Construction Method, Device, Equipment and Storage Medium of Adversarial Ensemble Classification Model

Abstract

The present invention discloses a method, device, equipment and storage medium for constructing an adversarial integrated classification model. The method includes: obtaining a training data set; wherein the training data set includes a plurality of samples to be trained and the classification label corresponding to each sample to be trained, and each sample to be trained includes a plurality of features; performing feature selection on each sample to be trained to obtain a feature vector set; training a plurality of pre-constructed classifiers through the feature vector set to obtain a plurality of base classifiers; training a plurality of pre-constructed classifiers through the feature vector set to obtain a plurality of base classifiers, so as to form a classifier set; whenever a sample to be detected is received, randomly select a preset number of base classifiers from the classifier set for integration to obtain a target integrated classification model. Using the present invention can make it difficult for attackers to learn the true decision boundary, so as to improve the robustness and classification detection accuracy of the integrated classification model.

Description

Technical Field

[0001] The present invention relates to the technical field of network security research, and in particular, to a method, device, terminal device, and computer-readable storage medium for constructing an adversarial ensemble classification model. Background Art

[0002] With the rapid increase in the amount of data worldwide, machine learning has been widely applied in multiple fields such as transportation, vision, finance, and security to distinguish malicious samples from benign samples. However, existing machine learning-based classifiers are vulnerable to evasion attacks by adversarial samples, that is, an attacker can change the feature values of malicious samples by adding imperceptible perturbations to force the classifier to classify malicious samples as benign samples, thus causing adverse effects and consequences to related systems.

[0003] In recent years, researchers have begun to attempt to solve the security risks brought by adversarial sample attacks through ensemble learning, making it difficult for attackers to create adversarial samples to attack the target classification model. However, the learning process of traditional ensemble classification models enables attackers to learn the true decision boundary of the target classification model using a small amount of training data, thereby creating targeted adversarial samples to evade the detection of the target classification model, resulting in a low classification accuracy of the target classification model. Summary of the Invention

[0004] The present invention provides a method, device, terminal device, and computer-readable storage medium for constructing an adversarial ensemble classification model, which can make it difficult for attackers to learn the true decision boundary, so as to improve the robustness and classification detection accuracy of the ensemble classification model.

[0005] An embodiment of the present invention provides a method for constructing an adversarial ensemble classification model, including:

[0006] Obtaining a training data set; wherein, the training data set includes a plurality of training samples to be trained and a classification label corresponding to each training sample to be trained, and each training sample to be trained includes a plurality of features;

[0007] Performing feature selection on each training sample to be trained to obtain a feature vector set;

[0008] Training a plurality of pre-constructed classifiers through the feature vector set to obtain a plurality of base classifiers, so as to form a classifier set;

[0009] Whenever a sample to be detected is received, randomly select a preset number of base classifiers from the classifier set for integration to obtain a target ensemble classification model.

[0010] As an improvement of the above solution, the performing feature selection on the feature vector of each training sample to be trained to obtain a feature vector set is specifically:

[0011] Feature selection is performed on each of the to-be-trained samples based on an adversarial feature selection algorithm to obtain a set of feature vectors.

[0012] As an improvement to the above solution, the feature selection of each of the to-be-trained samples based on the adversarial feature selection algorithm to obtain a set of feature vectors is specifically as follows:

[0013] Feature selection is performed on each of the to-be-trained samples according to the following formula to obtain the feature vector corresponding to each of the to-be-trained samples, so as to constitute a set of feature vectors:

[0014]

[0015] where k = 1, 2,..., N, N is the number of features included in the to-be-trained samples, and k * is the k-th selected feature in the to-be-trained sample, is the mapping of any k features selected in the to-be-trained sample, G is the generalization ability of the preset classifier without an attack, S is the security of the preset classifier in the presence of an attack, and λ is a trade-off parameter.

[0016] As an improvement to the above solution, the generalization ability G of the preset classifier without an attack is calculated by the following formula:

[0017]

[0018] where n is the number of to-be-trained samples in the training dataset, is the mapping of any k features selected in the i-th to-be-trained sample in the training dataset, and y i is the classification label of the i-th to-be-trained sample in the training dataset, l(·, ·) is a preset classification function, and g(·) is the discriminant function of the preset classifier g.

[0019] As an improvement to the above solution, the security S of the preset classifier in the presence of an attack is calculated by the following formula:

[0020]

[0021] where n + is the number of malicious samples in the training dataset, d(·, ·) is a distance function, is the mapping of any k features selected in the j-th malicious sample in the training dataset, is the mapping of any k features selected in the attack sample corresponding to the j-th malicious sample.

[0022] As an improvement to the above solution, training a plurality of pre-constructed classifiers with the feature vector set to obtain a plurality of base classifiers to form a classifier set specifically includes:

[0023] Training the i-th pre-constructed classifier with the i-th feature vector in the feature vector set to obtain the i-th base classifier;

[0024] Forming a classifier set with all the trained base classifiers; wherein, the number of the base classifiers is the same as the number of feature vectors included in the feature vector set.

[0025] Correspondingly, another embodiment of the present invention provides a device for constructing an adversarial ensemble classification model, including:

[0026] A data acquisition module, configured to acquire a training data set; wherein, the training data set includes a plurality of training samples and classification labels corresponding to each of the training samples, and each of the training samples includes a plurality of features;

[0027] A feature selection module, configured to perform feature selection on each of the training samples to obtain a feature vector set;

[0028] A classifier training module, configured to train a plurality of pre-constructed classifiers with the feature vector set to obtain a plurality of base classifiers to form a classifier set;

[0029] An ensemble classification module, configured to randomly select a preset number of base classifiers from the classifier set for ensemble each time a sample to be detected is received, to obtain a target ensemble classification model.

[0030] As an improvement to the above solution, the feature selection module specifically includes:

[0031] Performing feature selection on each of the training samples based on an adversarial feature selection algorithm to obtain a feature vector set.

[0032] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the method for constructing an adversarial ensemble classification model as described in any one of the above is implemented.

[0033] Another embodiment of the present invention provides a computer-readable storage medium, including a stored computer program. When the computer program runs, it controls the device where the computer-readable storage medium is located to execute the method for constructing an adversarial ensemble classification model as described in any one of the above.

[0034] Compared with the prior art, the method, apparatus, device, and storage medium for constructing an adversarial integrated classification model disclosed in the embodiments of the present invention first obtain a training data set including a plurality of samples to be trained, and obtain a feature vector set composed of a plurality of different feature vectors by performing feature selection on each of the samples to be trained; then, train a plurality of pre-constructed classifiers through the feature vector set to obtain a plurality of base classifiers to form a classifier set; finally, whenever a sample to be detected is received, randomly select a preset number of base classifiers from the classifier set for integration to obtain a target integrated classification model for classifying and detecting the sample to be detected. The present invention introduces randomness in the decision-making stage. By randomly selecting base classifiers to construct a target integrated classification model for classifying and detecting the sample to be detected, it is difficult for an attacker to learn the true decision boundary of the target integrated classification model, thereby improving the robustness and classification detection accuracy of the target integrated classification model. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a schematic flowchart of a method for constructing an adversarial integrated classification model provided by an embodiment of the present invention;

[0036] Figure 2 is a schematic diagram of the training process of a target integrated classification model provided by an embodiment of the present invention;

[0037] Figure 3 is a schematic diagram of the classification process of a target integrated classification model provided by an embodiment of the present invention;

[0038] Figure 4 is a schematic structural diagram of an apparatus for constructing an adversarial integrated classification model provided by an embodiment of the present invention;

[0039] Figure 5 is a schematic structural diagram of a terminal device provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0040] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0041] See Figure 1 , Figure 1 is a schematic flowchart of a method for constructing an adversarial integrated classification model provided by an embodiment of the present invention.

[0042] The method for constructing an adversarial integrated classification model provided by the embodiments of the present invention includes the steps:

[0043] S11. Obtain a training data set; wherein, the training data set includes a plurality of samples to be trained and the classification label corresponding to each sample to be trained, and each sample to be trained includes a plurality of features;

[0044] S12. Perform feature selection on each sample to be trained to obtain a set of feature vectors;

[0045] S13. Train a plurality of pre-constructed classifiers through the set of feature vectors to obtain a plurality of base classifiers, so as to form a classifier set;

[0046] S14. Whenever a sample to be detected is received, randomly select a preset number of base classifiers from the classifier set for integration to obtain a target integrated classification model.

[0047] It can be understood that in step S14, the target integrated classification model is the adversarial integrated classification model. In the actual operation process, the current received sample to be detected is classified and detected through the target integrated classification model. The method for constructing the adversarial integrated classification model of this embodiment is applicable to any classification scenario and classification model (such as: text classification model, video classification model, intrusion detection model, etc.) to improve the robustness and classification and detection accuracy of the target integrated classification model.

[0048] It should be noted that the classification label is used to classify the sample to be trained into a malicious sample or a normal sample. In addition, the training data set also includes an attack sample corresponding to each malicious sample, and each attack sample includes a plurality of features.

[0049] It is worth noting that in the evasion attack of adversarial samples, the attacker's goal is to estimate the decision boundary of the target system and manipulate the input sample to mislead the decision of the target system. Usually, the evasion attack problem can be described as: given a machine learning system M and an input sample x; wherein, x can be correctly classified by M, and the output is c(x). And the attacker's goal is to try to find the target classification boundary by sniffing the information of M. Then, after knowing which samples may be misclassified by the machine learning system M, the attacker can minimally modify the input sample x to modify it into an attack sample x'; wherein, x' will be misclassified by the machine learning system M, for example: c(x')≠c(x). Assuming that the modification amount of the input sample is represented by the distance function d(x,x'), the objective function E(x) of the evasion attack problem can be expressed as:

[0050] E(x)=argmin xd(x, x'), s.t. c(x') ≠ c(x);

[0051] Among them, s.t. represents the constraint condition, c(x') is the classification result output by the machine learning system M based on the attack sample x', and c(x) is the classification result output by the machine learning system M based on the input sample x.

[0052] It can be understood that the purpose of the evasion attack problem is: by minimally modifying the input sample x, to achieve the purpose of changing the classification result output by the machine learning system M (i.e., evading the attack).

[0053] Exemplarily, assume that the distance function d(x, x') uses the L0 norm (usually calculated using the L - P norm, such as: L0 norm, L1 norm, L2 norm, and L infinity norm). In this embodiment, the L0 norm is used to represent the number of features modified from x to x'. Assume the sample x = 01111, and at this time the class of the sample x is 1, that is, c(x) = 1. Assume x' = 11111, and c(x') = 0, then d(x, x') = 1, because only by modifying one feature value, the classification result is changed. Here, x' = 11111 is the optimal solution to the evasion attack problem. Of course, there may be other solutions, such as: x' = 10111, but this solution requires changing two feature values, so x' = 10111 is not the optimal solution to the evasion attack problem.

[0054] Preferably, the pre - constructed classifier is a strong classifier.

[0055] It should be noted that traditional classifiers, such as: random forest, gradient boosting tree, ensemble SVM, etc. are all composed of multiple weak classifiers. Although traditional classifiers can increase the difference between weak classifiers, thereby improving the classification accuracy. However, the performance of a single weak classifier is poor. The classifier obtained by ensemble learning based on a set of weak classifiers usually needs to use voting or averaging methods to call all the weak classifiers in the classifier to make a better decision, making it easy for attackers to detect the classification boundary of the ensemble classifier, resulting in poor robustness of traditional ensemble classifiers. Therefore, in this embodiment, a strong classifier is used for training to obtain the base classifier for ensemble learning. It should be noted that a strong classifier refers to a classifier with high robustness without significantly reducing the classification accuracy.

[0056] In addition, considering that the learning process of traditional classifiers may enable attackers to train classifiers using a small amount of training data, making the decision boundary of the trained classifier close to the target system, thus making the attack easier. Therefore, the purpose of this embodiment is to improve the ensemble learning process to obfuscate the decision boundary of the target ensemble classification model, making it difficult for attackers to learn the true decision boundary even if they know some or all of the training data, thereby improving the robustness of the target ensemble classification model.

[0057] In this embodiment, since any single strong classifier can achieve good performance, when making a decision, it is not necessary to involve all strong classifiers in the decision-making. Instead, m strong classifiers can be randomly selected from multiple strong classifiers to make a decision. On the one hand, compared with a single classifier, making a decision by integrating m classifiers can improve the classification accuracy; on the other hand, randomly selecting m classifiers for decision-making can obfuscate the classification boundary. Even if the attacker knows all the parameters of the target system, they cannot know which classifiers will be used to make a decision and cannot obtain the true decision boundary, thus ensuring that the target ensemble classification model has high robustness and classification accuracy. Moreover, each base classifier in the target ensemble classification model is trained with carefully selected features, and these base classifiers all have high classification accuracy and robustness. Each base classifier has a different feature space and different feature weights, making the integrated classification model more robust against evasion attacks.

[0058] In some optional embodiments, in step S12, feature selection is performed on each of the to-be-trained samples based on a feature selection algorithm to obtain a set of feature vectors. The feature selection algorithm can be any one of the following: the method of minimizing classification error, filter algorithm, adversarial feature selection algorithm, wrapper algorithm. In addition, other feature selection methods can also be selected to perform feature selection on the features of each of the to-be-trained samples, which is not specifically limited here.

[0059] Preferably, in step S12, the performing feature selection on the feature vectors of each of the to-be-trained samples to obtain a set of feature vectors is specifically:

[0060] Performing feature selection on each of the to-be-trained samples based on the adversarial feature selection algorithm to obtain a set of feature vectors.

[0061] As one optional embodiment, the performing feature selection on each of the to-be-trained samples based on the adversarial feature selection algorithm to obtain a set of feature vectors is specifically:

[0062] Performing feature selection on each of the to-be-trained samples according to the following formula to obtain the feature vector corresponding to each of the to-be-trained samples, so as to form a set of feature vectors:

[0063]

[0064] where k = 1, 2, …, N, N is the number of features included in the samples to be trained, and k * is the k-th selected feature in the samples to be trained, is the mapping of any k selected features in the samples to be trained, G is the generalization ability of the preset classifier without attacks, S is the security of the preset classifier in the presence of attacks, and λ is a trade-off parameter.

[0065] It should be noted that in the actual operation process, multiple features selected based on each of the samples to be trained form an optimal feature vector corresponding to the sample to be trained. After each selection of an optimal feature vector, the selected feature vector is put into the feature vector set and also used as the input for the next feature selection.

[0066] As an example, a set of training data is obtained where x i is the i-th sample to be trained in the training dataset, and y i is the classification label corresponding to the i-th sample to be trained. The preset classifier g: is used to represent the potential independent and identically distributed mapping process inferred from the training dataset; where the sample to be trained the classification label of the sample to be trained represents the feature space, represents the class classification label space, Then, the generalization ability G of the preset classifier without attacks can be formalized as:

[0067]

[0068] where E is the expectation factor, is the first data distribution, g is a binary classifier, g(·) is the discriminant function of g, and l(·, ·) is the preset classification function.

[0069] Furthermore, according to the following formula, it is calculated that

[0070]

[0071] Then, the security S of the preset classifier in the presence of attacks can be formalized as:

[0072]

[0073] where is the classification label representing the malicious sample, is the second data distribution, is the mapping of k features randomly selected from the samples to be trained, is the optimal solution to the evasion attack problem.

[0074] However, in the actual operation process, and are usually unknown. Therefore, a training dataset consisting of n samples to be trained can be used to estimate G and S.

[0075] In some more optimal embodiments, the generalization ability G of the preset classifier without attack is calculated by the following formula:

[0076]

[0077] where n is the number of samples to be trained in the training dataset, is the mapping of k features randomly selected from the i-th sample to be trained in the training dataset, y i is the classification label of the i-th sample to be trained in the training dataset, l(·,·) is a preset classification function, and g(·) is the discriminant function of the preset classifier g.

[0078] In some more optimal embodiments, the security S of the preset classifier under attack is calculated by the following formula:

[0079]

[0080] where n + is the number of malicious samples in the training dataset, d(·,·) is a distance function, is the mapping of k features randomly selected from the j-th malicious sample in the training dataset, is the mapping of k features randomly selected from the attack sample corresponding to the j-th malicious sample.

[0081] It should be noted that the attack sample corresponding to the j-th malicious sample can be obtained based on any one of the adversarial sample / attack sample generation methods such as Fast Gradient Sign Method (abbreviation: FGSM), Carlini and Wagner Attacks (abbreviation: C&W), Jacobian-based Saliency Map Attack (abbreviation: JSMA), etc.

[0082] Preferably, the attack sample corresponding to the j-th malicious sample is obtained according to the following formula:

[0083]

[0084] Among them, E(x j ) is the objective function for evading the attack problem. The attack sample corresponding to the j-th malicious sample is the solution of the objective function based on the j-th malicious sample. s.t. represents the constraint condition. x j is the j-th malicious sample of the training dataset, and x' j is the attack sample obtained by modifying the j-th malicious sample x j . c(x' j ) is the classification result output by the preset classifier based on x' j , and c(x j ) is the classification result output by the preset classifier based on x j .

[0085] It should be noted that the preset classifier can be any pre-constructed classifier with classification ability, and no specific limitation is made here.

[0086] It is worth noting that taking the L0 norm as an example, for a certain sample to be trained, as long as one feature of the sample to be trained is modified, the classification result of the classifier for the sample to be trained can be changed. Then, the distance calculated by the distance function is 1; if 10 features of the sample to be trained need to be modified to change the classification result, then the distance calculated by the distance function is 10. Therefore, the size of S directly depends on the value of the distance function. In addition, S is also related to the training dataset to a certain extent. For example: for some training datasets, generally modifying one or two features can change the classification result, while for some training datasets, generally 10 - 20 features need to be modified to change the classification result. It can be seen that the value of S depends on the training dataset and the distance function d(·,·). According to the calculation formula of G, G must be a value between [0, 1]. If S is too large, then G loses its effect. Therefore, it is necessary to use the trade-off parameter λ to adjust the value of S so that λS is also a value between [0, 1]. Exemplarily, assume that for each sample to be trained in a set of training datasets, a distance d is obtained, and the largest d value is 4, and the value of S is 2, that is, the average value of the distances d corresponding to each sample to be trained. At this time, the value of λ is 1 / 4, so that λS will be a value between [0, 1]. Based on the above analysis, the value of the trade-off parameter λ is 1 divided by the maximum value of d(·,·), and the trade-off parameter λ is used to balance the values of G and S.

[0087] In a specific implementation manner, in step S13, the training of multiple pre-constructed classifiers by using the feature vector set to obtain multiple base classifiers to form a classifier set includes:

[0088] Training the i-th pre-constructed classifier by using the i-th feature vector in the feature vector set to obtain the i-th base classifier;

[0089] Construct all the trained base classifiers into a classifier set; where the number of the base classifiers is the same as the number of feature vectors included in the feature vector set.

[0090] Furthermore, the pre-constructed classifier is: SVM, decision tree, neural network-based classifier or deep learning-based classifier.

[0091] It should be noted that, in addition to the above-mentioned SVM, decision tree, neural network-based classifier, and deep learning-based classifier, the pre-constructed classifier can also be any other classifier, which is not specifically limited here.

[0092] The following gives two specific algorithms to illustrate the construction method of the adversarial ensemble classification model provided in this embodiment:

[0093]

[0094]

[0095] It can be understood that referring to Figure 2 and Figure 3 , in the embodiment of the present invention, first, a feature selection process is used to select the optimal features of the samples to be trained in the training dataset to form n feature vectors, and then a base classifier is trained through each feature vector to obtain n base classifiers. When classifying the sample to be detected, m base classifiers are randomly selected from these n base classifiers to vote to generate the final classification result; where n is greater than or equal to m, and n and m are positive integers. It should be noted that usually, m is taken as an odd number here, such as: 3, 5, 7, etc.

[0096] Referring to Algorithm 2 and Figure 3 , after obtaining the target ensemble classification model through step S14, each base classifier in the target ensemble classification model is used to classify the currently received sample to be detected to obtain multiple sub-classification results, and the following formula is used to accumulate the multiple sub-classification results to obtain the final classification result C:

[0097]

[0098] where m is the number of sub-classification results, and c k is the value of the k-th sub-classification result.

[0099] It should be noted that the sub-classification result is a binary number, c k = 1 or c k = -1.

[0100] It can be understood that in this embodiment, first, an adversarial feature selection algorithm is used to select a feature vector for each training sample to ensure both classification accuracy and robustness, and add it to the feature vector set. Then, n different feature vectors in the feature vector set are used to train n classifiers respectively to obtain n base classifiers. Finally, m base classifiers are randomly selected from the n base classifiers for decision-making, so as to ensure that each base classifier has good classification accuracy and robustness, and at the same time make it impossible for the attacker to accurately estimate the decision boundary, and the robustness of the ensemble classifier can be improved without reducing the classification accuracy. Moreover, the experimental results of actual data show that the target ensemble classification model obtained by the construction method of the adversarial ensemble classification model provided in the embodiments of the present invention is significantly superior to the traditional ensemble classification model in terms of robustness against evasion attacks and gradient-related metrics, and will not significantly lose classification accuracy in the absence of attacks.

[0101] See Figure 4 , which is a schematic structural diagram of a device for constructing an adversarial ensemble classification model provided in an embodiment of the present invention.

[0102] The device for constructing an adversarial ensemble classification model provided in an embodiment of the present invention includes:

[0103] A data acquisition module 21, configured to acquire a training data set; wherein, the training data set includes a plurality of training samples and classification labels corresponding to each training sample, and each training sample includes a plurality of features;

[0104] A feature selection module 22, configured to perform feature selection on each training sample to obtain a feature vector set;

[0105] A classifier training module 23, configured to train a plurality of pre-constructed classifiers through the feature vector set to obtain a plurality of base classifiers to form a classifier set;

[0106] An ensemble classification module 24, configured to randomly select a preset number of base classifiers from the classifier set for ensemble each time a sample to be detected is received to obtain a target ensemble classification model.

[0107] As an improvement to the above solution, the feature selection module 22 is specifically configured to:

[0108] Perform feature selection on each training sample based on an adversarial feature selection algorithm to obtain a feature vector set.

[0109] As an optional implementation manner, the feature selection module 22 is configured to perform feature selection on each training sample based on an adversarial feature selection algorithm to obtain a feature vector set, specifically:

[0110] Feature selection is performed on each of the to-be-trained samples according to the following formula to obtain a feature vector corresponding to each of the to-be-trained samples, so as to form a feature vector set:

[0111]

[0112] where k = 1, 2, …, N, N is the number of features included in the to-be-trained samples, and k * is the k-th selected feature in the to-be-trained sample, is the mapping of any k features selected from the to-be-trained sample, G is the generalization ability of the preset classifier in the case of no attack, S is the security of the preset classifier in the case of the existence of an attack, and λ is a trade-off parameter.

[0113] Preferably, in the feature selection module 22, the generalization ability G of the preset classifier in the case of no attack is calculated by the following formula:

[0114]

[0115] where n is the number of to-be-trained samples in the training dataset, is the mapping of any k features selected from the i-th to-be-trained sample in the training dataset, and y i is the classification label of the i-th to-be-trained sample in the training dataset, l(·, ·) is a preset classification function, and g(·) is the discriminant function of the preset classifier g.

[0116] Furthermore, in the feature selection module 22, the security S of the preset classifier in the case of the existence of an attack is calculated by the following formula:

[0117]

[0118] where n + is the number of malicious samples in the training dataset, d(·, ·) is a distance function, is the mapping of any k features selected from the j-th malicious sample in the training dataset, is the mapping of any k features selected from the attack sample corresponding to the j-th malicious sample.

[0119] As one of the preferred implementation manners, the classifier training module 23 is specifically configured to:

[0120] Train the i-th pre-constructed classifier through the i-th feature vector in the feature vector set to obtain the i-th base classifier;

[0121] Construct a classifier set from all the trained base classifiers, where the number of the base classifiers is the same as the number of feature vectors included in the feature vector set.

[0122] It should be noted that for the relevant specific descriptions and beneficial effects of the embodiments of the construction device of the adversarial ensemble classification model in this embodiment, reference can be made to the relevant specific descriptions and beneficial effects of the embodiments of the above-mentioned construction method of the adversarial ensemble classification model, which will not be elaborated here.

[0123] See Figure 5 , which is a schematic structural diagram of a terminal device provided by an embodiment of the present invention.

[0124] A terminal device provided by an embodiment of the present invention includes a processor 10, a memory 20, and a computer program stored in the memory 20 and configured to be executed by the processor 10. When the processor 10 executes the computer program, the construction method of the adversarial ensemble classification model as described in any of the above embodiments is implemented.

[0125] When the processor 10 executes the computer program, the steps in the embodiments of the above-mentioned construction method of the adversarial ensemble classification model are implemented, such as Figure 1 All the steps of the construction method of the adversarial ensemble classification model shown. Alternatively, when the processor 10 executes the computer program, the functions of each module / unit in the embodiments of the above-mentioned construction device of the adversarial ensemble classification model are implemented, such as Figure 4 The functions of each module of the construction device of the adversarial ensemble classification model shown.

[0126] Exemplarily, the computer program can be divided into one or more modules. The one or more modules are stored in the memory 20 and executed by the processor 10 to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of completing specific functions, and this instruction segment is used to describe the execution process of the computer program in the terminal device.

[0127] The terminal device can be a computing device such as a desktop computer, a notebook, a palm computer, and a cloud server. The terminal device may include, but is not limited to, a processor 10 and a memory 20. Those skilled in the art can understand that the schematic diagram is only an example of the terminal device, and does not constitute a limitation on the terminal device. It may include more or fewer components than shown in the figure, or combine certain components, or different components. For example, the terminal device may further include input / output devices, network access devices, a bus, etc.

[0128] The so-called processor 10 may be a Central Processing Unit (CPU), or may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The processor 10 is the control center of the terminal device, and connects various parts of the entire terminal device through various interfaces and lines.

[0129] The memory 20 can be used to store the computer programs and / or modules. The processor 10 realizes various functions of the terminal device by running or executing the computer programs and / or modules stored in the memory 20, and by calling the data stored in the memory 20. The memory 20 may mainly include a program storage area and a data storage area. Among them, the program storage area may store an operating system, application programs required for at least one function, etc.; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disks, memory, plug-in hard disks, Smart Media Cards (SMCs), Secure Digital (SD) cards, Flash Cards, at least one magnetic disk storage device, flash device, or other volatile solid-state storage devices.

[0130] Among them, if the modules / units integrated in the terminal device are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, to implement all or part of the processes in the above-mentioned method embodiments of the present invention, it can also be completed by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, the steps of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0131] It should be noted that the device embodiments described above are only illustrative. The units described as separate components may or may not be physically separated. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that they have a communication connection, which can be specifically implemented as one or more communication buses or signal lines. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0132] Another embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program. When the computer program runs, it controls the device where the computer-readable storage medium is located to execute the method for constructing an adversarial integrated classification model described in any one of the above method embodiments.

[0133] In summary, for a method, apparatus, device, and computer-readable storage medium for constructing an adversarial integrated classification model provided by an embodiment of the present invention, first, a training data set including a plurality of training samples is obtained, and a feature vector set composed of a plurality of different feature vectors is obtained by performing feature selection on each of the training samples; then, a plurality of pre-constructed classifiers are trained through the feature vector set to obtain a plurality of base classifiers, so as to form a classifier set; finally, whenever a sample to be detected is received, a preset number of base classifiers are randomly selected from the classifier set for integration to obtain a target integrated classification model for classifying and detecting the sample to be detected. The present invention introduces randomness in the decision-making stage. By randomly selecting base classifiers to construct a target integrated classification model for classifying and detecting a sample to be detected, it is difficult for an attacker to learn the true decision boundary of the target integrated classification model, thereby improving the robustness and classification detection accuracy of the target integrated classification model.

[0134] The above is the preferred embodiment of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements are also regarded as the protection scope of the present invention.

Claims

1. A method for constructing an adversarial integrated classification model, characterized in that Applied to a text classification model, the method for constructing the adversarial ensemble classification model includes: Obtain a training data set; wherein, the training data set includes a plurality of training samples and the classification label corresponding to each training sample, and each training sample includes a plurality of features; the training samples are text samples; Perform feature selection on each training sample to obtain a feature vector set; Train a plurality of pre-constructed classifiers through the feature vector set to obtain a plurality of base classifiers, so as to form a classifier set; Whenever a sample to be detected is received, randomly select a preset number of base classifiers from the classifier set for integration to obtain a target ensemble classification model; The classification label is used to classify the training sample into a malicious sample or a normal sample; the training data set further includes an attack sample corresponding to each malicious sample, and each attack sample includes a plurality of features; The performing feature selection on the feature vectors of each training sample to obtain a feature vector set specifically includes: Perform feature selection on each training sample based on an adversarial feature selection algorithm to obtain a feature vector set; The performing feature selection on each training sample based on the adversarial feature selection algorithm to obtain a feature vector set specifically includes: Perform feature selection on each training sample according to the following formula to obtain the feature vector corresponding to each training sample, so as to form a feature vector set: where k = 1, 2, …, N, N is the number of features included in the training samples to be trained, and k * is the k-th selected feature in the training samples to be trained, is the mapping of any k features randomly selected from the training samples to be trained, G is the generalization ability of the preset classifier without attacks, S is the security of the preset classifier in the presence of attacks, and λ is the trade-off parameter; The security S of a preset classifier in the case of an existing attack is calculated by the following formula: where n + is the number of malicious samples in the training dataset, and d(·,·) is the distance function, is the mapping of k randomly selected features from the j-th malicious sample in the training dataset, is the mapping of k randomly selected features from the attack sample corresponding to the j-th malicious sample.

2. The method for constructing an adversarial integrated classification model according to claim 1, characterized in that The generalization ability G of a preset classifier in the case of no attack is calculated by the following formula: where n is the number of samples to be trained in the training dataset, is the mapping of k features arbitrarily selected from the i-th sample to be trained in the training dataset, y i is the classification label of the i-th sample to be trained in the training dataset, l(·,·) is a preset classification function, and g(·) is the discriminant function of the preset classifier g.

3. The method for constructing an adversarial integrated classification model according to claim 1, characterized in that The training a plurality of pre-constructed classifiers through the feature vector set to obtain a plurality of base classifiers, so as to form a classifier set includes: Train the i-th pre-constructed classifier through the i-th feature vector in the feature vector set to obtain the i-th base classifier; Construct all the trained base classifiers into a classifier set; wherein, the number of base classifiers is the same as the number of feature vectors included in the feature vector set.

4. An apparatus for constructing an adversarial integrated classification model, characterized in that Applied to a text classification model, the device for constructing the adversarial ensemble classification model includes: A data acquisition module, configured to obtain a training data set; wherein, the training data set includes a plurality of training samples and the classification label corresponding to each training sample, and each training sample includes a plurality of features; the training samples are text samples; A feature selection module, configured to perform feature selection on each training sample to obtain a feature vector set; A classifier training module, configured to train a plurality of pre-constructed classifiers through the feature vector set to obtain a plurality of base classifiers, so as to form a classifier set; An ensemble classification module, configured to randomly select a preset number of base classifiers from the classifier set for integration whenever a sample to be detected is received, to obtain a target ensemble classification model; The classification label is used to classify the to-be-trained samples into malicious samples or normal samples; the training dataset further includes an attack sample corresponding to each malicious sample, and each of the attack samples includes multiple features; The feature selection module is used to perform feature selection on each of the to-be-trained samples based on an adversarial feature selection algorithm to obtain a feature vector set, specifically: Feature selection is performed on each of the to-be-trained samples according to the following formula to obtain a feature vector corresponding to each of the to-be-trained samples, so as to form a feature vector set: where k = 1, 2, …, N, N is the number of features included in the samples to be trained, and k * is the k-th selected feature in the samples to be trained, is the mapping of any k features randomly selected from the samples to be trained, G is the generalization ability of the preset classifier without attacks, S is the security of the preset classifier in the presence of attacks, and λ is the trade-off parameter; In the feature selection module, the security S of the preset classifier in the case of the existence of an attack is calculated by the following formula: Among them, n + is the number of malicious samples in the training dataset, and d(·,·) is the distance function. is the mapping of k features arbitrarily selected from the j-th malicious sample in the training dataset. is the mapping of k features arbitrarily selected from the attack sample corresponding to the j-th malicious sample.

5. A terminal device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the method for constructing the adversarial integrated classification model according to any one of claims 1 to 3 is implemented.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein when the computer program runs, the device where the computer-readable storage medium is located is controlled to execute the method for constructing the adversarial integrated classification model according to any one of claims 1 to 3.

Images