted by the fully convolutional neural network to extract the feature data of the security image. After multiple convolution processes, the resolution is reduced. Deconvolution is performed on the output segmented image to restore the security image with reduced resolution after multiple convolutions to the size of the original image. After the fully convolutional neural network is segmented, similar pixels are divided into similar colors, which facilitates the subsequent classification and labeling of these divided areas. The fully convolutional neural network can classify each pixel in an image, can achieve the classification of the characteristic parts of the image and the fine pixel-level segmentation, and can accurately delineate the specific contours of the object.

[0052] In some embodiments, the effective area filter includes:

[0053] Input layer, first convolution layer, first rectified linear unit function layer, second convolution layer, second rectified linear unit function layer, first pooling layer, third rectified linear unit function layer, third convolution layer, fourth rectified linear unit function layer, second pooling layer, fully connected layer, Dropout layer and output layer.

[0054] In this step, some neural network Trojan viruses exist in invalid areas of the image. For example, in a picture of a dog, a flower appears in the grass that does not appear in the original picture. Such backdoor designs can often deceive the human eye because manual inspections always give priority to areas where key information is located in the image and automatically ignore invalid areas.

[0055] The framework of the effective area filter is a structure that combines multiple convolutional layers and pooling layers, and uses the rectified linear unit function as the activation function. The design of this framework can filter out invalid areas in the security map and reduce the risk of Trojan virus burial. Even if there are set Trojan viruses in the effective area, they are very easy to be observed by the human eye.

[0056] In some embodiments, the first convolutional layer, the second convolutional layer, and the third convolutional layer all perform feature detection;

[0057] The first pooling layer and the second pooling layer both perform feature highlighting;

[0058] The fully connected layer classifies the secure data of different characteristics;

[0059] The Dropout layer prevents overfitting of training;

[0060] The first rectified linear unit function layer, the second rectified linear unit function layer, the third rectified linear unit function layer and the fourth rectified linear unit function layer are used as activation functions to improve the training speed.

[0061] In this step, all convolutional layers in the effective region filter framework detect and extract features from the input training security image.

[0062] The introduction of all pooling layers is to imitate the human visual system to reduce the dimension and abstract the visual input objects. In fact, it is a form of downsampling. The input image is divided into several rectangular areas and the maximum value is output for each sub-area. The pooling layer will continuously reduce the spatial size of the data, and the number of parameters and the amount of calculation will also decrease. This also controls overfitting to a certain extent. Pooling layers are periodically inserted between convolutional layers.

[0063] Each neuron in the fully connected layer is fully connected to all neurons in the previous layer, integrating the local information with category distinction in the convolutional layer or pooling layer, combining the features extracted previously, and highly purifying the features.

[0064] Each time the random Dropout layer is trained, different hidden neurons are deleted, and the network structure is different. This is similar to training different networks. The entire Dropout process is equivalent to averaging many different neural networks. Different networks produce different overfitting, and some "opposite" fits can offset each other to reduce overfitting overall.

[0065] The introduction of activation function is to increase the nonlinearity of neural network model. By adding activation function and introducing nonlinear factors to neurons, neural network can arbitrarily approximate any nonlinear function, so that neural network can be applied to many nonlinear models. Compared with other functions, the rectified linear unit function as an activation function can make neural network training faster.

[0066] In addition, the effective region filter is an incidental neural network of the target network, and the training speed is kept within a controllable range.

[0067] In some embodiments, removing the invalid area for setting the Trojan virus in each of the training images specifically includes:

[0068] Determining a valid area and an invalid area of ​​the training image;

[0069] All pixels in the valid area are kept unchanged, and all pixels in the invalid area are set to 0.

[0070] In this step, after the training image passes through the valid area filter, all pixels in the valid area remain unchanged, and all pixels in the invalid area are set to 0. The invalid area with all pixels set to 0 will be 0 when it passes through the convolution layer in the valid area filter framework for feature detection and extraction in the subsequent process, and no features can be extracted, so it is ignored by the target network, achieving the effect of removing the invalid area.

[0071] In some embodiments, Figure 3 As shown, the method also includes:

[0072] Step 301, obtaining a prediction image;

[0073] Step 302, filtering the prediction image by using the effective area filter to obtain a filtered prediction image;

[0074] Step 303: input the filtered prediction image into the trained target network to obtain the prediction result output by the target network.

[0075] In this step, the prediction images are the image data sets required when using the target network, and the prediction results are the execution results of the target neural network. The prediction images are filtered by the effective area filter before entering the trained target network. The filtered prediction image data sets enter the target network to obtain the final prediction results.

[0076] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0077] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0078] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a neural network Trojan virus defense device.

[0079] refer to Figure 4 , the neural network Trojan virus defense device comprises:

[0080] The training data set acquisition module 401 is configured to acquire a training data set of a target network, wherein the training data set includes a certain amount of training images;

[0081] The effective area screening module 402 is configured to screen each of the training images through a pre-trained effective area filter to remove the invalid area used to set the Trojan virus in each of the training images to obtain a screened training data set;

[0082] The target network training module 403 is configured to train the target network using the screened training data set.

[0083] In some embodiments, the effective area screening module 402 includes:

[0084] A security data set acquisition unit is configured to acquire a security data set, wherein the security data set includes a certain amount of security images that are not provided with Trojan viruses;

[0085] A region division unit is configured to divide each of the security images into a valid region and an invalid region by using a data segmentation algorithm;

[0086] The valid area marking unit is configured to use the valid area of ​​each of the security images as a corresponding label to obtain a marked security data set.

[0087] In some embodiments, the region division unit is configured to:

[0088] Convolving the security image to obtain feature data; deconvolving the feature data to obtain a processed image of the same size as the original security image; dividing the valid area and the invalid area according to the color of each pixel included in the processed image.

[0089] In some embodiments, the valid region filter includes:

[0090] Input layer, first convolution layer, first rectified linear unit function layer, second convolution layer, second rectified linear unit function layer, first pooling layer, third rectified linear unit function layer, third convolution layer, fourth rectified linear unit function layer, second pooling layer, fully connected layer, Dropout layer and output layer.

[0091] In some embodiments, the first convolutional layer, the second convolutional layer, and the third convolutional layer all perform feature detection;

[0092] The first pooling layer and the second pooling layer are both used for feature highlighting;

[0093] The fully connected layer is used to classify the secure data with different characteristics;

[0094] The Dropout layer is used to prevent overfitting of training;

[0095] The first rectified linear unit function layer, the second rectified linear unit function layer and the third rectified linear unit function layer are all used as activation functions to improve training speed.

[0096] In some embodiments, the effective area screening module 402 further includes:

[0097] A region division unit, configured to determine a valid region and an invalid region of the training image;

[0098] The pixel setting unit is configured to keep all pixels in the effective area unchanged and set all pixels in the invalid area to 0.

[0099] In some embodiments, the neural network Trojan virus protection device further includes:

[0100] A prediction picture acquisition module is configured to acquire a prediction picture;

[0101] a prediction picture screening module, configured to screen the prediction pictures through the effective area filter to obtain screened prediction pictures;

[0102] The prediction result acquisition module is configured to input the screened prediction image into the trained target network to obtain the prediction result output by the target network.

[0103] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0104] The device of the above embodiment is used to implement the corresponding neural network Trojan virus defense method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0105] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the neural network Trojan virus defense method described in any of the above embodiments is implemented.

[0106] Figure 5 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 501, a memory 502, an input / output interface 503, a communication interface 504, and a bus 505. The processor 501, the memory 502, the input / output interface 503, and the communication interface 504 are connected to each other through the bus 505 in the device.

[0107] The processor 501 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0108] The memory 502 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 502 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 502 and called and executed by the processor 501.

[0109] The input / output interface 503 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0110] The communication interface 504 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0111] The bus 505 includes a path for transmitting information between various components of the device (eg, the processor 501 , the memory 502 , the input / output interface 503 , and the communication interface 504 ).

[0112] It should be noted that, although the above device only shows a processor 501, a memory 502, an input / output interface 503, a communication interface 504, and a bus 505, in a specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0113] The electronic device of the above-mentioned embodiment is used to implement the corresponding neural network Trojan virus defense method in any of the above-mentioned embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0114] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the neural network Trojan virus defense method described in any of the above embodiments.

[0115] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0116] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the neural network Trojan virus defense method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0117] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0118] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0119] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0120] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A neural network Trojan virus defense method, characterized in that: include: Obtaining a training data set of a target network, wherein the training data set includes a certain amount of training images; Filtering each of the training images by using a pre-trained valid area filter to remove invalid areas for setting Trojan viruses in each of the training images, thereby obtaining a filtered training data set; Training the target network using the screened training data set; The effective region filter is trained by: Acquire a security data set, wherein the security data set includes a certain amount of security images that are not provided with Trojan viruses; Segmenting each of the security images using a data segmentation algorithm to divide each of the security images into a valid area and an invalid area; For each of the safety images, using the valid area of ​​the safety image as a corresponding label to obtain a labeled safety data set; Using the labeled safety data set to train the effective area filter; Each of the security images is segmented by a data segmentation algorithm to divide each of the security images into a valid area and an invalid area, specifically including: Convolving the security image to obtain feature data; Deconvolve the feature data to obtain a processed image having the same size as the original security image; The effective area and the invalid area are divided according to the color of each pixel included in the processed image.

2. The method according to claim 1, characterized in that: The valid area filters include: Input layer, first convolution layer, first rectified linear unit function layer, second convolution layer, second rectified linear unit function layer, first pooling layer, third rectified linear unit function layer, third convolution layer, fourth rectified linear unit function layer, second pooling layer, fully connected layer, Dropout layer and output layer.

3. The method according to claim 2, characterized in that The first convolution layer, the second convolution layer and the third convolution layer all perform feature detection; The first pooling layer and the second pooling layer are both used for feature highlighting; The fully connected layer is used to classify secure data with different characteristics; The Dropout layer is used to prevent overfitting of training; The first rectified linear unit function layer, the second rectified linear unit function layer and the third rectified linear unit function layer are all used as activation functions to improve training speed.

4. The method according to claim 1, characterized in that: The removing of the invalid area used for setting the Trojan virus in each of the training images specifically includes: Determining a valid area and an invalid area of ​​the training image; All pixels in the valid area are kept unchanged, and all pixels in the invalid area are set to 0.

5. The method according to claim 1, characterized in that Also includes: Get the prediction image; Filtering the prediction picture by the effective area filter to obtain a filtered prediction picture; The filtered prediction image is input into the trained target network to obtain the prediction result output by the target network.

6. A neural network Trojan virus defense device, characterized in that: include: A training data set acquisition module is configured to acquire a training data set of a target network, wherein the training data set includes a certain amount of training images; An effective area screening module is configured to screen each of the training images through a pre-trained effective area filter to remove an invalid area for setting a Trojan virus in each of the training images to obtain a screened training data set; The valid area filter is trained by the following method: obtaining a security data set, the security data set including a certain amount of security images without Trojan virus; segmenting each of the security images by a data segmentation algorithm, so as to divide each of the security images into a valid area and an invalid area; for each of the security images, using the valid area of ​​the security image as a corresponding label to obtain a labeled security data set; The valid area filter is obtained by training the marked security data set; each of the security images is segmented by a data segmentation algorithm to divide each of the security images into a valid area and an invalid area, specifically for convolving the security image to obtain feature data; deconvolving the feature data to obtain a processed image of the same size as the original security image; and dividing the valid area and the invalid area according to the color of each pixel included in the processed image; The target network training module is configured to train the target network using the screened training data set.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 5.

Images