An adversarial attack detection method based on feature space projection

Abstract

The application provides a feature space projection-based adversarial attack detection method, which is characterized in that: the feature space obtained by a plurality of intermediate layers of a neural network is decomposed to obtain feature subspaces and adversarial subspaces of each intermediate layer of the network, the ratio of the projection lengths of a sample on the two subspaces is calculated as a detection quantity, and a detection quantity curve containing a plurality of continuous intermediate layers is obtained; through comparison calculation with the amplitude and change trend of the detection quantity mean curve of normal samples, the adversarial sample can be effectively detected, the detection model can be successfully established only by using normal samples, specific adversarial samples are not needed for training, the defect of low accuracy in the sample-based space distribution detection is solved, in the detection of adversarial attacks, multiple iterations are not needed, the complexity is low, and the time consumption is greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of radiation source identification and counterattack, and in particular to a deep learning counterattack detection technology based on feature space projection. Background Art

[0002] Electromagnetic target recognition (ETR) is a technology that uses only the physical layer characteristics of electromagnetic signals to identify individual targets. This is due to the non-ideal characteristics of the hardware within electromagnetic targets. Different target devices transmitting the same information sequence will inevitably distort the electromagnetic signals relative to the theoretical signal. This distortion is unique, like a human fingerprint.

[0003] Electromagnetic target recognition technology is widely used in both military and civilian fields. In recent years, deep learning algorithms, represented by deep neural networks, have become a research hotspot in the field of electromagnetic target recognition due to their powerful feature extraction capabilities. Deep learning is a data-driven adaptive learning method that utilizes large amounts of training data to adaptively characterize radiation source characteristics by minimizing a loss function. This avoids complex feature engineering, improves the system's automation level, and achieves superior recognition results compared to traditional methods.

[0004] While deep learning offers opportunities for the intelligent development of electromagnetic target recognition technology, it also introduces some challenges. In the field of image recognition, adversarial attacks can significantly reduce the recognition accuracy of neural networks by adding subtle perturbations to input samples that are imperceptible to the human eye, or even trick the neural network into misclassifying the sample. This phenomenon also exists in the field of electromagnetic target recognition. Attackers can disable or even deceive electromagnetic target recognition systems by transmitting interfering signals. Because electromagnetic target recognition technology is primarily used in security, the security of the algorithm itself is crucial. Therefore, practical applications of electromagnetic target recognition technology based on deep learning feature extraction and classification must consider the various potential malicious attacks it faces.

[0005] There are currently two main methods for detecting adversarial attacks. One method detects adversarial examples based on their spatial distribution. This method assumes that adversarial examples are not normally generated and that their distribution space is distinct from that of benign examples. Therefore, it can estimate the distribution of existing benign examples to determine whether the received data sample belongs to a subspace of benign examples. The other method detects adversarial examples based on their robustness. When attackers generate adversarial examples, they often ignore robustness and instead pursue other properties such as minimal perturbation, invisibility, and target label classification. These properties are often incompatible with robustness, making adversarial examples significantly less robust than benign examples.

[0006] The above two existing detection technologies have the following shortcomings:

[0007] (1) Detection methods based on the spatial distribution of samples often require assuming the specific distribution of samples. In the absence of prior knowledge, it is difficult to accurately identify adversarial samples.

[0008] (2) Detection methods based on the robustness of adversarial samples have a reasonable performance in detecting adversarial samples, but they often require multiple iterations and are time-consuming. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to propose an adversarial attack detection method that only requires normal sample information and does not require iterative calculation.

[0010] The technical solution adopted by the present invention to solve the above technical problems is a method for detecting adversarial attacks based on feature space projection, the detection steps comprising:

[0011] Inputting a sample to be detected into an electromagnetic target recognition model, and using K intermediate layers in the electromagnetic target recognition model to output K intermediate layer feature vectors of the sample to be detected; K is less than or equal to the total number of intermediate layers of the electromagnetic target recognition model; the electromagnetic target recognition model is a trained deep neural network;

[0012] The ratio of the projection lengths of the K feature vectors of the sample to be detected on the normal sample subspace and the adversarial subspace is used as the detection quantity of the sample to be detected, and the K detection quantities are combined to obtain the detection quantity curve vector of the sample to be detected;

[0013] For the K intermediate layers of the sample to be detected, the slope of the Kth detection value and the previous K-1 detection values ​​is calculated to obtain the K-1 slopes of the sample to be detected. The K-1 slopes are compared with the preset slope detection threshold one by one. If two or more of the K-1 slopes are less than the slope detection threshold, the sample to be detected is judged to be an adversarial sample and an adversarial attack is detected. Otherwise, the next step of judgment is performed.

[0014] Determine whether the ratio of the projection lengths of the characteristic vectors of the K intermediate layers of the sample to be detected on the normal sample subspace and the adversarial subspace is greater than the average detection quantity in the Kth intermediate layer. If so, the sample to be detected is judged to be a normal sample. Otherwise, calculate the similarity between the detection quantity curve of the sample to be detected and the average detection quantity curve vector. If the similarity is greater than the preset similarity detection threshold, the sample to be detected is judged to be an adversarial sample. If the similarity is less than or equal to the preset similarity detection threshold, the sample to be detected is judged to be a normal sample.

[0015] Preferably, the preset slope detection threshold, the average detection amount in the Kth intermediate layer, the average detection amount curve vector and the preset similarity detection threshold are obtained through the following preprocessing steps:

[0016] Collect several normal samples of M types of electromagnetic targets, input all normal sample sets into the electromagnetic target recognition model, and use K intermediate layers in the electromagnetic target recognition model to output the feature vectors of the normal samples;

[0017] Take the average value of all feature vectors of each class output by each intermediate layer to calculate the central feature matrix of each class; for each intermediate layer, merge the central feature matrices of M classes into the central feature matrix of the intermediate layer;

[0018] For each intermediate layer, the first unitary matrix obtained by singular value decomposition of the central feature matrix is ​​divided into two mutually orthogonal parts: the sample subspace and the adversarial subspace.

[0019] For each intermediate layer, the ratio of the projection lengths of the feature vectors of each normal sample on the normal sample subspace and the adversarial subspace is used as the detection quantity. The detection quantities corresponding to the K intermediate layers are combined to obtain the detection quantity curve vector of each normal sample. Then, the average detection quantity of all samples in each intermediate layer is obtained according to the mean value of all elements in the detection quantity curve vector of each normal sample. The average detection quantity curve vector obtained by combining the average detection quantities corresponding to the K intermediate layers is:

[0020] For each normal sample, calculate the K-th element in the detection curve vector and the K-1 slope values ​​of the first K-1 elements to form a slope vector, and then combine the J vectors to form a slope matrix;

[0021] Select a normal sample whose slope vector is smaller than the average detection value in the K-th middle layer, and calculate the similarity between the detection value curve vector of the selected normal sample and the average detection value curve vector;

[0022] In the similarity between the detection quantity curve vector of the selected normal sample and the average detection quantity curve vector, a quantile is selected as the similarity detection threshold as needed, and a suitable quantile is selected in the slope matrix as the slope detection threshold vector; wherein each element in the detection threshold vector is represented as a slope detection threshold.

[0023] The present invention decomposes the feature space obtained from multiple intermediate layers of a neural network to obtain the characteristic subspace and adversarial subspace of each intermediate layer. By calculating the ratio of the lengths of the sample's projections onto the two subspaces as the detection quantity, a detection quantity curve encompassing multiple consecutive intermediate layers is generated. By comparing the amplitude and trend of the detection quantity mean curve with that of normal samples, adversarial samples can be effectively detected, resolving the low accuracy of spatially distributed detection based on samples while significantly reducing time consumption.

[0024] Beneficial effects of the present invention:

[0025] 1. The current detection method based on the spatial distribution of samples has a low success rate in detecting adversarial attacks. It is impossible to use an effective model to distinguish between normal samples and adversarial samples. This technology uses the middle layer of a deep neural network to extract features, designs an algorithm to decompose multiple feature vectors and calculates projection similarity, distinguishes the length and change trend of the projections of adversarial samples and benign samples, and effectively distinguishes normal samples from adversarial samples.

[0026] 2. Existing detection methods based on robustness to adversarial examples typically have similar recognition success rates to this technology, but often require multiple iterations for calculation. These methods are complex and time-consuming, and cannot provide real-time recognition and detection results. This technology does not require multiple iterations when detecting adversarial attacks, is less complex, and is much faster.

[0027] 3. Only normal samples are needed to successfully establish a detection model. There is no need to generate specific adversarial samples for training. Therefore, a variety of unknown adversarial attack methods can be effectively detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 Implementation flow chart of the present invention;

[0029] Figure 2 Data time-frequency diagram;

[0030] Figure 3 Adversarial attack detection step based on feature space projection;

[0031] Figure 4 The identification model structure diagram in the present invention. DETAILED DESCRIPTION

[0032] like Figure 1 As shown, a method for detecting adversarial attacks based on feature space projection includes the following steps:

[0033] S1 builds an electromagnetic target recognition model based on deep learning. The steps are as follows:

[0034] S11 sets M communication radiation source individuals and collects signals through a signal collection device. The signal collection device collects the signals emitted by the M communication radiation sources and stores the signals in the form of time domain data. The obtained signal time domain data is x(t).

[0035] S12 pre-processes the collected time domain signal, performs energy detection on the time domain signal, and simultaneously performs energy detection on the simulated noise signal to obtain a threshold, and retains the valid signal through threshold screening.

[0036] S13 normalizes the signal to compress the signal amplitude, stabilize the time domain waveform, and obtain a signal that focuses on the time domain waveform performance.

[0037] S14 performs short-time Fourier transform (STFT) on the time domain signal to convert the electromagnetic target time domain signal into a two-dimensional time-frequency signal, taking into account both time domain characteristics and frequency domain characteristics, and better extracting the features hidden in the time domain waveform.

[0038] Select the short-time Fourier transform window length as 224, keep the number of points calculated for discrete Fourier transform consistent with the window length as 224, set the appropriate number of overlapping points, and obtain a dual-channel time-frequency diagram with a size of 224×224 after short-time Fourier transform, as shown in Figure 2 .

[0039] S15 is trained using a deep neural network with W intermediate layers. M = 8 signal types are collected, and 70% of the entire dataset is randomly selected as the training set, 15% as the test set, and 15% as the validation set. The model is trained using the training set.

[0040] S2 builds an adversarial attack detection model based on feature space projection. The steps are as follows:

[0041] S21, collect M types of electromagnetic targets, each type of electromagnetic target has L normal samples, input the M*L normal sample sets into the trained electromagnetic target recognition model, and use the feature vectors output by the K intermediate layers in the electromagnetic target recognition model in, It represents the feature vector output by the lth sample in the i-th category after passing through the kth intermediate layer of the electromagnetic target recognition model, where variable i = 1, 2, ..., M, variable l = 1, 2, ..., L, and variable k = 1, 2, ..., K; K is less than W, M is the number of electromagnetic target categories, and L is the number of normal samples of each electromagnetic target category.

[0042] S22, take the average of all the feature vectors of each class output by the kth intermediate layer, and calculate the central feature matrix C of each class i k , merge the central feature matrices of M classes into the central feature matrix G of the kth intermediate layerk ;

[0043]

[0044] G k =(C 1 k ,C 2 k ,...,C M k );

[0045] S23, the central feature matrix G of each intermediate layer k Perform singular value decomposition G k =v k T Σu, get the first unitary matrix v k ; Take v k The first N=8 columns are used as the sample subspace v k,1 , and the rest is used as the adversarial subspace v k,2 , sample subspace v k,1 and adversarial subspace v k,2 mutually orthogonal, T Represents matrix transpose;

[0046] S24, the feature vector The type dimension i and the sample number dimension l are combined and re-expressed as the feature vector B k,j , where j is the sample number in the total number J, j = 1, 2, ..., J, J = M * L; the feature vector B k,j The ratio of the projection lengths θ on the normal sample subspace and the adversarial subspace k,j As the detection amount, the detection amount corresponding to the K intermediate layers is combined to obtain the detection amount curve vector Γ of sample j j , and then the detection curve vector Γ j The average value of all elements in the kth intermediate layer is the average detection amount of all samples Merge the average detection amount corresponding to K intermediate layers The average detection curve vector obtained

[0047]

[0048] Γ j =(θ 1,j ,θ 2,j ,...,θ K,j )

[0049]

[0050] S25 For each sample j, calculate the detection curve vector Γ j The K-1 slope values ​​h of the K-th element and the K-1 previous elements k′,j Composing the slope vector h j , k′=1,2,...,K-1, and then the J vectors are combined into the slope matrix H;

[0051]

[0052] H=(h1,h2,...,h J )

[0053] S26 selects its ratio θ k,j Less than the average detection amount in the K-th middle layer Normal sample, calculate its detection curve vector Γ j and the average detection curve vector The similarity σ j ;

[0054] Among them, α k is the similarity coefficient, α k ∈[0,1];

[0055] S27 is similar to the selected normal samples σ j In the quantile as needed, the similarity detection threshold τ is selected, and the appropriate quantile is selected in the slope matrix H as the slope detection threshold vector υ; wherein each element in the detection threshold vector υ is represented as the slope detection threshold υ k′ ;

[0056] Testing steps:

[0057] S28 inputs the sample to be detected into the electromagnetic target recognition model to obtain the feature vector A output by the K intermediate layers k ;

[0058] S29 takes the feature vectors A of each intermediate layer of the sample to be detected k The ratio of the projection lengths θ on the normal sample subspace and the adversarial subspace k As the detection quantity, the detection quantities corresponding to the K intermediate layers are combined to obtain the detection quantity curve vector Γ of the sample to be detected;

[0059]

[0060] Γ=(θ1,θ2,...,θ K ).

[0061] S210 calculates the ratio θ for the K middle layers of the sample to be detected KCombined with the slope of the first K-1 points, we can get the K-1 slopes h of the sample to be tested. k′ , h k′ The slope detection threshold υ k′ One-to-one comparison, if K-1 slopes h k′ There are two or more than two smaller than υ k′ , then the sample is considered to be an adversarial sample, otherwise it goes to step S211;

[0062] S211 determines the ratio θ K Is it greater than the average detection amount in the Kth intermediate layer? If it is greater than, it is directly a normal benign sample, otherwise calculate the detection amount curve Γ of the sample to be tested and the average detection amount curve vector The similarity σ,

[0063]

[0064] If σ is greater than the similarity detection threshold τ, then the sample is considered to be an abnormal adversarial sample, otherwise it is considered to be a benign sample.

[0065] S3 builds an adversarial attack and uses the model built in S2 to detect adversarial samples:

[0066] S31 builds a model through steps S11-S27. The model structure of the present invention is as follows: Figure 3 .

[0067] S32 uses the recognition model and validation set samples in S1 to construct two different adversarial attack samples from the following formula. FGM (fast gradient method) is a fast gradient attack, which is a single-step adversarial attack with a fast attack speed. ε is used to control the power of the attack.

[0068] The CW (Carlini & Wagner) attack is an optimization-based attack method that seeks the optimal perturbation. The attack has a high success rate and does not require controlling the attack power.

[0069] S33 passes the obtained attack sample through steps S28-S211 and calculates the detection success rate of the method.

[0070] S34 is shown in Table 1, which shows the attack success rate of the fgm attack and the CW attack on the recognition model in S1 and the detection success rate of this method. Among them, PSR is the power ratio of the attack perturbation relative to the sample, which is controlled by ε in fgm attack. In CW attack, its PSR is fixed according to the optimization result.

[0071] Table 1

Claims

1. A method for detecting adversarial attacks based on feature space projection, characterized in that: The testing steps include: The signal emitted by the communication radiation source is collected and stored as a time domain signal, and then the time domain signal is energy detected. At the same time, a simulated noise signal is used as a threshold for energy detection. If the signal passes the threshold screening, it is considered to be a valid signal. The time domain signal is retained as a sample to be detected and input into an electromagnetic target recognition model. The K intermediate layers in the electromagnetic target recognition model are used to output the feature vectors of the K intermediate layers of the sample to be detected; K is less than or equal to the total number of intermediate layers of the electromagnetic target recognition model; the electromagnetic target recognition model is a deep neural network that has completed training; The ratio of the projection lengths of the K feature vectors of the sample to be detected on the normal sample subspace and the adversarial subspace is used as the detection quantity of the sample to be detected, and the K detection quantities are combined to obtain the detection quantity curve vector of the sample to be detected; For the K intermediate layers of the sample to be detected, the slope of the Kth detection value and the previous K-1 detection values ​​is calculated to obtain the K-1 slopes of the sample to be detected. The K-1 slopes are compared with the preset slope detection threshold one by one. If two or more of the K-1 slopes are less than the slope detection threshold, the sample to be detected is judged to be an adversarial sample and an adversarial attack is detected. Otherwise, the next step of judgment is performed. Determine whether the ratio of the projection lengths of the characteristic vectors of the K intermediate layers of the sample to be detected on the normal sample subspace and the adversarial subspace is greater than the average detection quantity in the Kth intermediate layer. If so, the sample to be detected is judged to be a normal sample. Otherwise, calculate the similarity between the detection quantity curve of the sample to be detected and the average detection quantity curve vector. If the similarity is greater than the preset similarity detection threshold, the sample to be detected is judged to be an adversarial sample. If the similarity is less than or equal to the preset similarity detection threshold, the sample to be detected is judged to be a normal sample.

2. The method according to claim 1, wherein: The preset slope detection threshold, the average detection amount in the Kth middle layer, the average detection amount curve vector and the preset similarity detection threshold are obtained through the following preprocessing steps: Collect several normal samples of M types of electromagnetic targets, input all normal sample sets into the electromagnetic target recognition model, and use K intermediate layers in the electromagnetic target recognition model to output the feature vectors of the normal samples; Take the average value of all feature vectors of each class output by each intermediate layer to calculate the central feature matrix of each class; for each intermediate layer, merge the central feature matrices of M classes into the central feature matrix of the intermediate layer; For each intermediate layer, the first unitary matrix obtained by singular value decomposition of the central feature matrix is ​​divided into two mutually orthogonal parts: the sample subspace and the adversarial subspace. For each intermediate layer, the ratio of the projection lengths of the feature vectors of each normal sample on the normal sample subspace and the adversarial subspace is used as the detection quantity. The detection quantities corresponding to the K intermediate layers are combined to obtain the detection quantity curve vector of each normal sample. Then, the average detection quantity of all samples in each intermediate layer is obtained according to the mean value of all elements in the detection quantity curve vector of each normal sample. The average detection quantity curve vector obtained by combining the average detection quantities corresponding to the K intermediate layers is: For each normal sample, calculate the K-th element in the detection curve vector and the K-1 slope values ​​of the first K-1 elements to form a slope vector, and then combine the J vectors to form a slope matrix; Select a normal sample whose slope vector is smaller than the average detection value in the K-th middle layer, and calculate the similarity between the detection value curve vector of the selected normal sample and the average detection value curve vector; In the similarity between the detection quantity curve vector of the selected normal sample and the average detection quantity curve vector, a quantile is selected as the similarity detection threshold as needed, and a suitable quantile is selected in the slope matrix as the slope detection threshold vector; wherein each element in the detection threshold vector is represented as a slope detection threshold.

3. The method according to claim 2, wherein: Take the average value of all feature vectors of each class output by each intermediate layer and calculate the central feature matrix C of each class i k The method is: in, It represents the feature vector output by the lth sample in the i-th category after passing through the kth intermediate layer of the electromagnetic target recognition model, where variable i = 1, 2, ..., M, variable l = 1, 2, ..., L, and variable k = 1, 2, ..., K; M is the number of electromagnetic target categories, and L is the number of normal samples of each electromagnetic target category; For each intermediate layer, the central feature matrix of the M class is merged into the central feature matrix G of the intermediate layer k , G k =(C 1 k ,C 2 k ,…,C M k ).

4. The method according to claim 2, wherein: For the central feature matrix G of each intermediate layer k Perform singular value decomposition G k =v k T Σu, get the first unitary matrix v k ; Take v k The first N columns are used as the sample subspace v k,1 , and the rest is used as the adversarial subspace v k,2 , sample subspace v k,1 and adversarial subspace v k,2 mutually orthogonal, T Represents matrix transpose, variable k=1,2,...,K.

5. The method according to claim 2, wherein: In the preprocessing step: for each intermediate layer, the feature vector B of each normal sample k,j The ratio of the projection lengths θ on the normal sample subspace and the adversarial subspace k,j As the detection amount, the detection amount curve vector Γ obtained by combining the detection amounts corresponding to the K intermediate layers j , and then the detection curve vector Γ j The average value of all elements in the kth intermediate layer is the average detection amount of all samples Merge the average detection amount corresponding to K intermediate layers The average detection curve vector obtained C j =(θ 1,j ,i 2,j ,...,θ K,j ) Among them, the eigenvector B k,j To transform the feature vector The type dimension i and the sample number dimension l are combined to represent the new representation, j is the sample number in the total number J, j = 1, 2, ..., J, J = M * L; |||| 2 represents the 2 norm, v k,1 is the sample subspace, v k,2 For adversarial subspace, variable k = 1, 2, ..., K; In the detection step: the feature vectors of the K intermediate layers of the sample to be detected are respectively measured in the normal sample subspace v k,1 and adversarial subspace v k,2 The ratio of the upper projection length θ k As the detection amount of the sample to be detected, K detection amounts are combined to obtain the detection amount curve vector Γ of the sample to be detected; C=(θ1,θ2,...,θ K ); Among them, A k The sample to be detected is input into the electromagnetic target recognition model to obtain the feature vector output by each intermediate layer.

6. The method according to claim 5, wherein: For each normal sample j, the detection curve vector Γ is calculated separately j The Kth element and the K-1 slope values ​​of the first K-1 elements form the slope vector h j , and then the slope vectors of J samples are combined into the slope matrix H: H=(h1,h2,...,h J ) Wherein, variable k′=1,2,...,K-1; In the detection step: for the K middle layers of the sample to be detected, calculate the ratio θ K Combined with the slope of the first K-1 points, we can get the K-1 slopes h of the sample to be tested. k′ :

7. The method according to claim 5, wherein: In the preprocessing step: calculate the detection curve vector Γ of the selected normal sample j and the average detection curve vector The similarity σ j , specifically: Among them, α k is the similarity coefficient, α k ∈[0,1]; In the detection step, the detection amount curve Γ of the sample to be detected and the average detection amount curve vector are calculated The similarity σ is specifically:

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 are implemented.

Images