A signal countermeasure sample detection method based on fourier spectrum

Abstract

The application discloses a signal adversarial sample detection method based on Fourier spectrum, and belongs to the technical field of signal security of machine learning, and comprises the following steps: preparing a benign sample data set and an adversarial sample data set, respectively extracting Fourier spectrum features of the benign sample data set and the adversarial sample data set and respectively performing feature fusion, composing a feature data set and dividing a feature training set and a feature test set; constructing a detection network, performing binary classification training on the detection network by using the feature training set, and obtaining an optimal detection network model; and inputting the feature test set into the optimal detection network model and outputting a detection result. The data is processed by using discrete Fourier transform, the features of the benign sample and the adversarial sample are respectively extracted and fused, the method process is effectively shortened, and a complex full-connection network is used for classification, so that the features of the electromagnetic signal are more fitted, and the detection precision can be effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of signal security of machine learning, and more particularly to a signal adversarial sample detection method based on Fourier spectrum. BACKGROUND

[0002] With the explosive growth of modern wireless communication devices, the electromagnetic environment is becoming more and more complex, and it is necessary to effectively regulate a large number of radio signals in space. Signal classification is used for unknown signal identification and plays an important role in air control and spectrum monitoring. At present, deep learning technology is widely used in signal classification tasks, which has achieved performance breakthroughs. However, adversarial attacks on signal classification tasks are increasing, which has caused security problems. The security research on signal classification has promoted the development of signal adversarial sample detection technology.

[0003] At present, some adversarial sample detection methods have appeared. For example, the density of adversarial sample subspace is usually lower than that of benign samples, especially when the input sample is far away from the class manifold. The neighborhood context encoder (NCE) detector proposed by Mao et al. uses a transformer to train a k-nearest neighbor classifier to represent the surrounding subspace of the detection sample. Xin Li et al. constructed a cascade classifier, each SVM classifier corresponding to a layer, and used benign samples and adversarial samples for training. In view of the poor generalization of existing detection methods, Wang Shuyan et al. used multiple adversarial attack deep learning models to generate an adversarial sample group, and constructed a sample difference detection system, which effectively improved the comprehensiveness and diversity of the model adversarial sample detection. At present, most defense means need to use adversarial samples as training sets, but it is difficult to detect unknown adversarial samples. Jianfei et al. found the invariant in the deep neural network by fitting the distribution, and the selection of the training set is irrelevant to the adversarial sample, which effectively improves the detection success rate of unknown samples. However, the above-mentioned adversarial sample detection methods still have some shortcomings in the use of signals. Most of them are based on the combination of model intermediate layer output features for judgment, and the method process is long, resulting in high overall cost. In addition, the existing detection methods in the field of electromagnetic signals have low accuracy.

[0004] Therefore, how to overcome the problem of inaccurate adversarial samples in the existing adversarial sample detection method, improve the detection accuracy, and reduce the detection cost is a problem that needs to be solved by those skilled in the art. SUMMARY

[0005] Therefore, the present application provides a signal adversarial sample detection method based on Fourier spectrum, which effectively improves the accuracy of adversarial sample detection.

[0006] In order to achieve the above purpose, the present application adopts the following technical scheme:

[0007] A signal based on Fourier spectrum sample detection method of counteracting, comprising the following steps:

[0008] Obtaining a signal data set, dividing the signal data set into a training set and a test set;

[0009] Constructing a target neural network, based on the training set, iteratively training the target neural network through an optimizer, obtaining a target classification model; inputting the test set into the target classification model to obtain a signal classification result;

[0010] According to the signal classification result, comparing the real signal category and screening out the test set samples with correct classification to form a benign sample data set; according to the gradient of the loss function of the target classification model, iteratively adding an adversarial perturbation to the benign sample data set to obtain an adversarial sample data set;

[0011] Respectively extracting the Fourier spectrum features of the benign sample data set and the adversarial sample data set and respectively performing feature fusion to form a feature data set and divide the feature training set and the feature test set;

[0012] Constructing a detection network, using the feature training set to iteratively train the detection network through an optimizer, obtaining an optimal detection network model; inputting the feature test set into the optimal detection network model to output a detection result.

[0013] Preferably, according to the gradient of the loss function in the target neural network, iteratively adding an adversarial perturbation to the benign sample data set to obtain an adversarial sample data set, comprising:

[0014] According to the following formula to obtain an adversarial sample:

[0015]

[0016] In the formula, x t+1 is an adversarial sample, x t is a benign sample; alpha is a perturbation coefficient, which determines the step size in each iteration; sign(·) is a sign function, which specifies the change direction of the signal sampling point; J(x, y) is the loss function of the target classification model; is the gradient of the loss function with respect to the signal value.

[0017] Preferably, respectively extracting the Fourier spectrum features of the benign sample data set and the adversarial sample data set and respectively performing feature fusion to form a feature data set and divide the feature training set and the feature test set, comprising:

[0018] Discrete Fourier transform is performed on the sample data in the benign sample data set and the adversarial sample data set to convert the time domain signal into a frequency domain signal;

[0019] The discrete Fourier transform formula is as follows:

[0020]

[0021] In the formula, x(n) is a complex signal of length N consisting of two dimensions; N is the number of sampling points of the discrete signal; X(m) is the Fourier transform of signal x at n, and the frequency domain signal X is a complex signal.

[0022] Preferably, the Fourier spectral features include the Fourier amplitude spectrum and the Fourier phase spectrum.

[0023] Preferably, the Fourier amplitude spectrum calculation formula is as follows:

[0024]

[0025] The formula for calculating the Fourier phase spectrum is as follows:

[0026]

[0027] In the formula, Re(·) represents the real part of the frequency domain complex signal X(m); Im(·) represents the imaginary part of the frequency domain complex signal X(m).

[0028] Preferably, the Fourier spectral features of the benign sample dataset and the adversarial sample dataset are fused according to the following formula to form a feature dataset:

[0029] Data = |X(m)| + Φ(X(m)) * i;

[0030] Where i represents the imaginary unit.

[0031] Preferably, the detection network is a binary classification network composed of two layers of complex fully connected networks and complex activation functions.

[0032] As can be seen from the above technical solutions, compared with the prior art, the present invention discloses a signal adversarial sample detection method based on Fourier spectrum. It uses discrete Fourier transform to process data, extracts features of benign samples and adversarial samples respectively, and performs feature fusion on each, effectively shortening the method process; and uses complex fully connected networks for classification, which is more in line with the characteristics of electromagnetic signals and can effectively improve the detection accuracy. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0034] Figure 1 A flowchart of a signal adversarial sample detection method based on Fourier spectrum provided in an embodiment of the present invention;

[0035] Figure 2 This is a flowchart illustrating the adversarial example detection based on a feature dataset according to the present invention. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] This invention discloses a signal adversarial example detection method based on Fourier spectrum, with reference to... Figure 1 The method includes the following steps:

[0038] 1. Given a signal dataset, divide the signal dataset into a training set and a test set.

[0039] 2. Determine the target deep neural network C for signal classification. Commonly used target deep neural networks are signal modulation classification models such as ResNet and VggNet. Based on the training set in the signal dataset, the target deep neural network C is trained iteratively through an optimizer to obtain a target classification model capable of classifying signal modulation types. The test set data from the dataset is input into the target classification model to obtain the classification results. Based on the classification results, the samples correctly classified by the network are extracted as benign samples in the detection samples, denoted as Dc.

[0040] 3. Based on the classification results, extract the samples that the target deep neural network C can classify correctly as benign samples in the detection samples, denoted as Dc (correctly classified samples are obtained by comparing them with the true signal category); based on the gradient of the loss function of the target deep neural network C, through multiple iterations, add adversarial perturbations to the extracted benign samples Dc to obtain adversarial samples Da. Specifically, the adversarial samples Da are obtained according to the following formula:

[0041]

[0042] In the formula, x t+1 For adversarial examples, x tα is a benign sample; α is the perturbation coefficient, which determines the step size in each iteration; sign(·) is the sign function, which specifies the direction of signal sampling point change; J(x, y) is the loss function of the target classification model. Let be the gradient of the loss function with respect to the signal value.

[0043] 4. Combine the benign sample Dc and the adversarial sample Da to form the original sample dataset. Extract the Fourier spectral features of the benign sample Dc and the adversarial sample Da separately, and then fuse them to form a feature dataset. Divide this dataset into a feature training set and a feature test set. The flowchart for adversarial sample detection based on the feature dataset is as follows: Figure 2 As shown.

[0044] Specifically, the Discrete Fourier Transform (DFT) is used in the original sample dataset to transform the original samples from time-domain signals to frequency-domain signals. The formula for the DFT transformation is:

[0045]

[0046] In the formula, x(n) is a complex signal of length N, consisting of two dimensions; N is the number of sampling points of the discrete signal; X(m) is the Fourier transform of signal x at n, and the frequency domain signal X is a complex signal; from this, the Fourier spectral characteristics of the signal are further calculated: the Fourier amplitude spectrum and the Fourier phase spectrum, calculated as follows:

[0047] Fourier amplitude spectrum:

[0048]

[0049] Fourier phase spectrum:

[0050]

[0051] In the formula, Re(·) represents the real part of the complex signal X(m) in the frequency domain; Im(·) represents the imaginary part of the complex signal X(m) in the frequency domain; by combining the Fourier amplitude spectrum and Fourier phase spectrum of the signal as the real and imaginary parts respectively, a complex dataset, i.e., a feature dataset, is obtained, as follows:

[0052] Data = |X(m)| + Φ(X(m)) * i;

[0053] Where i represents the imaginary unit.

[0054] 5. Construct a network T for classifying normal samples (i.e., benign samples) and adversarial samples. Extract features from the feature dataset, train the detection network T for binary classification using the feature training set, and test the detection network T for classification using the feature test set to obtain the detection results. The detection results are measured by detection accuracy, precision, and recall. Specifically, the method for constructing the detection network T involves building a two-layer complex fully connected network and a complex ReLU activation function. Specifically, the output of the complex fully connected network is:

[0055] output=(Re(·)-Im(·))+(Re(·)-Im(·))*i;

[0056] Activation function ReLU:

[0057] output=ReLu(Re(·))+ReLu(Im(·))*i.

[0058] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0059] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A signal adversarial example detection method based on Fourier spectrum, characterized in that, Includes the following steps: Obtain the signal dataset and divide the signal dataset into a training set and a test set; Construct a target neural network, and iteratively train the target neural network using an optimizer based on the training set to obtain a target classification model; input the test set into the target classification model to obtain the signal classification result; Based on the signal classification results, the real signal categories are compared and the correctly classified test set samples are selected to form a benign sample dataset; Iterate according to the gradient of the loss function of the target classification model, add adversarial perturbation to the benign sample dataset, and obtain the adversarial sample dataset; The Fourier spectral features of the benign sample dataset and the adversarial sample dataset are extracted separately, and feature fusion is performed on each. The feature dataset is composed and divided into a feature training set and a feature test set, including: Perform a discrete Fourier transform on the sample data in the benign sample dataset and the adversarial sample dataset to convert the time-domain signal into a frequency-domain signal; The discrete Fourier transform formula is as follows: ； In the formula, x(n) is a complex signal of length N consisting of two dimensions; N is the number of sampling points of the discrete signal; X(m) is the Fourier transform of signal x at n, and the frequency domain signal X is a complex signal; The Fourier spectral features include the Fourier amplitude spectrum and the Fourier phase spectrum; The formula for calculating the Fourier amplitude spectrum is as follows: ； The formula for calculating the Fourier phase spectrum is as follows: ； In the formula, Represents a complex signal X in the frequency domain The real part; Represents the frequency domain complex signal X The imaginary part; The Fourier spectral features of the benign sample dataset and the adversarial sample dataset are fused according to the following formula to form a feature dataset: ； Where i represents the imaginary unit; A detection network is constructed, and the network is iteratively trained using the feature training set to obtain the optimal detection network model. The feature test set is then input into the optimal detection network model to output the detection results. The detection network is a binary classification network composed of two layers of complex fully connected networks and complex activation functions.

2. The signal adversarial example detection method based on Fourier spectrum according to claim 1, characterized in that, Iteratively applying the gradient of the loss function in the target neural network, adversarial perturbations are added to the benign sample dataset to obtain an adversarial sample dataset, including: The adversarial sample is obtained according to the following formula: ； In the formula, For adversarial examples, This is a benign sample; The perturbation coefficient determines the step size in each iteration. This is a sign function that specifies the direction of signal sampling point change; Let be the loss function of the target classification model; Let be the gradient of the loss function with respect to the signal value.

Images