Adversarial sample generation method and device for modulation recognition of interference communication signals

Abstract

The application relates to an adversarial sample generation method and device for interference communication signal modulation identification. The method comprises the following steps: from the perspective of a classification decision hyperplane, a shortest vertical distance of points to a surface is obtained in a geometric four-dimensional space, the direction is also a normal vector direction of the hyperplane, a perturbation control quantity hyperparameter is found by combining a two-search algorithm, that is, the "distance" of the perturbation moving in the normal vector direction, and minimum perturbation can be obtained. Based on this, an adversarial sample generation method with the shortest "distance" as the core is proposed. By adopting the method, adversarial samples can be quickly generated under the premise of ensuring the attack success rate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication signal modulation identification, in particular to a method and device for generating adversarial samples for interfering with communication signal modulation identification. BACKGROUND

[0002] In recent years, deep learning algorithms have made great progress in many fields such as machine vision and speech recognition. In the field of wireless communication, it is often necessary to correctly identify the modulation mode of the signal with almost zero prior knowledge in order to facilitate subsequent demodulation and analysis. Therefore, signal modulation identification technology is indispensable in spectrum sensing, electronic countermeasures and communication reconnaissance. The traditional modulation identification process needs to extract signal features manually, which is tedious and has many uncertainties, and cannot adapt to the increasingly complex communication environment. In order to avoid the many drawbacks of manual processing, more and more scholars have begun to use deep learning methods to directly extract features from the original data of communication signals, ensuring the real-time and robustness of automatic modulation identification of communication signals, so they can achieve better recognition performance than traditional methods. Many studies have shown that using deep neural networks to identify the modulation mode of wireless communication signals can achieve good recognition results.

[0003] However, recent research has found that convolutional neural networks (CNN) are very vulnerable to adversarial samples in the field of image recognition. Adversarial samples are generated by adding subtle perturbations to the original data using a specific algorithm, and when input into the model, they will produce a high-confidence misclassification result. There are many adversarial sample algorithms, such as FGSM, Deepfool and CW, which can produce perturbations that cannot be identified by the human eye, and when added to images, they can cause CNN-based image recognition classification algorithms to produce misjudgments with high confidence, seriously affecting the security performance of artificial intelligence.

[0004] Using adversarial samples to interfere with communication signal modulation identification has become a new type of communication countermeasure. Existing methods for generating adversarial samples for communication signal modulation identification have good adversarial performance, but in practical applications, considering the real-time performance of communication countermeasures in complex electromagnetic environments, the speed of generating adversarial samples also has an important impact. In existing adversarial sample generation methods, some are fast but have a low attack success rate; others use iterative methods to improve the attack success rate and obtain more refined adversarial samples, but this affects the speed of generating adversarial samples. SUMMARY

[0005] Therefore, it is necessary to provide a method and device for generating adversarial samples for interfering with communication signal modulation identification that can guarantee a certain attack success rate while generating adversarial samples quickly.

[0006] A method for generating an adversarial sample for interfering with communication signal modulation identification, the method comprising:

[0007] obtaining an original signal sample;

[0008] calculating a shortest distance from the original signal sample to a classification decision hyperplane according to a known communication signal modulation identification model to be interfered with and model parameters, and taking a direction of the shortest distance as a normal vector direction of a perturbation amount;

[0009] calculating a distance of the perturbation amount moving in the normal vector direction according to a binary search algorithm, i.e., a control hyperparameter of the perturbation amount;

[0010] superimposing the original signal sample according to the normal vector direction of the perturbation amount and the control hyperparameter to generate an adversarial sample for the known communication signal modulation identification model to be interfered with.

[0011] In one embodiment, the calculating a shortest distance from the original signal sample to a classification decision hyperplane according to a known communication signal modulation identification model to be interfered with and model parameters comprises:

[0012] solving and obtaining an approximate affine classifier region of a nonlinear classifier in the known communication signal modulation identification model to be interfered with according to a calculation manner of the approximate affine classifier region of the nonlinear classifier in Deepfool, and finding the shortest distance from the original signal sample to the classification decision hyperplane based on the region.

[0013] In one embodiment, the approximate affine classifier region of the nonlinear classifier is expressed as:

[0014]

[0015] In the above formula, f(·) represents a known communication signal modulation identification model function to be interfered with, represents an original category of the original signal sample x0, and k represents other categories.

[0016] In one embodiment, the normal vector direction of the perturbation amount can be defined as:

[0017]

[0018] In the above formula, ω l represents model parameters.

[0019] In one embodiment, the known communication signal modulation identification model to be interfered with is a CNN model.

[0020] An adversarial sample generation device for interference communication signal modulation identification, the device comprising:

[0021] A sample acquisition module for acquiring an original signal sample;

[0022] A perturbation quantity normal vector direction acquisition module for calculating the shortest distance of the original signal sample to a classification decision hyperplane according to a known communication signal modulation identification model to be interfered and model parameters, and taking the direction of the shortest distance as the normal vector direction of the perturbation quantity;

[0023] A perturbation quantity control hyperparameter obtaining module for calculating the distance of the perturbation quantity moving in the normal vector direction according to a binary search algorithm, i.e. the control hyperparameter of the perturbation quantity;

[0024] An adversarial sample generation module for superimposing the original signal sample according to the normal vector direction and the control hyperparameter of the perturbation quantity, to generate an adversarial sample for the communication signal modulation identification model to be interfered.

[0025] A computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0026] Acquiring an original signal sample;

[0027] Calculating the shortest distance of the original signal sample to a classification decision hyperplane according to a known communication signal modulation identification model to be interfered and model parameters, and taking the direction of the shortest distance as the normal vector direction of the perturbation quantity;

[0028] Calculating the distance of the perturbation quantity moving in the normal vector direction according to a binary search algorithm, i.e. the control hyperparameter of the perturbation quantity;

[0029] Superimposing the original signal sample according to the normal vector direction and the control hyperparameter of the perturbation quantity, to generate an adversarial sample for the communication signal modulation identification model to be interfered.

[0030] A computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the following steps:

[0031] Acquiring an original signal sample;

[0032] Calculating the shortest distance of the original signal sample to a classification decision hyperplane according to a known communication signal modulation identification model to be interfered and model parameters, and taking the direction of the shortest distance as the normal vector direction of the perturbation quantity;

[0033] Calculating the distance of the perturbation quantity moving in the normal vector direction according to a binary search algorithm, i.e. the control hyperparameter of the perturbation quantity;

[0034] According to the normal vector direction of the perturbation amount and the control hyperparameter, the original signal sample is superimposed to generate an adversarial sample for the communication signal modulation identification model to be interfered.

[0035] The above-mentioned adversarial sample generation method and device for interfering communication signal modulation identification start from the perspective of a classification decision hyperplane, and the shortest perpendicular distance from a point to a plane is in the direction of the normal vector of the hyperplane. In combination with the two search algorithm to find the perturbation control amount hyperparameter, that is, the "distance" of the perturbation moving in the normal vector direction, the minimum perturbation can be obtained. Based on this, the shortest "distance" is taken as the core of the adversarial sample generation method. The method can generate adversarial samples at a high speed on the premise of ensuring the attack success rate. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 It is a flowchart of an embodiment of the adversarial sample generation method for interfering communication signal modulation identification;

[0037] Figure 2 It is an approximate multi-classification shortest distance diagram for an embodiment;

[0038] Figure 3 It is a structure diagram of the VT-CNN2 algorithm model in an experiment;

[0039] Figure 4 It is a training and testing accuracy curve diagram of the VT-CNN2 algorithm model in an experiment;

[0040] Figure 5 It is an attack success rate curve diagram of three algorithms under different SNRs in an experiment;

[0041] Figure 6 It is a waveform comparison diagram of adversarial samples and original data in three algorithms in an experiment;

[0042] Figure 7 It is a structure block diagram of the adversarial sample generation device for interfering communication signal modulation identification in an embodiment;

[0043] Figure 8 It is an internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0045] As Figure 1As shown, a method for generating an adversarial sample for interference communication signal modulation identification is provided, comprising the following steps:

[0046] Step S100, obtaining an original signal sample;

[0047] Step S110, calculating the shortest distance of the original signal sample to the classification decision hyperplane according to a known communication signal modulation identification model to be interfered and model parameters, and taking the direction of the shortest distance as the normal vector direction of the perturbation amount;

[0048] Step S120, calculating the distance of the perturbation amount moving in the normal vector direction according to the two search algorithm, that is, the control hyperparameter of the perturbation amount;

[0049] Step S130, superimposing the original signal sample according to the normal vector direction of the perturbation amount and the control hyperparameter to generate an adversarial sample for the communication signal modulation identification model to be interfered.

[0050] In this embodiment, in view of the background that the communication signal modulation identification system in the prior art mostly adopts a convolutional neural network, the communication signal modulation identification system, that is, the recognition neural network, is interfered by the adversarial sample, which becomes a new type of communication countermeasure. Specifically, in a wireless communication system, a signal received from a transmitter by a receiver is x, and it is assumed that there is an interference machine to transmit a low-power perturbation signal r x to the receiver. adv The signal received by the receiver becomes x x , wherein x adv is an adversarial sample. The goal of the interference machine is to design the perturbation signal r x so that the wireless communication system classifies the received signal incorrectly.

[0051] Among them, the definition of the adversarial sample is: assuming that the classifier F:X→Y maps the input sample x∈X to the discrete label set Y={1,…,k}. For an input x∈X, assuming that the actual class is y, F(x)=y. We want to find a small perturbation η. If the input sample is disturbed, i.e. x′=x+η, then the output label is predicted to be the wrong class, i.e. F(x′)≠y. This disturbed sample x′ is the adversarial sample.

[0052] According to whether the adversarial sample attack specifies a target class, the adversarial sample attack can be divided into targeted attack and untargeted attack.

[0053] For untargeted attack, as long as the predicted label of the adversarial sample is different from the original label; for targeted attack, the label of the adversarial sample needs to be a specified label y tThe smaller the perturbation amount of the adversarial sample is, the less likely it is to be perceived, and thus the untargeted attack and the targeted attack can be represented as the following optimization problems respectively:

[0054]

[0055]

[0056] The attack on the adversarial sample in the present application is an untargeted attack.

[0057] In the present embodiment, the case of a white-box attack is considered, that is, a signal modulation identification model adopted by a communication system is known. The method in the present application generates adversarial samples for a CNN algorithm for the signal modulation identification model.

[0058] In step S100, the original signal sample obtained is a communication modulation signal to be identified by a signal modulation model.

[0059] In step S110, the shortest distance of the original signal sample to the classification decision hyperplane is calculated according to the known communication signal modulation identification model to be interfered and the model parameters, including: according to the calculation method of the iterative approximation affine classifier space of the nonlinear classifier in Deepfool, the nonlinear classifier approximation affine classifier region in the communication signal modulation identification model to be interfered is solved and obtained, and the shortest distance of the original signal sample to the classification decision hyperplane is found based on the region.

[0060] Specifically, the present method starts from the perspective of the classification decision hyperplane, and according to the geometric thinking, the perpendicular distance from a point to a plane is the shortest, and the direction is also the normal vector direction of the hyperplane. In combination with the binary search algorithm, the perturbation control hyperparameter ε is designed to find, that is, the "distance" of the perturbation moving in the normal vector direction, and the minimum perturbation can be obtained. Based on this, the adversarial attack algorithm SD-Alg (Shortest Distance Algorithm) algorithm is proposed with the shortest "distance" as the core.

[0061] As shown in Figure 2 for the non-targeted adversarial attack, x0 is the original signal sample, τ is the normal vector of the approximate hyperplane, and the shortest distance along the normal vector is recorded as the optimal distance d. In this way, a single-step attack can achieve the purpose of successful attack, while generating fine-grained adversarial perturbation and greatly shortening the adversarial sample generation time.

[0062] Further, first, the nonlinear classifier needs to be approximated as a linear classifier to find the optimal classification hyperplane projection. According to the calculation method of the iterative approximation affine classifier space of the nonlinear classifier in Deepfool, the nonlinear classifier approximation affine classifier region is:

[0063]

[0064] In formula (3), f(·) represents a known communication signal modulation identification model function to be interfered, represents the original category of the original signal sample x0, k represents other categories. Based on this area, find the optimal category label distance That is, the optimal distance d corresponds to the category, so the disturbance vector, that is, the projection vector, that is, the normal vector direction of the disturbance amount can be defined as:

[0065]

[0066] In formula (4), ω l ' represents the model parameter.

[0067] Then find the optimal scaling factor ε by searching method to generate the adversarial disturbance r * , and then superimposed on the original signal sample to generate the adversarial sample.

[0068] As shown in the following table, a detailed algorithm step of the method is also provided:

[0069] Table 1 Fast adversarial sample generation algorithm SD-Alg

[0070]

[0071]

[0072] The disturbance amount r x can be obtained by the above algorithm, and then the adversarial sample x adv = x+r x can be obtained. For each sample x, the above algorithm is used to obtain the adversarial sample, and the adversarial sample dataset is constructed.

[0073] Next, the effect of the above method is verified by taking the target VT-CNN2 model of the more advanced communication system as an example of modulation recognition, and the dataset used, that is, the communication modulation signal to be recognized, is the public RML2016.10a communication signal dataset. The dataset contains 8 kinds of digital modulation signals and 3 kinds of analog modulation signals, a total of 11 kinds of modulation signals, 22000 samples, and the detailed information of the dataset is as follows.

[0074] Table 2 RML2016.10a communication signal dataset

[0075]

[0076]

[0077] The structure of the VT-CNN2 model is as follows Figure 3as shown.

[0078] The data is divided according to SNR, and for each SNR, the training set and test set are divided, and the sample number is 7000 and 4000 respectively, and then the signal recognition model is obtained by training 500 times on the training set of the VT-CNN2 algorithm model as shown. Figure 3 The training accuracy and test accuracy are shown in Table 3. The smaller the SNR, the worse the model generalization ability, and the test accuracy is very low. As shown in Figure 4 The training and test accuracy curves of the VT-CNN2 algorithm model are shown in

[0079] Table 3 VT-CNN2 model test accuracy

[0080]

[0081]

[0082] Then, the perturbation rate of each sample in the sample set is generated by the adversarial sample generation method in the present application to obtain the corresponding adversarial sample, and an adversarial sample dataset is constructed, and the adversarial sample dataset is input into the trained VT-CNN2 algorithm model for modulation recognition to verify the effect of the adversarial attack. In order to verify its effect, it is divided into three parts of comparison test of adversarial attack success rate, adversarial sample generation time and adversarial perturbation amount, and the existing adv-2018-Alg1 adversarial sample generation algorithm and adv-2020-Alg1 adversarial sample generation algorithm are used to generate adversarial samples for different SNR test sets, and input into the trained VT-CNN2 algorithm model.

[0083] First, the attack success rate of the three algorithms under different SNR is counted, as shown in Figure 5 In Figure 5 , the data with SNR≤-8dB is excluded, because from the network recognition accuracy above, when SNR≤-8, the test accuracy of the model is less than 50%, so the generalization ability of the model is weak, and it has no practical significance to test the adversarial attack. From Figure 5 It can be seen that the three kinds of adversarial attack algorithms can get good attack success rate, even if the SNR is low, the attack success rate can reach more than 50%, and in most SNR, the attack success rate is close to 80%. From the curve graph, although the effects of the three algorithms are very close, there are still differences. When the SNR is small, the Adv-2018-Alg1 and Adv-2020-Alg1 algorithms perform better than the SD-Alg algorithm, and as the SNR increases, the SD-Alg algorithm proposed in the present application shows a higher attack success rate.

[0084] From the perspective of attack success rate, although the method proposed in the application is not enough advantage, the difference is not obvious, then from the generation time of adversarial samples, the adv-2018-Alg1 algorithm and the adv-2020-Alg1 algorithm need to perform multiple iteration gradients for each class in the generation of perturbation process, and then find the smallest perturbation control hyperparameter ε, which needs to consume a lot of time. In practice, it is hoped that the algorithm generates small and fast perturbation. And the SD-Alg algorithm only needs to calculate the distance from the classification hyperplane of other classes, so the time will be less than the adv-2018-Alg1 and adv-2020-Alg1 algorithms. The following table shows the average time of three algorithms for generating adversarial samples for a single sample in the test set. It can be seen that SD-Alg is much smaller than the other two algorithms.

[0085] Table 4 Time for generating adversarial samples in the test set

[0086]

[0087] Finally, from the microscopic point of view, the advantages and disadvantages of the three algorithms are distinguished by comparing the adversarial perturbation size generated by the three algorithms. The smaller the perturbation, the smaller the change to the original signal, and the more precise the control of the perturbation. First, calculate the average L2 norm of the perturbation, as shown in the following table. Compared with the other two algorithms, the average L2 norm value of the SD-Alg algorithm is much smaller.

[0088] Table 5 Comparison of adversarial sample perturbation size

[0089]

[0090] As Figure 6 shown, in order to facilitate observation, a data is extracted for adversarial sample and original data waveform display. The original waveform and the IQ two-way data visualization waveform of the adversarial sample are compared. It can be seen that the waveform change after adding the perturbation is very small, but compared with the adv-2020-Alg1 algorithm, the perturbation generated by the adv-2018-Alg1 algorithm changes significantly larger, the adv-2018-Alg1 algorithm is second, and the SD-Alg algorithm perturbation is the smallest, and the waveform change is the smallest.

[0091] In the method for generating adversarial samples for interference communication signal modulation identification, from the perspective of a classification decision hyperplane, the shortest distance is the perpendicular distance from a point to a plane in four dimensions, and this direction is also the normal vector direction of the hyperplane. Therefore, the normal vector direction of the perturbation is constructed, and the control hyperparameter of the perturbation, that is, the distance of the perturbation moving in the normal vector direction, is found by using a binary search algorithm. In this way, the minimum perturbation can be obtained. Then, the perturbation is superimposed with the original signal sample to generate an adversarial sample. Through verification, the adversarial sample generated by the method improves the speed of generating adversarial samples on the basis of ensuring a certain adversarial attack success rate, and the smaller perturbation means smaller changes to the original signal.

[0092] It should be understood that, although Figure 1 The steps in the flowchart of the method for generating adversarial samples for interference communication signal modulation identification are displayed in sequence according to the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise explicitly stated herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps in the method for generating adversarial samples for interference communication signal modulation identification can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least part of other steps or sub-steps or stages of other steps.

[0093] In one embodiment, as shown in Figure 7 A device for generating adversarial samples for interference communication signal modulation identification is provided, comprising: a sample acquisition module 200, a perturbation normal vector direction acquisition module 210, a perturbation control hyperparameter acquisition module 220, and an adversarial sample generation module 230, wherein:

[0094] The sample acquisition module 200 is configured to acquire an original signal sample.

[0095] The perturbation normal vector direction acquisition module 210 is configured to calculate the shortest distance from the original signal sample to a classification decision hyperplane according to a known communication signal modulation identification model to be interfered and model parameters, and take the direction of the shortest distance as the normal vector direction of the perturbation.

[0096] The perturbation control hyperparameter acquisition module 220 is configured to calculate the distance of the perturbation moving in the normal vector direction, that is, the control hyperparameter of the perturbation, according to a binary search algorithm.

[0097] The adversarial sample generation module 230 is configured to superimpose the original signal sample according to the normal vector direction and the control hyperparameter of the perturbation to generate an adversarial sample for the communication signal modulation identification model to be interfered.

[0098] The specific limitations of the apparatus for generating adversarial samples for modulation identification of interference communication signals can refer to the limitations of the method for generating adversarial samples for modulation identification of interference communication signals described above, which will not be repeated here. Each module in the apparatus for generating adversarial samples for modulation identification of interference communication signals described above can be realized by software, hardware and their combination in whole or in part. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to call and execute the operations corresponding to the above-mentioned modules by the processor.

[0099] In one embodiment, a computer device is provided, which can be a terminal, and its internal structure diagram can be as shown in Figure 8 The computer device includes a processor, a memory, a network interface, a display screen and an input device connected by a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The network interface of the computer device is used to communicate with external terminals through network connection. The computer program is executed by the processor to implement a method for generating adversarial samples for modulation identification of interference communication signals. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0100] Those skilled in the art can understand that Figure 8 the structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0101] In one embodiment, a computer device is provided, which includes a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the following steps:

[0102] a sample acquisition module, configured to acquire original signal samples;

[0103] The disturbance quantity normal vector direction obtaining module is configured to calculate the shortest distance from the original signal sample to the classification decision hyperplane according to the known communication signal modulation identification model to be disturbed and model parameters, and take the direction of the shortest distance as the normal vector direction of the disturbance quantity.

[0104] The disturbance quantity control hyperparameter obtaining module is configured to calculate the distance of the disturbance quantity moving in the normal vector direction according to the dichotomy algorithm, that is, the control hyperparameter of the disturbance quantity.

[0105] The adversarial sample generating module is configured to superimpose the original signal sample according to the normal vector direction and the control hyperparameter of the disturbance quantity, and generate an adversarial sample for the communication signal modulation identification model to be disturbed.

[0106] In one embodiment, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. When the computer program is executed by a processor, the following steps are implemented:

[0107] The sample obtaining module is configured to obtain an original signal sample.

[0108] The disturbance quantity normal vector direction obtaining module is configured to calculate the shortest distance from the original signal sample to the classification decision hyperplane according to the known communication signal modulation identification model to be disturbed and model parameters, and take the direction of the shortest distance as the normal vector direction of the disturbance quantity.

[0109] The disturbance quantity control hyperparameter obtaining module is configured to calculate the distance of the disturbance quantity moving in the normal vector direction according to the dichotomy algorithm, that is, the control hyperparameter of the disturbance quantity.

[0110] The adversarial sample generating module is configured to superimpose the original signal sample according to the normal vector direction and the control hyperparameter of the disturbance quantity, and generate an adversarial sample for the communication signal modulation identification model to be disturbed.

[0111] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, storage, databases, or other media in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0112] The technical features of the above embodiments can be combined in any way. In order to make the description simple, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist, they should be considered as the scope of the present application.

[0113] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of the patent of the present application should be subject to the appended claims.

Claims

1. A method for generating adversarial examples for identifying modulation of interference communication signals, characterized in that, The method comprises: obtaining an original signal sample; calculating the shortest distance of the original signal sample to a classification decision hyperplane according to a known communication signal modulation identification model to be interfered and model parameters, and taking the direction of the shortest distance as the normal vector direction of the perturbation amount, wherein according to the calculation mode of the iterative approximation affine classifier space of the nonlinear classifier in Deepfool, the nonlinear classifier approximation affine classifier region in the communication signal modulation identification model to be interfered is solved and obtained, and the shortest distance of the original signal sample to the classification decision hyperplane is found based on the region, and the communication signal modulation identification model to be interfered is a CNN model; calculating the distance of the perturbation amount moving in the normal vector direction according to the binary search algorithm, that is, the control hyperparameter of the perturbation amount; superimposing the original signal sample according to the normal vector direction and the control hyperparameter of the perturbation amount to generate an adversarial sample for the communication signal modulation identification model to be interfered.

2. The method of claim 1, wherein, The nonlinear classifier approximation affine classifier region is represented as: In the above formula, f(·) represents a known communication signal modulation identification model function to be interfered, represents the original category of the original signal sample x0, and k represents other categories.

3. The method of claim 2, wherein, The normal vector direction of the perturbation amount can be defined as: In the above formula, denote model parameters.

4. An adversarial sample generation device for interference communication signal modulation identification, characterized by, The device comprises: a sample acquisition module for acquiring an original signal sample; a perturbation amount normal vector direction acquisition module for calculating the shortest distance of the original signal sample to a classification decision hyperplane according to a known communication signal modulation identification model to be interfered and model parameters, and taking the direction of the shortest distance as the normal vector direction of the perturbation amount, wherein according to the calculation mode of the iterative approximation affine classifier space of the nonlinear classifier in Deepfool, the nonlinear classifier approximation affine classifier region in the communication signal modulation identification model to be interfered is solved and obtained, and the shortest distance of the original signal sample to the classification decision hyperplane is found based on the region, and the communication signal modulation identification model to be interfered is a CNN model; a perturbation amount control hyperparameter acquisition module for calculating the distance of the perturbation amount moving in the normal vector direction according to the binary search algorithm, that is, the control hyperparameter of the perturbation amount; an adversarial sample generation module for superimposing the original signal sample according to the normal vector direction and the control hyperparameter of the perturbation amount to generate an adversarial sample for the communication signal modulation identification model to be interfered.

Images