A method and device for generating a traffic adversarial sample to access a black box model

Abstract

The present disclosure provides a method and device for generating traffic adversarial samples to access a black-box model, wherein the method comprises: proportionally extracting small samples from each class of balanced traffic samples, accessing the black-box model with the small samples to obtain prediction results, and retaining small samples with inconsistent prediction results and true labels as meta-learning samples; dividing the meta-learning samples into training samples and test samples, performing iterative training of meta-learning on a pre-trained substitute model using the training samples, constantly updating the network parameters of the substitute model to obtain a final optimized substitute model, and evaluating the learning effect of meta-learning using the test samples; using balanced traffic samples to perform white-box attacks on the optimized substitute model, changing the differentiable features in the traffic samples, generating traffic adversarial samples after successfully attacking the optimized substitute model using the attack method; and attacking the black-box model using the traffic adversarial samples. The present disclosure improves the attack success rate of the black-box attack.

Description

TECHNICAL FIELD

[0001] The present document relates to the technical field of network security, and particularly relates to a method and device for generating traffic adversarial samples to access a black-box model. BACKGROUND

[0002] In the field of adversarial machine learning, an attacker in a black-box attack scenario cannot access the internal information of a target model, and can only create adversarial samples through input and output information, which makes the black-box attack more difficult than the white-box attack.

[0003] In the related art, two schemes of generating adversarial samples or optimizing attack methods are usually used to improve the attack effect in the black-box scenario. The related method of generating adversarial samples faces the following problems: the traffic feature data cannot maintain the constraint of malicious function after adding perturbation, the perturbed network traffic cannot be transmitted in the existing network; only the output information of the target model label can be obtained through the input data, and the whole information of the target model cannot be understood; and the attacker accesses the target model too many times, which will make the defender alert.

[0004] In summary of the above analysis of the development status of the technical field, there is a lack of method for maintaining non-differentiable features unchanged when adding perturbation in the black-box attack scenario, accessing the internal information of the target model, and limiting the access times of the target model in the existing technology. SUMMARY

[0005] The purpose of the present application is to provide a method for generating traffic adversarial samples to access a black-box model, which aims to solve the above problems in the prior art.

[0006] According to a first aspect of an embodiment of the present disclosure, a method for generating traffic adversarial samples to access a black-box model is provided, comprising:

[0007] Small samples are obtained by proportionally extracting from each class of balanced traffic samples, the small samples are accessed to the black-box model to obtain prediction results, and small samples with inconsistent prediction results and true labels are reserved as meta-learning samples;

[0008] The meta-learning samples are divided into training samples and test samples, the training samples are used to perform iterative training of meta-learning on the pre-trained substitute model, the network parameters of the substitute model are updated, an optimized substitute model is obtained, and the learning effect of meta-learning is evaluated using the test samples;

[0009] The balanced traffic samples are used to perform white-box attack on the optimized substitute model, the differentiable features in the traffic samples are changed, and the traffic adversarial samples are generated after the attack on the optimized substitute model is successful using the attack method;

[0010] The traffic adversarial samples are used to attack the black-box model.

[0011] According to a second aspect of the embodiments of the present disclosure, a device for generating traffic adversarial samples to access a black-box model is provided, comprising:

[0012] a meta-learning sample extraction module configured to extract small samples from each class of the balanced traffic samples in proportion, access the black-box model with the small samples to obtain prediction results, and reserve small samples with inconsistent prediction results and real labels as meta-learning samples;

[0013] a network parameter optimization module configured to divide the meta-learning samples into training samples and test samples, perform iterative training of meta-learning on the pre-trained substitute model using the training samples, constantly update network parameters of the substitute model, obtain a final optimized substitute model, and evaluate learning effect of the meta-learning using the test samples;

[0014] a traffic adversarial sample generation module configured to perform white-box attack on the optimized substitute model using the balanced traffic samples, change differentiable features in the traffic samples, and generate traffic adversarial samples after the attack on the optimized substitute model is successful using the attack method;

[0015] a black-box model attack module configured to attack the black-box model using the traffic adversarial samples.

[0016] The technical solutions provided by the embodiments of the present disclosure can have the following beneficial effects: only the differentiable features are disturbed to ensure malicious functions of the traffic; the meta-learning is applied to generation of adversarial samples of traffic features to reduce the number of accesses to the target model; the substitute model is introduced to improve the attack success rate of the black-box attack by using the high attack success rate of the white-box attack.

[0017] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of one or more embodiments of the present disclosure or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor.

[0019] Figure 1 is a flowchart of a method for generating traffic adversarial samples to access a black-box model according to an embodiment of the present disclosure;

[0020] Figure 2 is a schematic diagram of meta-learning according to an embodiment of the present disclosure;

[0021] Figure 3 is a schematic diagram of an iterative process of meta-learning according to an embodiment of the present disclosure;

[0022] Figure 4 is a schematic diagram of generating a traffic adversarial sample according to an embodiment of the present application;

[0023] Figure 5 is a schematic diagram of a technical solution according to an embodiment of the present application;

[0024] Figure 6 is a schematic diagram of generating a traffic adversarial sample to access a black-box model according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable persons skilled in the art to better understand the technical solutions in one or more embodiments of the present application, the technical solutions in one or more embodiments of the present application will be described clearly and completely in conjunction with the accompanying drawings of one or more embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on one or more embodiments of the present application, all other embodiments obtained by persons skilled in the art without creative labor should belong to the protection scope of the present document.

[0026] Method embodiment

[0027] According to an embodiment of the present application, a method for generating a traffic adversarial sample to access a black-box model is provided, Figure 1 is a flowchart of a method for generating a traffic adversarial sample to access a black-box model according to an embodiment of the present application, as Figure 1 shown, the method for generating a traffic adversarial sample to access a black-box model according to an embodiment of the present application specifically includes:

[0028] In step S110, small samples are obtained by proportionally sampling from each class of balanced traffic samples, the small samples are used to access the black-box model to obtain prediction results, and small samples with inconsistent prediction results and true labels are reserved as meta-learning samples;

[0029] In step S120, the meta-learning samples are divided into training samples and test samples, the training samples are used to perform iterative training of meta-learning on the pre-trained substitute model, the network parameters of the substitute model are constantly updated to obtain a final optimized substitute model, and the test samples are used to evaluate the learning effect of meta-learning. Specifically includes:

[0030] The initial parameters of the pre-trained substitute model are assigned to the unique network parameters corresponding to the first sample in the training sample, the unique network parameters of the first sample are optimized once using the Support Set in meta-learning, the updated unique network parameters are obtained, the loss of the training sample is calculated using the Query Set in meta-learning on the updated unique network parameters, and the gradient of the loss with respect to the updated unique network parameters is calculated, the updated parameters of the substitute model are obtained by multiplying the gradient by the learning rate of the substitute model, the updated parameters of the substitute model are used as the initial parameters in the next round of iterative training, the initial parameters are assigned to the unique network parameters corresponding to the second sample in the training sample, and the cycle is repeated until the final optimized substitute model is obtained.

[0031] In step S130, the optimized substitute model is attacked using the balanced traffic sample, the differentiable feature in the traffic sample is changed, and the traffic adversarial sample is generated after the attack on the optimized substitute model is successful using the attack method.

[0032] The differentiable feature in step S130 includes a feature that does not represent the inherent attribute in the traffic sample, and the attack method specifically includes FGSM attack, C&W attack, JSMA attack and DeepFool attack.

[0033] In step S140, the traffic adversarial sample is used to attack the black box model. Specifically, if the prediction result after attacking the black box model is inconsistent with the true label, it is considered that the attack is successful.

[0034] The method further includes:

[0035] The traffic sample containing the true label is selected, the traffic sample is cleaned and preprocessed to obtain the processed traffic sample, the normal traffic sample and the plurality of attack traffic samples in the processed traffic sample are respectively subjected to undersampling and oversampling operations to obtain the balanced traffic sample, and the balanced traffic sample and the corresponding true label are input into the substitute model for pre-training.

[0036] In one specific embodiment, the CICIDS-2017 dataset containing real label traffic samples is selected, the data is cleaned and preprocessed, the traffic feature values of the CICIDS-2017 dataset are set to 0, and the traffic feature values containing ∞ are discarded. The number of normal traffic samples in the general traffic sample dataset is much larger than that of attack traffic samples, so the attack traffic samples are oversampled and the normal traffic samples are undersampled. The balanced dataset after sampling is X0, the data samples in X0 include j types of attack traffic samples and 1 type of normal traffic samples. All balanced traffic samples and their corresponding real labels are input into the substitute model for training. The substitute model is mainly based on multilayer perceptron, and convolutional neural network or long short-term memory recurrent neural network can also be used. After training, the initial parameters φ of the model are obtained 0 .

[0037] A small sample X is obtained by proportionally extracting from each class of balanced traffic sample X0 s The rule for extracting the small sample is m i = αN i , where m i is the number of samples collected from the i-th class of samples, N i is the number of i-th class samples in the balanced traffic sample X0, i = 0 ~ j, 0 is the normal sample class, and α is the proportion of collecting small samples. α should be properly adjusted and should not be too large or too small. If α is too small, the number of samples available for learning later will be reduced, and if α is too large, the number of accesses will be too much.

[0038] The small sample X s is used to access the black box model to obtain the prediction result Y s . The small sample with inconsistent prediction result and real label is retained as a meta-learning sample, and the small sample with consistent prediction result and real label is discarded. The meta-learning sample for the next stage is X s '.

[0039] The parameters of the substitute model are optimized through meta-learning. The process of meta-learning parameter optimization is as follows:

[0040] Prepare n groups of training samples and test samples from the meta-learning sample X s ', which are called SupportSet and Query Set in meta-learning. The test sample is used to evaluate the effect of the learned parameters. The network structure is a pre-trained substitute model, and the parameters of the pre-trained substitute model are φ 0 . Start the iterative training:

[0041] Sample 1 training task x, and assign the initial parameters φ 0 of the substitute model to the unique network parameters of task x , that is Using Support Set of task x, learning rate a based on task x x , the gradient of is updated once; the loss of is calculated based on the first optimization Using Query Set to calculate the loss of task x and calculate the gradient of ; using the gradient multiplied by the learning rate a of the substitute model t Update the parameters φ 0 , update φ 0 to φ 1 ; sample the next training task y, and assign the parameters φ 1 of the substitute model to the parameters of task y Using Support Set of task y, learning rate a based on task y y , the gradient of is updated once; the loss of is calculated based on the first optimization Using Query Set to calculate the loss of task y and calculate the gradient of t Update the parameters φ 1 , update φ 1 to φ 2 . Cycle in turn, repeat the above process until n sets of training tasks are completed, and the final optimized substitute model is obtained. The learning effect of meta-learning is evaluated using test samples. Figure 2 is a schematic diagram of the meta-learning of the embodiment of the present application, as Figure 2 shown, the process of the meta-learning of the present embodiment is shown, Figure 3 is a schematic diagram of the meta-learning iteration process of the embodiment of the present application, as Figure 3 shown, the process of the iteration in the meta-learning of the present embodiment is shown.

[0042] The optimized substitute model is attacked using balanced samples, in order to ensure that the generated traffic adversarial samples do not change the characteristics of the traffic and can be transported in the live network, the features of the traffic samples are divided into differentiable features X diff and non-differentiable features X non-diff , the non-differentiable features are classification features that maintain the intrinsic properties of the traffic, so they are not modified, such as "protocol type", "service type", etc., and only the differentiable features are changed when generating traffic adversarial samples.

[0043] The attack methods specifically include FGSM attack, C&W attack, JSMA attack and DeepFool attack, and the traffic adversarial samples are generated after the attack methods are successfully used to attack the optimization substitution module, and the attack success rates of the methods are recorded.

[0044] The black box model is attacked using the traffic adversarial samples, and if the prediction result after the black box model is attacked is inconsistent with the true label, it is regarded as successful attack, the total number of traffic adversarial samples for attacking the black box model is Xz, and the number of traffic adversarial samples for successful attack is recorded as Xc. C The attack success rate b = Xc / Xz is calculated.

[0045] To sum up, in view of the existing problems, the method for generating traffic adversarial samples to access a black box model only disturbs the differentiable features, ensures that the malicious functions of the traffic are continuous, and ensures that the disturbed network traffic can still be transmitted in the existing network; the method of meta-learning is applied to the process of generating traffic adversarial samples, which greatly reduces the number of times of accessing the target model; the substitution model is introduced, the method of attacking the white box model is used to attack the substitution model to generate traffic adversarial samples to attack the black box model, and the attack success rate of the black box model is improved.

[0046] The above technical solutions of the embodiments of the present application will be illustrated by combining the following drawings.

[0047] Figure 4 is a schematic diagram of generating traffic adversarial samples according to an embodiment of the present application, as shown in Figure 4 , the complete schematic process of extracting meta-learning samples, optimizing a substitution model, generating traffic adversarial samples and attacking a black box model according to an embodiment of the present application is shown. Figure 5 is a schematic diagram of the technical solutions of the embodiments of the present application, as shown in Figure 5 , the complete technical process of the embodiments of the present application is shown.

[0048] Device embodiment

[0049] According to the embodiments of the present application, a device for generating traffic adversarial samples to access a black box model is provided, Figure 6 is a schematic diagram of the device for generating traffic adversarial samples to access a black box model according to an embodiment of the present application, as shown in Figure 6 , the device for generating traffic adversarial samples to access a black box model according to the embodiments of the present application specifically includes:

[0050] The meta-learning sample extraction module 60 is used to extract small samples from each class of balanced traffic samples in proportion, access the small samples to the black box model to obtain prediction results, and reserve the small samples with inconsistent prediction results and true labels as meta-learning samples.

[0051] The network parameter optimization module 62 is configured to divide the meta-learning samples into training samples and test samples, perform iterative training of meta-learning on the pre-trained substitute model using the training samples, constantly update network parameters of the substitute model, obtain a final optimized substitute model, and evaluate learning effect of the meta-learning using the test samples.

[0052] The network parameter optimization module 62 is specifically configured to assign initial parameters of the pre-trained substitute model to unique network parameters corresponding to a first sample in the training samples, perform optimization on the unique network parameters of the first sample using a Support Set in the meta-learning, obtain updated unique network parameters, calculate a loss of the training samples using a Query Set in the meta-learning on the updated unique network parameters, and calculate a gradient of the loss on the updated unique network parameters, multiply the gradient by a learning rate of the substitute model to obtain substitute model update parameters, use the substitute model update parameters as initial parameters in the next round of iterative training, assign the initial parameters to unique network parameters corresponding to a second sample in the training samples, and sequentially cycle until the final optimized substitute model is obtained.

[0053] The traffic adversarial sample generation module 64 is configured to perform a white-box attack on the optimized substitute model using the balanced traffic samples, change differentiable features in the traffic samples, and generate traffic adversarial samples after the attack on the optimized substitute model is successful.

[0054] The traffic adversarial sample generation module 64 is specifically configured to: the differentiable features include features that do not represent inherent attributes in the traffic samples; and the attack method specifically includes FGSM attack, C&W attack, JSMA attack, and DeepFool attack.

[0055] The black-box model attack module 66 is configured to attack the black-box model using the traffic adversarial samples, and if a prediction result after the attack on the black-box model is inconsistent with a true label, the attack is considered successful.

[0056] The apparatus further includes:

[0057] The preprocessing module 68 is configured to select traffic samples containing true labels, clean and preprocess the traffic samples to obtain processed traffic samples, perform under-sampling and over-sampling operations on normal traffic samples and a plurality of attack traffic samples in the processed traffic samples, respectively, to obtain balanced traffic samples, and input the balanced traffic samples and corresponding true labels to the substitute model for pre-training.

[0058] To sum up, in response to the existing problems, this paper invented a device for generating traffic adversarial samples to access black-box models. It only perturbs differentiable features, ensuring that the malicious functions of the traffic continue while ensuring that the disturbed network traffic can still be transmitted on the existing network; the meta-learning method is applied to the process of generating traffic adversarial samples, which greatly reduces the number of times the target model is accessed; an alternative model is introduced, and the white-box model attack method is used to attack the alternative model to generate traffic adversarial samples to attack the black-box model, thereby improving the success rate of black-box model attacks.

[0059] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating traffic adversarial samples to access a black box model, characterized in that: include: Small samples are drawn proportionally from each class of the balanced traffic samples, and the small samples are used to access the black box model to obtain prediction results. Small samples whose prediction results are inconsistent with the true labels are retained as meta-learning samples; Dividing the meta-learning samples into training samples and test samples, performing iterative meta-learning training on a pre-trained surrogate model using the training samples, continuously updating the network parameters of the surrogate model to obtain a final optimized surrogate model, and using the test samples to evaluate the learning effect of the meta-learning; Using the balanced traffic sample to perform a white-box attack on the optimized substitution model, changing the differentiable features in the traffic sample, and generating a traffic adversarial sample after successfully attacking the optimized substitution module using the attack method; The traffic adversarial sample is used to attack the black box model.

2. The method according to claim 1, characterized in that The method further comprises: A traffic sample containing a true label is selected, the traffic sample is cleaned and preprocessed to obtain a processed traffic sample, and undersampling and oversampling operations are performed on a normal traffic sample and multiple attack traffic samples in the processed traffic sample to obtain the balanced traffic sample, and the balanced traffic sample and the corresponding true label are input into the replacement model for pre-training.

3. The method according to claim 1, characterized in that The step of performing iterative meta-learning training on the pre-trained surrogate model using the training samples to continuously update the network parameters of the surrogate model to obtain the final optimized surrogate model specifically includes: The initial parameters of the pre-trained replacement model are assigned to the unique network parameters corresponding to the first sample in the training sample, and the unique network parameters of the first sample are optimized once using the Support Set in the meta-learning to obtain updated unique network parameters. The loss of the training sample is calculated for the updated unique network parameters using the Query Set in the meta-learning, and the gradient of the loss with respect to the updated unique network parameters is calculated. The gradient is multiplied by the learning rate of the replacement model to obtain the updated parameters of the replacement model. The updated parameters of the replacement model are used as the initial parameters in the next round of iterative training, and the initial parameters are assigned to the unique network parameters corresponding to the second sample in the training sample. This cycle is repeated until the final optimized replacement model is obtained.

4. The method according to claim 1, wherein The differentiable features include: features that do not represent intrinsic attributes in the traffic sample; the attack methods specifically include: FGSM attack, C&W attack, JSMA attack and DeepFool attack.

5. The method according to claim 1, wherein The using of the traffic adversarial sample to attack the black box model specifically includes: if the prediction result after attacking the black box model is inconsistent with the true label, the attack is deemed to be successful.

6. A device for generating traffic adversarial samples to access a black box model, characterized in that include: A meta-learning sample extraction module is used to proportionally extract small samples from each class of the balanced traffic samples, access the black box model with the small samples to obtain prediction results, and retain small samples whose prediction results are inconsistent with the true labels as meta-learning samples; a network parameter optimization module, configured to divide the meta-learning samples into training samples and test samples, perform iterative meta-learning training on a pre-trained surrogate model using the training samples, continuously update the network parameters of the surrogate model to obtain a final optimized surrogate model, and use the test samples to evaluate the learning effect of the meta-learning; A traffic adversarial sample generation module is used to perform a white-box attack on the optimized substitution model using the balanced traffic sample, change the differentiable features in the traffic sample, and generate a traffic adversarial sample after successfully attacking the optimized substitution module using the attack method; A black box model attack module is used to attack the black box model using the traffic adversarial sample.

7. The device according to claim 6, characterized in that The device further comprises: The preprocessing module is used to select traffic samples containing real labels, clean and preprocess the traffic samples to obtain processed traffic samples, undersample and oversample the normal traffic samples and multiple attack traffic samples in the processed traffic samples to obtain the balanced traffic samples, and input the balanced traffic samples and the corresponding real labels into the replacement model for pre-training.

8. The device according to claim 6, characterized in that The network parameter optimization module is specifically used for: The initial parameters of the pre-trained replacement model are assigned to the unique network parameters corresponding to the first sample in the training sample, and the unique network parameters of the first sample are optimized once using the Support Set in the meta-learning to obtain updated unique network parameters. The loss of the training sample is calculated for the updated unique network parameters using the Query Set in the meta-learning, and the gradient of the loss with respect to the updated unique network parameters is calculated. The gradient is multiplied by the learning rate of the replacement model to obtain the updated parameters of the replacement model. The updated parameters of the replacement model are used as the initial parameters in the next round of iterative training, and the initial parameters are assigned to the unique network parameters corresponding to the second sample in the training sample. This cycle is repeated until the final optimized replacement model is obtained.

9. The device according to claim 6, characterized in that The module for generating traffic adversarial samples is specifically used for: the differentiable features include: features that do not represent the intrinsic attributes of the traffic samples; the attack methods specifically include: FGSM attack, C&W attack, JSMA attack and DeepFool attack.

10. The device according to claim 6, characterized in that The black box model attack module is specifically used to: if the prediction result after attacking the black box model is inconsistent with the true label, the attack is deemed to be successful.

Images