Classification model theft detection method integrating query behavior features

Abstract

The present invention relates to a classification model theft detection method integrating query behavior features, and belongs to the field of computer and information science. The present invention first extracts the query behavior data stream from the original traffic data packet, and extracts the query sample based on the query behavior data stream; then the query sample is subjected to normal distribution verification to calculate the sample feature malicious value, and CNN and LSTM are used to extract the spatiotemporal features of the query behavior data stream, and then the query behavior type is determined and the behavior malicious value is calculated; finally, the classification model theft detection is performed in combination with the sample feature malicious value and the behavior malicious value. Aiming at the problem that the feature difference between the malicious query samples generated by the attacker and the benign query samples is not obvious, the present invention proposes a classification model theft detection method integrating the query behavior features, which improves the recall rate of the classification model theft detection.

Description

Technical Field

[0001] The invention relates to a classification model theft detection method integrating query behavior features, and belongs to the field of computer and information science. Background Art

[0002] As deep neural networks play an increasingly important role in computer vision, natural language processing and other fields, the security issues faced by models have also received widespread attention. Model stealing attacks can initiate queries to the target model through the interface provided by the service provider to obtain sample labels, and further derive the internal parameters of the target model or construct an alternative model similar to the target model. This type of attack can achieve model stealing based only on the vector or label information returned by the target model without any prior knowledge of the model, which seriously infringes the intellectual property rights of the model owner. Therefore, studying an effective model stealing detection method has important theoretical significance and practical value for protecting model privacy and security.

[0003] The existing model stealing detection methods are mainly based on query sample detection methods, which identify attack behaviors by detecting the differences between normal user query samples and abnormal user query samples. This method believes that in order to get closer to the classification boundary of the target model faster, attackers often use various methods to modify query samples. Such samples with traces of artificial modification will be significantly different from normal query samples used by benign users. For example, the query samples used by attackers are generally controlled by humans, and the distance distribution between samples will deviate from the normal distribution. Therefore, the minimum Euclidean distance between the new sample and the previous similar sample can be calculated and compared with the threshold, and the sample minimum distance set and threshold are updated. Then, the minimum distance set is tested for normal distribution to determine whether it is an attack behavior. Similar methods can also use the maximum mean or hardness histogram difference between normal samples and attack samples to detect attack samples. However, the constraint of this type of detection method is that there are obvious differences in statistical characteristics between malicious samples and normal samples. However, if the attacker adopts a natural selection strategy to select non-problem domain samples, that is, Non-Problem Domain data, this type of detection method can be bypassed. The query sample-based method cannot detect NPD model stealing attacks. The main reason is that the method ignores the mining of query behavior feature differences. Attackers have the characteristics of high-frequency query behavior, and attack behaviors can be identified by modeling user behavior patterns.

[0004] In summary, the existing model stealing detection methods have the following main problems: they only use the statistical differences between malicious samples and normal samples, ignore the mining of user query behavior characteristics, and fail to effectively detect NPD model stealing attacks. Summary of the invention

[0005] The purpose of the present invention is to address the problem that the feature differences between malicious query samples generated by attackers and benign query samples are not obvious, and to propose a classification model theft detection method that integrates query behavior features.

[0006] The design principle of the present invention is as follows: first, the basic information of the account is extracted to perform similarity calculation and detect whether there are users with multiple accounts; second, the query behavior data stream in the original traffic data packet of all user accounts is preprocessed, and the query sample sequence is extracted based on the query behavior data stream; then, the query sample sequence is subjected to normal distribution verification to calculate the sample feature malicious value, and CNN and LSTM are used to extract the spatiotemporal characteristics of the query behavior data stream, and then the query behavior type is determined and the behavior malicious value is calculated; finally, the sample feature malicious value and the behavior malicious value are combined to perform classification model theft detection.

[0007] The technical solution of the present invention is achieved through the following steps:

[0008] Step 1: Extract basic account information to perform similarity calculation and detect whether there are users with multiple accounts.

[0009] Step 1.1, extract account operation features and username features.

[0010] Step 1.2, calculate the similarity between two accounts.

[0011] Step 2: pre-process the query behavior data stream in the original traffic data packets corresponding to all accounts of the user, and extract query samples based on the query behavior data stream.

[0012] Step 2.1, perform session segmentation, data interception and matrix generation processing on the original traffic data packet.

[0013] Step 2.2: extract query samples in sessions and create a query sample sequence for each user.

[0014] Step 3: Use CNN and LSTM to extract the spatiotemporal features of the query behavior data stream, use the attention graph to amplify the data packet difference between the attack behavior and the normal behavior, and output the behavior maliciousness value.

[0015] Step 3.1: Extract the spatiotemporal information features of the query behavior data stream through the convolutional neural network (CNN) and the long short-term memory network (LSTM) to obtain the behavior data stream feature map.

[0016] Step 3.2, calculate the attention map using the feature map extracted in step 3.1.

[0017] In step 3.3, the attention map is globally averaged and pooled to obtain the classification probability, and then the entropy value of the attention map is calculated. The effectiveness of the attention map is obtained based on the entropy value.

[0018] In step 3.4, the attention map is combined with the original feature map to obtain the feature map after highlighting the features. After passing through the Softmax layer, the user behavior category and behavior maliciousness value are finally output.

[0019] Step 4: Perform a normal distribution check on the query sample sequence and calculate the sample feature malicious value.

[0020] Step 4.1, using the query sample sequence extracted in step 2, calculate the distance distribution between query samples.

[0021] Step 4.2, calculate the statistic W using the SW test method.

[0022] Step 5: jointly determine the query behavior category based on the detection results of the query behavior characteristics and the query sample characteristics.

[0023] Beneficial Effects

[0024] Compared with the traditional model theft detection method, the present invention uses the similarity between accounts to identify multi-account users, integrates the mining of query behavior characteristics, and introduces attention graphs to expand the difference between traffic data packets generated by normal and abnormal behaviors, thereby expanding the detection range and effectively improving the detection recall rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of the classification model theft detection method that integrates query behavior features of the present invention. DETAILED DESCRIPTION

[0026] In order to better illustrate the purpose and advantages of the present invention, the implementation method of the present invention is further described in detail below with reference to examples.

[0027] The experimental data uses two image datasets based on MNIST and CIFAR10 and a model stealing attack dataset based on three model stealing methods: Syn, AdvPD, and NPD. For each type of attack, a stealing attack scenario is set up to query multiple accounts at the same time, and the network traffic data packets generated during the query process are collected.

[0028] The experiment uses false alarm rate and detection speed to evaluate the effectiveness of the method. The specific calculation method is as follows:

[0029] (1) False positive rate (FPR). Randomly select 7,500 normal samples and divide them into 50 groups, each with 150 samples. Test each group separately and count the number of groups misjudged as malicious as Q. Calculate the proportion of Q:

[0030]

[0031] (2) Detection speed. The query sequence X generated by the attack is {x1, x2, …, x K} As the detection object, the query sequence X contains K samples. When the detection result is an attack, the number of samples detected N is recorded as the detection speed. If no attack is detected, the result is recorded as missed:

[0032]

[0033] The detection speed can also reflect the recall rate of the method under a certain sample size condition. For example, if there is no detection failure when the sample size is K, the recall rate of the method under this condition is considered to be 100%.

[0034] This experiment was conducted on a computer and a GPU server. The computer configuration was: Intel(R) Core(TM) i7-6700, CPU main frequency 3.40GHz, 8GB RAM, operating system 64-bit Windows 10; the server configuration was: GTX1080Ti, RAM 256G, operating system Linux Ubuntu 64-bit.

[0035] The specific process is:

[0036] Step 1: Extract basic account information and detect whether there are users with multiple accounts.

[0037] Step 1.1: Extract the number of IP addresses used by account A and account B, query input time, query frequency, page dwell time, and total account login time, perform standardization and construct an operation vector, calculate the Euclidean distance and cosine value as account operation similarity features, and measure the similarity of account operation habits and the similarity of operation vectors in direction, respectively.

[0038] In step 1.2, the usernames of account A and account B are extracted, the usernames are vectorized using the bag-of-words model, and the Jaro distance and cosine value are calculated as the username similarity features to measure the similarity of account naming habits and the similarity of the username vectors in direction, respectively.

[0039] Step 1.3: Use the critical weight method to perform weighted summation on the account operation similarity features and the username similarity features, perform a threshold judgment on the final similarity, and classify two accounts that exceed the threshold as the same user.

[0040] Step 2: pre-process the query behavior data stream in the original traffic data packets corresponding to all accounts of the user, and extract the query sample sequence based on the query behavior data stream.

[0041] Step 2.1, perform session segmentation, traffic interception and matrix generation processing on the original traffic file.

[0042] Step 2.1.1: for the original traffic file, the query behavior data stream of the same user is divided into sessions, and sorted according to the order of precedence to form the user's query behavior sequence.

[0043] Step 2.1.2, intercept the first 10 data packets in a session, intercept 160 bytes from the 16th to the 175th bit of each data packet, and intercept a total of 10*160 bytes, a total of 1600 bytes, and convert them into a 40*40 two-dimensional matrix.

[0044] Step 2.2: extract query samples in sessions and create a query sample sequence for each user.

[0045] Step 3: Use CNN and LSTM to extract the spatiotemporal features of the query behavior data stream, use the attention graph to amplify the data packet difference between the attack behavior and the normal behavior, and derive the behavior maliciousness value.

[0046] Step 3.1, extract the spatiotemporal features of the query behavior data stream through convolutional neural network (CNN) and long short-term memory network (LSTM).

[0047] In step 3.1.1, for the two-dimensional matrix flow generated in step 2.1.2, a CNN network is used to extract spatial features, where the hidden layer of the CNN uses two convolutional layers, and each convolutional layer is followed by a maximum pooling layer.

[0048] In step 3.1.2, the input size of the LSTM network is 160, the step size is 10, the network contains two hidden layers, each hidden layer uses 256 units, and the output is a feature map F(x) containing spatial and temporal information.

[0049] In step 3.2, after performing a convolution operation on the feature map extracted in step 3.1.2, it finally passes through a 1*1*1 convolution layer to output the attention map M(x).

[0050] In step 3.3, the attention map is subjected to global average pooling to obtain the classification probability and then calculate the entropy value of the attention map. The effectiveness of the attention map is obtained based on the entropy value.

[0051] Step 3.3.1, M(x) passes through a global average pooling layer, which uses the Softmax function as the activation function and outputs the predicted class probability P att , calculate the entropy of this classification, where C is the total number of sample categories, is the probability value of the i-th category classified according to the attention map, log(·) is the logarithmic function, see formula (3).

[0052]

[0053] Step 3.3.2, calculate the effectiveness t of M(x) based on the entropy value, see formula (4). The larger the entropy value, the closer the prediction probability is, the weaker the classification ability is, and the lower the effectiveness of the attention map is.

[0054]

[0055] In step 3.4, the attention map is combined with the original feature map to obtain the feature map after highlighting the features and evaluate the malicious value of the behavior.

[0056] In step 3.4.1, the original feature map is weighted using the attention map to highlight the differences between normal and malicious traffic packets, see formula (5), where ⊙ is the Hadamard product.

[0057] F′(x)={1+t·(M(x)-1)}⊙F(x) (5)

[0058] In step 3.4.2, F'(x) passes through the Softmax layer to obtain the user behavior category.

[0059] Step 3.4.3, suppose the total number of samples detected is N, the number of attacks of a certain type that appears most frequently is M, and its attack category is c. Then the malicious value x of the behavior queried by the user is net for:

[0060]

[0061] Step 4: Calculate the query sample features, perform normal distribution verification, and calculate the sample feature malicious value.

[0062] Step 4.1: Based on the output of step 2.1.1, extract the load sample of each session to form a load sample sequence S.

[0063] Step 4.1.1, if the sample s of S i If the category is c, then the growth set G of category c c =G c ∪{s i}, for sample s i Calculate the difference between all previous c-type samples s0,s1,s2,…,s i-1 The minimum distance d between min (s i ).

[0064] Step 4.1.2, D c is the set of minimum distances between samples of this type, and the initial threshold T c =0, if d min (s i )>Tc , then update D c and T c :D c =D c ∪{d min (s i )}, in For the set D c The mean, std(D c ) is the set D c The standard deviation of .

[0065] Step 4.2, use the SW test method to calculate the statistic W, the malicious value of the user query sample is:

[0066]

[0067] Among them, δ′ is the judgment threshold selected through a large number of experiments.

[0068] Step 5: Based on the detection results of the query behavior characteristics and the query sample characteristics, jointly vote to determine the query behavior type.

[0069] Step 5.1: Voting the output of step 3.3.3 and step 4.2 to get the final evaluation score X = x net +x img .

[0070] Step 5.2, the final judgment result is:

[0071]

[0072] Where δ is the judgment threshold selected through a large number of experiments.

[0073] The experimental results show that in the distributed model stealing scenario, three types of model stealing attacks, AdvPD, NPD and Syn, are carried out. The present invention is compared with two current high-level detection methods, PRADA and VarDetect. The present invention has the best comprehensive performance and can detect all types of model stealing attack behaviors without sacrificing detection speed. There is no detection failure, and the false alarm rate remains zero. The results show that compared with traditional methods, the present invention can effectively resist multiple model stealing attacks, expand the detection range, and have good detection effects.

[0074] The specific description above further illustrates the purpose, technical solutions and beneficial effects of the invention in detail. It should be understood that the above is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A classification model theft detection method integrating query behavior features, characterized by The method comprises the following steps: Step 1: extract account information to calculate similarity, perform weighted summation of similarities, perform threshold comparison, and detect whether there are multiple account users; Step 2: pre-processing the behavior data stream in the original traffic data packets corresponding to all accounts of the user, and extracting query samples based on the query behavior data stream; Step 3: Use CNN and LSTM to extract the spatiotemporal features of the query behavior data stream, use the attention map to amplify the difference between the attack behavior and the normal behavior data packets, and output the behavior malicious value. First, use the feature map to extract the attention map and perform category prediction. Then, calculate the effectiveness of the attention map based on the entropy value of the predicted category probability. Then, use the attention map to weight the feature map according to the effectiveness. Finally, classify the feature map and obtain the user behavior malicious value. Step 4: Calculate the query sample features, perform normal distribution verification, and calculate the sample feature maliciousness value; Step 5: Based on the detection results of the query behavior characteristics and the query sample characteristics, jointly vote to determine the query behavior type.

2. The classification model theft detection method integrating query behavior features according to claim 1 is characterized in that: The probability of the class predicted from the attention map output in step 3 is P att , calculate the entropy value Where i is the i-th category, C is the total number of sample categories, is the probability value of the ith category classified according to the attention map, log(·) is the logarithmic function, and the entropy value is used to calculate the effectiveness of the attention map t = 1-H(P att ) / max(P att ), where max(P att ) Function expression probability vector P att The larger the entropy value, the closer the prediction probability is, the greater the classification uncertainty, the weaker the classification ability, and the lower the effectiveness of the attention map. Finally, the attention map is used to weight the feature map according to the effectiveness, highlighting the data packet features that have a positive effect on detecting attack behaviors.

3. The classification model theft detection method integrating query behavior features according to claim 1 is characterized in that: Step 5: Voting decision is made based on the malicious value of user query behavior and the malicious value of user query samples to obtain the final result. The specific comparison method is: X=x net +x img (2) Where X is the overall user malicious evaluation value calculated after detection, x net In step 3, we get: the total number of samples used for detection is N, the number of attacks of a certain type that appears most frequently is M, the attack type obtained after the feature graph is classified is c, and the malicious value x of the user query behavior is output net =M / N; x img In step 4, we obtain: Use the SW test method to calculate the statistic W of the minimum distance distribution between samples, and make a threshold judgment on W. If it is greater than the threshold, then x img =0, if it is less than the threshold value, then x img =|W-δ′| / δ′, δ′ is the detection threshold of the user query sample detection module, and both δ′ and the overall user malicious judgment threshold δ are empirical values ​​selected through a large number of experiments. Result is the final judgment result of the classification model theft detection method. AdvPD, NPD and Syn are three types of classification model theft methods, and benign is a benign detection result.

Images