A trajectory classification defense method and system of an adversarial sample

Abstract

The present application relates to a kind of trajectory classification defense method and system of counter sample, belong to data mining field.First according to space-time trajectory data sample, the extraction of trajectory data feature is carried out, and the basic trajectory data feature (longitude, latitude, time, speed, acceleration, trajectory angle etc.) is extracted.Adversarial defense is carried out using differential privacy protection mechanism, according to the principle of setting model robustness, generate Laplace noise in trajectory feature, according to the expression of noise relationship obtained by Laplace probability density function and scale parameter, then search smaller noise data value using iterative search algorithm, add noise in model, after the effect of convolution network is carried out, trajectory classification is acquired The defense effect of the model, finally according to low frequency filtering technique, feature denoising is carried out.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of data mining, and relates to a trajectory classification adversarial sample defense method and system. BACKGROUND

[0002] With the development and popularity of intelligent devices, people's spatio-temporal trajectory data can be easily obtained through positioning and communication devices, which contains a large amount of valuable user information. We can perform classification analysis on the trajectory data to provide important technical support for traffic route planning, urban construction, business operation, etc. However, trajectory data is vulnerable to attacks by attackers. Attackers can change the training results of neural network models by changing some characteristics of trajectory data (such as longitude, latitude, time, speed, acceleration, angle, etc.), that is, attackers can steal user spatio-temporal trajectory information to perform adversarial sample attacks and change the mining results of trajectory classification. Therefore, how to protect spatio-temporal trajectory data from adversarial sample attacks is a problem that needs to be solved in the field of trajectory adversarial machine learning.

[0003] Among the existing defense methods, one method is to perform defense inside the convolutional neural network, that is, to add a masking layer to eliminate some unimportant features for defense. For attackers, the main basis for generating adversarial samples for adversarial attacks is relatively important features. Adding a masking layer to cover unobvious features alone cannot achieve good defense effect against attacks. Another method uses a deconvolutional neural network to reconstruct feature data and eliminate noise to achieve the purpose of defense. However, if the internal structure of the network is changed, the reverse transformation of the data may have a great impact on the overall feature data, resulting in an undesirable defense effect. Although these two methods are different, they mainly perform defense inside the neural network and ignore the transformation of important feature data. Currently, the problem of trajectory data adversarial sample defense has not been truly solved. In fact, the existing defense methods do not defend from the original trajectory features, that is, if the trajectory features can be changed to achieve adversarial sample defense, the problem can be fundamentally solved.

[0004] However, so far, there is no specific method to start from the trajectory features to design related defense methods. In existing research, the only available reference is to add uniform noise to the trajectory feature data or use the FGSM method to generate adversarial noise. Considering that attackers attack trajectory data to also generate FGSM adversarial sample data, this makes the data defense feature model not very robust and does not achieve the expected defense effect.

[0005] In summary, the defense method of trajectory classification adversarial sample by changing the internal structure of neural network to design trajectory classification adversarial sample does not have good robustness, and does not change the feature data of trajectory, and does not have good universality in adversarial defense. SUMMARY

[0006] Therefore, the purpose of the present application is to provide a trajectory classification adversarial sample defense method and system. First, the basic features of the trajectory are extracted from the trajectory sample, such as longitude, latitude, time, speed, acceleration, angle, etc. Then, according to the differential privacy mechanism, the probability model is inferred, the best perturbation data value is searched out by the iterative search algorithm, the Laplace noise data is added to the trajectory feature data, and finally the denoising processing is carried out by the low-frequency denoising technology, which lays a foundation for truly solving the spatiotemporal trajectory data adversarial defense problem.

[0007] To achieve the above purpose, the present application provides the following technical scheme:

[0008] Step S1, trajectory data segment preprocessing. For the read trajectory data X to be protected, the total number is n, and the trajectory data is converted into a trajectory sample according to the data extraction operation, and the corresponding expression is as follows:

[0009] {x1, x2, x3...x n}

[0010] Where x i {i=1, 2, 3...} represents a trajectory sample, and each part of the sample is independent and has its own trajectory feature.

[0011] Step S2, feature extraction of trajectory sample. For each trajectory sample x i {i=1, 2, 3...} after preprocessing in step S1, 6 trajectory feature values are extracted, i.e. longitude, latitude, time, speed, acceleration and angle, and the corresponding representation is as follows:

[0012] (lng i , lat i , t i , v i , a i , deg i )

[0013] Where lng i represents longitude, lat i represents latitude, t i represents time, v i represents speed, a i represents acceleration, and deg i represents angle.

[0014] The data obtained after preprocessing the trajectory sample contains longitude lng i , latitude lat i , time t i , and the like basic information, and through calculation, speed v i , acceleration a i , angle deg i and the like characteristic information can be obtained, including the following sub-steps:

[0015] Step S2-1, calculation of trajectory distance, assuming that the longitude data of points A and B are lng1 and lng2 respectively, and the latitude data are lat1 and lat2 respectively, first, the distance between any two points of data is obtained according to the longitude and latitude data, and then the trajectory angle between the trajectories is obtained according to the distance:

[0016]

[0017] Where s AB represents the distance between points A and B, and r represents the radius of the earth.

[0018] Step S2-2, angle calculation, in a continuous trajectory data segment, there are three points A, B and C, the angle formed by the three points is γ, and the cosine value between the three points satisfies the following relationship:

[0019]

[0020] Where γ is the included angle of ACB, s AC is the distance between AC, and s BC and s AB are the distances between BC and AB respectively.

[0021] Step S2-3, calculation of speed and acceleration, according to the time and distance of the trajectory characteristics, the speed and acceleration in the trajectory sample are represented as:

[0022]

[0023]

[0024] Let the trajectory classifier of the neural network model be f, the trajectory data be X, the vector input into the convolution network model be V, the trajectory sample be x i , and the trajectory feature obtained through the convolution network model be ξ. The trajectory classification process is represented as follows:

[0025] f(X, V, x i ) = (ξ1, ξ2, ξ3, ξ4, ξ5, ξ6)

[0026] Step S3, noise generation. Select Laplace noise as the noise for addition, including the following sub-steps:

[0027] Step S3-1, constructing a trajectory defense model, adding Laplace noise in the trajectory feature to achieve the effect of defense, and designing an iterative random algorithm on this basis, the purpose is to find out a best noise data value, according to the trajectory feature, the classification result of the classifier is calculated as follows:

[0028] T={T1, T2, T3, T4, T5, T6}

[0029] Among them, T1 represents the result of the classifier classifying data as walking, and T2, T3, T4, T5 and T6 represent the results of the classifier classifying data as bicycle, bus, car, train and airplane respectively.

[0030] Each classification result corresponds to a probability result, that is, after the mapping of the neural network f, the classification result is represented by the corresponding probability P=f(T).

[0031] Thus, the probability representation of each trajectory mode corresponding to each trajectory is as follows:

[0032] P={P1, P2, P3, P4, P5, P6}

[0033] Among them, P1 represents the probability of the classifier predicting data as walking, and P2, P3, P4, P5 and P6 represent the probabilities of predicting as bicycle, bus, car, train and airplane respectively.

[0034] Based on the principle of differential privacy mechanism, the defense model of trajectory classification is obtained as:

[0035]

[0036] n(n=1,2,3,4,5) represents the number of trajectory classification categories, and ξ ij represents all the trajectory features of the trajectory sample i,

[0037] The classification result of each trajectory sample obtained by the action of the convolution network, A represents the adversarial function, and a represents the best noise to be added in the trajectory feature.

[0038] Suppose the data value range of each trajectory sample obtained by the action of the adversarial function is [0,c], denoted as:

[0039]

[0040] Step S3-2, noise generation. We consider adding Laplace noise in the trajectory feature, which satisfies the random value satisfying the Laplace distribution, and then according to the iterative search algorithm and the expected data value to find the best perturbation data, the Laplace probability density function is:

[0041]

[0042] Set an adversarial function A, according to the mapping relationship of the trajectory sample to the trajectory feature, there are 6 different features in the trajectory data, which is represented as:

[0043] f(d)=(lng i , lat i , t i , v i , a i , deg i ) T

[0044] Let the sensitivity of differential privacy be Δf=max||f(d)-A(d′)||, and the scale parameter b satisfies

[0045] Where d and d' represent adjacent trajectory samples, and the value of b is determined according to the selected different trajectory samples, and the size of the best noise data value α is calculated by the iterative search algorithm. Where b and α have the following relationship:

[0046]

[0047] Here we give the trajectory sample x generated by the trajectory data X, and the trajectory feature of each trajectory sample generates a random number under the action of the Laplace probability density function, that is, the trajectory feature with noise:

[0048]

[0049] The distribution function F(x) is decomposed into a linear combination of several relatively simple sub-distribution functions

[0050]

[0051] Where F(x) is the distribution function, p i >0, A positive random number Can be generated

[0052] Step S3-3, searching for the best noise, calculating the model data value according to the constructed trajectory defense model. Initialize the privacy protection parameters ε, σ, and assume the adversarial function as A. Calculate the model data value f(A(X)) of each trajectory sample as h1, and calculate the model data value e ε f(A(X+α)) as h2. Select different adjacent trajectory samples to calculate the b value data, and then obtain the α value. According to the relationship that h2 / h1 is greater than 1, the size of the b value is updated iteratively, and then the value of α is obtained, so that the defense model of the network outputs the corresponding best noise α within a certain threshold τ.

[0053] Step S4, perturbing data, adding the noise data obtained in step S3 to the trajectory feature to generate trajectory feature data with noise. For the defense method of the adversarial sample, that is, adding perturbation data β to the trajectory feature with noise, we consider adding perturbation to the gradient of the trajectory sample to obtain the corresponding trajectory classification adversarial sample data as follows:

[0054] x″=x′+A(x′+β,y)

[0055] x′ represents the trajectory sample with noise after adding Laplace noise, x″ represents the adversarial sample with noise after adding perturbation data to the trajectory sample, and y represents the label of the corresponding trajectory sample data classification. The defense effect of the defense system of the adversarial sample is compared with the classification accuracy of x′ and x″ through the neural network classifier.

[0056] Step S5, noise reduction process. Generally, the trajectory data with noise x′ contains high frequency part H and low frequency part L. The high frequency part refers to the pixel points with relatively sharp intensity changes in the trajectory data (such as edges, image details, and noise points); the low frequency part refers to the pixel points with relatively gentle intensity changes in the trajectory data (such as large color block places), that is, the trajectory data after noise reduction. Corresponding representation is as follows:

[0057] T′(x,y)=H(x,y)+L(x,y)

[0058] Where (x, y) represents the pixel point coordinates in the trajectory sample.

[0059] Considering that the difference between the target pixel and the surrounding pixels is not particularly large, the mean filtering technology in the low frequency filtering technology is used to eliminate the high frequency part of the trajectory segment and retain the low frequency part, so as to achieve the inverse transformation process, that is, to complete the noise reduction process. The neighborhood operation is to obtain the value of the target pixel by weighted processing of the neighborhood of the target pixel, and the weighted matrix h is also called neighborhood operator. The noise reduction process is represented as:

[0060]

[0061] Where T(x, y) represents the original trajectory sample pixel points, i.e. the target trajectory sample pixel points. The neighborhood operation refers to the calculation of a neighborhood-based function at each trajectory sample position (x, y). The neighborhood operator h is a special form of neighborhood filtering.

[0062] Assuming the length and width of the trajectory sample are M and N respectively, the operation of the neighborhood operator using the mean filtering technique is as follows:

[0063]

[0064] Where h represents the weighting matrix, i.e., the neighborhood operator.

[0065] The inverse transformation I process of the trajectory sample is represented as:

[0066] T(x,y)=I(T′(x,y))

[0067] After noise reduction, the samples are transformed into feature data representations through operations such as feature extraction.

[0068] The denoised samples are represented as sample data as follows:

[0069] X = {x1, x2, x3...x} n}

[0070] The trajectory sample data is processed by feature extraction to obtain a representation of each sample feature.

[0071] x i =(lng i lat i , t i v i a i , deg i )

[0072] Among them, lng i Indicates longitude, lat i t represents latitude. i v represents time. i Indicates velocity, a i Deg represents acceleration. i Indicates angle.

[0073] Meanwhile, this invention provides a noise generation defense system based on differential privacy, characterized by comprising the following modules:

[0074] The trajectory feature extraction module is used to extract basic features (longitude, latitude, time) and motion features (velocity, acceleration, angle) from a given trajectory segment through processing.

[0075] A preprocessing submodule, according to the selected trajectory segment X, converts the trajectory data into trajectory samples {x1, x2, x3...x n}, each sample contains corresponding trajectory features;

[0076] A feature extraction submodule directly obtains basic features in basic trajectory data, including longitude, latitude, and time (lng i , lat i , t i ), and then calculates motion features (v i , a i , deg i ) according to the association between features.

[0077] A noise generation and addition module is used to establish a trajectory adversarial defense system based on differential privacy, and the feature data size a of the feature to be obtained is obtained through a Laplace noise generation mechanism,

[0078] A defense system construction submodule, each trajectory corresponds to a classification model, based on which a defense model for trajectory classification is obtained based on differential privacy

[0079]

[0080] Through the effect of the adversarial function and the privacy protection strength, the best noise is obtained according to the Laplace probability density function

[0081] The variable of the Laplace sample of each sample is obtained by modifying the size of the b value, and the best noise is obtained;

[0082]

[0083] An iterative search noise module, which calculates the model data value f(A(X)) of each trajectory sample as h1, and calculates the model data value e ε f(A(X+α)) of each trajectory sample as h2. Select different adjacent trajectory samples to calculate the b value data, and then obtain the a value. According to the relationship that h2 / h1 is greater than 1, the size of the b value is updated iteratively, and then the value of a is obtained, so that the defense model of the network is within a certain threshold τ, and the corresponding best noise is output as a.

[0084] A perturbation data addition module adds noise data obtained to trajectory features to generate trajectory feature data with noise. The defense method for adversarial samples is to add perturbation data β to the trajectory features with noise, and the corresponding expression is as follows;

[0085] x″=x′+A(x′+β,y)

[0086] The noise reduction processing module adopts the mean filtering technology in the low frequency filtering technology, which is to eliminate the high frequency part of the track segment and reserve the low frequency part, so as to achieve the inverse transformation process, that is, to complete the noise reduction processing. The neighborhood operation is to obtain the value of the target pixel by weighting the neighborhood of the target pixel, and the weighting matrix h is also called neighborhood operator. The noise reduction process is represented as:

[0087]

[0088] Wherein T (x, y) represents the original track sample pixel point, that is, the target track sample pixel point. Indicates the neighborhood operation.

[0089] The beneficial effects of the present application are:

[0090] (1) The present application adds Laplace noise in the track sample, and calculates the best noise according to the search algorithm, which is simple to realize and has high noise generation rate.

[0091] (2) On the basis of adding noise to the track sample, the present application adds disturbance data to test the size of the track defense system capability, and according to the noise reduction process, the characteristics of the track sample are well reflected.

[0092] Other advantages, objects and features of the present application will be set forth in part in the following specification, and in part will become apparent to those skilled in the art from the following, or can be learned from the practice of the present application. The objects and other advantages of the present application can be realized and obtained by the following description. BRIEF DESCRIPTION OF DRAWINGS

[0093] In order to make the purpose, technical scheme and advantages of the present application clearer, the preferred detailed description of the present application will be combined with the drawings as follows, wherein:

[0094] Figure 1 The general method flow chart provided for the embodiment of the present application;

[0095] Figure 2 The specific step flow chart provided for the embodiment of the present application;

[0096] Figure 3 The defense method and system schematic diagram of the track sample classification of the embodiment of the present application. DETAILED DESCRIPTION

[0097] The present application will be described in greater detail by explaining specific working examples. Other advantages and effects of the present application will be more clearly understood from this description. The present application can also be implemented or applied in other different specific embodiments, and various modifications or changes can be made to the details based on different views and applications without departing from the spirit of the present application. It should be noted that the drawings provided in the following examples only schematically illustrate the basic concept of the present application, and the following examples and features in the examples can be combined with each other without conflict.

[0098] The drawings are only used for illustrative description, and the representation is only a schematic diagram, not a physical diagram, and cannot be understood as a limitation of the present application. In order to better illustrate the embodiments of the present application, some components in the drawings are omitted, enlarged or reduced, and do not represent the actual size of the product. It is understandable for those skilled in the art that some well-known structures and their descriptions in the drawings can be omitted.

[0099] The same or similar reference numerals in the drawings of the embodiments of the present application correspond to the same or similar components. In the description of the present application, it should be understood that the orientation or position relationship indicated by the terms "upper", "lower", "left", "right", "front", "back" and the like is based on the orientation or position relationship shown in the drawings, and is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative description, and cannot be understood as a limitation of the present application. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0100] The following describes the implementation steps of the present application by taking a data sequence composed of a part of the geolife data set as an example. The goal is to generate Laplacian noise alpha according to the adversarial sample instance to achieve the defense effect on the sample. According to the data set, a trajectory sample sequence is obtained, the trajectory sample contains trajectory sample points, each sample contains 300 trajectory points to obtain the trajectory feature.

[0101] The method provided by the technical scheme of the present application can realize automatic operation process by using computer software technology, Figure 1 is a general method flowchart of the embodiment of the present application, Figure 2 is a specific step flowchart provided by the embodiment of the present application, Figure 3 is a schematic diagram of the defense method and system for trajectory sample classification of the embodiment of the present application. The specific steps of the embodiment of the defense method and system for trajectory classification of the present application include:

[0102] Step S1, trajectory data segment preprocessing. For the read trajectory data X to be protected, the total number is n, the trajectory data is converted into trajectory sample corresponding expression as follows according to the data extraction operation:

[0103] {x1, x2, x3...x n}

[0104] Where x i {i=1, 2, 3...} represents a trajectory sample, each part of the sample is independent and has its own trajectory characteristics.

[0105] In the embodiment, the trajectory data is converted into trajectory sample as {x1, x2, x3...x 300}, the trajectory characteristics are extracted from the trajectory sample for calculation, and three data points A(39.984702, 116.318417, 2008-10-23, 02:53:04), B(39.999666, 116.324722, 2008-10-23, 04:34:42), C(40.009328, 116.320887, 2008-10-23, 11:11:12) are taken as examples for exploration. The specific implementation is as follows,

[0106] Step S2, feature extraction of trajectory sample. For each trajectory sample x i {i=1, 2, 3...} after preprocessing in step S1, 6 trajectory feature values are extracted, i.e. longitude, latitude, time, speed, acceleration and angle, which are represented as follows:

[0107] (lng i , lat i , t i , v i , a i , deg i )

[0108] Where lng i represents longitude, lat i represents latitude, t i represents time, v i represents speed, a i represents acceleration, and deg i represents angle.

[0109] The data obtained after preprocessing of the trajectory sample contains basic information such as longitude lng i , latitude lat i , time t i , etc. Through calculation, speed v i , acceleration a i , and angle deg iEqual feature information, including the following sub-steps:

[0110] In the embodiment, the longitude lng is directly obtained according to 300 trajectory points in the trajectory sample i The latitude lat i The time t i Equal information, according to the distance calculation formula, the distance s of any two trajectory points can be calculated, and the distance s is divided by the time t i The speed v is obtained i The acceleration a is obtained by dividing the speed by the time t i i The cosine value deg of any two trajectory points is calculated by the angle calculation formula i The angle value θ is obtained by the inverse trigonometric function arccos.

[0111] Step S2-1, trajectory distance calculation, assuming that the longitude data of points A and B are lng1 and lng2 respectively, and the latitude data are lat1 and lat2 respectively, first, the distance between any two points is obtained according to the longitude and latitude data, and then the trajectory angle between the trajectories is obtained according to the distance:

[0112]

[0113] Where s AB represents the distance between points A and B, and r represents the radius of the earth.

[0114] In the embodiment, the longitude and latitude information of points A, B and C is taken, and the trajectory distance is calculated to obtain

[0115] Similarly, s BC = 207200. That is, the actual distance between AB and BC is obtained by calculation.

[0116] Step S2-2, angle calculation, there are three points A, B and C in a continuous trajectory data segment, the angle formed by the three points is γ, and the cosine value between the three points satisfies the following relationship:

[0117]

[0118] Where γ is the included angle of ACB, s AC is the distance between AC, and s BC , s AB are the distances between BC and AB respectively.

[0119] In the embodiment, the trajectory angle at point B is calculated according to the calculated distances of AB and BC and the distance of point AC, and the trajectory angle at point B obtained by the above calculation is ​

[0120] The angle is 11 by the inverse trigonometric function. The data eigenvalue of point B can be obtained.

[0121] In step S2-3, the speed and acceleration are calculated according to the time and distance of the trajectory feature, and the speed and acceleration in the trajectory sample are expressed as:

[0122]

[0123]

[0124] In the embodiment, according to the distance between the ABC three points, the speed and acceleration values of point B can be obtained, and the speed of B is The acceleration of B is

[0125] Let the trajectory classifier of the neural network model be f, the trajectory data be X, the vector input into the convolution network model be V, and the trajectory sample be x i The trajectory feature obtained by the convolution network model is ξ. The trajectory classification process is represented as follows:

[0126] f(X, V, x i ) = (ξ1, ξ2, ξ3, ξ4, ξ5, ξ6)

[0127] In the embodiment, the trajectory features longitude ξ1, latitude ξ2, time ξ3, speed ξ4, acceleration ξ5, and angle ξ6 are generated by the trajectory sample under the action of the trajectory classifier according to the above steps. Then, the trajectory classification is performed according to the trajectory features. Through the above operation, the longitude, latitude, time, angle, and other parameter information are integrated within the range of 0-1 through data normalization processing. The feature information of point B can be obtained as follows:

[0128] f(X, V, x B ) = (0.681, 0.531, 0.268, 5.58, 0.00019, 0.521)

[0129] In step S3, noise is generated. Laplace noise is selected as the noise to be added, including the following sub-steps:

[0130] In the embodiment, Laplace noise is selected, and 6 classification results are obtained according to the classification of the network model, each result corresponding to a probability value. ε is the differential privacy protection strength, the numerical value can be set by the person skilled in the art according to the degree of data to be protected (usually in the range of 0.1-1, the smaller the value, the better the protection), and A represents the selected adversarial function, which can be selected according to the actual situation. Under the action of the Laplace probability density function and the probability model, the added noise α is calculated, and the specific implementation is as follows,

[0131]

[0132] ε is the privacy protection strength, set the protection degree is good, select ε as 0.1 for calculation.

[0133] Step S3-1, construct trajectory defense model, add Laplace noise in trajectory feature to achieve the effect of defense, in addition, design an iterative random algorithm, the purpose is to find out a best noise data value, according to the trajectory feature, the classification result of the classifier is calculated as follows:

[0134] T={T1, T2, T3, T4, T5, T6}

[0135] Among them, T1 represents the result of the classifier classifying data as walking, and T2, T3, T4, T5 and T6 represent the results of the classifier classifying data as bicycle, bus, car, train and airplane respectively.

[0136] Each classification result corresponds to a probability result, that is, after the mapping of the neural network f, the classification result is represented by the corresponding probability P=f(T).

[0137] Thus, the probability representation of each trajectory mode is obtained as follows:

[0138] P={P1, P2, P3, P4, P5, P6}

[0139] Among them, P1 represents the probability of the classifier predicting data as walking, and P2, P3, P4, P5 and P6 represent the probabilities of predicting as bicycle, bus, car, train and airplane respectively.

[0140] In the embodiment, each classification result corresponds to a group of probability data values, and the group with larger probability value is selected as the actual prediction result. According to the group of data values obtained by model training, the group is {0.21, 0.14, 0.12, 0.31, 0.16, 0.06}. It can be inferred that the sample trajectory is predicted as a car.

[0141] Based on the principle of differential privacy mechanism, the defense model of trajectory classification is obtained as:

[0142]

[0143] n(n=1,2,3,4,5) represents the number of trajectory classification, ξ ij represents all the trajectory features of trajectory sample i, the classification result of each trajectory sample obtained by convolution network, A represents the adversarial function, and α represents the best noise to be added in the trajectory feature.

[0144] Suppose the data value range of each trajectory sample after the action of the adversarial function is [0, c], denoted as:

[0145]

[0146] Step S3-2, noise generation. We consider adding Laplace noise in the trajectory feature, which satisfies a random value satisfying the Laplace distribution, and then according to the iterative search algorithm and the expected data value to find the best perturbation data, the Laplace probability density function is:

[0147]

[0148] Set an adversarial function A, according to the mapping relationship of the trajectory sample to the trajectory feature, there are 6 different features in the trajectory data, which is represented as:

[0149] f(d)=(lng i , lat i , t i , v i , a i , deg i ) T

[0150] Let the sensitivity of differential privacy be Δf=max||f(d)-A(d′)||, and the scale parameter b satisfies

[0151] Where d and d' represent adjacent trajectory samples, and the value of b is determined according to the selected different trajectory samples, and the size of the best noise data value α is calculated by the iterative search algorithm through b. Where b and α have the following relationship:

[0152]

[0153] Here we give the trajectory sample x generated by the trajectory data X, and the trajectory feature of each trajectory sample generates a random number under the action of the Laplace probability density function, that is, the trajectory feature with noise:

[0154]

[0155] The distribution function F(x) is decomposed into a linear combination of several relatively simple sub-distribution functions

[0156]

[0157] Where F(x) is the distribution function, p i >0, A positive random number can be generated

[0158] Step S3-3, searching for the best noise, calculating the model data value according to the constructed trajectory defense model. Initialize the privacy protection parameter ε, assume the adversarial function as A. Calculate the model data value f(A(X)) of each trajectory sample as h1, and calculate the model data value f(A(X+α)) of each trajectory sample as h2. Select different adjacent trajectory samples to calculate the b value data, and then obtain the α value. According to the relationship that h2 / h1 is greater than 1, the size of the b value is updated iteratively, and a threshold τ is reached, and then the value of α is obtained, so that the defense model of the network outputs the corresponding best noise as α under a certain threshold τ. ε

[0159] In the embodiment, the noise α value is updated according to the iterative search function, and the value is calculated according to the formula in step S3-1. When the threshold τ is reached, the search is stopped. When initializing, the b value is selected as

[0160] When the threshold τ is selected close to the boundary condition value 1, the search is stopped, and the b value is determined to obtain the best noise

[0161] Step S4, perturbing data, adding the noise data obtained in step S3 to the trajectory feature to generate trajectory feature data with noise. For the defense method of the adversarial sample, that is, adding perturbation data β to the trajectory feature with noise, we consider adding perturbation to the gradient of the trajectory sample to obtain the corresponding trajectory classification adversarial sample data as follows:

[0162] x″=x′+A(x′+β,y)

[0163] x′ represents the trajectory sample with noise after adding Laplace noise, x″ represents the adversarial sample with noise after adding perturbation data to the trajectory sample, and y represents the label of the corresponding trajectory sample data classification. The defense effect of the defense system of the adversarial sample is compared with the classification accuracy of x′ and x″ through the neural network classifier.

[0164] In the embodiment, the best perturbation noise α obtained in step S3 is added to the trajectory feature, that is, the data of 300 trajectory points is changed. In order to verify the ability of the trajectory sample defense system, perturbation data is added on this basis. According to the actual situation, the black box attack adds perturbation data β value 0.1 as an addition, and the size of the perturbation data is generated by the trajectory sample with noise through the neural network.

[0165] ​Step S5, noise reduction process. Generally, the track data X' with noise contains high frequency part H and low frequency part L, the high frequency part refers to the pixel points with sharp intensity change in the track data (such as edges, image details, noise points); the low frequency part refers to the pixel points with gentle intensity change in the track data (such as large color block places), that is, the track data after noise reduction. Corresponding representation is as follows:

[0166] T'(x, y) = H(x, y) + L(x, y)

[0167] Where (x, y) represents the pixel point coordinates in the track sample.

[0168] Considering that the difference between the target pixel and the surrounding pixels is not particularly large, the mean filtering technology in the low frequency filtering technology is used to eliminate the high frequency part of the track segment and retain the low frequency part, so as to achieve the inverse transformation process, that is, to complete the noise reduction processing. The neighborhood operation is to obtain the value of the target pixel by weighted processing of the neighborhood of the target pixel, and the weighted matrix h is also called neighborhood operator. The noise reduction process is represented as:

[0169]

[0170] Where T(x, y) represents the original track sample pixel, that is, the target track sample pixel. The neighborhood operation, that is, the neighborhood-based function calculation at each track sample position (x, y), the neighborhood operator h is a special form of neighborhood filtering.

[0171] Suppose the length and width of the track sample are M and N respectively, the operation of the neighborhood operator using the mean filtering technology is

[0172]

[0173] Where h represents the weighted matrix, that is, the neighborhood operator.

[0174] The inverse transformation I process of the track sample is represented as:

[0175] T(x, y) = I(T'(x, y))

[0176] After the noise reduction processing, the sample is converted into a feature data representation after feature extraction and other operations.

[0177] The sample after noise reduction is converted into a sample data representation as follows:

[0178] X = {x1, x2, x3...x n}.

[0179] The track sample data is obtained by feature extraction to obtain the representation of each sample feature.

[0180] x i = (lng i , lat i , t i , v i , a i , deg i )

[0181] where lng i denotes longitude, lat i denotes latitude, t i denotes time, v i denotes velocity, a i denotes acceleration, and deg i denotes angle.

[0182] In the embodiment, the result of step S3 is selected as sample data, i.e., feature data with noise, a weighted matrix h is calculated according to the length and width in the trajectory data, a low-frequency filtering technique is used to obtain a high-frequency part H and a low-frequency part L, the high-frequency part and the low-frequency part are added through neighborhood operation, and then the weighted matrix is integrated to obtain data after noise reduction processing.

[0183] Finally, it should be pointed out that the above embodiments are only used to illustrate the technical solutions of the present application and are not limiting. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the purpose and scope of the technical solutions, and they should be covered in the scope of the claims of the present application.

Claims

1. A defense method against adversarial examples in trajectory classification, characterized in that: The method includes the following steps: S1: Trajectory data segment preprocessing; For the read trajectory data X to be protected, the total number is denoted as n. According to the data extraction operation, the trajectory data is converted into the corresponding expression of trajectory samples as follows: {x1,x2,x3...x n } Where x i {i = 1, 2, 3...} represents trajectory samples, and each sample is independent and has its own trajectory characteristics; S2: Feature extraction of trajectory samples; for each trajectory sample x after preprocessing in S1 i The sequence {i = 1, 2, 3...} extracts six trajectory feature values: longitude, latitude, time, velocity, acceleration, and angle, represented as follows: (lng i ,lat i ,t i ,v i ,a i ,deg i ) Among them, lng i Indicates longitude, lat i t represents latitude. i v represents time. i Indicates velocity, a i Deg represents acceleration. i Indicates angle; The data packets obtained after preprocessing the trajectory samples contain longitude lng i latitude i Time t i The velocity v is obtained through calculation. i acceleration a i Angle (deg) i Feature information; S3, Noise Generation; Laplace noise is selected as the noise to be added; S4, Perturbation Data: The noisy data obtained in step S3 is added to the trajectory features to generate noisy trajectory feature data. For the defense method against adversarial examples, perturbation data β is added to the noisy trajectory features. We consider adding perturbation to the gradient of the trajectory samples, and the corresponding trajectory classification adversarial example data is as follows: x″=x′+A(x′+β,y) x′ represents the noisy data after adding Laplace noise to the trajectory sample, x″ represents the adversarial sample after adding perturbation data to the noisy trajectory sample, and y represents the label of the corresponding trajectory sample data classification. The defense effectiveness of the defense system is evaluated by comparing the classification accuracy of x' and x” obtained by the neural network classifier. Step S5, noise reduction process; the noisy trajectory data X′ contains a high-frequency component H and a low-frequency component L. The high-frequency component refers to the pixels in the trajectory data whose intensity changes drastically; the low-frequency component refers to the pixels in the trajectory data whose intensity changes gently, i.e., the trajectory data after noise reduction; the corresponding representations are as follows: T′(x,y)=H(x,y)+L(x,y) Where (x, y) represents the pixel coordinates in the trajectory sample; Mean filtering, a low-frequency filtering technique, is used to eliminate the high-frequency components of the trajectory segment while retaining the low-frequency components, achieving an inverse transformation process, thus completing the noise reduction. Neighborhood operations obtain the target pixel's value by weighting its neighborhood; this weighting matrix h is also called the neighborhood operator. The noise reduction process is represented as follows: Where T(x, y) represents the original trajectory sample pixel points, i.e. the target trajectory sample pixel points; This indicates neighborhood operation, which means performing a neighborhood-based function computation at each trajectory sample position (x, y). Assuming the length and width of the trajectory sample are M and N respectively, the operation of the neighborhood operator using the mean filtering technique is as follows: Where h represents the weighting matrix, i.e., the neighborhood operator; The inverse transformation I process of the trajectory sample is represented as: T(x,y)=I(T′(x,y)) After noise reduction, the samples are transformed into feature data representations through feature extraction. The denoised samples are represented as sample data as follows: X={x1,x2,x3...x n } Trajectory sample data are processed through feature extraction to obtain a representation of each sample feature; x i =(lng i ,lat i ,t i ,v i ,a i ,deg i ) Among them, lng i Indicates longitude, lat i t represents latitude. i v represents time. i Indicates velocity, a i Deg represents acceleration. i Indicates angle.

2. The method for defending against adversarial examples in trajectory classification according to claim 1, characterized in that: S2 includes the following steps: S2-1: Calculation of trajectory distance. Let the longitude data of points A and B be lng1 and lng2, and the latitude data be lat1 and lat2, respectively. First, obtain the distance between any two points based on the longitude and latitude data. Then, obtain the trajectory angle between the trajectories based on the distance. Where s AB The distance between points A and B is represented by r, where r represents the Earth's radius. S2-2: Angle Calculation. In a continuous trajectory data segment, there are three points, A, B, and C, and the angle formed by these three points is γ. The cosine values ​​between the three points have the following relationship: Where γ is the angle between ACB, and s AC Let s be the distance between AC, and similarly s BC s AB These are the distances between BC and AB, respectively. S2-3: Calculation of velocity and acceleration. Based on the time and distance of the trajectory features, the velocity and acceleration in the trajectory sample are expressed as follows: Let f be the trajectory classifier in the neural network model, X be the trajectory data, V be the vector input to the convolutional network model, and x be the trajectory samples. i The trajectory features obtained through the convolutional network model are ξ; the trajectory classification process is represented as follows: f(X, V, x i )={ξ1,ξ2,ξ3,ξ4,ξ5,ξ6).

3. The method for defending against adversarial examples in trajectory classification according to claim 2, characterized in that: S3 includes the following steps: S3-1: Construct a trajectory defense model by adding Laplace noise to the trajectory features to achieve a defense effect. Furthermore, an iterative random algorithm is designed to find an optimal noise data value. The classification results of the classifier are calculated based on the trajectory features as follows: T={T1, T2, T3, T4, T5, T6} Where T1 represents the result of the classifier classifying the data as walking, and similarly T2, T3, T4, T5, and T6 represent the result of the classifier classifying the data as bicycle, bus, car, train, and airplane, respectively. Each classification result corresponds to a probability result, that is, after the mapping effect of the neural network f, the classification result is represented by the corresponding probability P = f(T); The probability representation of the trajectory pattern corresponding to each trajectory is thus obtained as follows: P={P1, P2, P3, P4, P5, P6} Where P1 represents the probability that the classifier predicts the data as walking, and similarly P2, P3, P4, P5, and P6 represent the probabilities of predicting it as bicycle, bus, car, train, and airplane, respectively. Based on the principle of differential privacy, the defense model for trajectory classification is obtained as follows: n (n = 1, 2, 3, 4, 5) represents the number of trajectory classification categories, ξ ij Represents all trajectory features of trajectory sample i. The classification result of each trajectory sample obtained after the action of the convolutional network, where A represents the adversarial function and α represents the optimal noise to be added to the trajectory features; Let the range of data values ​​obtained by each trajectory sample after the adversarial function is [0, c], denoted as: S3-2, Noise Generation: Laplace noise is added to the trajectory features. This noise consists of random values ​​that follow a Laplace distribution. Then, an iterative search algorithm and the expected data values ​​are used to find the optimal perturbation data. The Laplace probability density function is: Define an adversarial function A. Based on the mapping relationship between trajectory samples and trajectory features, and given that the trajectory data has 6 distinct features, it can be expressed as follows: f(d)=(lng i ,lat i ,t i ,v i ,a i ,deg i ) T Let the sensitivity of differential privacy be Δf = max||f(d) - A(d′)||, and the scale parameter b satisfy... Where d and d′ represent neighboring trajectory samples, the value of b is determined based on the selected trajectory samples, and the optimal noise data value α is calculated using an iterative search algorithm based on the value of b; where b and α have the following relationship: Given trajectory samples x generated from trajectory data X, the trajectory features of each trajectory sample generate random numbers under the action of the Laplace probability density function, which are the trajectory features with noise: The distribution function F(x) is decomposed into a linear combination of several simpler sub-distribution functions. Where F(x) is the distribution function, p i >0, Generate a positive random number Make S3-3: Search for the optimal noise level and calculate the model data values ​​based on the constructed trajectory defense model; initialize the privacy protection parameters ε and σ, assuming the adversarial function is A; calculate the model data value f(A(X)) for each trajectory sample, set as h1, and calculate the model data value e for each trajectory sample. ε Let f(A(X+α)) be h2; select different neighboring trajectory samples to calculate b value data, and then obtain the α value. Based on the relationship that h2 / h1 is greater than 1, continuously update the size of b value, and then obtain the value of α, so that the network's defense model outputs the corresponding optimal noise as α at a certain threshold τ.

4. A defense system for trajectory classification adversarial examples, characterized in that: The system includes the following modules: The trajectory feature extraction module is used to extract the basic and motion features of the trajectory from the selected trajectory segment after preprocessing. The preprocessing submodule, based on the selected trajectory segment X, transforms the trajectory data into trajectory samples {x1, x2, x3...x...}. n Each sample contains corresponding trajectory features; The feature extraction submodule directly extracts basic features from the basic trajectory data, including longitude, latitude, and time. i lat i , t i Then, motion features (v) are calculated based on the correlation between the features. i a i , deg i ); The noise generation and addition module is used to build a trajectory adversarial defense system based on differential privacy. It obtains feature data α through a Laplace noise generation mechanism. Construct a defense system submodule, where each trajectory corresponds to a classification model, and obtain the trajectory classification defense model based on differential privacy: The search is continuously performed by leveraging the adversarial function and the strength of privacy protection. The variables of the Laplace sample for each sample are obtained based on the Laplace probability density function. The optimal noise is obtained by modifying the value of b. The iterative search noise module calculates the model data value f(A(X)) for each trajectory sample, denoted as h1, and calculates the model data value e for each trajectory sample. ε Let f(A(X+α)) be h2; select different neighboring trajectory samples to calculate b value data, and then obtain the α value. Based on the relationship that h2 / h1 is greater than 1, continuously update the size of b value to obtain the value of α, so that the network's defense system outputs the corresponding optimal noise as α at a certain threshold τ. The perturbation data addition module adds noise data to the trajectory features based on the obtained noise data, generating noisy trajectory feature data. For the defense method against adversarial examples, the perturbation data β is added to the noisy trajectory features, and the corresponding expression is as follows. x″=x′+A(x′+β,y) The noise reduction module uses mean filtering, a low-frequency filtering technique, to eliminate the high-frequency components of the trajectory segment while retaining the low-frequency components, achieving an inverse transformation process, thus completing the noise reduction. Neighborhood operations obtain the target pixel's value by weighting its neighborhood; this weighting matrix h is also called the neighborhood operator. The noise reduction process is represented as follows: Where T(x, y) represents the original trajectory sample pixels, i.e., the target trajectory sample pixels. This indicates neighborhood operations.

Images