An intelligent migration countermeasure method and system for electromagnetic signal recognition under incomplete information

Abstract

This invention belongs to the field of artificial intelligence algorithm technology and discloses an intelligent transfer adversarial method and system for electromagnetic signal recognition under incomplete information. First, multiple models of alternative target networks with incomplete information are constructed in parallel, and these alternative models are trained using an evolutionary strategy based on a prior knowledge matrix. Then, an ensemble network model is generated based on the trained alternative models, and a fully connected layer and a layer with feature-level weighted fusion are designed. Finally, an optimized adversarial method for electromagnetic spatial signal recognition tasks is designed, generating adversarial samples under the ensemble model, and transferring these adversarial samples to the target network to achieve adversarial capabilities against the target network. This invention can effectively achieve adversarial capabilities against the target network when the target network information is unknown, and it still exhibits good transfer adversarial performance under the same signal recognition task and different unknown target network conditions.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence algorithm technology, and particularly relates to an intelligent transfer adversarial method and system for electromagnetic signal recognition under incomplete information. Background Technology

[0002] Currently, adversarial attacks are commonly used in the image processing field. However, compared to image processing, attacks in another field are crucial: modulation recognition. Modulation recognition is a vital step between signal detection and demodulation, playing a key role in alleviating spectrum resource shortages. Automatic modulation recognition technology applies deep learning to modulation recognition, utilizing deep neural networks (DNNs) to significantly increase the speed and accuracy of modulated signal recognition. However, many studies have shown that neural networks are susceptible to carefully designed micro-perturbations. Adversarial examples, created by superimposing small malicious noises onto normal samples, can lead to incorrect model inputs, thus affecting the security of practical application systems. The discovery of adversarial attacks and adversarial examples poses a significant security threat to the field of artificial intelligence. Researchers have identified adversarial attacks as primarily categorized into two types: complete information adversarial attacks and incomplete information adversarial attacks. Complete information refers to the known details of the target model's internal structure, while incomplete information is unknown. Clearly, incomplete information adversarial attacks are more practical in real-world environments than complete information adversarial attacks, severely impacting the robustness of deep learning. Furthermore, if adversarial examples possess high cross-model transferability, they can pose serious security problems for real-world AI-based applications.

[0003] Currently, there are many studies on adversarial methods in the literature. Szegedy et al. first proposed the concept of adversarial examples. They successfully changed the classifier's prediction of the input sample by adding tiny perturbations that are imperceptible to the human eye (Szegedy C, Zaremba W, Sutskever I, et al. Intriguing properties of neural networks[C]. Proc. Int. Conf. Learn. Representations,2015: 1-10.). Since the introduction of adversarial examples, numerous adversarial methods have emerged, including: the fast gradient sign method (Goodfellow I, Shlens J, Szegedyn C, et al. Explaining and harnessing adversarial examples[C]. Proc. Int. Conf. Learn. Representations, 2015: 189-199.) and the C&W optimization-based method (Carlini N, Wagner D. Towards evaluating the robustness of neural networks[C]. 2017 IEEE symposium on security and privacy (sp). IEEE, 2017: 39-57.). These methods rely on detailed information about the target model for adversarial competition. However, in real-world scenarios, the weight information, training dataset, and validation dataset information of the target model are often difficult to obtain. To address this incomplete information model, Papernot et al. proposed using Jacobi augmentation to train a fitted alternative network model to generate adversarial examples against the target network model. However, this method, which uses a finite number of queries to fit the incomplete information model, exhibits low performance, thus affecting the success rate of adversarial examples (Papernot N, McDaniel P, Goodfellow I, et al. Practical black-box attacks against machine learning[C]. Proceedings of the 2017 ACM on Asia conference on computer and communications security. 2017:506-519.). Dong et al. proposed the MI-FGSM incomplete information adversarial method.Although this method smooths the direction of the added perturbation, the boundary effect still exists as the number of iterations increases, resulting in low robustness and low transferability of the generated adversarial examples (Dong Y, Liao F, Pang T, et al. Boosting adversarial attacks with momentum[C]. Proceedings of the IEEE conference on computer vision and pattern recognition. 2018: 9185-9193.). Su et al. proposed a black-box adversarial example generation method, ONE-PIXEL, which can adversarially attack networks with gradients that are difficult to compute and non-differentiable, and has good flexibility. However, since only one pixel of the original image is changed, the success rate of this method is relatively low, and the transferability of the generated adversarial examples is also low (Su J, Vargas DV, Sakurai K. One pixel attack for fooling deep neural networks[J]. IEEE Transactions on Evolutionary Computation, 2019, 23(5): 828-841.). Dong et al. proposed an incomplete information adversarial attack based on random coordinate selection. This method optimizes local noise, but its effectiveness is mediocre, and it does not consider the mobility of adversarial examples (Dong K, Shi J, Guo L. Black-box adversarial attacks based on random coordinate selection[C]. Journal of Physics: Conference Series. IOP Publishing, 2021, 1941(1): 012082.). Suryanto et al. proposed a distributed incomplete information adversarial attack based on multi-group particle swarm optimization. This method considers a relatively singular distributed approach, resulting in low confidence in the generated adversarial examples and failing to consider the mobility of adversarial examples (Suryanto N, Kang H, Kim Y, et al. A Distributed Black-Box Adversarial Attack Based on Multi-GroupParticle Swarm Optimization[J]. Sensors, 2020, 20(24): 7158.).To address the issue of adversarial example transferability that was not considered above, Liu et al. proposed an ensemble learning model to generate adversarial examples in order to improve the transferability of these adversarial examples across different incomplete information models under the same classification task. However, the ensemble learning model used simply merges the various softmax layers, resulting in low transferability of the generated adversarial examples (Liu Y, Chen X, Liu C, et al. Delving into transferable adversarial examples and black-box attacks[J]. arXivpreprint arXiv: 1611.02770, 2016.). Ding et al. proposed a low-query black-box adversarial attack based on transferability[J]. Knowledge-Based Systems, 2021, 226: 107102. This method uses a single network model that fits the incomplete information to generate adversarial examples. The resulting adversarial examples have low transferability, and the trained network model is an online query incomplete information model, which has a low performance ceiling within a limited query range (Ding K, Liu X, Niu W, et al. A low-query black-box adversarial attack based on transferability[J]. Knowledge-Based Systems, 2021, 226: 107102.).

[0004] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0005] (1) Existing automatic modulation recognition models for combating incomplete information often use transfer-based methods, which use a single substitution model or simple model ensemble to fit the decision boundary of the target model. The decision boundary fitted by this method has a large error, which further leads to a large error in the cross-entropy loss function.

[0006] (2) Existing technologies for automatic modulation and identification models that combat incomplete information often use Jacobi-based augmentation methods. These small-sample data augmentation methods require a large number of queries to the target model, making them easily detectable by the target model.

[0007] (3) In the existing technology, the automatic modulation recognition model against incomplete information basically does not consider the transferability between different models of the same classification task, and the generated adversarial samples have low transferability.

[0008] The difficulties in solving the above problems and defects are as follows: obtaining detailed information about incomplete information network models is difficult; the number of queries for fitting incomplete information network models with alternative network models is limited; and augmentation is hindered by a small number of known datasets. Furthermore, the difficulty is exacerbated by high-performance incomplete information network models with complex structures. It is also difficult to transfer adversarial examples generated by incomplete information network models to different classification incomplete information network models of the same task and solve the problem of a sharp drop in transfer performance. Summary of the Invention

[0009] To address the problems existing in the prior art, this invention provides an intelligent migration countermeasure method and system for electromagnetic signal recognition under incomplete information.

[0010] This invention is implemented as follows: First, an offline augmentation technique for small sample data is designed; then, a feature-level weighted ensemble model is constructed and trained; finally, a task-oriented optimized adversarial algorithm is designed to generate adversarial examples for attack. An intelligent transfer adversarial method for electromagnetic signal recognition under incomplete information includes:

[0011] Step 1 involves constructing multiple alternative models of the target network with incomplete information in parallel and training these alternative models using an evolutionary strategy method based on a prior knowledge matrix. The purpose of this step is to address the enhancement techniques proposed to suit the missing and random characteristics of small sample data. Furthermore, to address the issue of increased access to the target model during enhancement, an evolutionary strategy method based on a prior knowledge matrix is ​​proposed to enhance small sample data offline, significantly reducing the number of online accesses and further reducing the likelihood of being detected during the attack.

[0012] Step two involves generating an ensemble network model based on the multiple trained alternative models, and designing a fully connected layer for feature-level weighted fusion. The purpose of this step is to better find the decision boundary of the target model and propose an integrated network model, further weighting and fusing the performance of several single network models at the feature level, laying the groundwork for the next adversarial method.

[0013] Step 3: Design an optimized adversarial method for electromagnetic space signal recognition tasks, generate adversarial samples under the ensemble model, and transfer the adversarial samples to the target network to achieve adversarial capabilities against the target network. The purpose of this step is to use the designed optimized adversarial method for electromagnetic space signal recognition tasks to generate adversarial samples with high transfer performance and good attack performance on the ensemble model.

[0014] Furthermore, in step one, multiple alternative models of the incomplete information target network are constructed in parallel, and these alternative models are trained using an evolutionary strategy method based on a prior knowledge matrix. The specific process is as follows:

[0015] First, multiple alternative target network models are constructed in parallel. The known small amount of signal dataset is loaded onto the network model with incomplete information to obtain its label, and the obtained label is labeled onto the known small amount of signal dataset. The multiple alternative models are then trained in parallel.

[0016] Furthermore, in the parallel training of the constructed multiple alternative models, the multiple alternative models can be trained in parallel by repeating the following steps:

[0017] A small dataset of known labeled signals is loaded onto a pre-constructed alternative model to train the network. The cross-entropy loss function is denoted as... Let be a given signal from a set of a small number of signals. ,Will The predicted output obtained by loading the data into the incomplete information model is denoted as... Data augmentation techniques using Jacobian matrices to augment the dataset for signals Generate enhanced signal Its Jacobian data augmentation method is expressed as:

[0018]

[0019] Among them, the network model that fits incomplete information The derivative of the function with respect to the input is Using symbolic functions To determine the selected enhancement direction for this signal enhancement, Step size, To expand the previous dataset, To expand the dataset.

[0020] Furthermore, the specific process of the evolutionary strategy method based on the prior knowledge matrix is ​​as follows:

[0021] Will enhance the signal The network model, loaded with incomplete information, generates the predicted output. Using raw data Predicted output Subtract the enhanced signal Predicted output Generate difference vector The term with the largest value in the difference vector is defined as... And the largest term in the difference vector Set to 1 Set all other terms to 0 to generate a prior knowledge vector. , represented as:

[0022]

[0023] The generated prior knowledge vector records the original data. To augment data Change direction and augmented data The next stage of change trend; repeat the above steps for Signal generation A set of prior knowledge vectors are concatenated to generate a prior knowledge matrix. , represented as:

[0024]

[0025] Prior knowledge matrix records The signals and their changing trends are in a one-to-one correspondence. The control signals move towards the direction of the less data and missing categories in the known small dataset, thereby supplementing the less data and missing category signals to make the dataset more complete.

[0026] Take the first column of the prior knowledge matrix in ascending order. Column 1 corresponds to Input signal All were extracted to form a signal set. , represented as:

[0027] ,

[0028] signal set Mutation generation One variant signal:

[0029] ,

[0030] The generated A variant signal These are supplementary signals, which further enrich the signals of fewer and missing categories, and are synthesized offline through mutation, resulting in mutated signals. A signal is loaded onto the alternative network model to generate 1. Prior knowledge vectors are generated, and a new prior knowledge matrix is ​​constructed.

[0031] The previous prior knowledge matrix number The column contains signals that are all 1s and the new prior knowledge matrix. If a column contains all 1s, a crossover is performed to select the signal with higher fitness as the next generation. The selection criterion is the difference vector, which is compared between two consecutive 1s. Select the larger item from the column. The signal with higher fitness is selected as the next generation:

[0032]

[0033] Repeat the above steps to train a network model that fits incomplete information. Stop iterating when the accuracy of the network model that fits incomplete information no longer improves.

[0034] Furthermore, in step two, which generates an ensemble network model based on multiple trained alternative models, several alternative network models with different structures generated in step one are first used to extract and weightedly fuse the features of the layer before the fully connected layer. Specifically, this includes:

[0035] First, let the number of generated alternative models be... , Indicates interception An alternative network model, excluding fully connected layers and Other layers of the layer, Indicates a convolutional layer. The remaining layers after truncating the alternative network model are represented as follows:

[0036]

[0037] Design No. Weights when fusing features from a network model that fits incomplete information. ,in, Represents the convolutional layer of each alternative model The number of Indicates will indivual Add them together. Represented as:

[0038]

[0039] And the weight constraint conditions are:

[0040]

[0041] Weight design combines The complexity and depth of the alternative network model are summed to 1;

[0042] extract The feature representation of the output of the layer above the fully connected layer of the alternative network model is as follows: , It is a tensor, representing the features extracted from an alternative model. All extracted features are represented as:

[0043]

[0044] The extracted features are weighted and fused, denoted as... , represented as:

[0045]

[0046] Combine weights By fusing features learned from alternative network models, the diversity of features is increased, ultimately enhancing the samples. Simply load it into the ensemble network model for training.

[0047] Furthermore, in step two, a fully connected layer with feature-level weighted fusion is designed. The specific process of the layer is as follows:

[0048] Based on the length of the weighted features Set the number of neurons in the fully connected layer to be , This indicates that the activation function will be used. Set as , Indicates weight Initialize to The method sets the number of fully connected layers to two, with the first layer being:

[0049]

[0050] The second layer is:

[0051]

[0052] design layer, For the number of categories, This indicates that the activation function will be used. Set as Its layers are represented as:

[0053]

[0054] Finally, the two fully connected layers and The layers are connected in sequence to combine the weighted features. A complete ensemble network model can be built from the input of the first fully connected layer, which will enhance the samples. Simply load it into the ensemble network model for training.

[0055] Furthermore, in step three, an optimized adversarial method is designed for the intelligent recognition task of electromagnetic space signals. Adversarial examples are generated under the ensemble model, and these adversarial examples are transferred to the target network to achieve adversarial capabilities against the target network. The specific implementation process is as follows:

[0056] Optimized adversarial algorithms for electromagnetic space signal recognition tasks are selected to improve the transferability of adversarial examples, and a standard for evaluating the transferability of adversarial examples is used. Norms reduce the Euclidean distance between adversarial examples and original examples while increasing the features output by the ensemble network model, thereby improving transferability. The objective function in the optimized adversarial method for electromagnetic space signal recognition is redesigned and abstracted into a mathematical model, which is then added to the ensemble network model to generate adversarial examples and transferred to the incomplete information network model.

[0057] Furthermore, the optimized adversarial method for electromagnetic space signal recognition tasks is abstracted into a mathematical model as follows:

[0058]

[0059] in, Represents the original sample. This represents the generated adversarial example. It is the perturbation added to generate adversarial examples. It is the correct category label. It is the Euclidean distance between the original sample and the adversarial sample. It limits the range of data after the added perturbation.

[0060] Furthermore, a new objective function is introduced to replace the category constraint. Design an objective function:

[0061]

[0062] The above constraint problem simplifies to an inequality constraint problem:

[0063] ,

[0064] Then, using the mathematical method of transforming inequalities into equalities, the inequality-constrained problem is transformed into an equality-constrained problem:

[0065] ,

[0066] in, The constant is used to adjust the emphasis on optimization effect and noise level, and the Euclidean distance in the formula is... Using the 2-norm Substitution yields:

[0067] ,

[0068] Introducing new variables links the disturbance and the constraint; the constraint is... ,Will Replace with , It can be replaced with This constrained problem is transformed into a minimum value problem:

[0069] ,

[0070] The sample was then added to a pre-trained ensemble network model to generate adversarial examples, and then transferred to a network model with incomplete information.

[0071] Another objective of this invention is to provide an intelligent migration countermeasure system for electromagnetic signal recognition under incomplete information, the intelligent migration countermeasure system for electromagnetic signal recognition under incomplete information comprising:

[0072] Alternative model generation and training module is used to construct multiple alternative incomplete information target network models in parallel, and to train the alternative models using an evolutionary strategy method based on prior knowledge matrix;

[0073] An ensemble model design module is used to generate an ensemble network model based on multiple trained alternative models, and to design feature-level weighted fusion fully connected layers and... layer;

[0074] The adversarial example intelligent transfer module is used to design optimized adversarial methods for electromagnetic space signal recognition tasks. It generates adversarial examples under the ensemble model and transfers these adversarial examples to the target network to achieve adversarial capabilities against the target network.

[0075] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0076] First, addressing the technical problems existing in the prior art and the difficulty in solving them, this paper closely analyzes, in conjunction with the technical solution to be protected by this invention and the results and data obtained during the research and development process, how the technical solution of this invention solves the technical problems, and the inventive technical effects brought about by solving these problems. The specific description is as follows:

[0077] This invention proposes an evolutionary strategy adversarial method based on a prior knowledge matrix for incomplete information network models. This method can make the performance of the alternative network model infinitely close to the target model with a limited number of queries, providing a new approach to adversarial network models with unknown weight information. This invention also proposes an ensemble model method that fuses features from several networks, enabling the generated adversarial examples to adversarially challenge different network models for the same classification task. This allows for universal adversarial ...

[0078] Second, considering the technical solution as a whole or from a product perspective, the technical effects and advantages of the technical solution to be protected by this invention are specifically described as follows:

[0079] This invention implements an evolutionary strategy data augmentation method based on a prior knowledge matrix, which can make the performance of the alternative network model infinitely close to that of the target model while reducing the number of queries, providing a new method for adversarial network models with incomplete information. This invention proposes a weighted feature fusion ensemble network model method, overcoming the shortcomings of single alternative models and simple model ensemble methods. This allows the generated adversarial examples to adversarially challenge different incomplete information network models for the same classification task, achieving universal adversarial capabilities with a single generation, making the adversarial approach more realistic. Conversely, it not only enhances the adversarial performance of the recognition model but also improves the robustness of the recognition model. This application is limited to legal uses only.

[0080] Third, as supplementary evidence of the inventive step of the claims of this invention, it is also reflected in the following important aspects:

[0081] (1) The technical solution of this invention fills a technical gap in the industry both domestically and internationally:

[0082] The intelligent migration adversarial method and system for electromagnetic signal recognition under incomplete information proposed in this invention fills the gap in the line enhancement technology based on a small number of sample data in migration attack methods. At the same time, it adds the feature-level weighted fusion technology of integrated model. These two technologies fully supplement the field of improving the migration rate and generalization of adversarial samples that have not been covered by existing incomplete information adversarial technologies.

[0083] (2) The technical solution of the present invention solves a technical problem that people have long wanted to solve but have never been able to solve successfully:

[0084] The intelligent migration countermeasure method and system for electromagnetic signal recognition under incomplete information proposed in this invention completely solves two problems of existing incomplete information countermeasure technology. First, how to reduce the number of online accesses to the target model. This invention proposes an offline enhancement algorithm based on an evolutionary strategy of prior knowledge matrix, which greatly reduces the number of accesses. Second, how to improve the performance of the alternative model. This invention proposes a feature-level weighted ensemble model, which greatly improves the accuracy of the decision boundary of the alternative model. Attached Figure Description

[0085] Figure 1 This is a flowchart of the intelligent migration countermeasure method for electromagnetic signal recognition under incomplete information provided in the embodiments of the present invention;

[0086] Figure 2 This is a structural block diagram of the intelligent migration countermeasure system for electromagnetic signal recognition under incomplete information provided in this embodiment of the invention;

[0087] Figure 3 This is a schematic diagram of the simulation experiment results provided in the embodiments of the present invention. Detailed Implementation

[0088] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0089] I. Explanatory and Illustrative Embodiments. To enable those skilled in the art to fully understand how the present invention is specifically implemented, this section provides an explanatory and illustrative description of the embodiments described in the claims.

[0090] like Figure 1 As shown, the intelligent migration countermeasure method for electromagnetic space signal recognition under incomplete information provided in this embodiment of the invention includes:

[0091] S101: Construct multiple alternative models of incomplete information target networks in parallel and train these alternative models using an evolutionary strategy method based on prior knowledge matrices.

[0092] S102: Generate an ensemble network model based on multiple trained alternative models, and design a fully connected layer for feature-level weighted fusion. layer;

[0093] S103: Design an optimized adversarial method for electromagnetic space signal recognition tasks. Generate adversarial samples under an integrated model and transfer these adversarial samples to the target network to achieve adversarial capabilities against the target network.

[0094] In S101 of this embodiment of the invention, multiple alternative models of incomplete information target networks are constructed in parallel, and these alternative models are trained using an evolutionary strategy method based on a prior knowledge matrix. The specific process is as follows:

[0095] 1. First, multiple alternative incomplete information target network models are constructed in parallel. The known small amount of signal dataset is loaded onto the incomplete information network model to obtain its label, and the obtained label is labeled onto the known small amount of signal dataset.

[0096] You can train multiple alternative models in parallel by following these steps in a loop:

[0097] A small dataset of known labeled signals is loaded onto a pre-constructed alternative model to train the network. The cross-entropy loss function is denoted as... Let be a given signal from a set of a small number of signals. ,Will The predicted output obtained by loading the data into the incomplete information model is denoted as... Data augmentation techniques using Jacobian matrices to augment the dataset for signals Generate enhanced signal Its Jacobian data augmentation method is expressed as:

[0098]

[0099] Its fitting network model of incomplete information The derivative of a function with respect to its input is denoted as Using symbolic functions To determine the selected enhancement direction for this signal enhancement, Step size, To expand the previous dataset, To expand the dataset.

[0100] The evolutionary strategy method based on prior knowledge matrices is implemented as follows:

[0101] Will enhance the signal The network model, loaded with incomplete information, generates the predicted output. Using raw data Predicted output Subtract the enhanced signal Predicted output Generate difference vector The term with the largest value in the difference vector is defined as... And the largest term in the difference vector Set to 1 Set all other terms to 0 to generate a prior knowledge vector. , represented as:

[0102]

[0103] The purpose of generating prior knowledge vectors is to record the original data. To augment data Change direction and augmented data The next stage of change trend.

[0104] Repeat the above method for Signal generation A set of prior knowledge vectors are concatenated to generate a prior knowledge matrix. , represented as: ,

[0105] Prior knowledge matrix design concept:

[0106] Prior knowledge matrix records Each signal and its changing trend have a one-to-one correspondence. The control signal moves towards the less common and missing categories in the known small dataset, thereby supplementing the less common and missing category signals to make the dataset more complete.

[0107] 2. Next, the columns in the prior knowledge matrix are sorted in ascending order. Column 1 corresponds to Input signal All were extracted to form a signal set. It is represented as:

[0108]

[0109] Mutations:

[0110] signal set Mutation generation One variant signal:

[0111]

[0112] The generated The purpose of each variant signal is: to generate A variant signal Signals belonging to the less common and missing categories were further supplemented with signals belonging to the less common and missing categories, and offline mutation synthesis was carried out to reduce the number of queries and reduce the possibility of being defended by incomplete information network models.

[0113] The mutated A signal is loaded onto a network model that fits incomplete information to generate... We obtain a prior knowledge vector and construct a new prior knowledge matrix.

[0114] cross:

[0115] The previous prior knowledge matrix number The presence of a signal where all columns are 1 and the newly generated prior knowledge matrix. If a column contains all 1s, a crossover is performed to select the signal with higher fitness as the next generation. The selection criterion is the difference vector, which is compared between two consecutive 1s. Select the larger item from the column. The signal with higher fitness is selected as the next generation:

[0116]

[0117] Repeat the above steps to train the network model that fits the incomplete information. Stop iterating when the accuracy of the network model that fits the incomplete information no longer improves. The design idea of ​​the augmentation training method described in step 2 is as follows:

[0118] Because the method described in step 2 is performed offline, its reinforcement training can theoretically be iterated an infinite number of times. Theoretically, the classification performance of the fitted alternative network model will infinitely approach the performance of the incomplete information network model, reducing online queryability and the possibility of being discovered by adversaries. Moreover, the performance of the alternative network model directly determines the adversarial success rate and transfer rate of generated adversarial examples. Therefore, offline reinforcement training is used.

[0119] In S102 of this embodiment of the invention, an ensemble network model is generated based on multiple trained alternative models, and a fully connected layer with feature-level weighted fusion is designed. The specific process is as follows:

[0120] First, using step one, several alternative network models with different structures are generated. Features from the layer preceding the fully connected layer are then extracted and weighted and fused. Let the number of generated alternative models be denoted as . , Indicates interception An alternative network model, excluding fully connected layers and Other layers of the layer, Indicates a convolutional layer. The remaining layers after truncating the alternative network model are represented as follows:

[0121]

[0122] Design No. Weights when fusing features from a network model that fits incomplete information. ,in Represents the convolutional layer of each alternative model The number of Indicates will indivual Add them together. Represented as:

[0123]

[0124] And the weight constraint conditions are:

[0125]

[0126] Weight design combines The complexity and depth of the alternative network model are summed to 1.

[0127] The weight design idea is to divide the features of several network models that fit incomplete information proportionally based on the structural complexity, number of convolutional layers, and depth of learned features of different network models that fit incomplete information. The higher the structural complexity and the deeper the learned features, the higher the proportion should be.

[0128] 2. The design representation of feature fusion is as follows:

[0129] Next, extract The feature representation of the output of the layer above the fully connected layer of the alternative network model is as follows: , It is a tensor, representing the features extracted from an alternative model. All extracted features are represented as:

[0130]

[0131] The extracted features are weighted and fused, denoted as... , represented as:

[0132]

[0133] Combine weights The fusion of features learned by a network model that fits incomplete information increases the diversity of features. The diversity of features directly determines the performance of the network model that integrates the incomplete information, and thus affects the success rate and transferability of adversarial examples.

[0134] Next, based on the length of the weighted features... Set the number of neurons in the fully connected layer to be , This indicates that the activation function will be used. Set as , Indicates weight Initialize to The method sets the number of fully connected layers to two, with the first layer being:

[0135]

[0136] The second layer is:

[0137]

[0138] Next design layer, For the number of categories, This indicates that the activation function will be used. Set as Its layers are represented as:

[0139]

[0140] Finally, the two fully connected layers and The layers are connected in sequence to combine the weighted features. A complete ensemble network model can be built from the input of the first fully connected layer, and finally, the augmented samples are added. Simply load it into the ensemble network model for training.

[0141] In S103 of this embodiment of the invention, an optimized adversarial method for electromagnetic space signal recognition tasks is designed. Adversarial samples are generated under an ensemble model, and these adversarial samples are transferred to the target network to achieve adversarial capabilities against the target network. The specific process is as follows:

[0142] The objective function in the optimized adversarial method for electromagnetic space signal recognition is redesigned and abstracted into a mathematical model as follows:

[0143]

[0144] in, Represents the original sample. This represents the generated adversarial example. It is the perturbation added to generate adversarial examples. It is the correct category label. It is the Euclidean distance between the original sample and the adversarial sample. This limits the range of data after the added perturbation; data exceeding this range is discarded, thus increasing the speed of adversarial example generation. This represents a nonlinear function that adds perturbation errors to the original samples and classifies them into other labels, so solving this equation constraint problem is basically not feasible.

[0145] Here, we introduce an objective function to replace... This is a category constraint. All these inequality constraints are satisfied; if the category constraint holds, then the inequality will be less than or equal to 0. Design an objective function for this:

[0146]

[0147] Therefore, the above constraint problem can be simplified to an inequality constraint problem:

[0148]

[0149] Then, by using the mathematical method of transforming inequalities into equalities, the problem with inequality constraints can be transformed into a problem with equality constraints:

[0150]

[0151] in, The constant is used to adjust the balance between optimization effect and noise level, and the Euclidean distance in the formula is... Using the 2-norm By substitution, we can obtain: ,

[0152] Introducing new variables links the disturbance and the constraint, because here the constraint is... Utilizing the favorable properties of the tanh function to Replace with , It can be replaced with This constrained problem is transformed into a minimum value problem:

[0153]

[0154] It is then added to the ensemble network model trained in S102 to generate adversarial examples, and then transferred to the network model under incomplete information to achieve the attack.

[0155] Its main design idea is: the optimized adversarial scheme selected in this invention can improve the transferability of adversarial examples, and the standard for evaluating the transferability of adversarial examples can be... Norm, the purpose of which is to reduce the Euclidean distance between adversarial examples and original samples while increasing the features output by the network model in S102 that integrates incomplete information, can improve transferability.

[0156] This invention provides an intelligent migration countermeasure method for electromagnetic spatial signal recognition under incomplete information. However, those skilled in the art can implement it using other steps. Figure 1 The intelligent migration countermeasure method for electromagnetic space signal recognition under incomplete information provided by this invention is merely a specific embodiment.

[0157] like Figure 2 As shown, the intelligent migration countermeasure system for electromagnetic space signal recognition under incomplete information provided by the present invention includes:

[0158] Several alternative model generation and training modules 1: Construct multiple alternative incomplete information target network models in parallel, and train these alternative models using an evolutionary strategy method based on prior knowledge matrix;

[0159] Ensemble Model Design Module 2: Generates an ensemble network model based on multiple trained alternative models, and designs a fully connected layer for feature-level weighted fusion. layer;

[0160] Adversarial Example Intelligent Transfer Module 3: Designs an optimized adversarial method for electromagnetic space signal recognition tasks, generates adversarial examples under the ensemble model, and transfers the adversarial examples to the target network to achieve adversarial capabilities for the target network.

[0161] II. Application Examples. To demonstrate the inventiveness and technical value of the technical solution of this invention, this section provides application examples of the technical solution of the claims on specific products or related technologies.

[0162] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0163] III. Evidence of the Relevant Effects of the Embodiments. The embodiments of the present invention have achieved some positive effects during research and development or use, and indeed possess significant advantages compared to existing technologies. The following description, in conjunction with data, charts, and other materials from the experimental process, illustrates these advantages.

[0164] To evaluate the performance of this invention, simulation verification was conducted. In the simulation experiment, a migration adversarial system for intelligent recognition of electromagnetic space signals under incomplete information was considered. The modulation recognition model to be countered was the DenseNet model, and the modulation signal types to be recognized included eight digital signals: 8PSK, QPSK, BPSK, GFSK, CPFSK, PAM4, QAM16, and QAM64, as well as two analog signals: WBFM and AM-DSB. The simulation parameters for studying the performance of the incomplete information model were set as follows: the signal-to-noise ratio of the modulation signals was selected within the interval [-20, 18] with a 2dB interval; the number of signals per signal-to-noise ratio was 6000; and the number of iterations was [number missing]. The simulation parameters for studying the performance of alternative network models (ResNet, VGGNet, CLDNNNet) are set as follows: the modulation signal signal-to-noise ratio (SNR) is selected within the range [-20, 18] with a 2dB interval; approximately 27 signals are used per signal at each SNR; a prior knowledge matrix is ​​constructed to query the incomplete information network 15 times; and the offline iteration count is [number missing]. The simulation parameters for studying the performance of ensemble network models are set as follows: the modulation signal SNR is selected within the range [-20, 18] with a 2dB interval; 64 features are extracted from the layer above the fully connected layer of each alternative network model; and approximately 9 signals per signal at each SNR are used to generate adversarial examples in the ensemble network model. The simulation results of this invention are as follows: Figure 3 As shown, from Figure 3As can be seen, with the increase of the signal-to-noise ratio, the adversarial performance advantage of the proposed method gradually becomes apparent compared to the transfer performance of a single alternative network model. Therefore, compared with existing algorithms, the method of this invention has a significant advantage in adversarial transfer performance.

[0165] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A smart transfer adversarial method for electromagnetic signal recognition under incomplete information, characterized in that, The intelligent migration adversarial method for electromagnetic signal recognition under incomplete information includes: Step 1: Construct multiple alternative models of the target network with incomplete information in parallel, and train these alternative models using an evolutionary strategy method based on prior knowledge matrices. Step two involves generating an ensemble network model based on the multiple trained alternative models, and designing a fully connected layer for feature-level weighted fusion. layer; Step 3: Design an optimized adversarial method for electromagnetic space signal recognition tasks, generate adversarial samples under the ensemble model, and transfer the adversarial samples to the target network to achieve adversarial capabilities against the target network. In step one, multiple alternative models of incomplete information target networks are constructed in parallel, and these alternative models are trained using an evolutionary strategy method based on prior knowledge matrices. The specific process is as follows: First, multiple alternative target network models are constructed in parallel. The known small amount of signal dataset is loaded onto the network model with incomplete information to obtain its label, and the obtained label is labeled onto the known small amount of signal dataset. The multiple alternative models are then trained in parallel. In the parallel training of the constructed multiple alternative models, the multiple alternative models can be trained in parallel by repeating the following steps: A small dataset of known labeled signals is loaded onto a pre-constructed alternative model to train the network. The cross-entropy loss function is denoted as... Let be a given signal from a set of a small number of signals. ,Will The predicted output obtained by loading the data into the incomplete information model is denoted as... Data augmentation techniques using Jacobian matrices to augment the dataset for signals Generate enhanced signal Its Jacobian data augmentation method is expressed as: ， Among them, the network model that fits incomplete information The derivative of the function with respect to the input is Using symbolic functions To determine the selected enhancement direction for this signal enhancement, Step size, To expand the previous dataset, To expand the dataset; The specific process of the evolutionary strategy method based on the prior knowledge matrix is ​​as follows: Will enhance the signal The network model, loaded with incomplete information, generates the predicted output. Using raw data Predicted output Subtract the enhanced signal Predicted output Generate difference vector The term with the largest value in the difference vector is defined as... And the largest term in the difference vector Set to 1 Set all other terms to 0 to generate a prior knowledge vector. , is represented as: ， The generated prior knowledge vector records the original data. To augment data Change direction and augmented data The next stage of change trend; repeat the above steps for Signal generation A set of prior knowledge vectors are concatenated to generate a prior knowledge matrix. , is represented as: ， Prior knowledge matrix records The signals and their changing trends are in a one-to-one correspondence. The control signals move towards the direction of the less data and missing categories in the known small dataset, thereby supplementing the less data and missing category signals to make the dataset more complete. Take the first column of the prior knowledge matrix in ascending order. Column 1 corresponds to Input signal All were extracted to form a signal set. , is represented as: ， signal set Mutation generation One variant signal: ， The generated A variant signal These are supplementary signals, which further enrich the signals of fewer and missing categories, and are synthesized offline through mutation, resulting in mutated signals. A signal is loaded onto the alternative network model to generate 1. Prior knowledge vectors are generated, and a new prior knowledge matrix is ​​constructed. The previous prior knowledge matrix number The column contains signals that are all 1s and the new prior knowledge matrix. If a column contains all 1s, a crossover is performed to select the signal with higher fitness as the next generation. The selection criterion is the difference vector, which is compared between two consecutive 1s. Select the larger item from the column. The signal with higher fitness is selected as the next generation: ， Repeat the above steps to train a network model that fits incomplete information. Stop iterating when the accuracy of the network model that fits incomplete information no longer improves.

2. The intelligent migration countermeasure method for electromagnetic signal recognition under incomplete information as described in claim 1, characterized in that, Step two, which generates an ensemble network model based on multiple trained alternative models, first utilizes several alternative network models with different structures generated in step one, extracts the features of the layer before the fully connected layer, and then performs a weighted fusion. Specifically, this includes: First, let the number of generated alternative models be... , Indicates interception An alternative network model, excluding fully connected layers and Other layers of the layer, Indicates a convolutional layer. The remaining layers after truncating the alternative network model are represented as follows: ， Design No. Weights when fusing features from a network model that fits incomplete information. ,in, Represents the convolutional layer of each alternative model The number of Indicates will indivual Add them together. Represented as: ， And the weight constraint conditions are: ， Weight design combines The complexity and depth of the alternative network model are summed to 1; extract The feature representation of the output of the layer above the fully connected layer of the alternative network model is as follows: , It is a tensor, representing the features extracted from an alternative model. All extracted features are represented as: ， The extracted features are weighted and fused, denoted as... , is represented as: ， Combine weights By fusing features learned from alternative network models, the diversity of features is increased, ultimately enhancing the samples. Simply load it into the ensemble network model for training.

3. The intelligent migration countermeasure method for electromagnetic signal recognition under incomplete information as described in claim 2, characterized in that, In step two, a fully connected layer with feature-level weighted fusion is designed. The specific process of the layer is as follows: Based on the length of the weighted features Set the number of neurons in the fully connected layer to be , This indicates that the activation function will be used. Set as , Indicates weight Initialize to The method sets the number of fully connected layers to two, with the first layer being: ， The second layer is: ， design layer, For the number of categories, This indicates that the activation function will be used. Set as Its layers are represented as: ， Finally, the two fully connected layers and The layers are connected in sequence to combine the weighted features. A complete ensemble network model can be built from the input of the first fully connected layer, which will enhance the samples. Simply load it into the ensemble network model for training.

4. The intelligent migration countermeasure method for electromagnetic signal recognition under incomplete information as described in claim 1, characterized in that, Step three involves designing an optimized adversarial method for intelligent electromagnetic space signal recognition tasks. Adversarial samples are generated under an integrated model and then transferred to the target network to achieve adversarial capabilities. The specific implementation process is as follows: Optimized adversarial algorithms for electromagnetic space signal recognition tasks are selected to improve the transferability of adversarial examples, and a standard for evaluating the transferability of adversarial examples is used. Norms reduce the Euclidean distance between adversarial examples and original examples while increasing the features output by the ensemble network model, thereby improving transferability. The objective function in the optimized adversarial method for electromagnetic space signal recognition is redesigned and abstracted into a mathematical model, which is then added to the ensemble network model to generate adversarial examples and transferred to the incomplete information network model.

5. The intelligent migration countermeasure method for electromagnetic signal recognition under incomplete information as described in claim 4, characterized in that, The optimized adversarial method for electromagnetic space signal recognition tasks is abstracted into a mathematical model as follows: ， in, Represents the original sample. This represents the generated adversarial example. It is the perturbation added to generate adversarial examples. It is the correct category label. It is the Euclidean distance between the original sample and the adversarial sample. It limits the range of data after the added perturbation.

6. The intelligent migration countermeasure method for electromagnetic signal recognition under incomplete information as described in claim 5, characterized in that, Introducing a new objective function to replace the category constraint Design an objective function: ， The above constraint problem simplifies to an inequality constraint problem: ， Then, using the mathematical method of transforming inequalities into equalities, the inequality-constrained problem is transformed into an equality-constrained problem: ， in, The constant is used to adjust the emphasis on optimization effect and noise level, and the Euclidean distance in the formula is... Using the 2-norm Substitution yields: ， Introducing new variables links the disturbance and the constraint; the constraint is... ,Will Replace with , It can be replaced with This constrained problem is transformed into a minimum value problem: ， The sample was then added to a pre-trained ensemble network model to generate adversarial examples, and then transferred to a network model with incomplete information.

7. An intelligent transfer countermeasure system for electromagnetic signal recognition under incomplete information, used to implement the intelligent transfer countermeasure method for electromagnetic signal recognition under incomplete information as described in any one of claims 1 to 6, characterized in that, The intelligent migration countermeasure system for electromagnetic signal recognition under incomplete information includes: Alternative model generation and training module is used to construct multiple alternative incomplete information target network models in parallel, and to train the alternative models using an evolutionary strategy method based on prior knowledge matrix; An ensemble model design module is used to generate an ensemble network model based on multiple trained alternative models, and to design feature-level weighted fusion fully connected layers and... layer; The adversarial example intelligent transfer module is used to design optimized adversarial methods for electromagnetic space signal recognition tasks. It generates adversarial examples under the ensemble model and transfers these adversarial examples to the target network to achieve adversarial capabilities against the target network.

Images