Universal countermeasure perturbation generation method and device for electromagnetic signal modulation recognition

Abstract

The present invention discloses a method and device for generating universal adversarial perturbations for electromagnetic signal modulation recognition. The method comprises: step S1, pre-training a classification model for electromagnetic signal modulation recognition; step S2, obtaining the structure and weight parameters of the classification model, randomly sampling a predetermined number of signal samples from a training set, attacking the predetermined number of signal samples one by one, and sequentially generating adversarial samples corresponding to each white-box attack algorithm; step S3, horizontally splicing the signal adversarial perturbations of different adversarial samples of the same attack algorithm to obtain a perturbation matrix for a single attack algorithm, and stacking the perturbation matrices of different attack algorithms as different channels to obtain a fused perturbation matrix; step S4, inputting the fused perturbation matrix into a pre-constructed convolutional autoencoder for training. After the training is completed, the output of the encoding layer of the convolutional autoencoder is used as the generated universal adversarial perturbation. The universal adversarial perturbation attack generated by the solution of the present invention has a higher success rate and better stability.

Description

Technical Field

[0001] The present invention relates to the field of security technology of deep learning, and in particular to a general countermeasure disturbance generation method and device applied to electromagnetic signal modulation recognition. Background Art

[0002] Since the 20th century, the rapid development of electronic information technology has led to an exponential increase in the number and variety of signals. Faced with the diverse range of signals in this new era, a variety of signal recognition methods have emerged. Furthermore, deep learning has become increasingly widely used in various fields (biomedicine, visual scenes, speech recognition, and natural language processing). Its application to modulated signal type recognition has also seen significant progress. For example, O'Shea TJ et al. studied the adaptability of convolutional neural networks to complex-valued time-domain signals and used blind temporal learning on deep convolutional neural network signal sequences to develop an effective signal classification method. Building on this previous research, O'Shea TJ et al. proposed a modulation recognition method based on a deep residual network.

[0003] As model structures become increasingly complex, the accuracy of these models continues to steadily improve. However, they remain highly vulnerable to strong adversarial environments, particularly in the communications field. Sadeghi M et al. proposed a novel approach that uses a general adversarial network to generate and transmit synthetic signals that are indistinguishable from the intended signal, thereby deceiving wireless signal classification models and significantly reducing signal classification accuracy. Kim B et al. found that increasing the number of attacking antennas significantly increases the success rate of attacks and confirmed the vulnerability of modulation classifiers to over-the-air adversarial attacks. Consequently, security issues in deep learning are becoming increasingly apparent.

[0004] As a complex system, deep learning is subject to threats from various sources. These threats primarily fall into three categories: First, model theft: hackers use technical means to illegally steal models deployed locally or on central servers. Second, data poisoning: adding anomalous data to training data causes the trained model to misclassify under certain circumstances. Third, adversarial examples: adding tiny perturbations to input samples, causing the model to misclassify with high confidence. These tiny perturbations are carefully designed through algorithms, not random perturbations. Deep learning security has become a pressing issue that we must address today.

[0005] Patent application number CN112215078A discloses a universal adversarial perturbation generation method for electromagnetic signal modulation recognition based on an autoencoder. This method uses the Deepfool white-box attack algorithm to obtain signal adversarial perturbations for a small number of samples. This method then uses the output data of the encoding layer obtained after autoencoder training as a universal adversarial perturbation to perform perturbation attacks on all signal samples. However, during the implementation of this invention, the inventors discovered that:

[0006] The attack effect of the patented method of CN112215078A is not particularly outstanding. In actual use, the adversarial samples used to generate universal adversarial perturbations are TOP-K strong attack successful samples screened out from all the adversarial samples after the attack. Therefore, the white-box attack perturbations generated from the small number of samples obtained have high quality requirements and large randomness. Moreover, since it still requires all samples to be attacked before universal adversarial perturbations can be generated, the computational complexity is not reduced, and it is not an efficient universal adversarial perturbation generation framework. At the same time, for scenarios where it is unpredictable which attack algorithm will be effective, since it only uses one white-box attack algorithm to generate universal adversarial perturbations, the stability of the universal perturbation generation method provided is not very good. Summary of the Invention

[0007] In response to the above technical problems, the present invention provides a method and device for generating universal adversarial perturbations for electromagnetic signal modulation recognition. Without the need to screen strong adversarial samples, universal adversarial perturbations can be generated relying only on a small number of signal samples. The generated universal adversarial perturbations have a higher attack success rate and better stability.

[0008] To achieve the above object, the present invention adopts the following technical solutions:

[0009] In one aspect, the present invention provides a general countermeasure perturbation generation method for electromagnetic signal modulation recognition, comprising:

[0010] Step S1, dividing the electromagnetic signal data set into a training set and a test set, and pre-training a classification model for electromagnetic signal modulation recognition;

[0011] Step S2: obtaining the structure and weight parameters of the classification model, randomly sampling a predetermined number of signal samples from the training set, and attacking the predetermined number of signal samples one by one using two or more white-box attack algorithms, and sequentially generating adversarial samples corresponding to each white-box attack algorithm;

[0012] Step S3: horizontally concatenate the signal adversarial perturbations of different adversarial samples of the same attack algorithm to obtain the perturbation matrix of the single attack algorithm, and stack the perturbation matrices of different attack algorithms as different channels to obtain a fused perturbation matrix;

[0013] In step S4, the fused perturbation matrix is input into a pre-built convolutional autoencoder for training. After the training is completed, the output of the encoding layer of the convolutional autoencoder is used as the generated universal adversarial perturbation.

[0014] In another aspect, the present invention provides a general countermeasure disturbance generation device for electromagnetic signal modulation recognition, comprising:

[0015] a classification model training unit configured to divide the electromagnetic signal data set into a training set and a test set, and pre-train a classification model for electromagnetic signal modulation recognition;

[0016] an adversarial sample generation unit for a multi-attack algorithm, configured to obtain the structure and weight parameters of the classification model, randomly sample a predetermined number of signal samples from a training set, attack the predetermined number of signal samples one by one using two or more white-box attack algorithms, and sequentially generate adversarial samples corresponding to each white-box attack algorithm;

[0017] The fusion perturbation matrix generation unit is configured to horizontally concatenate the signal adversarial perturbations of different adversarial samples of the same attack algorithm to obtain the perturbation matrix of the single attack algorithm, and to stack the perturbation matrices of different attack algorithms as different channels to obtain the fused perturbation matrix;

[0018] The universal adversarial perturbation generation unit is configured to input the fused perturbation matrix into a pre-constructed convolutional autoencoder for training, and after the training is completed, use the output of the encoding layer of the convolutional autoencoder as the generated universal adversarial perturbation.

[0019] The technical solution of the present invention can achieve the following beneficial effects:

[0020] The present invention relates to a universal adversarial perturbation generation method and device for electromagnetic signal modulation recognition. Compared with the existing scheme of generating universal adversarial perturbations using only one white-box attack algorithm, the present invention uses two or more white-box attack algorithms to attack a predetermined number of signal samples one by one, generates adversarial samples corresponding to each white-box attack algorithm in turn, horizontally splices the signal adversarial perturbations of different adversarial samples of the same attack algorithm to obtain the perturbation matrix of the single attack algorithm, stacks the perturbation matrices of different attack algorithms as different channels to obtain a fused perturbation matrix, inputs the fused perturbation matrix into a pre-constructed convolutional autoencoder for training, and after the training is completed, uses the output of the encoding layer of the convolutional autoencoder as the generated universal adversarial perturbation. It can be seen from this that the present invention integrates two or more white-box multiple attack algorithms, can generate universal adversarial perturbations with only a small number of signal samples, and without screening strong adversarial samples, effectively reducing computational consumption while providing a higher attack success rate. At the same time, for scenarios where it is unpredictable which attack algorithm will work, a more stable fused universal perturbation generation method is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A flowchart of a general countermeasure disturbance generation method for electromagnetic signal modulation recognition provided by the present invention;

[0023] Figure 2 A general framework diagram for generating countermeasures against disturbances provided by the present invention;

[0024] Figure 3 A line chart comparing the loss of classification accuracy of general adversarial perturbations for various attack algorithms provided by the present invention, where the horizontal axis represents the perturbation intensity and the vertical axis represents the loss of classification accuracy.

[0025] Figure 4 This is a structural block diagram of a universal countermeasure disturbance generation device for electromagnetic signal modulation recognition provided by the present invention. DETAILED DESCRIPTION

[0026] The present invention is described below in detail using the radio modulation recognition task as an example, using the accompanying drawings and the modulation signal dataset RML2016.10A. The embodiments listed herein are intended only to illustrate the present invention and are not intended to limit its scope. Any obvious modifications or variations to the present invention do not depart from the spirit and scope of the present invention.

[0027] Figure 1 The flowchart of the general countermeasure disturbance generation method for electromagnetic signal modulation recognition provided by the present invention is as follows. Figure 1 As shown, the general anti-disturbance generation method provided by the present invention includes the following steps:

[0028] Step S1: Divide the electromagnetic signal data set into a training set and a test set, and pre-train a classification model for electromagnetic signal modulation recognition.

[0029] For the modulated signal dataset RML2016.10A, the classification model used in this paper is 1D_Resnet, whose structure mainly includes convolutional layers, pooling layers, and fully connected layers. The IQ electromagnetic signal sample dataset includes: signal length L and the I and Q values corresponding to each time point.

[0030] To train the classification model, the electromagnetic signal dataset is divided into a training set and a test set. The training set is used to train the classification model to identify electromagnetic signal modulation types, and the test set is used to test the classification model's training results. The criterion for a well-trained classification model is that it can accurately predict the output of the signals in the dataset.

[0031] Step S2: obtain the structure and weight parameters of the classification model, randomly sample a predetermined number of signal samples from the training set, use two or more white-box attack algorithms to attack the predetermined number of signal samples one by one, and generate adversarial samples corresponding to each white-box attack algorithm in turn.

[0032] Figure 2 This is a general framework diagram for generating anti-perturbations provided by the present invention. Figure 2 In this step S2, N signal samples are randomly sampled from the training set, and corresponding adversarial samples are generated in sequence using S white-box attack algorithms for the sampled N signal samples, and the adversarial perturbations {p1,...,p i ,...,p N}, where p∈R L×2 , the number of generated adversarial samples is: N×S.

[0033] Step S3: horizontally splice the signal adversarial perturbations of different adversarial samples of the same attack algorithm to obtain the perturbation matrix of the single attack algorithm, and stack the perturbation matrices of different attack algorithms as different channels to obtain the fused perturbation matrix.

[0034] This step S3 specifically includes:

[0035] Step S3.1: Horizontally concatenate the adversarial perturbations of the same attack algorithm to obtain the perturbation matrix m∈R of the single attack algorithm L ×2N ;

[0036] Step S3.2: Stack the perturbation matrices of S different attack algorithms as different channels to obtain the fused perturbation matrix M∈R L×2N×S .

[0037] In step S4, the fused perturbation matrix is input into the pre-built convolutional autoencoder for training. After the training is completed, the output of the encoding layer of the convolutional autoencoder is used as the generated universal adversarial perturbation.

[0038] This step S4 specifically includes:

[0039] Step S4.1: Use the structure of a convolutional autoencoder. Its encoder structure consists of two two-dimensional convolutional layers and two maximum pooling layers. Its decoding layer consists of two deconvolutional layers and two upsampling layers. At the same time, set the dimension of the encoding layer output to be consistent with the dimension of the single signal anti-perturbation. Input the signal perturbation matrix into the autoencoder for training, where the loss function is defined as given the input space x∈R L×2N×S , feature space h∈R L×2 And the output space x'∈R L×2N×S , the convolutional autoencoder minimizes the reconstruction error of the input features by solving the mapping f and g of the encoding layer and the decoding layer, that is,

[0040] h=f(x)

[0041] x'=g(h)

[0042] Loss=min‖xg(f(x))‖2

[0043] Step S4.2: After training, the output of the encoding layer is used as the universal adversarial perturbation p * ∈R L×2 .

[0044] The beneficial effects of the present invention are as follows:

[0045] In scenarios where universal adversarial perturbations are generated with a small number of samples, existing methods generally have poor attack effects and require prioritizing high-quality TOP-K strong adversarial perturbations for generating universal adversarial perturbations. These conditions are relatively harsh, and the universal adversarial perturbation can only be generated after attacking all samples. The computational complexity is not reduced, and it is not an efficient universal adversarial perturbation generation framework. The universal adversarial perturbation generation method provided by the present invention integrates two or more white-box attack algorithms, relying only on a small number of signal samples without screening strong adversarial samples to generate universal adversarial perturbations. This effectively reduces computational cost while providing a higher attack success rate. Furthermore, for scenarios where it is unpredictable which attack algorithm will be effective, a more stable fusion universal perturbation generation method is provided.

[0046] The following combination Figure 2 , the general anti-disturbance generation method provided by the present invention is further illustrated.

[0047] For the modulation signal dataset RML2016.10A, the IQ electromagnetic signal sample dataset includes: signal length L=128 and I and Q values corresponding to each time point.

[0048] Randomly sample N = 36 signal samples from the training set, and use S = 3 white-box attack algorithms (FGSM, PGD, and DeepFool) to generate corresponding adversarial samples for the sampled signal samples in turn. Since there are 128 sampling points, each sampling point has two values, I and Q, the corresponding single signal adversarial perturbations {p1, ..., p i ,...,p N＝36}, where p∈R 128×2 .

[0049] Horizontally concatenate the adversarial perturbations of the same attack algorithm to obtain the perturbation matrix m∈R of the single attack algorithm 128×72 .

[0050] The perturbation matrices of the three different attack algorithms are stacked as different channels to obtain the fused perturbation matrix M∈R 128 ×72×3 .

[0051] A convolutional autoencoder structure is used. Its encoder structure consists of two two-dimensional convolutional layers and two maximum pooling layers. Its decoding layer consists of two deconvolutional layers and two upsampling layers. At the same time, the dimension of the encoding layer output is set to be consistent with the dimension of the single signal anti-perturbation. The signal perturbation matrix is input into the autoencoder for training, where the loss function is defined as given input space x∈R 128×72×3 , feature space h∈R 128×2 And the output space x'∈R 128×72×3 , the convolutional autoencoder minimizes the reconstruction error of the input features by solving the mapping f and g of the encoding layer and the decoding layer, that is,

[0052] h=f(x)

[0053] x'=g(h)

[0054] Loss=min‖xg(f(x))‖2

[0055] After training, the output of the encoding layer is used as the universal adversarial perturbation p * ∈R 128×2 .

[0056] In a preferred embodiment of the present invention, see Figure 1 , the method of the present invention further comprises:

[0057] Step S5: Perform a performance test on the generated universal adversarial perturbation to obtain the classification accuracy loss of the universal adversarial perturbation.

[0058] Step S5 specifically includes:

[0059] All signal samples in the test set are input into the classification model to obtain the original classification accuracy of the classification model; universal adversarial perturbations are added to the correctly classified signal samples, and then all signal samples in the test set are input into the classification model again to obtain the classification accuracy of the classification model after adding universal adversarial perturbations; the original classification accuracy of the classification model is subtracted from the classification accuracy after adding universal adversarial perturbations to obtain the classification accuracy difference of the classification model, and then the classification accuracy difference of the classification model is divided by the original classification accuracy to obtain the classification accuracy loss of universal adversarial perturbations.

[0060] The greater the classification accuracy loss, the better the performance of the generated universal adversarial perturbation. According to the classification accuracy loss of the universal adversarial perturbation, the performance of different white-box attack algorithms can be conveniently evaluated.

[0061] Figure 3 A line comparison chart of the classification accuracy loss of the general adversarial perturbations of the various attack algorithms provided by the present invention, wherein the horizontal axis is the magnitude of the perturbation intensity and the vertical axis is the classification accuracy loss. It can be understood that the larger the vertical axis, the better the attack effect of the attack algorithm under the perturbation amount. Among them: the legend AE_deepfool is the effect of the general adversarial perturbation generated by the patented method with application number CN112215078A, the legends Deepfool, FGSM and PGD are the effects of the general adversarial perturbations generated using a single white box attack algorithm, and the legends Deepfool+FGSM, FGSM+PGD, Deepfool+PGD and Deepfool+FGSM+PGD are the effects of the general adversarial perturbations generated using two or more white box attack algorithms.

[0062] according to Figure 3 It can be found that: even though the patented method of CN112215078A screened the strong adversarial perturbation samples of TOP-36 for use in generating universal adversarial perturbations, the effect of causing the model to misclassify is not better than the effect of the model classification accuracy reduction caused by all the universal adversarial perturbations generated by randomly selecting samples under the framework of this method. For the attack algorithm, the lower the classification accuracy of the model after the attack, that is, the greater the loss of classification accuracy, the better the attack effect, which can effectively verify the effectiveness of the method described in the present invention. At the same time, it can also be found that the fused universal adversarial perturbation may have a general effect when the perturbation amount is small, but when the perturbation amount increases, its perturbation effect grows rapidly. In addition, the fusion of Deepfool with FGSM and PGD respectively will lead to a decline in the attack effect, but when the three attack algorithms are fused, there is a certain compensatory effect, which is more suitable for actual attack scenarios where it is unclear which attack algorithm can work.

[0063] It should be noted that according to the experimental results, the fusion effect of the two white-box attack algorithms FGSM+PGD is the best, while the fusion effect of the three white-box attack algorithms Deepfool+FGSM+PGD is not the best. There is no actual theoretical basis for the coupling effect between the attack algorithms, and currently it can only be summarized based on experimental attempts.

[0064] The present invention also provides a universal anti-disturbance generation device, which has the same technical concept as the aforementioned universal anti-disturbance generation method. Figure 4 For a structural block diagram of a general countermeasure disturbance generation device for electromagnetic signal modulation recognition provided by the present invention, see Figure 4 The universal anti-disturbance generating device of the present invention comprises:

[0065] The classification model training unit 410 is configured to divide the electromagnetic signal data set into a training set and a test set, and pre-train a classification model for electromagnetic signal modulation recognition;

[0066] The adversarial sample generation unit 420 is configured to obtain the structure and weight parameters of the classification model, randomly sample a predetermined number of signal samples from the training set, and attack the predetermined number of signal samples one by one using two or more white-box attack algorithms to sequentially generate adversarial samples corresponding to each white-box attack algorithm;

[0067] The fused perturbation matrix generation unit 430 is configured to horizontally concatenate the signal adversarial perturbations of different adversarial samples of the same attack algorithm to obtain a perturbation matrix of the single attack algorithm, and stack the perturbation matrices of different attack algorithms as different channels to obtain a fused perturbation matrix;

[0068] The universal adversarial perturbation generation unit 440 is configured to input the fused perturbation matrix into a pre-constructed convolutional autoencoder for training, and after the training is completed, use the output of the encoding layer of the convolutional autoencoder as the generated universal adversarial perturbation.

[0069] In one embodiment of the present invention, see Figure 4 The general anti-disturbance generating device of the present invention may further include:

[0070] The performance testing unit 450 is configured to perform a performance test on the generated universal adversarial perturbation to obtain the classification accuracy loss of the universal adversarial perturbation.

[0071] In one embodiment of the present invention, the performance testing unit 450 is specifically configured to:

[0072] Inputting all signal samples in the test set into the classification model to obtain the original classification accuracy of the classification model;

[0073] Adding the universal adversarial perturbation to correctly classified signal samples, then re-inputting all signal samples in the test set into the classification model to obtain the classification accuracy of the classification model after adding the universal adversarial perturbation;

[0074] The original classification accuracy of the classification model is subtracted from the classification accuracy after adding the universal adversarial perturbation to obtain the classification accuracy difference of the classification model, and then the classification accuracy difference of the classification model is divided by the original classification accuracy to obtain the classification accuracy loss of the universal adversarial perturbation.

[0075] Among them, the greater the classification accuracy loss, the better the performance of the generated universal adversarial perturbation.

[0076] In one embodiment of the present invention, the general anti-disturbance generation unit 440 is specifically configured to:

[0077] The structure and loss function of a convolutional autoencoder are constructed, wherein the encoder structure includes two two-dimensional convolutional layers and two maximum pooling layers, the decoding layer includes two deconvolutional layers and two upsampling layers, and the loss function is a given input control and feature space. At the same time, the dimension of the encoding layer output is set to be consistent with the dimension of the single signal adversarial perturbation; the fused perturbation matrix is input into the convolutional autoencoder for training, and the convolutional autoencoder minimizes the reconstruction error of the input features by solving the mapping between the encoding layer and the decoding layer; after the training is completed, the output of the encoding layer is used as the generated universal adversarial perturbation.

[0078] In one embodiment of the present invention, the adversarial example generation unit 420 is specifically configured to:

[0079] Three gradient-based white-box attack algorithms, Deepfool, FGSM, and PGD, are used to attack a predetermined number of sampled signal samples one by one, and adversarial samples corresponding to the three white-box attack algorithms are generated in turn.

[0080] The implementation of each unit in the universal anti-disturbance generation device of the present invention can refer to the corresponding steps of the aforementioned universal anti-disturbance generation method, which will not be repeated here.

[0081] In summary, the general anti-disturbance generation method and device provided by the present invention have the following technical effects:

[0082] Compared with the existing general adversarial perturbation generation method, the scheme disclosed in the present invention shows a higher attack success rate. In addition, when randomly selecting samples, the method of the present invention does not need to screen strong adversarial perturbations, and is more practical.

[0083] It should be understood that although this specification is described in terms of implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0084] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or equivalent substitutions that can be easily conceived by a technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of the claims of the present invention.

Claims

1. A general adversarial perturbation generation method for electromagnetic signal modulation recognition, characterized in that: include: Step S1, dividing the electromagnetic signal data set into a training set and a test set, and pre-training a classification model for electromagnetic signal modulation recognition; Step S2: obtaining the structure and weight parameters of the classification model, randomly sampling a predetermined number of signal samples from the training set, attacking the predetermined number of signal samples one by one, and sequentially generating adversarial samples corresponding to each white-box attack algorithm; Step S3: horizontally concatenate the signal adversarial perturbations of different adversarial samples of the same attack algorithm to obtain the perturbation matrix of the single attack algorithm, and stack the perturbation matrices of different attack algorithms as different channels to obtain a fused perturbation matrix; In step S4, the fused perturbation matrix is input into a pre-built convolutional autoencoder for training. After the training is completed, the output of the encoding layer of the convolutional autoencoder is used as the generated universal adversarial perturbation.

2. The method according to claim 1, characterized in that The method further comprises: Step S5: Perform a performance test on the generated universal adversarial perturbation to obtain the classification accuracy loss of the universal adversarial perturbation.

3. The method according to claim 2, characterized in that The step S5 specifically includes: Inputting all signal samples in the test set into the classification model to obtain the original classification accuracy of the classification model; Adding the universal adversarial perturbation to correctly classified signal samples, then re-inputting all signal samples in the test set into the classification model to obtain the classification accuracy of the classification model after adding the universal adversarial perturbation; The original classification accuracy of the classification model is subtracted from the classification accuracy after adding the universal adversarial perturbation to obtain the classification accuracy difference of the classification model, and then the classification accuracy difference of the classification model is divided by the original classification accuracy to obtain the classification accuracy loss of the universal adversarial perturbation.

4. The method according to claim 1, wherein The step S4 specifically includes: Construct the structure and loss function of a convolutional autoencoder. The encoder structure consists of two two-dimensional convolutional layers and two maximum pooling layers, and the decoding layer consists of two deconvolutional layers and two upsampling layers. The dimension of the encoding layer output is set to be consistent with the dimension of the single signal anti-perturbation. The signal perturbation matrix is input into the autoencoder for training. The loss function is defined as a given input control and feature space. The convolutional autoencoder minimizes the reconstruction error of the input features by solving the mapping between the encoding layer and the decoding layer. After training is completed, the output of the encoding layer is used as the generated universal adversarial perturbation.

5. The method according to any one of claims 1 to 4, characterized in that In step S2, two or more white-box attack algorithms are used to attack the predetermined number of signal samples one by one, and adversarial samples corresponding to each white-box attack algorithm are generated in sequence, specifically: Three gradient-based white-box attack algorithms, Deepfool, FGSM, and PGD, are used to attack a predetermined number of sampled signal samples one by one, and adversarial samples corresponding to the three white-box attack algorithms are generated in turn.

6. A general countermeasure disturbance generation device for electromagnetic signal modulation recognition, characterized in that: include: a classification model training unit configured to divide the electromagnetic signal data set into a training set and a test set, and pre-train a classification model for electromagnetic signal modulation recognition; an adversarial sample generation unit configured to obtain the structure and weight parameters of the classification model, randomly sample a predetermined number of signal samples from a training set, attack the predetermined number of signal samples one by one using two or more white-box attack algorithms, and sequentially generate adversarial samples corresponding to each white-box attack algorithm; The fusion perturbation matrix generation unit is configured to horizontally concatenate the signal adversarial perturbations of different adversarial samples of the same attack algorithm to obtain the perturbation matrix of a single attack algorithm, and to stack the perturbation matrices of different attack algorithms as different channels to obtain a fused perturbation matrix; The universal adversarial perturbation generation unit is configured to input the fused perturbation matrix into a pre-constructed convolutional autoencoder for training, and after the training is completed, use the output of the encoding layer of the convolutional autoencoder as the generated universal adversarial perturbation.

7. The device according to claim 6, characterized in that The device further comprises: The performance testing unit is configured to perform a performance test on the generated universal adversarial perturbation to obtain the classification accuracy loss of the universal adversarial perturbation.

8. The device according to claim 7, characterized in that The performance testing unit is specifically configured as follows: Inputting all signal samples in the test set into the classification model to obtain the original classification accuracy of the classification model; Adding the universal adversarial perturbation to correctly classified signal samples, then re-inputting all signal samples in the test set into the classification model to obtain the classification accuracy of the classification model after adding the universal adversarial perturbation; The original classification accuracy of the classification model is subtracted from the classification accuracy after adding the universal adversarial perturbation to obtain the classification accuracy difference of the classification model, and then the classification accuracy difference of the classification model is divided by the original classification accuracy to obtain the classification accuracy loss of the universal adversarial perturbation.

9. The device according to claim 6, characterized in that The general anti-disturbance generation unit is specifically configured as follows: Construct the structure and loss function of a convolutional autoencoder. The encoder structure consists of two 2D convolutional layers and two max pooling layers. The decoding layer consists of two deconvolutional layers and two upsampling layers. The loss function is a given input control and feature space. The dimension of the encoding layer output is set to be consistent with the dimension of the single signal adversarial perturbation. Inputting the fused perturbation matrix into the convolutional autoencoder for training, the convolutional autoencoder minimizes the reconstruction error of the input features by solving the mapping between the encoding layer and the decoding layer; After training is completed, the output of the encoding layer is used as the generated universal adversarial perturbation.

10. The device according to any one of claims 6 to 9, characterized in that: The adversarial sample generation unit is specifically configured as follows: Three gradient-based white-box attack algorithms, Deepfool, FGSM, and PGD, are used to attack a predetermined number of sampled signal samples one by one, and adversarial samples corresponding to the three white-box attack algorithms are generated in turn.

Images