Attack and defense confrontation method, device, equipment and medium for network and power data recognition model
By conducting offensive and defensive confrontations on the network and electricity data recognition model, a model with defensive capabilities is generated, which solves the problem of vulnerability of artificial intelligence technology in the face of malicious sample attacks, and understands the model decision-making process through interpretable presentation, improving the model's robustness. Stickiness and defense.
Patent Information
- Application Number
- CN202410449195.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-15
- Publication Date
- 2025-01-21
- Estimated Expiration
- 2044-04-15
AI Technical Summary
Existing artificial intelligence technologies are fragile when facing attacks from malicious samples, resulting in increased security detection and defense challenges in cyberspace and electromagnetic space. At the same time, the algorithm is insufficient to explain the decision-making process to users.
By obtaining and extracting key features of grid and electricity data, we build an original data sample set and build an initial model for training. Then the original sample data set is perturbed to generate an adversarial feature data sample set, and a gradient adversarial attack is performed to obtain interpretable comparative presentation results. Based on this result, the original sample data set is modified in a targeted manner, a targeted adversarial data sample set is generated and the original data sample set is randomly spliced to form a defense model data sample set, and the network and electricity data recognition model is trained to generate a defensive model. Model.
By conducting offensive and defensive confrontations on the network and electricity data recognition model, we can improve its robustness in confrontation scenarios, reduce the impact of adversarial samples on the classification and recognition model, improve the defense capabilities of the model, and better understand the model through interpretability presentation. decision-making process.
Smart Images
Figure CN118378690B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of artificial intelligence security technology, and in particular to an attack and defense confrontation method, device, equipment and medium for a network and electrical data recognition model. Background Art
[0002] At present, artificial intelligence is widely used in cyberspace and electromagnetic space adversarial technologies. However, since artificial intelligence technology is vulnerable to weak perturbations and deceptions of malicious samples at the model algorithm and data levels, it has brought greater challenges to the security detection and defense of cyberspace and electromagnetic space. The robustness of the attack adversarial model mainly depends on the attacker's ability to make the adversarial sample as close to the original input as possible. For different adversarial attack samples, the defense capabilities of the attack adversarial model are often quite different. At the same time, for some normal samples, there may also be different degrees of misidentification probability. In addition, poor interpretability is also one of the drawbacks of current artificial intelligence technology. There is an unobservable black box space between the input data and the output answer of the algorithm, and its decision and behavior cannot be explained to the user. Summary of the invention
[0003] The purpose of the present invention is to provide an attack and defense confrontation method, device, equipment and medium for network and power data recognition model to improve the above problems. In order to achieve the above purpose, the technical solution adopted by the present invention is as follows:
[0004] In a first aspect, the present application provides an attack and defense method for a network and electric data recognition model, including:
[0005] Obtain multiple pieces of grid power data, extract key features of the grid power data to construct an original data sample set;
[0006] Constructing an initial model, and using the original data sample set to train and test the initial model to obtain a network power data recognition model;
[0007] After perturbing the original sample data set, an adversarial feature data sample set is generated, and the adversarial feature data sample set is used to perform a gradient adversarial attack on the power grid data recognition model to obtain an interpretable comparison presentation result;
[0008] Based on the interpretability comparison presentation results, the original sample data set is modified again to generate a targeted adversarial data sample set, and the targeted adversarial data sample set and the original data sample set are randomly spliced into a defense model data sample set;
[0009] The network and power data recognition model is trained using the defense model data sample set to obtain a network and power data recognition defense model with defense capabilities.
[0010] In a second aspect, the present application also provides an attack and defense confrontation device for a network and electric data recognition model, including:
[0011] Acquisition module: used to acquire multiple pieces of grid power data and extract key features of grid power data to construct a sample set of original data;
[0012] Model building module: used to build an initial model, train and test the initial model using the original data sample set to obtain a grid power data recognition model;
[0013] Adversarial attack module: used to generate an adversarial feature data sample set after perturbing the original sample data set, and use the adversarial feature data sample set to perform a gradient adversarial attack on the power grid data recognition model to obtain an interpretable comparison presentation result;
[0014] Modification module: used to modify the original sample data set in a targeted manner based on the interpretability comparison presentation result, generate a targeted adversarial data sample set, and randomly splice the targeted adversarial data sample set and the original data sample set into a defense model data sample set;
[0015] Training module: used to train the network and power data recognition model using the defense model data sample set to obtain a network and power data recognition defense model with defense capabilities.
[0016] In a third aspect, the present application also provides an attack and defense confrontation device for a network and electric data recognition model, including:
[0017] Memory for storing computer programs;
[0018] A processor is used to implement the steps of the attack and defense confrontation method of the network and power data identification model when executing the computer program.
[0019] In a fourth aspect, the present application also provides a readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned attack and defense confrontation method based on the network and electrical data identification model are implemented.
[0020] The beneficial effects of the present invention are:
[0021] The present invention conducts attack and defense confrontation on the network and power data recognition model, and presents its recognition ability, the anti-attack ability of the original model, and the defense ability of the reinforced model in an explainable way. According to the explainable presentation results, the decision-making process and behavior of the model can be more comprehensively understood, and the generated adversarial samples can be better utilized to further improve the robustness of the recognition model in adversarial scenarios, thereby reducing the impact of adversarial samples on the classification and recognition model, and obtaining a more effective defense model.
[0022] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or be understood by implementing the embodiments of the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.
[0024] Figure 1 It is a schematic diagram of the attack and defense confrontation method of the network and power data identification model described in an embodiment of the present invention;
[0025] Figure 2 It is a schematic diagram of the structure of the attack and defense confrontation device of the network and electric data recognition model described in an embodiment of the present invention;
[0026] Figure 3 It is a schematic diagram of the attack and defense equipment structure of the network and power data recognition model described in an embodiment of the present invention.
[0027] Markings in the figure:
[0028] 800. Attack and defense countermeasure equipment for network and electrical data recognition model; 801. Processor; 802. Memory; 803. Multimedia component; 804. I / O interface; 805. Communication component. DETAILED DESCRIPTION
[0029] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.
[0030] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.
[0031] First of all, before training the recognition model, it is necessary to identify the network data and distinguish between wired network traffic data and wireless network electromagnetic signal data. For wired network traffic data, an attack and defense confrontation method of a network traffic recognition model is provided, and for wireless network electromagnetic signal data, an attack and defense confrontation method of an electromagnetic signal recognition model is provided.
[0032] Embodiment 1:
[0033] This embodiment provides an attack and defense confrontation method for a network data identification model, specifically an attack and defense confrontation method for a network traffic identification model, including the following steps:
[0034] See also Figure 1 , the figure shows that the method includes:
[0035] S1. Obtain multiple network traffic data, extract key features of the network traffic data to construct an original data sample set;
[0036] Specifically, the step S1 includes:
[0037] S11. Acquire multiple pieces of original network traffic data, the attributes of the original network traffic data include normal network traffic data and different types of abnormal network traffic data, and obtain network traffic data after preprocessing the original network traffic data;
[0038] Specifically, the types of abnormal network traffic data include but are not limited to DoS Hulk, PortScan, DDoS, DoS GoldenEver, FIP-Patator, SSH-Patator, DoSslowloris, etc.
[0039] S12. Extract features from each piece of network traffic data to obtain several features corresponding to each piece of network traffic data;
[0040] Preferably, the minimum and maximum normalization method is used to normalize the features so that the data is mapped to the range [0, 100].
[0041] S13. sorting the importance of several features of the network traffic data by using a random forest model, and determining the key features corresponding to the network traffic data according to the importance of the features;
[0042] Specifically, by adjusting the parameters of the random forest model, when the classification accuracy of the feature reaches the optimal value, the importance index of each feature in the optimal model is output, and the feature importance is sorted in descending order from large to small. According to the feature importance, the first 18 features with importance index greater than 0.01 are selected as key features, that is, 18 key features are determined for the network traffic data of each attribute.
[0043] S14. Use the key features of the network traffic data as input labels and the attributes of the network traffic data as output labels to form an original data sample set.
[0044] Based on the above embodiments, the method further includes:
[0045] S2. Construct an initial model, train and test the initial model using the original data sample set to obtain a network traffic data recognition model, preferably, the initial model includes but is not limited to 1D-CNN, BiLSTM, Transformer and its combined model CNN-BiLSTM model;
[0046] Specifically, step S2 includes:
[0047] S21. Divide the original data sample set into a training set and a test set according to an 8:2 ratio;
[0048] S22. train the initial model using the training set;
[0049] Specifically, normal network traffic data and different types of abnormal network traffic data in the training set are respectively input into the initial model for learning and training.
[0050] S23. Input the test set into the trained initial model, and the initial model learns the key features of the network traffic data and outputs the predicted attributes of the network traffic data;
[0051] S24. Calculate the loss function using the predicted attributes and true attributes of the network traffic data. When the loss function reaches a preset threshold, obtain a network traffic data recognition model.
[0052] Based on the above embodiments, the method further includes:
[0053] S3. After perturbing the original sample data set, an adversarial feature data sample set is generated, and the adversarial feature data sample set is used to perform a gradient adversarial attack on the network traffic data recognition model to obtain an interpretable comparison presentation result;
[0054] Specifically, step S3 includes:
[0055] S31. Determine the stopping condition of the disturbance, wherein the stopping condition includes the maximum number of iterations max_iter and the maximum disturbance range eps. In this embodiment, the maximum disturbance range eps is set to 5%;
[0056] S32. Perform gradient perturbation on each group of original data samples in the original sample data set. When the range of the perturbation exceeds the maximum perturbation range or the number of perturbations reaches the maximum number of iterations, stop the perturbation to obtain adversarial feature data samples;
[0057] Specifically, each set of original sample data is subjected to gradient perturbation, and the perturbation step length is eps_iter. The specific perturbation process is as follows:
[0058]
[0059] In the formula, x i is the original input data, is the sample data generated by the i-th round of disturbance, is the sample data generated by the perturbation of the i+1th round, y is the true category label of the original input, α is the perturbation intensity of each iteration, ∈ is the maximum distortion of the original input data, α is usually much smaller than ∈, and J is the loss function. δ is the randomly initialized adversarial perturbation, usually uniformly distributed in the range of (-∈,∈); Project is the projection function, which limits all perturbed values to the ∈ domain while ensuring that they do not exceed the value range. Represents the loss function for x i The partial derivative of .
[0060] S33. All adversarial feature data samples constitute an adversarial feature data sample set;
[0061] S34. Input the original sample data set and the adversarial feature data sample set into the network traffic data recognition model for prediction, and obtain the prediction results of the original sample data set and the adversarial feature data sample set;
[0062] S35. Compare the prediction results of the original sample data set with the prediction results of the adversarial feature data sample set to obtain an interpretable presentation of the attack result and an interpretable presentation of the attack effect;
[0063] Specifically, the step S35 includes:
[0064] S351. Generate a first confusion matrix using the prediction results of the original sample data set, see Table 1;
[0065] Table 1
[0066]
[0067] In the table, TP represents the number of normal network traffic data recognized as normal network traffic data by the network traffic data recognition model, FN represents the number of normal network traffic data recognized as abnormal network traffic data by the network traffic data recognition model, FP represents the number of abnormal network traffic data recognized as normal network traffic data by the network traffic data recognition model, and TN represents the number of abnormal network traffic data recognized as abnormal network traffic data by the network traffic data recognition model.
[0068] S352. Calculate the first evaluation index of the network traffic data recognition model before being attacked according to the first confusion matrix;
[0069] The accuracy, precision, recall, and macro-weighted F1 score are used as indicators to evaluate the classification performance of the network traffic data recognition model. The specific calculation process is as follows:
[0070]
[0071] S353. Generate a second confusion matrix using the prediction results of the adversarial feature data sample set;
[0072] S354. Calculate a second evaluation index after the network traffic data recognition model is attacked according to the second confusion matrix;
[0073] S355. Compare the first evaluation index and the second evaluation index to obtain an interpretable presentation of the attack effect, obtain a comparison chart based on the evaluation index before and after the adversarial attack, and present an interpretable presentation of the evaluation index change to determine the quality of the attack effect;
[0074] S356. Visually compare the prediction results of network traffic data of each attribute in the original sample data set with the prediction results of network traffic data of each attribute in the adversarial feature data sample set to obtain an interpretable presentation of the attack results;
[0075] S36. Use the prediction results of the original sample data set and the prediction results of the adversarial feature data sample set to perform reverse reasoning on the network traffic data recognition model to obtain an interpretable presentation of the feature data sample changes;
[0076] Specifically, in order to better understand the decision-making process and behavior of the model, LRP reasoning is performed on the original sample data set and the adversarial feature data sample set. The decision of the neural network is decomposed into the contribution of each input feature through back propagation. The reasoning process of LRP is as follows:
[0077] 1) Take out each layer of the neural network of the network traffic data recognition model in reverse order, and reversely infer based on the output results;
[0078] 2) Using the output of the last layer of neural network as input to perform LRP reasoning, obtaining an output result, and using the output result as input of the penultimate layer of neural network;
[0079] Assume the input feature is X = (x1, x 2, …,x n ), the output feature is Y=(y1,y 2, …,y m ), where n is the number of input features and m is the number of outputs. Let R be the associated value to be propagated, R = (r1, r2, ..., r n ).
[0080] The last layer of association propagation is:
[0081]
[0082] Among them, k represents the last layer of neural network, R k represents the feature importance of the input features of the last layer of neural network, X k represents the input features of the last layer of neural network, and Y represents the output features of the last layer of neural network. k Represents the weight parameter of the last layer of neural network. e1 is a minimum value to prevent the denominator from being 0.
[0083] The associated propagation of the hidden layer is:
[0084]
[0085] Among them, l represents the lth layer of neural network, R l represents the feature importance of the input features of the lth layer, X l Represents the input features of the l-th layer neural network, y l Represents the output features of the l-th layer neural network. Θ l Represents the weight parameter of the l-th layer of the neural network. e is a minimum value to prevent the denominator from being 0.
[0086] 3) Repeat step 2) to complete the reverse input of each layer of the neural network;
[0087] 4) Finally, the importance of each feature is generated and the importance of the features is re-sorted in descending order;
[0088] By comparing the importance ranking of the features obtained by reasoning with the importance ranking before the attack, we can get the interpretable presentation of the feature data sample changes. Through the interpretable presentation of the feature data sample changes, we can understand the decision-making process and behavior of the model, and thus understand the changes in the features that the neural network pays attention to when completing the classification and recognition tasks. Based on the above understanding, targeted improvement measures are taken for the original sample data to optimize the performance and interpretability of the model.
[0089] Based on the above embodiments, the method further includes:
[0090] S4. Based on the interpretability comparison presentation results, the original sample data set is modified again to generate a targeted adversarial data sample set, and the targeted adversarial data sample set and the original data sample set are randomly spliced into a defense model data sample set;
[0091] Specifically, step S4 includes:
[0092] S41. Determine the maximum modification range of the original sample data based on the interpretable presentation of the attack results and the interpretable presentation of the feature data sample changes;
[0093] S42. Modify the original data sample set in a targeted manner within the maximum modification range to obtain a targeted adversarial data sample set;
[0094] S43. Randomly concatenate the targeted adversarial data sample set and the original data sample set into a defense model data sample set.
[0095] Based on the above embodiments, the method further includes:
[0096] S5. Use the defense model data sample set to train the network traffic data recognition model to obtain a network traffic data recognition defense model with defense capabilities;
[0097] Specifically, step S5 includes:
[0098] S51. Input the defense model data sample set into the network traffic data recognition model for training to obtain the prediction result of the defense model data sample set;
[0099] The defense process of the network traffic data identification model is as follows:
[0100]
[0101] Among them, X represents the input of the sample, δ represents the perturbation superimposed on the input, y is the label of the sample, (X, y) ~ D represents the data of the sampling distribution, ∥δ∥≤∈ means limiting the perturbation δ to the range ∈, L(X+δ, y, θ) represents the loss obtained by superimposing a perturbation δ on the sample X and comparing it with the label y through the network traffic recognition model, and θ represents the weight and bias of the model.
[0102] S52. Generate a third confusion matrix using the prediction results of the defense model data sample set, and calculate a third evaluation index after the network traffic data recognition model defense according to the third confusion matrix;
[0103] S53. Compare the second evaluation index and the third evaluation index to determine the effectiveness of the model defense;
[0104] S54. Use the prediction results of the original sample data set and the prediction results of the defense model data sample set to perform reverse reasoning on the network traffic data recognition model to obtain an interpretable presentation of the feature data sample changes.
[0105] Embodiment 2:
[0106] This embodiment provides an attack and defense confrontation method for a network and electric data recognition model, specifically an attack and defense confrontation method for an electromagnetic signal recognition model, including the following steps:
[0107] See also Figure 1 , the figure shows that the method includes:
[0108] S1. Acquire multiple electromagnetic signals, extract key features of the electromagnetic signals to construct an original data sample set;
[0109] Specifically, the step S1 includes:
[0110] S11. Acquire multiple pieces of original electromagnetic signal data, wherein the attributes of the original electromagnetic signal data include 8 digital signals (such as common QPSK, 8PSK and QAM16, etc.) and 3 analog signals (such as AM-DSB, etc.), pre-process the electromagnetic signal data using Rayleigh fading and Gaussian white noise channel setting methods, and set the electromagnetic signal data to different levels of signal-to-noise ratios from -10dB to 30dB;
[0111] S12. extracting features from each electromagnetic signal data using a feature extraction method based on a combination of artificial features and a deep learning model to obtain a number of features corresponding to each electromagnetic signal data;
[0112] S13. Use kernelized principal component analysis (KPCA) to rank the importance of several features, and determine the key features corresponding to the electromagnetic signal data according to the importance of the features;
[0113] S14. The key features of the electromagnetic signal data are used as input labels, and the attributes of the electromagnetic signal data are used as output labels to form an original data sample set.
[0114] Based on the above embodiments, the method further includes:
[0115] S2. Construct an initial model, train and test the initial model using the original data sample set to obtain an electromagnetic signal data recognition model, preferably, the initial model includes but is not limited to 1D-CNN, BiLSTM, Transformer and its combined model CNN-BiLSTM model;
[0116] Specifically, step S2 includes:
[0117] S21. Divide the original data sample set into a training set and a test set according to an 8:2 ratio;
[0118] S22. train the initial model using the training set;
[0119] Specifically, normal electromagnetic signal data and different types of abnormal electromagnetic signal data in the training set are respectively input into the initial model for learning and training.
[0120] S23. Inputting the test set into the trained initial model, the initial model learns the key features of the electromagnetic signal data and outputs the predicted attributes of the electromagnetic signal data;
[0121] S24. The loss function is calculated using the predicted attributes and true attributes of the electromagnetic signal data. When the loss function reaches a preset threshold, an electromagnetic signal data recognition model is obtained.
[0122] Based on the above embodiments, the method further includes:
[0123] S3. After perturbing the original sample data set, an adversarial feature data sample set is generated, and the adversarial feature data sample set is used to perform a gradient adversarial attack on the electromagnetic signal data recognition model to obtain an interpretable comparison presentation result;
[0124] Specifically, step S3 includes:
[0125] S31. Determine the stopping condition of the disturbance, wherein the stopping condition includes the maximum number of iterations max_i ter and the maximum disturbance range eps. In this embodiment, the maximum disturbance range eps is set to 5%;
[0126] S32. Perform gradient perturbation on each group of original data samples in the original sample data set. When the range of the perturbation exceeds the maximum perturbation range or the number of perturbations reaches the maximum number of iterations, stop the perturbation to obtain adversarial feature data samples;
[0127] S33. All adversarial feature data samples constitute an adversarial feature data sample set;
[0128] S34. Input the original sample data set and the adversarial feature data sample set into the electromagnetic signal data recognition model for prediction, and obtain the prediction results of the original sample data set and the adversarial feature data sample set;
[0129] S35. Compare the prediction results of the original sample data set with the prediction results of the adversarial feature data sample set to obtain an interpretable presentation of the attack result and an interpretable presentation of the attack effect;
[0130] Specifically, the step S35 includes:
[0131] S351. Generate a first confusion matrix using the prediction results of the original sample data set;
[0132] S352. Calculate the first evaluation index of the electromagnetic signal data recognition model before being attacked according to the first confusion matrix;
[0133] S353. Generate a second confusion matrix using the prediction results of the adversarial feature data sample set;
[0134] S354. Calculate a second evaluation index after the electromagnetic signal data recognition model is attacked according to the second confusion matrix;
[0135] S355. Compare the first evaluation index and the second evaluation index to obtain an interpretable presentation of the attack effect, obtain a comparison chart based on the evaluation index before and after the adversarial attack, and present an interpretable presentation of the evaluation index change to determine the quality of the attack effect;
[0136] S356. Visually compare the prediction results of the electromagnetic signal data of each attribute in the original sample data set with the prediction results of the electromagnetic signal data of each attribute in the adversarial feature data sample set to obtain an interpretable presentation of the attack results;
[0137] S36. Using the prediction results of the original sample data set and the prediction results of the adversarial feature data sample set, reverse reasoning is performed on the electromagnetic signal data recognition model to obtain an interpretable presentation of the feature data sample changes;
[0138] Specifically, in order to better understand the decision-making process and behavior of the model, LRP inference is performed on the original sample data set and the adversarial feature data sample set, and the decision of the neural network is decomposed into the contribution degree of each input feature through back propagation.
[0139] Based on the above embodiments, the method further includes:
[0140] S4. Based on the interpretability comparison presentation results, the original sample data set is modified again to generate a targeted adversarial data sample set, and the targeted adversarial data sample set and the original data sample set are randomly spliced into a defense model data sample set;
[0141] Specifically, step S4 includes:
[0142] S41. Determine the maximum modification range of the original sample data based on the interpretable presentation of the attack results and the interpretable presentation of the feature data sample changes;
[0143] S42. Modify the original data sample set in a targeted manner within the maximum modification range to obtain a targeted adversarial data sample set;
[0144] S43. Randomly concatenate the targeted adversarial data sample set and the original data sample set into a defense model data sample set.
[0145] Based on the above embodiments, the method further includes:
[0146] S5. training the electromagnetic signal data recognition model using the defense model data sample set to obtain an electromagnetic signal data recognition defense model with defense capability;
[0147] Specifically, step S5 includes:
[0148] S51. Input the defense model data sample set into the electromagnetic signal data recognition model for training to obtain the prediction result of the defense model data sample set;
[0149] S52. Generate a third confusion matrix using the prediction results of the defense model data sample set, and calculate a third evaluation index after the electromagnetic signal data recognition model defense according to the third confusion matrix;
[0150] S53. Compare the second evaluation index and the third evaluation index to determine the effectiveness of the model defense;
[0151] S54. Use the prediction results of the original sample data set and the prediction results of the defense model data sample set to perform reverse reasoning on the electromagnetic signal data recognition model to obtain an interpretable presentation of the feature data sample changes.
[0152] Embodiment 4:
[0153] like Figure 2 As shown, this embodiment provides an attack and defense confrontation device for a network and electric data recognition model, and the device includes:
[0154] Acquisition module: used to acquire multiple pieces of grid power data and extract key features of grid power data to construct a sample set of original data;
[0155] Model building module: used to build an initial model, train and test the initial model using the original data sample set to obtain a grid power data recognition model;
[0156] Adversarial attack module: used to generate an adversarial feature data sample set after perturbing the original sample data set, and use the adversarial feature data sample set to perform a gradient adversarial attack on the power grid data recognition model to obtain an interpretable comparison presentation result;
[0157] Modification module: used to modify the original sample data set in a targeted manner based on the interpretability comparison presentation result, generate a targeted adversarial data sample set, and randomly splice the targeted adversarial data sample set and the original data sample set into a defense model data sample set;
[0158] Training module: used to train the network and power data recognition model using the defense model data sample set to obtain a network and power data recognition defense model with defense capabilities.
[0159] Based on the above embodiment, the acquisition module includes:
[0160] Preprocessing unit: used to obtain multiple pieces of original grid power data, the attributes of which include normal grid power data and different types of abnormal grid power data, and to obtain grid power data by preprocessing the original grid power data;
[0161] Feature extraction unit: used to extract features from each piece of network power data to obtain several features corresponding to each piece of network power data;
[0162] Sorting unit: used to sort the importance of several features of power grid data and determine the key features corresponding to the power grid data according to the importance of the features;
[0163] The first construction unit is used to form an original data sample set by taking the key features of the power grid data as input labels and the attributes of the power grid data as output labels.
[0164] Based on the above embodiment, the model building module includes:
[0165] Division unit: used to divide the original data sample set into a training set and a test set according to a preset ratio;
[0166] The first training unit: used to train the initial model using the training set;
[0167] Testing unit: used to input the test set into the trained initial model. The initial model learns the key features of the power grid data and then outputs the predicted attributes of the power grid data.
[0168] The first calculation unit is used to calculate the loss function using the predicted attributes and real attributes of the power grid data, and when the loss function reaches a preset threshold, a power grid data recognition model is obtained.
[0169] Based on the above embodiment, the anti-attack module includes:
[0170] A first determining unit: used to determine a stopping condition of the disturbance, wherein the stopping condition includes a maximum number of iterations and a maximum disturbance range;
[0171] Perturbation unit: used to perform gradient perturbation on each group of original data samples in the original sample data set. When the perturbation range exceeds the maximum perturbation range or the number of perturbations reaches the maximum number of iterations, the perturbation is stopped to obtain adversarial feature data samples;
[0172] The second construction unit is used to form an adversarial feature data sample set from all adversarial feature data samples;
[0173] Prediction unit: used to input the original sample data set and the adversarial feature data sample set into the power grid data recognition model for prediction, and obtain the prediction results of the original sample data set and the adversarial feature data sample set;
[0174] The first comparison unit is used to compare the prediction results of the original sample data set with the prediction results of the adversarial feature data sample set to obtain an interpretable presentation of the attack result and an interpretable presentation of the attack effect;
[0175] Reverse reasoning unit: used to perform reverse reasoning on the power grid data recognition model using the prediction results of the original sample data set and the prediction results of the adversarial feature data sample set, and obtain an interpretable presentation of the feature data sample changes.
[0176] Based on the above embodiment, the first comparison unit includes:
[0177] A first generating unit: used for generating a first confusion matrix using the prediction result of the original sample data set;
[0178] A second calculation unit: used to calculate a first evaluation index before the network power data recognition model is attacked according to the first confusion matrix;
[0179] A second generating unit: used for generating a second confusion matrix using the prediction result of the adversarial feature data sample set;
[0180] A third calculation unit: used to calculate a second evaluation index after the network power data recognition model is attacked according to the second confusion matrix;
[0181] The second comparison unit is used to compare the first evaluation index and the second evaluation index to obtain an interpretable presentation of the attack effect;
[0182] The third comparison unit is used to visually compare the prediction results of the network and electrical data of each attribute in the original sample data set with the prediction results of the network and electrical data of each attribute in the adversarial feature data sample set, so as to obtain an interpretable presentation of the attack results.
[0183] Based on the above embodiment, the modification module includes:
[0184] A second determination unit: used to determine the maximum modification range of the original sample data based on the interpretable presentation of the attack result and the interpretable presentation of the feature data sample change;
[0185] Modification unit: used to modify the original data sample set in a targeted manner within the maximum modification range to obtain a targeted adversarial data sample set;
[0186] Splicing unit: used to randomly splice the targeted adversarial data sample set and the original data sample set into a defense model data sample set.
[0187] It should be noted that, regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment of the method, and will not be elaborated here.
[0188] Embodiment 3:
[0189] Corresponding to the above method embodiment, this embodiment also provides an attack and defense confrontation device for a network and electrical data identification model. The attack and defense confrontation device for a network and electrical data identification model described below and the attack and defense confrontation method for a network and electrical data identification model described above can be referenced to each other.
[0190] Figure 3 FIG. 8 is a block diagram of an attack and defense device 800 for a network and power data recognition model according to an exemplary embodiment. Figure 3 As shown, the attack and defense confrontation device 800 of the network and electric data identification model may include: a processor 801 and a memory 802. The attack and defense confrontation device 800 of the network and electric data identification model may also include one or more of a multimedia component 803, an I / O interface 804, and a communication component 805.
[0191] The processor 801 is used to control the overall operation of the attack and defense confrontation device 800 of the network and electric data recognition model to complete all or part of the steps in the attack and defense confrontation method of the network and electric data recognition model. The memory 802 is used to store various types of data to support the operation of the attack and defense confrontation device 800 of the network and electric data recognition model. These data may include, for example, instructions for any application or method operating on the attack and defense confrontation device 800 of the network and electric data recognition model, as well as application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 802 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk or optical disk. The multimedia component 803 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signal may be further stored in the memory 802 or sent via the communication component 805. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 804 provides an interface between the processor 801 and other interface modules, and the above-mentioned other interface modules can be keyboards, mice, buttons, etc. These buttons can be virtual buttons or physical buttons. The communication component 805 is used for wired or wireless communication between the attack and defense confrontation device 800 of the network electrical data recognition model and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 805 can include: Wi-Fi module, Bluetooth module, NFC module.
[0192] In an exemplary embodiment, the attack and defense confrontation device 800 of the network and power data identification model can be implemented by one or more application-specific integrated circuits (Application Specific Integrated Circuit, referred to as ASIC), digital signal processors (Digital Signal Processor, referred to as DSP), digital signal processing devices (Digital Signal Processing Device, referred to as DSPD), programmable logic devices (Programmable Logic Device, referred to as PLD), field programmable gate arrays (Field Programmable Gate Array, referred to as FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned attack and defense confrontation method of the network and power data identification model.
[0193] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the attack and defense confrontation method of the network and electric data identification model are implemented. For example, the computer-readable storage medium can be the memory 802 including the program instructions, and the program instructions can be executed by the processor 801 of the attack and defense confrontation device 800 of the network and electric data identification model to complete the attack and defense confrontation method of the network and electric data identification model.
[0194] Embodiment 4:
[0195] Corresponding to the above method embodiment, a readable storage medium is also provided in this embodiment. The readable storage medium described below and the attack and defense confrontation method of the network and electrical data identification model described above can be referred to each other.
[0196] A readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the attack and defense confrontation method of the network and electric data recognition model of the above method embodiment.
[0197] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.
[0198] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
[0199] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.
Claims
1. A method for attack and defense of a network data recognition model, characterized in that: include: Acquire multiple pieces of network and electricity data, wherein the network and electricity data include wired network traffic data and wireless network electromagnetic signal data; Extract key features of grid power data to construct the original data sample set, including: Acquire multiple pieces of original grid power data, wherein the attributes of the original grid power data include normal grid power data and different types of abnormal grid power data, and obtain the grid power data after preprocessing the original grid power data; Extract features from each piece of network power data to obtain several features corresponding to each piece of network power data; Sort the importance of several features of the power grid data, and determine the key features corresponding to the power grid data according to the importance of the features; The key features of the power grid data are used as input labels, and the attributes of the power grid data are used as output labels to form the original data sample set; Constructing an initial model, training and testing the initial model using the original data sample set to obtain a network and power data recognition model, wherein the network and power data recognition model is a network flow data recognition model or an electromagnetic signal data recognition model; After perturbing the original sample data set, an adversarial feature data sample set is generated, and the adversarial feature data sample set is used to perform a gradient adversarial attack on the power grid data recognition model to obtain interpretable comparison presentation results, including: Determining a stopping condition for the disturbance, wherein the stopping condition includes a maximum number of iterations and a maximum disturbance range; Perform gradient perturbation on each group of original data samples in the original sample data set. When the perturbation range exceeds the maximum perturbation range or the number of perturbations reaches the maximum number of iterations, stop the perturbation and obtain the adversarial feature data samples. All adversarial feature data samples constitute an adversarial feature data sample set; The original sample data set and the adversarial feature data sample set are respectively input into the power grid data recognition model for prediction, and the prediction results of the original sample data set and the adversarial feature data sample set are obtained; Compare the prediction results of the original sample data set with the prediction results of the adversarial feature data sample set to obtain the interpretable presentation of the attack results and the interpretable presentation of the attack effects, including: Generate a first confusion matrix using the prediction results of the original sample data set; Calculate a first evaluation index of the network power data recognition model before being attacked according to the first confusion matrix; Generate a second confusion matrix using the prediction results of the adversarial feature data sample set; Calculating a second evaluation index after the network power data recognition model is attacked according to the second confusion matrix; Compare the first evaluation index with the second evaluation index to obtain an interpretable presentation of the attack effect, obtain a comparison chart based on the evaluation indexes before and after the adversarial attack to interpret the changes in the evaluation indexes, and judge the effectiveness of the attack; The prediction results of the network and power data of each attribute in the original sample data set are respectively compared visually with the prediction results of the network and power data of each attribute in the adversarial feature data sample set to obtain an interpretable presentation of the attack results; The prediction results of the original sample data set and the prediction results of the adversarial feature data sample set are used to perform reverse reasoning on the power grid data recognition model to obtain an interpretable presentation of the feature data sample changes, including: Perform LRP reasoning on the original sample data set and the adversarial feature data sample set to generate the importance of each feature, re-sort the feature importance in descending order, and compare the importance ranking of the features obtained by reasoning with the importance ranking before the attack to obtain an interpretable presentation of the feature data sample changes; Based on the interpretability comparison presentation results, the original sample data set is modified again to generate a targeted adversarial data sample set, and the targeted adversarial data sample set and the original data sample set are randomly spliced into a defense model data sample set; The network and power data recognition model is trained using the defense model data sample set to obtain a network and power data recognition defense model with defense capabilities.
2. The attack and defense confrontation method of the network and power data recognition model according to claim 1 is characterized in that ,Based on the interpretability comparison presentation results, the original sample data set is modified again to generate a targeted adversarial data sample set, and the targeted adversarial data sample set and the original data sample set are randomly spliced into a defense model data sample set, including: Based on the interpretable presentation of attack results and the interpretable presentation of feature data sample changes, determine the maximum modification range of the original sample data; Perform targeted modification on the original data sample set within the maximum modification range to obtain a targeted adversarial data sample set; The targeted adversarial data sample set and the original data sample set are randomly spliced into the defense model data sample set.
3. An attack and defense device for network and electric data recognition model, characterized in that: include: Acquisition module: used to acquire multiple network data, including wired network flow data and wireless network electromagnetic signal data; Extract key features of grid power data to construct original data sample set; The acquisition module comprises: Preprocessing unit: used to obtain multiple pieces of original grid power data, the attributes of the original grid power data include normal grid power data and different types of abnormal grid power data, and obtain the grid power data after preprocessing the original grid power data; Feature extraction unit: used to extract features from each piece of network power data to obtain several features corresponding to each piece of network power data; Sorting unit: used to sort the importance of several features of power grid data and determine the key features corresponding to the power grid data according to the importance of the features; The first construction unit is used to form an original data sample set by taking the key features of the power grid data as input labels and the attributes of the power grid data as output labels; Model building module: used to build an initial model, train and test the initial model using the original data sample set to obtain a grid power data recognition model; Adversarial attack module: used to generate an adversarial feature data sample set after perturbing the original sample data set, and use the adversarial feature data sample set to perform a gradient adversarial attack on the power grid data recognition model to obtain an interpretable comparison presentation result; The anti-attack module includes: A first determining unit: used to determine a stopping condition of the disturbance, wherein the stopping condition includes a maximum number of iterations and a maximum disturbance range; Perturbation unit: used to perform gradient perturbation on each group of original data samples in the original sample data set. When the perturbation range exceeds the maximum perturbation range or the number of perturbations reaches the maximum number of iterations, the perturbation is stopped to obtain adversarial feature data samples; The second construction unit is used to form an adversarial feature data sample set from all adversarial feature data samples; Prediction unit: used to input the original sample data set and the adversarial feature data sample set into the power grid data recognition model for prediction, and obtain the prediction results of the original sample data set and the adversarial feature data sample set; The first comparison unit is used to compare the prediction results of the original sample data set with the prediction results of the adversarial feature data sample set to obtain an interpretable presentation of the attack result and an interpretable presentation of the attack effect, including: Generate a first confusion matrix using the prediction results of the original sample data set; Calculate a first evaluation index of the network power data recognition model before being attacked according to the first confusion matrix; Generate a second confusion matrix using the prediction results of the adversarial feature data sample set; Calculating a second evaluation index after the network power data recognition model is attacked according to the second confusion matrix; Compare the first evaluation index with the second evaluation index to obtain an interpretable presentation of the attack effect, obtain a comparison chart based on the evaluation indexes before and after the adversarial attack to interpret the changes in the evaluation indexes, and judge the effectiveness of the attack; The prediction results of the network and power data of each attribute in the original sample data set are respectively compared visually with the prediction results of the network and power data of each attribute in the adversarial feature data sample set to obtain an interpretable presentation of the attack results; Reverse reasoning unit: used to perform reverse reasoning on the network data recognition model using the prediction results of the original sample data set and the prediction results of the adversarial feature data sample set, and obtain an interpretable presentation of the feature data sample changes, including: Perform LRP reasoning on the original sample data set and the adversarial feature data sample set to generate the importance of each feature, re-sort the feature importance in descending order, and compare the importance ranking of the features obtained by reasoning with the importance ranking before the attack to obtain an interpretable presentation of the feature data sample changes; Modification module: used to modify the original sample data set in a targeted manner based on the interpretability comparison presentation result, generate a targeted adversarial data sample set, and randomly splice the targeted adversarial data sample set and the original data sample set into a defense model data sample set; Training module: used to train the network and power data recognition model using the defense model data sample set to obtain a network and power data recognition defense model with defense capabilities.
4. The attack and defense confrontation device of the network and electric data recognition model according to claim 3 is characterized in that: The modification module comprises: A second determination unit: used to determine the maximum modification range of the original sample data based on the interpretable presentation of the attack result and the interpretable presentation of the feature data sample change; Modification unit: used to modify the original data sample set in a targeted manner within the maximum modification range to obtain a targeted adversarial data sample set; Splicing unit: used to randomly splice the targeted adversarial data sample set and the original data sample set into a defense model data sample set.
5. An attack and defense device for network and electric data recognition model, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of the attack and defense confrontation method of the network and electrical data recognition model as described in any one of claims 1 to 2 when executing the computer program.
6. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the attack and defense confrontation method of the network and electrical data identification model as described in any one of claims 1 to 2.