Intelligent adversarial method, system and device for communication signal modulation recognition under small sample prior information and medium

Abstract

The application discloses an intelligent confrontation method, system, equipment and medium for communication signal modulation recognition under small sample prior information, and the method comprises the following steps: based on a meta-learning method, generating meta-confrontation disturbance for data of different modulation types; adding the meta-confrontation disturbance, and rapidly updating the gradient to generate an unknown type data confrontation sample; based on singular value decomposition and principal feature reconstruction, effectively enhancing the concealment of the confrontation sample, and migrating the confrontation sample to an incomplete information network to realize confrontation on the incomplete information network; the system, equipment and medium can realize the intelligent confrontation method for communication signal modulation recognition under small sample prior information in any one of steps 1-3; the application can realize efficient attack on new unknown category data samples after several or even one gradient update, and simultaneously proposes a singular value decomposition and principal feature reconstruction algorithm, extracts main feature components of the disturbance, reduces redundancy of the disturbance components, and generates a high-concealment confrontation sample.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence algorithm adversarial technology in information security, and particularly relates to an intelligent adversarial method, system, device and medium for communication signal modulation recognition under small sample prior information. Background Technology

[0002] Adversarial attacks are commonly used in image processing and modulation recognition (MCR) fields. MCR recognition is a crucial step between signal detection and demodulation, playing a key role in alleviating spectrum resource shortages. Automatic modulation recognition technology applies deep learning to modulation recognition, utilizing deep neural networks (DNNs) to significantly increase the speed and accuracy of modulated signal recognition. However, many studies have shown that neural networks are susceptible to carefully designed micro-perturbations. Adversarial attacks, created by superimposing small malicious noises onto normal samples, can lead to incorrect model outputs, further impacting the security of practical application systems. The discovery of adversarial examples poses a significant security threat to the field of artificial intelligence.

[0003] Researchers have discovered that adversarial attacks can be broadly categorized into two types: complete information attacks and incomplete information attacks. Complete information refers to the detailed information within the network model, while incomplete information is unknown. Clearly, compared to complete information attacks, incomplete information attacks are more practical in real-world environments and severely impact the robustness of deep learning.

[0004] Currently, many adversarial methods have been studied in the literature. For incomplete information models, Papernot et al. proposed using Jacobi augmentation to train a substitute model to generate adversarial examples against incomplete information network models. This method uses a finite number of queries to train the substitute model, and cannot quickly generate adversarial examples for new, unknown sample data (Papernot N, McDaniel P, Goodfellow I, et al. Practical black-box attacks against machine learning[C]. Proceedings of the 2017 ACM on Asia conference on computer and communications security. 2017:506-519.). Pin-Yu Chen et al. proposed a zero-order optimization attack method for incomplete information with better attack performance. This algorithm uses zero-order random coordinate descent, dimensionality reduction, multi-scale attacks, and importance sampling techniques for the attack. However, this method does not consider how to quickly generate adversarial examples when the target model's sample data changes (Chen PY, Zhang H, Sharma Y, et al. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models[C]. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security (AISec), 2017, 15-26.). Dong et al. proposed a gradient method based on momentum iteration, which can generate both complete and incomplete information attacks on the target model. The authors believe that existing adversarial attack methods can only effectively attack simple target models, and therefore have certain limitations.To address this, he proposed the MI-FGSM method, which increases the gradient of the loss function in each iteration, effectively avoiding getting trapped in local optima. However, the authors did not consider the redundancy of the generated adversarial examples (Dong Y, Liao F, Pang T, et al. Boosting adversarial attacks with momentum[C]. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018, 9185-9193.). Huang et al. proposed an intermediate-level attack method, which can attack the generated adversarial examples based on incomplete information about the direction and magnitude of the adversarial perturbation, thereby effectively improving the attack effect. However, this method did not consider the redundancy problem (Huang Q, Katsman I, He H, et al. Enhancing Adversarial Example Transferability with an Intermediate Level Attack[J]. arXiv, 2019.). Also in 2020, a decision-based incomplete information attack method was proposed, and Chen et al. proposed a three-step incomplete information attack method. This method is based on a novel approach that estimates the gradient direction at the decision boundary. The authors demonstrate through experiments that this algorithm requires significantly fewer model queries compared to several state-of-the-art decision-based adversarial attacks. However, the authors do not consider the adversarial example redundancy problem (Chen J, Jordan MI, Wainwright MJ, et al. Hopskipjumpattack: A query-efficient decision-based attack[C]. Proceedings of the 41st IEEE Symposium on Security and Privacy(SP), 2020, 1277-1294.). In 2022, Li et al. proposed an approximate gradient sign method using differential evolution for incomplete information adversarial attacks. This method addresses the incomplete information adversarial attack problem using an approximate gradient sign method using differential evolution.Unlike most existing methods, the proposed method is novel in that it searches for gradient signs using a differential evolution approach instead of perturbations. However, the authors do not consider the problem of adversarial example redundancy (Li C, Wang H, Zhang J, et al. An Approximated Gradient Sign Method Using DifferentialEvolution for Black-Box Adversarial Attack[J]. IEEE Transactions on Evolutionary Computation, 2022, 26(5): 976-990.). In the same year, Fu et al. proposed an incomplete information attack method based on meta-learning, which achieves incomplete information attack by training meta-adversarial perturbations and estimating model gradients.

[0005] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0006] (1) Existing technologies for adversarial attacks against incomplete information models require retraining network parameters when conducting adversarial attacks on new sample data, which seriously affects the efficiency of adversarial attacks.

[0007] (2) Existing technologies are difficult to adapt to incomplete information models and new types of data samples. When implementing new adversarial methods, it is necessary to solve a time-consuming optimization problem, namely, updating the cross-entropy loss function for new sample data.

[0008] (3) Existing technologies for countering incomplete information models use gradient-based adversarial attack methods to generate adversarial samples that are redundant. That is, changing some perturbation points of any adversarial sample does not affect the success rate of the adversarial attack. If this redundancy is not reduced, the concealment of the adversarial sample will inevitably be worse, making it easier for the enemy target model to detect and defend against it. Summary of the Invention

[0009] To overcome the problems existing in the prior art, the present invention aims to provide an intelligent adversarial method, system, device and medium for communication signal modulation identification under small sample prior information. Under the premise of small sample prior information data, the invention seeks general element adversarial perturbations of communication signals, loads element perturbations onto sample data of unknown modulation type, and generates a new adversarial sample through iteration. Based on singular value decomposition and principal feature reconstruction, the main features of the generated perturbation are extracted to reconstruct the adversarial sample, thereby reducing the redundancy of the perturbation and improving the concealment of the adversarial sample.

[0010] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0011] An intelligent adversarial method for communication signal modulation identification with small sample prior information is proposed. Under the premise of small sample prior information data, a general element adversarial perturbation is found in the communication signal. The element perturbation is loaded onto the sample data of unknown modulation type, and a new adversarial sample is generated quickly through iteration. Based on singular value decomposition and principal feature reconstruction, the main features of the generated perturbation are extracted to reconstruct the adversarial sample, thereby reducing the redundancy of the perturbation components and generating highly concealed adversarial samples.

[0012] A method for adversarial detection of communication signal modulation based on small sample prior information, specifically including the following steps:

[0013] Step 1: Based on the meta-learning method, generate meta-adversarial perturbations for data with different modulation types;

[0014] Step 2: Add meta-adversarial perturbations and quickly update gradients to generate adversarial examples for unknown data types.

[0015] Step 3: Based on singular value decomposition and principal feature reconstruction, the concealment of the adversarial sample is effectively enhanced, and the adversarial sample is transferred to an incomplete information network to achieve adversarial action against the incomplete information network.

[0016] In step one, based on the meta-learning method, meta-adversarial perturbations for data with different modulation types are generated. The specific process is as follows:

[0017] First, given a meta-adversarial perturbation v randomly initialized for data of different modulation types, a target classification model f with parameters θ, a cross-entropy loss function denoted as L, a dataset denoted as D, and a batch of sample data randomly sampled from dataset D denoted as B={x (i) ,y (i)}~D, using the gradient ascent method to update the perturbation v to generate v′, find a single perturbation v, and after iteratively adapting to new data samples, deceive the target model with high probability in the data samples. The mathematical model is established as follows:

[0018] f(x+v′)≠f(x).

[0019] In step two, a meta-adversarial perturbation is added to quickly update the gradient for generating adversarial examples of unknown data types. The specific process is as follows:

[0020] The perturbation v′ of the new sample data is calculated using single-step or multi-step gradient ascent.

[0021] One-step gradient ascent is represented as:

[0022]

[0023] Where α represents the hyperparameter, This indicates taking the derivative with respect to the input v;

[0024] Multistep gradient ascent is represented as:

[0025]

[0026] Where n represents the nth iteration, and its value is 0, 1, ..., N-1. Clip v,ε {} indicates that v is restricted to the range [v-ε, v+ε].

[0027] The meta-adversarial perturbation v is updated using single-step or multi-step gradient ascent, and the resulting meta-adversarial perturbation is projected onto the feasibility space to generate adversarial samples of unknown data types.

[0028] In step three, based on singular value decomposition and principal feature reconstruction, the concealment of the adversarial sample is effectively enhanced, and the adversarial sample is transferred to an incomplete information network to achieve adversarial action against the incomplete information network. The specific process is as follows:

[0029] The adversarial samples generated in step two all have redundancy, that is, changing some perturbation points of any adversarial sample does not affect the success rate of the adversarial attack, which makes the adversarial samples less covert and easier for the enemy target model to detect and defend against. Therefore, a method based on singular value decomposition and principal feature reconstruction is used to extract the main feature components of the perturbation and reduce the redundancy of the perturbation components.

[0030] First, in step two, single-step or multi-step gradient ascent is used to calculate the new sample data. Both IQ and adversarial data are used, meaning both the adversarial sample and the original sample are two-dimensional matrices. The perturbation is represented by the difference between the adversarial sample generated in the previous section and the original sample, as shown in the following formula:

[0031] A = XY

[0032] Where A represents the perturbation matrix, X represents the adversarial sample matrix, and Y represents the original sample matrix;

[0033] Let a bilinear function

[0034] f(x,y)=x T By

[0035] Where x,y∈R n×1 ,B∈R n×n Introduce a linear transformation x = Uξ, y = Vη, U, V ∈ R n×n Then the above expression can be expressed as:

[0036] f(x,y)=(Uξ) T B(Vη)=ξ T U T BVη

[0037] make

[0038] S = UT BV

[0039] Then the above expression can be represented as f(x,y)=ξ T Sη, where if U and V are both orthogonal matrices, then by choosing suitable U and V to make S a diagonal matrix, that is...

[0040] S=diag(δ1,δ2,…,δ n )

[0041] Multiply both sides of the above equation by U on the left and V on the right. T achievable

[0042] B = USV T

[0043] We obtain the singular value decomposition theorem: for a perturbation matrix A∈R m×n There must exist an orthogonal matrix U∈R m×n and V∈R n×n This makes the following equation true:

[0044] A = USV T

[0045] Among them, U=(u1,u2,…,u m )∈R m×m u i The column vectors of U are called left singular matrices; V = (v1, v2, ..., v n )∈R n×n v i Let V be a column vector, called the right singular matrix; S represents a diagonal matrix composed of singular values, where m ≥ m. O∈R (m-n)×n Represents the zero matrix; when m≤n, S=[diag(σ1,σ2,…,σ m ),O],O∈R m×(n-m) ,(σ1,σ2,…,σ q Let σ₁ represent the singular values ​​of matrix A, and let σ₂ ≥ σ₁ ≥ … ≥ σ₂. q ≥0, q=min(m,n);

[0046] For a diagonal matrix S composed of singular values, its first r singular values ​​are much larger than the last mr singular values. That is, the matrix reconstructed by the left and right singular matrices corresponding to the first r singular values ​​is the matrix with the main features extracted. Therefore, reconstruction is performed by extracting the first r singular values.

[0047] The decomposition process yields a diagonal matrix S composed of singular values, defined as follows:

[0048] b i =σ i -σ i+1i = 1, 2, ..., m-1

[0049] Among them, b i The sequence b = (b1, b2, ..., b) is formed. m-1 () represents the singular value difference spectrum sequence. Based on the difference spectrum, the left and right singular component matrices corresponding to the first r components are selected for reconstruction, i.e.

[0050]

[0051] Rewriting the above equation in matrix form, we get:

[0052]

[0053] Where A represents the original perturbation matrix, U represents the reconstructed perturbation matrix. r =[u1,u2,…,u r ]∈R m×r Let S be the first r columns of the left singular matrix U. r =diag(σ1,σ2,…,σ r )∈R r×r V is the reconstructed diagonal matrix formed by the first r columns of matrix S. r =[v1,v2,…,v r ]∈R n×r The first r columns of the right singular matrix V;

[0054] Disturbances caused by reconstruction Reconstructing the final adversarial sample The formula is expressed as:

[0055]

[0056] Reconstructed adversarial examples This reduces redundancy while also improving the concealment of adversarial examples; it is then transferred to incomplete information network models to implement adversarial practices.

[0057] An intelligent adversarial system for communication signal modulation recognition based on small sample prior information includes:

[0058] The meta-perturbation update module, based on step one and using the meta-learning method, learns meta-adversarial perturbations on input data of different modulation types, and generates perturbations for corresponding new data samples after one or more iterations.

[0059] The adversarial example generation module is used in step two to calculate the perturbation of the new sample data using single-step or multi-step gradient ascent, update the meta-adversarial perturbation using single-step or multi-step gradient ascent, project the obtained meta-adversarial perturbation onto the feasibility space, and generate adversarial examples of unknown type data.

[0060] The adversarial example reconstruction module is used in step three to reconstruct the adversarial example based on singular value decomposition and principal feature reconstruction, and to transfer the adversarial example to an incomplete information network to achieve adversarial action against the incomplete information network.

[0061] A smart adversarial device for communication signal modulation recognition with small sample prior information includes: a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, it can implement the smart adversarial method for communication signal modulation recognition with small sample prior information described in any one of steps one to three.

[0062] A computer storage medium, wherein a computer program stored in the storage medium, when executed by a processor, is capable of performing intelligent adversarial operations based on the intelligent adversarial method for communication signal modulation recognition under small sample prior information as described in any one of steps one to three.

[0063] The advantages and positive effects of this invention are as follows:

[0064] Existing technologies generate adversarial examples from data with already determined classification categories. When new category data samples arrive, the network parameters need to be retrained. Obtaining detailed information about incomplete information network models is difficult, and perturbation calculations are very time-consuming. Furthermore, adversarial examples generated by incomplete information network models inevitably have high redundancy and poor concealment, making them easy for adversary target models to detect and difficult to launch rapid attacks.

[0065] First, this invention proposes a meta-perturbation adversarial method under incomplete information. It designs an adaptive meta-perturbation method based on communication signal modulation recognition to generate meta-perturbations. This invention updates new data samples using a gradient iteration method. The goal is to learn meta-perturbations on input data with different modulation types, so that perturbations corresponding to new data samples can be generated in one or even several iterations.

[0066] Secondly, this invention adds meta-adversarial perturbations to unknown sample data, and generates aggressive adversarial samples quickly through only one or a few gradient ascents, which is fast and efficient.

[0067] Finally, to address the redundancy problem of gradient-based adversarial attack methods, a singular value decomposition and principal feature reconstruction method is proposed. This method calculates perturbations based on the generated adversarial examples and decomposes and reconstructs low-redundancy perturbations, ultimately generating highly concealed and highly aggressive adversarial examples. This solves the problem of how to quickly and effectively generate adversarial examples when the target model classification task changes. Attached Figure Description

[0068] Figure 1 This is a flowchart of the method of the present invention.

[0069] Figure 2 This is a comparison chart of generator perturbations of training sets of different sizes and attacks by the MIM algorithm in this invention.

[0070] Figure 3 (a) is a comparison of the perturbation average waveform of the 64QAM of the present invention at a signal-to-noise ratio of 2dB at 128 sampling points; Figure 3 (b) is a comparison of the waveform of the perturbation average value at a signal-to-noise ratio of 16dB. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Those skilled in the art can implement the invention using other steps. Figure 1 The communication signal modulation recognition adversarial method provided by the present invention with small sample prior information is only a specific embodiment.

[0072] To address the problems existing in the prior art, the present invention provides an intelligent adversarial method, system, device, and medium for communication signal modulation recognition under small sample prior information. The present invention will be described in detail below with reference to the accompanying drawings.

[0073] This invention provides an intelligent adversarial method for communication signal modulation recognition based on small sample prior information.

[0074] like Figure 1 As shown, the specific steps include:

[0075] S101, based on the meta-learning method, generates meta-adversarial perturbations for data with different modulation types. The specific process is as follows:

[0076] This invention applies a meta-learning method to adversarial examples, training a perturbation. This allows for effective attacks on unknown new-class data samples after only a few or even one gradient update step. This perturbation is called a meta-perturbation. Traditional methods generate adversarial examples from data with a predetermined classification, requiring retraining of network parameters when new-class data samples arrive, significantly increasing time consumption. However, meta-perturbations greatly reduce computation and enable rapid attacks on any unknown data sample. Since the perturbation is updated using a gradient-based iterative method on new data samples, the main goal of this method is to learn this perturbation on input data with different modulation types, enabling the generation of perturbations for new data samples within one or even a few iterations.

[0077] First, given a meta-adversarial perturbation v randomly initialized for data of different modulation types, a target classification model f with parameters θ, a cross-entropy loss function denoted as L, a dataset denoted as D, and a batch of sample data randomly sampled from dataset D denoted as B={x (i) ,y (i)}~D, the perturbation v is updated using the gradient ascent method to generate v′. The method of this invention aims to find a single perturbation v such that after adapting to new data samples in several iterations, it can deceive the target model with a high probability in most data samples. The mathematical model is established as follows:

[0078] f(x+v′)≠f(x)

[0079] S102: Add meta-adversarial perturbations to quickly update gradients for generating adversarial examples for unknown data types; the specific process is as follows:

[0080] The perturbation v′ of the new sample data can be calculated using single-step or multi-step gradient ascent. Single-step gradient ascent is expressed as:

[0081]

[0082] Where α represents the hyperparameter, This represents the derivative with respect to the input v. Multistep gradient ascent is represented as:

[0083]

[0084] Where n represents the nth iteration, and its value is 0, 1, ..., N-1. Clip v,ε {} indicates that v is restricted to the range [v-ε, v+ε]. This algorithm can use either single-step or multi-step gradient ascent to update v. The following derivation mainly focuses on the single-step gradient ascent algorithm, which updates v to v′ on the new dataset B′ by maximizing the loss function. The mathematical expression is as follows:

[0085]

[0086] Meta-adversarial perturbations emphasize adaptability. Using the generated perturbation v′ and meta-step size β, the perturbation v is updated on a new sample dataset, where β represents the meta-step size. The specific formula is as follows:

[0087]

[0088] Finally, the obtained meta-adversarial perturbation is projected into the feasibility space.

[0089] S103: Based on singular value decomposition and principal feature reconstruction, the concealment of adversarial examples is effectively enhanced, and these adversarial examples are transferred to incomplete information networks to achieve adversarial capabilities against incomplete information networks; the specific process is as follows:

[0090] At present, the adversarial samples generated by gradient-based adversarial attack algorithms all have redundancy. That is, changing some perturbation points of any adversarial sample does not affect the success rate of the adversarial attack. If this redundancy is not reduced, the concealment of the adversarial sample will inevitably be worse, making it easier for the enemy target model to detect and defend against it. To address this problem, this patent proposes a method based on singular value decomposition and principal feature reconstruction to extract the main feature components of the perturbation and reduce the redundancy of the perturbation components.

[0091] First, in step two, single-step or multi-step gradient ascent is used to calculate the new sample data. Both IQ and adversarial data are used, meaning both the adversarial sample and the original sample are two-dimensional matrices. The perturbation is represented by the difference between the adversarial sample generated in the previous section and the original sample, as shown in the following formula:

[0092] A = XY

[0093] Since the data used in this algorithm is IQ two-way data, that is, both the adversarial sample and the adversarial sample are two-dimensional matrices, where A represents the perturbation matrix, X represents the adversarial sample matrix, and Y represents the original sample matrix.

[0094] Furthermore, consider a bilinear function.

[0095] f(x,y)=x T By

[0096] Where x,y∈R n×1 ,B∈R n×n Introduce a linear transformation x = Uξ, y = Vη, U, V ∈ R n×n Then the above expression can be expressed as:

[0097] f(x,y)=(Uξ) T B(Vη)=ξ T U T BVη

[0098] Furthermore, let

[0099] S = U T BV

[0100] Then the above formula can be expressed as f(x,y)=ξ T Sη, where U and V are both orthogonal matrices, then by choosing appropriate U and V, S can be made a diagonal matrix, i.e.

[0101] S=diag(δ1,δ2,…,δ n )

[0102] Multiply both sides of the above equation by U on the left and V on the right. T achievable

[0103] B = USV T

[0104] Since the dataset used in this algorithm is not a square matrix, it can be generalized to general matrices, leading to the singular value decomposition theorem: for a perturbation matrix A∈R m×n There must exist an orthogonal matrix U∈R m×n and V∈R n×n This makes the following equation true:

[0105] A = USV T

[0106] Among them, U=(u1,u2,…,u m )∈R m×m u i The column vectors of U are called left singular matrices; V = (v1, v2, ..., v n )∈R n×n v i Let V be a column vector, called a right singular matrix. Let S denote a diagonal matrix composed of singular values, where m ≥ m. O∈R (m-n)×n Represents the zero matrix; when m≤n, S=[diag(σ1,σ2,…,σ m ),O],O∈R m×(n-m) ,(σ1,σ2,…,σ q Let σ₁ represent the singular values ​​of matrix A, and let σ₂ ≥ σ₁ ≥ … ≥ σ₂. q ≥0, q=min(m,n).

[0107] For a diagonal matrix S composed of singular values, its first r singular values ​​are much larger than the last mr singular values. That is, the matrix reconstructed by the left and right singular matrices corresponding to the first r singular values ​​is the matrix with the main features extracted. Therefore, reconstruction is performed by extracting the first r singular values.

[0108] From the singular value decomposition theorem above, we can obtain the diagonal matrix S composed of singular values, defined as follows:

[0109] b i =σ i -σ i+1 i = 1, 2, ..., m-1

[0110] Among them, b i The sequence b = (b1, b2, ..., b) is formed. m-1 () represents the singular value difference spectrum sequence. Based on the difference spectrum, the left and right singular component matrices corresponding to the first r components are selected for reconstruction, i.e.

[0111]

[0112] Rewriting the above equation in matrix form, we get:

[0113]

[0114] Where A represents the original perturbation matrix, U represents the reconstructed perturbation matrix. r =[u1,u2,…,u r ]∈R m×r Let S be the first r columns of the left singular matrix U. r =diag(σ1,σ2,…,σ r )∈R r×r V is the reconstructed diagonal matrix formed by the first r columns of matrix S. r =[v1,v2,…,v r ]∈R n×r The first r columns of the right singular matrix V;

[0115] Disturbances caused by reconstruction Reconstructing the final adversarial sample The formula is expressed as:

[0116]

[0117] Reconstructed adversarial examples This reduces redundancy while improving the stealth of adversarial examples. Finally, it is transferred to an incomplete information network model for adversarial implementation.

[0118] An intelligent adversarial system for communication signal modulation recognition based on small sample prior information includes:

[0119] The meta-perturbation update module, based on step one and using the meta-learning method, learns meta-adversarial perturbations on input data of different modulation types, and generates perturbations for corresponding new data samples after one or more iterations.

[0120] The adversarial example generation module is used in step two to calculate the perturbation of the new sample data using single-step or multi-step gradient ascent, update the meta-adversarial perturbation using single-step or multi-step gradient ascent, project the obtained meta-adversarial perturbation onto the feasibility space, and generate adversarial examples of unknown data types.

[0121] The adversarial example reconstruction module is used in step three to reconstruct the adversarial example based on singular value decomposition and principal feature reconstruction, and to transfer the adversarial example to an incomplete information network to achieve adversarial action against the incomplete information network.

[0122] A smart adversarial device for communication signal modulation recognition with small sample prior information includes: a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, it can implement the smart adversarial method for communication signal modulation recognition with small sample prior information described in any one of steps one to three.

[0123] A computer storage medium, wherein a computer program stored in the storage medium, when executed by a processor, is capable of performing intelligent adversarial operations based on the intelligent adversarial method for communication signal modulation recognition under small sample prior information as described in any one of steps one to three.

[0124] The technical effects of the present invention will be described in detail below with reference to simulation experiments.

[0125] To evaluate the performance of this invention, simulation verification was conducted. In the simulation experiment, an intelligent adversarial method and system for modulation recognition of communication signals under small-sample prior information was considered. The modulation recognition model to be adversarial was a ResNet model, and the modulation signal types to be recognized included six digital signals: BPSK, QPSK, 8PSK, 16QAM, CPFS, and GFSK. The simulation parameters for studying the performance of the incomplete information model were set as follows: the signal-to-noise ratio (SNR) of the modulation signals was selected from values ​​within the interval [-20, 18] with a 2dB interval; the number of signals per SNR was 6000; and the number of iterations was N = 500. The simulation parameters for studying meta-adversarial perturbations are set as follows: 70 samples are randomly selected from the datasets BPSK, QPSK, 8PSK, 16QAM, CPFS, and GFSK within the signal-to-noise ratio range [-20, 18] with a 2dB interval to form a training set for training meta-adversarial perturbations. The total number of samples in this training set is 8400. The learning rate of the MAML main network is set to 0.0002, and the learning rate of the sub-tasks is set to 0.04. The sub-network is ResNet50, and the batch size is set to 60. The multi-step iterative MIM algorithm is used when optimizing the meta-adversarial perturbations in the sub-network. The parameters for studying sample data with unknown modulation types are set as follows: 64QAM sample signals are generated under the same channel environment. This sample signal set contains 20 signal-to-noise ratios (from 18dB to -20dB, with a step size of 2dB). Each signal-to-noise ratio includes 6000 sample signals. Each signal sample consists of one in-phase component and one quadrature component, i.e., it contains two-dimensional data (I-channel and Q-channel), with each dimension having a length of 128. The simulation results of this invention are as follows: Figure 2 As shown, at a signal-to-noise ratio of 10dB, the curves from top to bottom represent the forward recognition accuracy of the incomplete information network model ResNet, the attack success rate of generating adversarial examples directly using the MIM method without meta-perturbation, and the attack rate of adversarial examples generated using meta-perturbation against the incomplete information network model when the number of training set samples is 600, 1200, and 2400, respectively. Figure 2As can be seen, when the target model classification task changes, the meta-perturbation generated by the method proposed in this invention can quickly generate adversarial examples with only one or a few gradient updates, without retraining the alternative model. Simulation results also show that when the number of unknown data samples is extremely small, the meta-perturbation can still generate effective adversarial examples through gradient ascent updates, solving the problem of quickly generating adversarial examples for unknown datasets. Figure 3 As shown, under the premise of ensuring the success rate of the attack, the magnitude of the adversarial interference generated by using and not using the singular value decomposition and principal feature reconstruction method is constrained by the infinity norm. The average perturbation value at 128 sampling points of the 64QAM signal at signal-to-noise ratios of 16dB and 2dB is calculated as follows: Figure 3 (a) When the signal-to-noise ratio is 2dB, the average values ​​of the MIM perturbation and the MIM-SVD perturbation are 0.0016 and -0.0014, respectively. Figure 3 (b) When the signal-to-noise ratio is 16dB, the average values ​​of the MIM perturbation and the MIM-SVD perturbation are 0.0019 and -0.0017, respectively, which shows the effectiveness of the method.

[0126] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0127] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A smart adversarial method for communication signal modulation recognition based on small sample prior information, characterized in that, Specifically, the following steps are included: Step 1: Based on the meta-learning method, generate meta-adversarial perturbations for data with different modulation types; Step 2: Add meta-adversarial perturbations to quickly update gradients, which are used to generate adversarial examples for unknown types of data. Step 3: Based on singular value decomposition and principal feature reconstruction, the concealment of the adversarial sample is effectively enhanced, and the adversarial sample is transferred to the incomplete information network to achieve adversarial action against the incomplete information network. In step three, based on singular value decomposition and principal feature reconstruction, the concealment of the adversarial sample is effectively enhanced, and the adversarial sample is transferred to an incomplete information network to achieve adversarial action against the incomplete information network. The specific process is as follows: The adversarial samples generated in step two all have redundancy, that is, changing some perturbation points of any adversarial sample does not affect the success rate of the adversarial attack, which makes the adversarial samples less covert and easier for the enemy target model to detect and defend against. Therefore, a method based on singular value decomposition and principal feature reconstruction is used to extract the main feature components of the perturbation and reduce the redundancy of the perturbation components. First, in step two, single-step or multi-step gradient ascent is used to calculate the new sample data. Both datasets, namely the adversarial sample and the original sample, are two-dimensional matrices; the perturbation is represented by the difference between the adversarial sample generated in the previous section and the original sample, as shown in the following formula: in, Represents the perturbation matrix. Represents the adversarial sample matrix. Represents the original sample matrix; Let a bilinear function in, Introducing a linear transformation , , Then the above expression can be expressed as: make The above expression is then expressed as , among which, if , Since they are all orthogonal matrices, by choosing appropriate... , Make It is a diagonal matrix, that is Multiply both sides of the above equation by the left side. right multiplication achievable We obtain the singular value decomposition theorem: for the perturbation matrix There must exist an orthogonal matrix. and This makes the following equation true: in, , for The column vectors of a matrix are called left singular matrices; , for The column vectors of a matrix are called right singular matrices; Let represent a diagonal matrix composed of singular values, when hour, , Represents a zero matrix; when hour, , , Representation matrix The singular values, and , ; For a diagonal matrix composed of singular values , before The singular value is much larger than the subsequent ones. The singular values, i.e., the first The matrix reconstructed from the left and right singular matrices corresponding to each singular value is the matrix with the main features extracted. Therefore, by extracting the first... Reconstruct the singular values; The decomposition steps yield a diagonal matrix composed of singular values. ,definition in, The sequence formed This represents a sequence of singular value difference spectra. Based on the difference spectrum, the first... The left and right singular component matrices corresponding to each component are reconstructed, i.e. Rewriting the above equation in matrix form, we get: in, Represents the original perturbation matrix. This represents the reconstructed perturbation matrix. Left singular matrix The former List, For matrix The former Columns and front The reconstructed diagonal matrix composed of columns A right singular matrix The former List; Disturbances caused by reconstruction Reconstructing the final adversarial sample The formula is expressed as: Reconstructed adversarial examples This reduces redundancy while also improving the concealment of adversarial examples; it is then transferred to incomplete information network models to implement adversarial practices.

2. The intelligent adversarial method for communication signal modulation recognition under small sample prior information as described in claim 1, characterized in that, In step one, based on the meta-learning method, meta-adversarial perturbations for data with different modulation types are generated. The specific process is as follows: First, given the meta-adversarial perturbation randomly initialized for data of different modulation types. The parameters are Target classification model The cross-entropy loss function is denoted as The dataset is denoted as Randomly in the dataset A batch of sample data is recorded as follows: The perturbation is updated using the gradient ascent method. generate To find a single perturbation After iteratively adapting to new data samples, the mathematical model is established to deceive the target model with a high probability in the data samples: 。 3. The intelligent adversarial method for communication signal modulation recognition under small sample prior information as described in claim 2, characterized in that, In step two, a meta-adversarial perturbation is added to quickly update the gradient, which is used to generate adversarial examples for unknown data types. The specific process is as follows: Calculate the perturbation of new sample data using single-step or multi-step gradient ascent. , One-step gradient ascent is represented as: in, Indicates hyperparameters, Indicates input Differentiate; Multistep gradient ascent is represented as: in, Indicates the first In the next iteration, its value is... , Indicates will Limited to Within the range, Use single-step or multi-step gradient ascent to update meta-adversarial perturbations. The obtained meta-adversarial perturbations are projected onto the feasibility space to generate adversarial samples of unknown data types.

4. A system based on the intelligent adversarial method for communication signal modulation recognition under small sample prior information as described in any one of claims 1 to 3, characterized in that, include: The meta-perturbation update module, based on step one and using the meta-learning method, learns meta-adversarial perturbations on input data of different modulation types, and generates perturbations for corresponding new data samples after one or more iterations. The adversarial example generation module is used in step two to calculate the perturbation of the new sample data using single-step or multi-step gradient ascent, update the meta-adversarial perturbation using single-step or multi-step gradient ascent, project the obtained meta-adversarial perturbation onto the feasibility space, and generate adversarial examples of unknown type data. The adversarial example reconstruction module is used in step three to reconstruct the adversarial example based on singular value decomposition and principal feature reconstruction, and to transfer the adversarial example to an incomplete information network to achieve adversarial action against the incomplete information network.

5. A device for intelligent adversarial methods based on communication signal modulation recognition under small sample prior information as described in any one of claims 1 to 3, characterized in that, include: The system includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, enables the implementation of the intelligent adversarial method for communication signal modulation recognition based on small sample prior information, as described in any one of steps one through three.

6. A computer storage medium, characterized in that, When the stored computer program is executed by the processor, it can perform the intelligent adversarial method for communication signal modulation recognition under small sample prior information as described in any one of claims 1 to 3, and perform intelligent adversarial ...

Images