An adversarial example generation method, device, and computer-readable storage medium

Abstract

The present invention belongs to the field of network security technology, and provides an adversarial sample generation method, device, and computer-readable storage medium. Training data for building a time series anomaly detection model is obtained based on industrial time series data; the time series anomaly detection model is trained using the training data and the true training prediction values as input time series data; through the trained time series anomaly detection model, the model training prediction values are calculated according to the test data, and the anomaly scores between the true test prediction values are calculated. According to the data distribution of the anomaly scores, the probability threshold is determined through the Gaussian distribution anomaly detection algorithm; variable perturbation calculation is performed on the test data based on the time series anomaly detection model, and the perturbation is added to the test data to generate corresponding time series adversarial samples. This method uses an attack method with variable perturbation to attack the model and generate corresponding time series adversarial samples, which has a small perturbation amplitude and smooth time series data while ensuring the attackability.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular, to an adversarial sample generation method, apparatus, and medium. Background Art

[0002] The integration of information technology (IT) and operational technology (OT) is an important trend in the development of modern industrial systems. IT has long been used to manage business operations, while OT has traditionally been used to control and monitor industrial processes. However, the growing demand for real-time data processing, machine learning, and artificial intelligence (AI) in industrial systems has given rise to the need for IT and OT integration, thus resulting in the industrial Internet of Things (IIoT). The IIoT enables devices on the production line to be interconnected to form an automated production process, thereby improving productivity and quality.

[0003] With the development of the industrial Internet of Things, the OT system, which was originally in a physically isolated state, faces various threats. Therefore, in the IIoT, ensuring system security is crucial for ensuring the reliable operation of the system. Any failure of these components may have significant consequences, including equipment damage, safety accidents, economic losses, and even threats to human life.

[0004] In recent years, the use of deep learning models for anomaly detection in the industrial Internet of Things has become increasingly popular, which ensures the security of industrial systems. However, these models are vulnerable to adversarial attacks, which are deliberately calculated by attackers to evade detection or cause system failures, thereby compromising the functional safety and information security of the cyber-physical system (CPS). One such adversarial attack is the temporal adversarial attack, which refers to generating temporal sequence adversarial samples by adding perturbations to the input time series, thereby causing subtle changes in the sequence data and evading the detection of anomaly detection models.

[0005] The paper "Anthi E, Williams L, Rhode M, et al. Adversarial attacks on machine learning cybersecurity defences in industrial control systems[J]. Journal of Information Security and Applications, 2021, 58: 102717." proposed a method for generating adversarial samples with a saliency map based on the Jacobian matrix. This method first calculates the Jacobian determinant of the entire neural network function with respect to the input, and then uses the Jacobian determinant to calculate the saliency map, identifying the correlation ranking between the features of the input data and the model's decision. Finally, it is determined whether the added noise causes the target model to misclassify. If the noise does not affect the performance of the model, another set of features is selected and a new iteration is carried out until a saliency map that can be used to generate adversarial samples appears, achieving the generation of adversarial samples.

[0006] The paper "Wu T, Wang X, Qiao S, et al. Small perturbations are enough: Adversarial attacks on time series prediction[J]. Information Sciences, 2022, 587: 794 - 812." proposed an adversarial attack against time series prediction. This method creates an adversarial time series according to the importance scale to slightly disrupt the original data, and uses the gradient information of the prediction model to propose a perturbation-based adversarial sample generation algorithm.

[0007] The paper "Anthi E, Williams L, Rhode M, et al. Adversarial attacks on machine learning cybersecurity defences in industrial control systems[J]. Journal of Information Security and Applications, 2021, 58: 102717." although generates adversarial samples for industrial control networks by using the Jacobian matrix and improves the security and robustness of the target supervised model through adversarial training. However, this method does not consider the temporal relationship existing in the data when using traditional public datasets, so this method does not consider the temporal characteristics of industrial scenarios when generating adversarial samples.

[0008] The paper "Wu T, Wang X, Qiao S, et al. Small perturbations are enough: Adversarial attacks on time series prediction [J]. Information Sciences, 2022, 587: 794-812." uses the gradient information of the prediction model and the importance measurement to create adversarial time series and generate time series adversarial samples with small perturbations. However, for the time series adversarial samples with small perturbations, the article does not take into account the characteristics of industrial data and the smoothness of the time series data.

[0009] In summary, the existing time-series adversarial sample generation methods have problems such as one-sided considerations and overly single scenarios, which makes them difficult to be used in industrial control networks and have low practicality. Summary of the Invention

[0010] This paper proposes a method, device, and medium for generating adversarial samples for industrial time series anomaly detection systems. This method exploits the fixed polling period, highly predictable time series data, and noise sensitivity of industrial scenarios to launch adversarial sample attacks against these systems.

[0011] The technical solutions of the present invention are as follows:

[0012] A method for generating adversarial samples includes the following steps:

[0013] Step 1: Obtain training data for building a time series anomaly detection model based on industrial time series data;

[0014] Step 2: Use training data x train and the true training label y train Use time series data as input to train the time series anomaly detection model;

[0015] Step 3: Use the time series anomaly detection model trained in step 2 to detect the test data x test Calculate model test predictions And calculate the true test label y test According to the data distribution of the anomaly scores, the probability threshold ∈ is determined by the Gaussian distribution anomaly detection algorithm;

[0016] Step 4: Based on the trained time series anomaly detection model and probability threshold ∈, the test data x test Perform variable perturbation calculation and add perturbation to the test data x test Generate corresponding temporal adversarial samples.

[0017] The step 1 is specifically as follows:

[0018] Step 1.1: Extract the time-series sensor data and corresponding labels from the industrial time-series data, and perform standardization and normalization processing on the time-series sensor data;

[0019] Step 1.2: Query and fill the missing values in the data obtained in Step 1.1 with 0;

[0020] Step 1.3: Set the sliding window size w x , and perform time-series processing on the data in Step 1.2 to obtain the training data x train , the true training label y train , the test data x test , the true test label y test , and the anomaly classification label y label .

[0021] The time-series anomaly detection model is based on the long short-term memory neural network (LSTM network). The LSTM network includes multiple neurons, and each neuron includes a forget gate, an input gate, and an output gate.

[0022] The specific content of Step 2 is as follows:

[0023] Step 2.1: Determine the information retained during the training process of the time-series anomaly detection model through the forget gate. The calculation formula is as follows:

[0024] f t = sigmoid(W f ·[h t-1 , x t +b f )

[0025] where w f is the weight matrix of the forget gate, [h t-1 , x t represents the connection between the gate output and the neuron output, b f represents the bias value of the forget gate, and f t represents the state of the forget gate, which determines the proportion of the neuron state at time t-1 retained to the neuron state at time t;

[0026] Step 2.2: Update the neuron state of the time-series anomaly detection model through the input gate. The calculation formula is as follows:

[0027] i t = sigmoid(W i ·[h t-1 , x t +b i )

[0028] C t = tanh(WC ·[h t-1 , x t + b C )

[0029] Among them, i t represents the state of the input gate, and C t represents the output value of the input gate of the timing anomaly detection model; W i , b i respectively represent the weight matrix and bias value passed into the sigmoid function calculation in the input gate; W C , b C respectively represent the weight matrix and bias value passed into the tanh function calculation in the input gate;

[0030] Step 2.3: Determine the value of the neuron state of the timing anomaly detection model through the output gate and perform iterative training. The calculation formula is as follows:

[0031] h t = sigmoid(W o ·[h t-1 , x t + b o ) ⊙ tanh(C t o )

[0032] Among them, ⊙ represents dot product, and h t represents the neuron state output by the output gate of the timing anomaly detection model; W o , b o represent the weight matrix and bias value of the output gate;

[0033] Step 2.4: Minimize the loss function through the gradient descent algorithm to make the timing anomaly detection model converge, and obtain the trained timing anomaly detection model. The loss function formula is as follows:

[0034]

[0035] Among them, represents the predicted value of model training, and y train represents the true training label.

[0036] The abnormal score is calculated through the Gaussian distribution. The specific steps include:

[0037] Step 3.1: Use the difference between the predicted value of model testing and the true testing label y test as the variable of the Gaussian distribution anomaly detection algorithm:

[0038]

[0039] Step 3.2: Calculate the mean μ and standard deviation σ of the difference err;

[0040]

[0041]

[0042] where m represents the dimension of the difference err data;

[0043] In Step 3.3, when performing outlier data point detection on the test data x test bring the difference into the following equation to calculate the outlier score:

[0044]

[0045] Step 3.4: Use the Gaussian distribution outlier detection algorithm, set the probability threshold ∈ according to the outlier score distribution. When AnomalyScore < ∈, regard the corresponding data point as an outlier sample.

[0046] The specific steps of Step 4 include:

[0047] Step 4.1: According to the trained time series outlier detection model, calculate the attack direction direction in the gradient attack method;

[0048]

[0049] where sign is the sign function, L is the loss function of the trained time series outlier detection model, represents calculating the gradient with the test data x test as the independent variable, and θ represents the weight parameter of the trained time series outlier detection model;

[0050] Step 4.2: Calculate the perturbation r = ∈·direction. In order to make the amplitude of each data dimension in the data different under the attack to achieve the effect of reducing the perturbation amplitude, construct an objective function with ∈ as the variable, and sort the importance of each single data dimension with a window size of w test in the test data x x and calculate the perturbation:

[0051] p = (f(x) - f(x + r))

[0052] where f(x) represents the output of the trained time series outlier detection model;

[0053] Step 4.3: Add a regularization penalty term of L2 norm to the calculated perturbation to limit the total amount of perturbation; in order to ensure that the generated time series adversarial samples are smooth with the waveform of the model training prediction value add a ridge regression penalty term to generate adversarial samples:

[0054]

[0055] Among them, ||·||2 represents the L2 norm, γ is a hyperparameter that controls the scale of perturbation generation, and α and λ are the hyperparameters that control the ||∈||2 regularization and the ridge regression penalty term, respectively;

[0056] Step 4.4: Use the gradient descent method to solve the adversarial samples, and obtain the time-series adversarial samples for industrial scenarios generated by the variable perturbation method;

[0057] x attack = ∈ * ·direction + x test

[0058] Step 4.5: Use the trained time-series anomaly detection model to predict the time-series adversarial sample x attack Calculate the number and proportion of data points where the predicted value of the original data is less than the threshold and the predicted value of the adversarial sample is greater than the threshold, so as to represent the proportion of the number of samples where the adversarial sample attack is successful in the total samples.

[0059] An adversarial sample generation device, comprising:

[0060] A network module, configured to capture industrial time-series data;

[0061] A memory, configured to store the captured industrial time-series data and computer programs;

[0062] A processor, configured to execute the computer programs stored in the memory. When the computer programs are executed, the processor is configured to:

[0063] Construct the industrial time-series data into training data for the time-series anomaly detection model;

[0064] Use the training data x train and the true training label y train as input time-series data to train the time-series anomaly detection model;

[0065] According to the trained time-series anomaly detection model and the test data x test calculate the model test prediction value and calculate the anomaly score between it and the true test label y test According to the data distribution of the anomaly scores, determine the probability threshold ∈ through the Gaussian distribution anomaly detection algorithm;

[0066] Perform variable perturbation calculation on the trained time-series anomaly detection model and the probability threshold ∈ for the test data x test Add the perturbation to the test data xtest to generate corresponding temporal adversarial examples x attack 。

[0067] The processor includes a data processing module. The data processing module extracts temporal sensor data and corresponding labels from industrial temporal data, performs standardization and normalization processing on the temporal sensor data; queries and fills missing values in the standardized and normalized temporal sensor data with 0; sets the sliding window size w x to perform temporal processing on the data after querying and filling with 0, obtaining training data x train true training labels y train test data x test true test labels y test abnormal classification labels y label 。

[0068] The temporal anomaly detection model is based on an LSTM network. The LSTM network includes multiple neurons, and each neuron includes a forget gate, an input gate, and an output gate.

[0069] A computer-readable storage medium stores a computer program, and the computer program can be executed by a processor to implement an adversarial example generation method.

[0070] Advantages of the present invention: A temporal adversarial example attack method for industrial control networks is proposed. Through variable perturbation calculation, the adversarial examples can maintain good attack effects with only a small perturbation added, preventing the adversarial examples from being recognized and cleaned as noise by industrial systems and improving the success rate of attacks:

[0071] (1) Use a long short-term memory neural network to predict industrial control network data, making full use of the strong temporal characteristics of industrial data.

[0072] (2) Use the predicted values and true values of the model as independent variables, and use an anomaly detection algorithm with a Gaussian distribution to build a security baseline, fitting the characteristic that the number of normal data in industrial data is much higher than that of abnormal data.

[0073] (3) Use an attack method with variable perturbations to attack the model, generating corresponding temporal adversarial examples. On the premise of ensuring the attack ability, the perturbation amplitude is small and the temporal data is smooth. Description of the Drawings

[0074] Figure 1 is a flowchart of the temporal adversarial example generation method;

[0075] Figure 2(a) is a waveform diagram of LIT101 training data;

[0076] Figure 2(b) is a waveform diagram of LIT101 test data;

[0077] Figure 3(a) is the waveform diagram of DPIT301 training data;

[0078] Figure 3(b) is the waveform diagram of DPIT301 test data;

[0079] Figure 4(a) is the waveform diagram of LIT301 training data;

[0080] Figure 4(b) is the waveform diagram of LIT301 test data;

[0081] Figure 5 It is the waveform comparison between the adversarial samples generated by using the algorithm VPGM of the present invention and the true test prediction values based on LIT101 data;

[0082] Figure 6 It is the comparison between the anomaly scores of the adversarial samples generated by using the algorithm VPGM of the present invention and the anomaly scores of the true test prediction values generated based on LIT101 data;

[0083] Figure 7(a) is the waveform of the true data of LIT101;

[0084] Figure 7(b) is the waveform comparison between the true data waveform of LIT101 and the waveform of the adversarial samples generated by the algorithm VPGM of the present invention when γ = 0.5;

[0085] Figure 7(c) is the waveform comparison between the true data waveform of LIT101 and the waveform of the adversarial samples when γ = 1;

[0086] Figure 7(d) is the waveform comparison between the true data waveform of LIT101 and the waveform of the adversarial samples when γ = 1.5;

[0087] Figure 7(e) is the waveform comparison between the true data waveform of LIT101 and the waveform of the adversarial samples when γ = 2;

[0088] Figure 7(f) is the waveform comparison between the true data waveform of LIT101 and the waveforms of the adversarial samples generated by the classical adversarial sample algorithms FGSM, BIM, and PGD;

[0089] Figure 8 It is a schematic diagram of the adversarial sample generation device. Detailed implementation manners

[0090] The following further describes in detail the specific implementation manners of the present invention in conjunction with the accompanying drawings and examples.

[0091] (1) The present invention uses three groups of data, namely "LIT101", "LIT301", and "DPIT301", with strong time-series characteristics in the safe water treatment system dataset, which fully reflects the time-series characteristics in the industrial scenario. (2) The present invention constructs a time-series anomaly detection model, uses the anomaly score to build a safety baseline, and simulates the protection means in the industrial scenario. (3) When generating time-series adversarial samples, by quantifying the perturbation variable and using an iterative method to calculate the gradient multiple times, it is ensured that the sample is modified to the minimum extent on the premise of achieving the attack effect, while ensuring the smoothness of the adversarial sample.

[0092] This example uses three groups of data, namely "LIT101", "LIT301", and "DPIT301", in the publicly available safe water treatment system dataset. By modifying the sensor value size, attack behaviors such as water level rise, water supply function damage, sensor damage, and system crash are achieved. The specific sensor data distribution is shown in Figures 2 - 4. An adversarial sample generation method is as Figure 1 shown, and the steps are as follows:

[0093] Step 1: Obtain the training data for building the time-series anomaly detection model according to the industrial time-series data. The specific steps are as follows:

[0094] Step 1.1: Extract the time-series sensor data and corresponding labels from the industrial time-series data, and perform standardization and normalization processing on the time-series sensor data. The calculation formulas are as follows.

[0095]

[0096]

[0097] Step 1.2: Query and fill the missing values in the data obtained in Step 1.1 with 0;

[0098] Step 1.3: Set the sliding window size w x , perform time-series processing on the data in Step 1.2, and obtain the training data x train , the true training label y train , the test data x test , the true test label y test , and the anomaly classification label y label ;

[0099] Step 2: Use the training data and training prediction values as the input time-series data to train the time-series anomaly detection model. Use a long short-term memory network with (20, 128, 128), and use a dropout module with 0.01 to ensure the correct fitting of the model training. The specific idea of this step is;

[0100] Step 2.1: Use the forgetting gate to determine the information retained during the training process of the neural network model. The calculation formula is as follows:

[0101] f t = σ(W f · [h t-1 , x t + b f )

[0102] where w f is the weight matrix of the forget gate, [h t-1 , x t represents the connection between the gate output and the neuron output, and b f represents the bias value of the forget gate. σ represents the sigmoid function.

[0103] Step 2.2: Update the neuron state of the neural network model using the input gate. The calculation formula is as follows:

[0104] i t = σ(W i · [h t-1 , x t + b i )

[0105] C t = tanh(W C · [h t-1 , x t + b C )

[0106] where C t represents the output value of the input gate of the neural network model; W i , b i represent the weight matrix and bias value passed into the sigmoid function in the input gate; W C , b C represent the weight matrix and bias value passed into the tanh function in the input gate.

[0107] Step 2.3: Determine the value of the neuron state of the neural network model using the output gate and perform iterative training. The calculation formula is as follows:

[0108] h t = σ(W o · [h t-1 , x t + b o ) ⊙ tanh(C t )

[0109] where ⊙ represents dot product, and h t represents the neuron state output by the output gate of the neural network model; W o , b o represent the weight matrix and bias value of the output gate.

[0110] Step 2.4: Minimize the loss function through the gradient descent algorithm to make the neural network model M converge, and finally obtain the time series prediction model. The formula of the loss function is as follows:

[0111]

[0112] where, represents the predicted value of model training, and y train represents the true training label;

[0113] Step 3: Calculate the anomaly score using the above time series anomaly detection model, and establish a safety baseline using the Gaussian distribution. The specific steps include:

[0114] Step 3.1: Use the predicted value of model testing and the difference from the true test label y test as the variable of the Gaussian distribution anomaly detection algorithm:

[0115]

[0116] Step 3.2: Then calculate the mean μ and standard deviation σ of the difference.

[0117]

[0118]

[0119] Step 3.3: When it is necessary to detect abnormal data points in the sample, substitute the difference into the equation to calculate the anomaly score:

[0120]

[0121] Step 3.4: Use the Gaussian distribution anomaly detection algorithm to set the probability threshold ∈ according to the anomaly score. When AnomalyScore < ∈, regard the corresponding data point as an abnormal sample.

[0122] Step 4: Generate corresponding time series adversarial samples for the time series anomaly detection model and compare them with the predicted values of the original test data. The specific steps include:

[0123] Step 4.1: According to the time series anomaly detection model, calculate the attack direction direction in the gradient attack method.

[0124]

[0125] where, sign is the sign function, L is the loss function of the time series anomaly prediction model, represents calculating the gradient with the test data x test as the independent variable, and θ represents the weight parameter of the time series anomaly prediction model.

[0126] Step 4.2: Calculate the perturbation r = ∈·direction. To make the amplitude of each data dimension in the data different under the attack and achieve the effect of reducing the perturbation amplitude, select ∈ as a variable to construct an objective function, sort the importance of data points in the sequence through gradient calculation, and calculate the perturbation:

[0127] p = (f(x) - f(x + r))

[0128] where f(x) represents the output of the time series anomaly prediction model, and the argmax function is used to describe the problem.

[0129] Step 4.3: To ensure that the number of perturbations is small when generating time perturbations. Limit the total perturbation by adding a regularization penalty term of the L2 norm; to ensure the waveform smoothness of the sequence, add a ridge regression penalty term to generate adversarial samples:

[0130]

[0131] where ||·||2 represents the L2 norm, μ is a hyperparameter controlling the perturbation generation scale, and α and λ are hyperparameters controlling the ||∈||2 regularization and the ridge regression penalty term

[0132] Step 4.4: Use the gradient descent method to solve the equation and obtain the time series adversarial samples for industrial scenarios generated by the variable perturbation method

[0133] x attack = ∈ * ·direction + x

[0134] Step 4.5: Use the time series anomaly prediction model to predict the time series adversarial sample x attack and calculate the proportion of data points where the predicted value of the original data is less than the threshold and the predicted value of the adversarial sample is greater than the threshold.

[0135] As Figure 8 shown, an adversarial sample generation device includes: a network module for capturing industrial time series data; a memory for storing the captured industrial time series data and computer programs; a processor for executing the computer programs stored in the memory. When the computer programs are executed, the processor is used to: construct the industrial time series data into training data for a time series anomaly detection model; use the training data x train and the true training label y train as input time series data to train the time series anomaly detection model; calculate the model training prediction value according to the training data x train of the trained time series anomaly detection model, and calculate the difference between the model training prediction value and the true training label y trainThe anomaly scores between them are calculated to establish a security baseline. Corresponding temporal adversarial samples are generated for the trained temporal anomaly detection model and compared with the predicted values of the original test data.

[0136] The processor includes a data processing module that extracts temporal sensor data and corresponding labels from industrial temporal data, normalizes and standardizes the temporal sensor data, queries and fills missing values in the normalized and standardized temporal sensor data with 0, and sets the sliding window size w. x Then, the data after querying and filling with 0 is temporally processed to obtain training data x. train true training labels y train test data x test true test labels y test anomaly classification labels y label .

[0137] When the industrial equipment is operating normally, the sensor data is divided into temporal unit data using a sliding window. The temporal unit data refers to arranging the sensor values in chronological order within a fixed time to reflect the temporal attributes of the sensor data.

[0138] For the sensor data that has been divided into temporal unit data, the variable perturbation adversarial sample generation method is used to calculate the perturbations required for the adversarial samples, and the perturbations are added to the test data to obtain the adversarial samples. The adversarial samples and the test data are input into the temporal anomaly detection model to obtain the corresponding predicted values of the model, and the effectiveness of the adversarial samples is evaluated by comparing the predicted values.

[0139] The temporal adversarial sample generation method calculates the gradient of the temporal anomaly detection model and generates perturbations using different attack amplitudes, making the adversarial samples highly aggressive. The L2-norm regular penalty term is used to keep the total perturbation small, and the ridge regression penalty term is used to solve the problem of waveform non-smoothness caused by the perturbations. The temporal anomaly detection model is based on an LSTM network, and the LSTM network includes multiple neurons, and each neuron includes a forget gate, an input gate, and an output gate.

[0140] A computer-readable storage medium stores a computer program that can be executed by a processor to implement the adversarial sample generation method.

[0141] To verify the aggressiveness, the number of perturbations, and the smoothness of the perturbations of the adversarial samples of the method proposed in the present invention, two groups of experiments were conducted to compare the differences between the original data and the adversarial samples and the prediction results of the model for the original data and the adversarial samples under the same model.

[0142] (1) Adversarial sample attack: During the training process, a sliding window of 50 sample points is used to segment the training data and the test data respectively. And in the test phase, four evaluation metrics, namely RSE, RAE, ASR, and AR, and four parameter values are used to evaluate the gap between the model's anomaly detection and the real data. The experimental results are shown in Table 1, and the attack waveform diagrams are as shown in Figure 5 and Figure 6 . The adversarial sample generation algorithm used in this paper makes the distance between the predicted value of the model and the predicted value of the original data relatively large, resulting in a decrease in the prediction accuracy and the failure of the anomaly detection function.

[0143] Table 1

[0144]

[0145] (2) Number of perturbations and smoothness: During the generation of adversarial samples, the perturbation calculation is performed on the sliding window data of 50 sample points. In the test phase, three evaluation metrics, namely RSE, RAE, and CORR, and four parameter values are used to calculate the gap between the adversarial samples and the original samples, as shown in Table 2. And Figure 7 shows the waveform comparison between the adversarial samples and the original samples. It can be seen from the experimental results that the adversarial sample generation algorithm used in this invention makes small changes to the original samples and has high smoothness.

[0146] Table 2

[0147]

[0148] In view of the above observations, the model proposed in this invention effectively attacks the time series model by generating adversarial samples for the time series model, and multiple evaluation metrics are significantly increased compared with the original data. And it can be seen from the figure that the number of perturbations is small and the generated time series adversarial samples have smoothness.

Claims

1. An adversarial example generation method, characterized in that, Specifically, the steps are as follows: Step 1: Obtain the training data for building the time series anomaly detection model based on industrial time series data; Step 2: Use the training data x train and the true training label y train as input time series data to train the time series anomaly detection model; Step 3: Through the time series anomaly detection model trained in Step 2, according to the test data x test Calculate the model test prediction value And calculate the anomaly score with the true test label y test Between them, according to the data distribution of the anomaly score, determine the probability threshold ∈ through the Gaussian distribution anomaly detection algorithm; Step 4: Perform variable perturbation calculation on the test data x based on the trained temporal anomaly detection model and the probability threshold ∈ test and add the perturbation to the test data x test to generate the corresponding temporal adversarial sample x attack ; The specific content of Step 4 includes: Step 4.1: According to the trained time series anomaly detection model, calculate the attack direction direction in the gradient attack method; where sign is the sign function, and L is the loss function of the trained time series anomaly detection model. It means to calculate the gradient with the test data x test as the independent variable, and θ represents the weight parameter of the trained time series anomaly detection model. Step 4.

2. Calculate the perturbation r = ∈·direction, construct an objective function with ∈ as a variable, and calculate the gradient for the test data x test in each window of size w x to sort the importance of each single data dimension, and calculate the perturbation: p = (f(x) - f(x + r)) where f(x) represents the output of the trained time series anomaly detection model; Step 4.3: Add a regularization penalty term of L2 norm to the calculated perturbation to limit the total amount of perturbation; in order to ensure that the generated temporal adversarial samples are smooth in waveform with the model training prediction value, add a ridge regression penalty term to generate adversarial samples: where ||·||2 represents the L2 norm, γ is a hyperparameter controlling the scale of perturbation generation, and α and λ are the hyperparameters controlling the ||∈||2 regularization and the ridge regression penalty term respectively; Step 4.4: Use the gradient descent method to solve the adversarial samples and obtain the time series adversarial samples for industrial scenarios generated by the variable perturbation method; x attack = ∈ * ·direction + x test Step 4.5: Use the trained time series anomaly detection model to predict the time series adversarial sample x attack Make a prediction, calculate the number and proportion of data points where the predicted value of the original data is less than the threshold and the predicted value of the time series adversarial sample is greater than the threshold, and use this to represent the proportion of the number of samples for which the adversarial sample attack is successful in the total number of samples.

2. The adversarial example generation method according to claim 1, wherein The specific content of Step 1 is as follows: Step 1.1: Extract the time series sensor data and corresponding labels from the industrial time series data, and perform standardization and normalization processing on the time series sensor data; Step 1.2: Query and fill the missing values in the data obtained in Step 1.1 with 0; Step 1.3: Set the sliding window size w x , perform temporal processing on the data in Step 1.2 to obtain training data x train , true training label y train , test data x test , true test label y test , anomaly classification label y label .

3. The adversarial example generation method according to claim 1 or 2, characterized in that The time series anomaly detection model is based on the long short-term memory neural network LSTM. The LSTM network includes multiple neurons, and each neuron includes a forget gate, an input gate, and an output gate.

4. The adversarial example generation method according to claim 3, wherein The specific content of Step 2 is as follows: Step 2.1: Determine the information retained during the training process of the time series anomaly detection model through the forget gate, and the calculation formula is as follows: f t = sigmoid(W f ·[h t-1 , x t + b f ) Among them, w f is the weight matrix of the forget gate, [h t-1 , x t represents the connection between the gate output and the neuron output, b f represents the bias value of the forget gate, and f t represents the state of the forget gate; Step 2.2: Update the neuron state of the time series anomaly detection model through the input gate, and the calculation formula is as follows: i t = sigmoid(W i ·[h t-1 , x t + b i ) C t =tanh(W C ·[h t-1 ,x t +b C ) Among them, i t represents the state of the input gate, and C t represents the output value of the input gate of the timing anomaly detection model; W i , b i respectively represent the weight matrix and bias value passed into the sigmoid function in the input gate; W C , b C respectively represent the weight matrix and bias value passed into the tanh function in the input gate; Step 2.3: Determine the value of the neuron state of the time series anomaly detection model through the output gate and perform iterative training, and the calculation formula is as follows: h t = sigmoid(W o ·[h t-1 , x t + b o ) ⊙ tanh(C t ) Among them, ⊙ represents dot product, and h t represents the neuron state output by the output gate of the time series anomaly detection model; W o , b o represent the weight matrix and bias value of the output gate; Step 2.4: Minimize the loss function through the gradient descent algorithm to make the time series anomaly detection model converge, and obtain the trained time series anomaly detection model. The loss function formula is as follows: Among them, represents the predicted value of model training, y train represents the true training label.

5. The adversarial example generation method according to claim 4, wherein The anomaly score is calculated through the Gaussian distribution. The specific steps include: Step 3.1, using the predicted value of the model test and the true test label y test as the variable of the Gaussian distribution anomaly detection algorithm: Step 3.2: Calculate the mean μ and standard deviation σ of the difference err; where m represents the dimension of the difference err data; Step 3.3: When detecting abnormal data points for the test data x test Substitute the difference into the following equation to calculate the anomaly score: Step 3.4: Use the Gaussian distribution anomaly detection algorithm, set the probability threshold ∈ according to the anomaly score distribution, and when AnomalyScore < ∈, regard the corresponding data points as anomaly samples.

6. An adversarial example generation device, characterized in that, It includes: A network module for capturing industrial time series data; A memory for storing the captured industrial time series data and computer programs; A processor for executing the computer programs stored in the memory. When the computer programs are executed, the processor is used for: Build the industrial time series data into the training data of the time series anomaly detection model; Use training data x train and true training label y train as input time series data to train a time series anomaly detection model; Apply the trained time series anomaly detection model to the test data x test Calculate the model test prediction value And calculate the anomaly score between it and the true test label y test According to the data distribution of the anomaly scores, determine the probability threshold ∈ through the Gaussian distribution anomaly detection algorithm; Perform variable perturbation calculation on the trained time series anomaly detection model and probability threshold ∈ for the test data x test and add the perturbation to the test data x test to generate the corresponding time series adversarial sample x attack ; Specifically includes: According to the trained time series anomaly detection model, calculate the attack direction direction in the gradient attack method; where sign is the sign function, and L is the loss function of the trained time series anomaly detection model. It means to calculate the gradient with the test data x test as the independent variable, and θ represents the weight parameter of the trained time series anomaly detection model. Calculate the perturbation r = ∈·direction, construct an objective function with ∈ as the variable, and perform gradient calculation on the test data x test in each of which the window size is w x to sort the importance of single data dimensions and calculate the perturbation: p = (f(x) - f(x + r)) where f(x) represents the output of the trained time series anomaly detection model; Add an L2-norm regular penalty term to the computational perturbation to limit the total amount of perturbation; in order to ensure that the generated temporal adversarial samples are smooth in waveform with the model training prediction value add a ridge regression penalty term to generate adversarial samples: where ||·||2 represents the L2 norm, γ is a hyperparameter controlling the scale of perturbation generation, and α and λ are the hyperparameters controlling the ||∈||2 regularization and the ridge regression penalty term respectively; Solve the adversarial samples using the gradient descent method, and obtain the temporal adversarial samples for industrial scenarios generated by the variable perturbation method; x attack = ∈ * ·direction + x test Use the trained time series anomaly detection model to predict the time series adversarial sample x attack Make predictions, calculate the number and proportion of data points where the predicted value of the original data is less than the threshold and the predicted value of the time series adversarial sample is greater than the threshold, and use this to represent the proportion of the number of samples where the adversarial sample attack is successful among the total samples.

7. The adversarial sample generation device according to claim 6, wherein The processor includes a data processing module, and the data processing module extracts temporal sensor data and corresponding labels from industrial temporal data, and performs standardization and normalization processing on the temporal sensor data; query and fill 0 for the missing values in the standardized and normalized temporal sensor data; Set the sliding window size w x , perform temporal processing on the zero-padded query data to obtain the training data x train , the true training label y train , the test data x test , the true test label y test , the anomaly classification label y label .

8. The adversarial sample generation device according to claim 7, wherein The temporal anomaly detection model is based on an LSTM network, and the LSTM network includes multiple neurons, and each neuron includes a forget gate, an input gate, and an output gate.

9. A computer-readable storage medium, characterized in that, Store a computer program, and the computer program can be executed by a processor to implement the adversarial sample generation method according to any one of claims 1-5.

Images