A wireless signal covert transmission method based on deep learning adversarial sample method

Abstract

The present invention discloses a method for covert transmission of wireless signals based on a deep learning adversarial sample method, comprising the following steps: a transmitting end generates a universal adversarial perturbation using a black-box attack method in combination with a deep learning network, adds the adversarial perturbation to the original signal, obtains an encrypted first signal, and sends it to a receiving end; the receiving end parses the first signal, detects whether an adversarial perturbation is received, and determines whether to update the adversarial perturbation; if the adversarial perturbation is updated, the adversarial perturbation variable of the receiving end is synchronously updated; if not, the existing adversarial perturbation is used; after receiving the first signal, the known adversarial perturbation is used to remove the interference to obtain a clean second signal, and then the original information is obtained using an agreed modulation method. The present invention adopts a transferable black-box universal adversarial sample generation method, and significantly improves the transferability of the adversarial perturbation by using a heat map attention loss function instead of a cross-entropy loss function, with high applicability and fast generation efficiency.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication signal processing technology, and more specifically, to a covert transmission method for wireless signals based on a deep learning adversarial sample method. Background Art

[0002] With the continuous development of artificial intelligence (AI) technology, its application areas are expanding, from images, audio, and text to communications. Due to the open nature of standard wireless communication signals like Wi-Fi, transmitted information is highly susceptible to interception and analysis. The key to analyzing intercepted communication information lies in identifying the modulation method and parameters. Understanding the modulation method of the signal allows successful analysis of the intercepted data, posing a significant threat to wireless communication security. Thanks to the continuous advancement of AI technology, automatic modulation method recognition based on AI has become widely used. It can easily identify waveform characteristics such as the modulation method of unencrypted and processed signals. Furthermore, research is underway on human behavior recognition and human identity recognition based on wireless signals, posing significant risks to wireless communication security.

[0003] Adversarial examples, proposed by Christian Szegedy and others, refer to input samples created by intentionally adding subtle interference to the original data, causing the model to produce an erroneous output with high confidence. The principle is that the attacker adds subtle changes to the source data that are difficult to detect with the senses, but can still cause the deep learning model to make incorrect classification decisions. For example, the following strange phenomenon, where carefully designed changes are superimposed on the original data, can affect the model's judgment even when they are difficult to detect with the naked eye. Figure 1 As shown in the figure, the signal uses BPSK binary phase shift keying modulation. After adding adversarial perturbations, the modulation classification system based on deep learning incorrectly classifies the signal modulation as QAM quadrature amplitude modulation.

[0004] Existing technologies use white-box adversarial sample generation methods such as FGSM (Fast Gradient Sign Method), BIM (I-FGSM), and PGD (Project Gradient Descent). They use adversarial perturbations generated by modulation classification models to perturb the transmitter's modulation method, and consider the concealment of adversarial perturbations to influence the intruder's recognition model with minimal waveform feature changes. The friendly receiver uses a pre-agreed modulation method to achieve demodulation.

[0005] White-box adversarial example generation methods are highly effective against modulation classification models with known parameters. However, defenses are constantly evolving. If the intruder uses a modulation classification model that is not the one used during training, the attack's effectiveness will be greatly reduced or even ineffective. This method uses traditional methods such as FGSM, BIM, and PGD. The algorithmic principle is to generate adversarial examples for a single sample. The degree of perturbation varies for each transmitted data, requiring individual training and perturbation generation before each data transmission, resulting in low efficiency. Summary of the Invention

[0006] In order to solve the problems that the existing adversarial sample generation methods in the communication field are mainly based on white boxes and have low applicability and low generation efficiency, the present invention provides a wireless signal covert transmission method based on deep learning adversarial sample method, which adopts a transferable black box universal adversarial sample generation method. By using the heat map attention loss function instead of the cross entropy loss function, the transferability of the adversarial perturbation is significantly improved, and the applicability is high and the generation efficiency is fast.

[0007] In order to achieve the above-mentioned purpose of the present invention, the technical solutions adopted are as follows:

[0008] A method for covert transmission of wireless signals based on a deep learning adversarial sample method, the method comprising the following steps:

[0009] The sending end uses a black-box attack method combined with a deep learning network to generate a universal adversarial perturbation, adds the adversarial perturbation to the original signal, obtains an encrypted first signal, and sends it to the receiving end;

[0010] The receiving end parses the first signal, detects whether an adversarial disturbance is received, and determines whether to update the adversarial disturbance. If the adversarial disturbance is updated, the adversarial disturbance variable at the receiving end is updated synchronously. If not, the existing adversarial disturbance is used. After receiving the first signal, the known adversarial disturbance is used to remove the interference to obtain a clean second signal, and then the original information is obtained using the agreed modulation method.

[0011] Preferably, the sending end uses a black box attack method combined with a deep learning network to generate universal adversarial perturbations, as follows:

[0012] Gradient-based black-box transfer adversarial attack, selects attention as the loss function, constructs the total loss function, and generates adversarial perturbations by minimizing the total loss function.

[0013] Furthermore, in order to make the adversarial perturbation invisible, the strength of the adversarial attack is limited by the distance from the original clean sample. The specific update process is as follows:

[0014]

[0015]

[0016]

[0017] Among them, Loss total Represents the total loss function; N represents the amount of data sent for a message; β is the perturbation step size; represents the adversarial perturbation added in the kth iteration; It represents the adversarial perturbation added in the k+1th iteration; x adv It represents the final generated adversarial sample, which is formed by superimposing the original data with the adversarial perturbation; g(x) is the gradient in the process of generating the adversarial perturbation; x represents the input data sample.

[0018] Furthermore, the construction of the total loss function is as follows:

[0019] S1: Construct the loss function of the first attention heatmap and the loss function of the second attention heatmap based on the input data sample x and the specified class y. Let h(x,y) represent the attention heatmap of the input data sample x and the specified class y. h(x,y) is a tensor with the same dimension as the input data sample x.

[0020] S2: Set the boundary loss function to reduce the distance between the first attention heat map and the second attention heat map;

[0021] S3: Construct modulation classification loss function and signal feature recognition loss function based on the boundary loss function distribution;

[0022] S4: Add the modulation classification loss function and the signal feature recognition loss function to obtain the total loss function. Furthermore, the loss function of the first attention heat map is expressed as follows:

[0023] Loss1=‖h(x,y true )‖1

[0024] Among them, y true is the true label of the data, h(x,y true ) represents the attention heat map of the input data sample x and the true label x, ‖‖1 is the L1 norm;

[0025] The loss function of the second attention heat map is expressed as follows:

[0026] Loss2=‖h(x,y sec (x))‖1

[0027] Among them, y sec (x) represents the second label category of the system recognition results, h(x,ysec (x) is the heat map of the second highest probability.

[0028] Furthermore, the boundary loss function is specifically expressed as follows:

[0029] Loss bd =‖h(x,y true )‖1-‖h(x,y sec (x))‖1.

[0030] Furthermore, the logarithmic boundary loss function is used as the boundary loss function. The specific form of the logarithmic boundary loss function is as follows:

[0031]

[0032] Furthermore, the expression of the modulation classification loss function is as follows:

[0033] Lossreg1=Loss log (x)-αLoss ce (x,y 1true )

[0034] The expression of the signal feature recognition loss function is as follows:

[0035] Lossreg2=Loss log (x)-αLoss ce (x,y 2true )

[0036] Among them, α is the trade-off coefficient between attention attack and cross entropy, Loss ce (x,y true ) represents the cross entropy loss function.

[0037] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for covert transmission of wireless signals based on a deep learning adversarial sample method are implemented.

[0038] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the wireless signal covert transmission method based on the deep learning adversarial sample method are implemented.

[0039] The beneficial effects of the present invention are as follows:

[0040] Based on the characteristics of adversarial samples, the present invention proposes a covert wireless signal transmission method based on deep learning adversarial sample method. Unlike existing research that uses adversarial samples as an attack method, the present invention is committed to using adversarial sample technology to improve the security of wireless communications and protect the secure transmission of wireless signals.

[0041] In order to counter communication systems with signal recognition and artificial intelligence (intelligent communication systems), the present invention proposes to use black-box attack methods combined with deep learning networks to generate universal adversarial perturbations, and add the generated adversarial perturbations to the signals sent by the transmitter, making it impossible for the intelligent model to recognize waveform features such as the demodulation method of the transmitted wireless signal, and unable to correctly demodulate the wireless signal, thereby protecting the security of transmitted information. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a schematic diagram of the existing technology for counteracting disturbances.

[0043] Figure 2 This is the signal security transmission process of the method described in the present invention.

[0044] Figure 3 This is the anti-disturbance generation and sending process of the present invention.

[0045] Figure 4 This is a defense flow chart for the method of the present invention to effectively avoid the recognition and analysis of the intelligent model. DETAILED DESCRIPTION

[0046] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] Example 1

[0048] like Figure 2 As shown, a method for covert transmission of wireless signals based on a deep learning adversarial sample method is provided, wherein the method comprises the following steps:

[0049] The sending end uses a black-box attack method combined with a deep learning network to generate a universal adversarial perturbation, adds the adversarial perturbation to the original signal, obtains an encrypted first signal, and sends it to the receiving end;

[0050] The receiving end parses the first signal, detects whether an adversarial disturbance is received, and determines whether to update the adversarial disturbance. If the adversarial disturbance is updated, the adversarial disturbance variable at the receiving end is updated synchronously. If not, the existing adversarial disturbance is used. After receiving the first signal, the known adversarial disturbance is used to remove the interference to obtain a clean second signal, and then the original information is obtained using the agreed modulation method.

[0051] This embodiment uses a black-box adversarial sample generation method to generate a universal adversarial perturbation, which is then directly added to the original transmitted signal to achieve an "encrypted" effect. The encrypted data not only protects the original data but also prevents intelligent modulation classification or signal feature recognition models from misjudging it, thereby protecting the original data and features. At the receiving end, the known perturbations are first eliminated, and then the original data is parsed using a pre-agreed modulation method.

[0052] In this embodiment, a black box attack method is used in combination with a deep learning network to generate universal adversarial perturbations, and a deep learning network needs to be selected as the basic attack model. This embodiment selects deep learning neural network architectures such as RNN (Recurrent Neural Network) and LSTM (Long short-term memory) as the basic attack model. In this embodiment, the deep learning network includes but is not limited to RNN and LSTM, such as the neural network in the figure, with a temporal network architecture. In addition, the use of different model parameters also belongs to the same method, such as the selection of the number of hidden layers in the LSTM long short-term memory network.

[0053] In a specific embodiment, the sending end uses a black-box attack method combined with a deep learning network to generate a universal adversarial perturbation, as follows:

[0054] Gradient-based black-box transfer adversarial attack, selects attention as the loss function, constructs the total loss function, and generates adversarial perturbations by minimizing the total loss function.

[0055] Furthermore, the construction of the total loss function is as follows:

[0056] S1: Construct the loss function of the first attention heat map and the loss function of the second attention heat map based on the input data sample x and the specified class y;

[0057] S2: Set the boundary loss function to reduce the distance between the first attention heat map and the second attention heat map;

[0058] S3: Construct modulation classification loss function and signal feature recognition loss function based on the boundary loss function distribution;

[0059] S4: Add the modulation classification loss function and the signal feature recognition loss function to obtain the total loss function.

[0060] Using black-box attack methods combined with the basic network to generate universal adversarial perturbations, gradient-based black-box transfer adversarial attacks, and selecting attention as the loss function can significantly improve transferability. Let h(x,y) represent the attention heat map of the input data sample x and the specified class y. h(x,y) is a tensor with the same dimension as the input data sample x. When the network attention of the correct class decreases, the attention of other classes increases and eventually exceeds the correct class, causing the model to seek information about other classes instead of the correct class, thereby making incorrect predictions. The specific loss function is as follows:

[0061] Loss h =‖h(x,y)‖1

[0062] Let h(x,y true ) represents the first attention heat map, and the loss function of the first attention heat map is expressed as follows:

[0063] Loss1=‖h(x,y true )‖1

[0064] Among them, y true is the true label of the data, h(x,y true ) represents the attention heat map of the input data sample x and the true label x, ‖‖1 is the L1 norm, and x is the data sample

[0065] Let h(x,y sec (x)) represents the second attention heat map, and the loss function of the second attention heat map is expressed as follows:

[0066] Loss2=‖h(x,y sec (x))‖1

[0067] Among them, y sec (x) represents the label category ranked second in the system recognition results

[0068] In a specific embodiment, it is known that if the attention size of the second attention heatmap exceeds the attention size of the correct class, the network will pay more attention to the incorrectly predicted information, so the boundary loss is set to reduce the distance between the first attention heatmap and the second attention heatmap.

[0069] The boundary loss function is specifically expressed as follows:

[0070] Loss bd =‖h(x,y true )‖1-‖h(x,y sec (x))‖1.

[0071] In a specific embodiment, empirically, logarithmic margin loss is the most effective for transfer attacks, so it is selected as one of the total loss functions. Because attention heatmaps vary significantly between models, self-normalization can improve the transferability of adversarial examples. Furthermore, the ratio of the two is considered to obtain a logarithmic loss.

[0072] This embodiment uses the logarithmic boundary loss function as the boundary loss function. The specific form of the logarithmic boundary loss function is as follows:

[0073]

[0074] In a specific embodiment, the attention attack can be easily combined with the cross entropy loss function. The expression of the modulated classification loss function is as follows:

[0075] Loss reg1 =Loss log (x)-αLoss ce (x,y 1true )

[0076] The expression of the signal feature recognition loss function is as follows:

[0077] Lossreg2=Loss log (x)-αLoss ce (x,y 2true )

[0078] Among them, α is the trade-off coefficient between attention attack and cross entropy, Loss ce (x,y true ) represents the cross entropy loss function (used to describe the difference between two probability distributions, a common loss function in classification loss.

[0079] In this embodiment, the total loss function is:

[0080] Loss total =Loss reg1 +Loss reg2

[0081] In a specific embodiment, by minimizing the total loss function Loss total To generate adversarial perturbations, in order to make the adversarial perturbations invisible, the strength of the adversarial attack is limited by the distance from the original clean sample. The specific update process is as follows:

[0082]

[0083]

[0084]

[0085] Among them, Loss total Represents the total loss function; N represents the amount of data sent for a message; β is the perturbation step size; represents the adversarial perturbation added in the kth iteration; It represents the adversarial perturbation added in the k+1th iteration; x adv It represents the final generated adversarial sample, which is formed by superimposing the original data with the adversarial perturbation; g(x) is the gradient in the process of generating the adversarial perturbation; x represents the input data sample.

[0086] Through the above method, the universal adversarial perturbation is obtained as x noise , and send the generated universal adversarial perturbation to the receiving end. The detailed process is as follows Figure 3 shown.

[0087] After the transmitter generates the adversarial perturbation, it adds the universal perturbation to the signal and sends it. The receiver analyzes the first signal, detects whether it has received an adversarial perturbation, and determines whether to update the adversarial perturbation. If the adversarial perturbation is updated, the adversarial perturbation variable at the receiver is updated synchronously. If not, the existing adversarial perturbation is used. After receiving the first signal, the known adversarial perturbation is used to remove the interference, obtaining a clean second signal, and then using the agreed modulation method to obtain the original information. The workflow diagram is as follows Figure 2 shown.

[0088] The above is the workflow of the signal under channel security conditions. It is known that in an open channel environment, such as Wi-Fi transmission, the signal transmitted by the sender can be easily intercepted, and its modulation method can be obtained using an intelligent modulation recognition model to obtain the sent information.

[0089] The method of the present invention can effectively avoid the recognition and analysis of the intelligent model. The specific principle is as follows: Figure 4 As shown in the figure, even in an open channel, if the signal sent by the transmitter is intercepted, the enemy cannot correctly interpret the signal's meaning. When the signal is intercepted, it is thrown into the modulation classification system based on deep learning. The data with the added adversarial perturbation has the ability to misjudge the modulation classification model, causing the enemy to misjudge the modulation mode. When using the wrong modulation mode, only erroneous information can be parsed. The principle of the signal feature recognition system is the same as above, and the security of the transmitted information is protected by adding adversarial perturbations.

[0090] When facing a friendly receiver, since both parties share the adversarial perturbation, the adversarial signal can be directly restored to the original signal, and demodulated according to the pre-agreed modulation method to obtain the correct transmitted data.

[0091] The method described in this embodiment has the following advantages:

[0092] 1. Leveraging existing adversarial sample generation technology, a complete wireless signal covert transmission method is proposed, which improves wireless communication security and can counter hostile communication systems with signal cognition and artificial intelligence.

[0093] 2. For hostile intelligent communication systems, detailed model parameters are often unavailable, so white-box adversarial example generation methods have limitations and are difficult to implement in the real world. However, this invention uses multiple alternative models and modifies attention heatmaps to generate adversarial examples, which can be effectively transferred to black-box models. Using black-box attack methods to generate universal adversarial perturbations offers high portability and applicability.

[0094] 3. The present invention generates a universal adversarial perturbation, and does not require training and adversarial sample generation every time a signal is sent, thereby improving work efficiency.

[0095] 4. Update the training set based on the data sent by the transmitter, and regularly update the anti-disturbance to further ensure communication security.

[0096] 5. The friendly receiver can recover the original data without considering waveform similarity or the "hiddenness" of the disturbance. This is effective for identifying both the enemy's modulation method and signal characteristics.

[0097] 6. The method described in this embodiment is versatile and can be used for a long time with regular replacement, and is highly safe.

[0098] Example 3

[0099] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of implementing the method for covert transmission of wireless signals based on the deep learning adversarial sample method described in Example 1 are as follows:

[0100] The sending end uses a black-box attack method combined with a deep learning network to generate a universal adversarial perturbation, adds the adversarial perturbation to the original signal, obtains an encrypted first signal, and sends it to the receiving end;

[0101] The receiving end parses the first signal, detects whether an adversarial disturbance is received, and determines whether to update the adversarial disturbance. If the adversarial disturbance is updated, the adversarial disturbance variable at the receiving end is updated synchronously. If not, the existing adversarial disturbance is used. After receiving the first signal, the known adversarial disturbance is used to remove the interference to obtain a clean second signal, and then the original information is obtained using the agreed modulation method.

[0102] The memory and processor are connected using a bus, which can include any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and are therefore not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor.

[0103] Example 4

[0104] A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of implementing the wireless signal covert transmission method based on the deep learning adversarial sample method as described in Example 1 are as follows:

[0105] The sending end uses a black-box attack method combined with a deep learning network to generate a universal adversarial perturbation, adds the adversarial perturbation to the original signal, obtains an encrypted first signal, and sends it to the receiving end;

[0106] The receiving end parses the first signal, detects whether an adversarial disturbance is received, and determines whether to update the adversarial disturbance. If the adversarial disturbance is updated, the adversarial disturbance variable at the receiving end is updated synchronously. If not, the existing adversarial disturbance is used. After receiving the first signal, the known adversarial disturbance is used to remove the interference to obtain a clean second signal, and then the original information is obtained using the agreed modulation method.

[0107] That is, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (which may be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0108] Obviously, the above embodiments of the present invention are merely examples for the purpose of illustrating the present invention, and are not intended to limit the embodiments of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A method for covert wireless signal transmission based on a deep learning adversarial sample method, characterized by: The method comprises the following steps: The sending end uses a black-box attack method combined with a deep learning network to generate a universal adversarial perturbation, adds the adversarial perturbation to the original signal, obtains an encrypted first signal, and sends it to the receiving end; The receiving end analyzes the first signal, detects whether an adversarial perturbation is received, and determines whether to update the adversarial perturbation. If so, the adversarial perturbation variable at the receiving end is updated synchronously; otherwise, the existing adversarial perturbation is used. After receiving the first signal, the known adversarial perturbation is used to remove the interference, obtaining a clean second signal, and then using the agreed modulation method to obtain the original information. The sender uses a black-box attack method combined with a deep learning network to generate universal adversarial perturbations, as follows: Gradient-based black-box transfer adversarial attack, which selects attention as the loss function, constructs the total loss function, and generates adversarial perturbations by minimizing the total loss function; And, the construction of the total loss function is as follows: S1: Construct the loss function of the first attention heatmap and the loss function of the second attention heatmap based on the input data sample x and the specified class y. Let h(x,y) represent the attention heatmap of the input data sample x and the specified class y. h(x,y) is a tensor with the same dimension as the input data sample x. S2: Set the boundary loss function to reduce the distance between the first attention heat map and the second attention heat map; S3: Construct modulation classification loss function and signal feature recognition loss function based on the boundary loss function distribution; S4: Add the modulation classification loss function and the signal feature recognition loss function to obtain the total loss function.

2. The method for covert wireless signal transmission based on deep learning adversarial sample method according to claim 1, characterized in that: In order to make the adversarial perturbation invisible, the strength of the adversarial attack is limited by the distance from the original clean sample. The specific update process is as follows: Among them, Loss total Represents the total loss function; N represents the amount of data sent for a message; β is the perturbation step size; represents the adversarial perturbation added in the kth round of iteration; It represents the adversarial perturbation added in the k+1th iteration; x adv It represents the final generated adversarial sample, which is formed by superimposing the original data with the adversarial perturbation; g(x) is the gradient in the process of generating the adversarial perturbation; x represents the input data sample.

3. The method for covert wireless signal transmission based on deep learning adversarial sample method according to claim 2, characterized in that: The loss function of the first attention heat map is expressed as follows: Loss1=‖h(x,y true )‖1 Among them, y true is the true label of the data, h(x,y true ) represents the attention heat map of the input data sample x and the true label x, ‖‖1 is the L1 norm; The loss function of the second attention heat map is expressed as follows: Loss2=||h(x,y sec (x))||1 Among them, y sec (x) represents the second label category of the system recognition results, h(x,y sec (x)) represents the second attention heat map.

4. The method for covert wireless signal transmission based on deep learning adversarial sample method according to claim 3, characterized in that: The boundary loss function is specifically expressed as follows: Loss bd =‖h(x,y true )‖1-‖h(x,y sec (x))‖1。 5. The method for covert wireless signal transmission based on deep learning adversarial sample method according to claim 3, characterized in that: The logarithmic boundary loss function is used as the boundary loss function. The specific form of the logarithmic boundary loss function is as follows:

6. The method for covert wireless signal transmission based on deep learning adversarial sample method according to claim 5, characterized in that: The expression of the modulation classification loss function is as follows: Loss reg1 =Loss log (x)-αLoss ce (x,y 1true ) The expression of the signal feature recognition loss function is as follows: Loss reg2 =Loss log (x)-αLoss ce (x,y 2true ) Among them, α is the trade-off coefficient between attention attack and cross entropy, Loss ce (x,y true ) represents the cross entropy loss function.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the wireless signal covert transmission method based on the deep learning adversarial sample method as described in any one of claims 1 to 6 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the wireless signal covert transmission method based on the deep learning adversarial sample method as described in any one of claims 1 to 6 are implemented.

Images