A method for countering attacks on modulated signals under frequency constraints

Abstract

The present invention discloses a method for countering attacks on modulated signals under frequency constraints, and belongs to the technical field of electromagnetic signal countermeasures. The method includes the following steps: data set construction and data preprocessing: data whitening, symbol mapping and pulse shaping are performed on the data to realize data set construction and data preprocessing; modulation recognition network construction and training: using an artificial intelligence model as a modulation recognition network and training the modulation recognition network; disturbance addition: adding disturbances to make the modulation recognition network misjudge to avoid the illegal receiver from accurately identifying and decoding the transmission signal. The method of the present invention optimizes the countermeasure disturbance through the frequency constraint imposed by the low-pass filter, so that the countermeasure energy is concentrated in the signal spectrum. The present invention not only realizes the attacks of non-targeted attacks and targeted attacks, but also evaluates the effectiveness of the method through a large number of experiments and comprehensive indicators; while maintaining the concealment of the time domain and frequency domain, the countermeasure attack effect on the intelligent recognition model of the illegal receiver is significantly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of electromagnetic signal countermeasures, and more specifically to a method for counteracting attacks of modulated signals under frequency constraints. Background Art

[0002] With the rapid development of wireless communication technology, the modulation and transmission of electromagnetic signals play a vital role in modern communication systems. As one of the core technologies in wireless communication systems, automatic modulation recognition technology is widely used in various scenarios, including radio monitoring, electronic warfare, and intelligent communications. However, with the development and introduction of artificial intelligence technology, the automatic modulation recognition model based on artificial intelligence is facing new challenges while improving recognition accuracy and processing efficiency.

[0003] In recent years, studies have found that artificial intelligence models are vulnerable to adversarial examples. Adversarial examples are data that cause the model to make incorrect judgments by making small but carefully designed perturbations to the original input. This attack seriously threatens the application of artificial intelligence in automatic modulation recognition, affecting its efficiency, security and reliability. Most existing adversarial attack methods only consider the signal time domain, and introduce mutations in the time domain to cause the model to misjudge, but this often introduces a large number of high-frequency components in the frequency domain. These high-frequency components not only affect the effectiveness of signal transmission, but also increase the risk of detection and interception by illegal receivers, reduce the concealment of adversarial examples, and cause spectrum leakage problems of adversarial perturbations.

[0004] In the related art, Chinese patent CN116634437A provides a frequency-selective adversarial sample signal waveform generation method. This method converts the signal into frequency domain data through Fourier transform, then filters in the frequency domain, limits the spectrum of the generated adversarial perturbation to the specified frequency band, and finally converts the signal back to the time domain through inverse Fourier transform. However, this scheme has some limitations. First, it only generates and tests perturbations in the case of known models, that is, white-box attacks, which is not applicable to the attacked models that are often unknown in practice. In addition, this method requires a large number of Fourier transform and inverse transform operations, which is not suitable for real-time processing and low latency requirements. Secondly, this scheme does not consider comparisons with similar iterative algorithm MIM attacks, nor does it cover targeted attack situations that are often required in practical applications.

[0005] From the above, we can see that although the relevant technologies have considered the frequency domain problems in the field of electromagnetic signal adversarial samples to a certain extent, their applicability and effectiveness in practical applications still have certain limitations. Summary of the invention

[0006] 1. Technical problems to be solved

[0007] In response to the spectrum leakage problem existing in the existing electromagnetic signal counterattack technology, the present invention provides a modulated signal counterattack method under frequency constraint, which directly performs frequency constraint on the time domain signal through a Butterworth low-pass filter, avoids a large number of Fourier transform and inverse transform operations, and designs loss functions for untargeted attack and targeted attack, which limits the frequency domain of adversarial disturbance to the signal bandwidth range, avoids serious out-of-band leakage problems, maintains the concealment of adversarial samples in the time domain and frequency domain, and effectively causes the illegal detection model to make misjudgments.

[0008] 2. Technical solution

[0009] The purpose of the present invention is achieved through the following technical solutions.

[0010] A method for countering attacks on modulated signals under frequency constraints comprises the following steps:

[0011] Dataset construction and data preprocessing: Data whitening, symbol mapping and pulse shaping are performed to achieve data set construction and data preprocessing;

[0012] Construction and training of modulation recognition network: Use artificial intelligence model as modulation recognition network and train the modulation recognition network;

[0013] Perturbation addition: By adding disturbances, the modulation recognition network is misjudged to prevent the illegal interceptor from accurately identifying and decoding the transmitted signal.

[0014] Furthermore, the steps of data set construction and data preprocessing include: whitening the bit stream data to eliminate redundancy and correlation in the data and ensure that the data sequence conforms to independent distribution; symbol mapping the whitened bit stream data to map each group of bit sequences to corresponding modulation symbols; pulse shaping the modulation symbols after symbol mapping to adjust the frequency response and time domain characteristics of the signal to achieve the expected sampling of each symbol rate; data packaging of the signal after pulse shaping; channel modeling and sending the packaged signal to the channel model to obtain the received signal data; setting the number of sampling points of the received signal data, each signal vector consists of an in-phase component and an orthogonal component. Make a data set and adjust the signal shape in the data set.

[0015] Furthermore, the channel modeling process is: channel modeling is performed according to the random process of sampling rate offset, center frequency offset, multipath effect and fading, and additive white noise; wherein the modeling method is:

[0016]

[0017] Where f0 is the normalized frequency offset, σ 2 The variance value given for the signal-to-noise ratio, stx (t) and s r (t) are the transmitted signal and the received signal respectively, t is the time, e is the base of the natural logarithm, j is the imaginary unit, and N is the additive white noise.

[0018] Furthermore, the steps of building and training the modulation recognition network include: using artificial intelligence models as the modulation recognition network, including CNN, VGG16, Resnet18 and Resnet34; optimizing and adjusting the size and number of convolution kernels to adapt to the length, width and height of the input signal; initializing the training configuration to realize the training of the modulation recognition network.

[0019] Furthermore, the perturbation adding step includes calculating the loss function, calculating the gradient, filtering, and calculating the perturbation and iteratively updating.

[0020] Furthermore, the steps of calculating the loss function are: input the original signal as the adversarial signal into the recognition network to obtain the prediction result; design the untargeted attack loss function and the targeted attack loss function to measure the difference between the model prediction result and the true label.

[0021] Furthermore, the loss function of the untargeted attack is as follows:

[0022]

[0023] Among them, x adv is an adversarial sample, M represents the number of samples, C is the number of categories, y is the true label, f is the target model, It represents the probability that the i-th signal sample belongs to the j-th class.

[0024] Furthermore, the targeted attack loss function is as follows:

[0025]

[0026] Among them, x adv is an adversarial sample, M represents the number of samples, C is the number of categories, y is the true label, and y target is the target label, f is the target model, It represents the probability that the nth signal sample belongs to the mth class.

[0027] Furthermore, the gradient is calculated by backpropagating the gradient of the loss function with respect to the input. The calculation process is as follows:

[0028]

[0029] in, represents the back propagation algorithm, x adv For adversarial samples, g and g targetThey are the calculated gradient information of non-targeted attack and gradient information of targeted attack respectively.

[0030] Furthermore, the filtering steps are as follows:

[0031] Set the Nyquist rate of the Butterworth low-pass filter to 100kHz, the cutoff frequency to 15.6kHz, and the order to 15. Perform a filtering operation on the obtained gradient information through the filter. The process is as follows:

[0032] g f =filter(b,a,g);

[0033] Among them, b and a are filter coefficients, filter is the filter used, and its frequency response function is:

[0034]

[0035] Where s is the current frequency, ω c is the cutoff frequency of the filter and n is the order of the filter.

[0036] 3. Beneficial effects

[0037] Compared with the prior art, the advantages of the present invention are:

[0038] (1) The present invention uses a Butterworth low-pass filter to impose frequency constraint processing on the gradient information, and then obtains adversarial perturbations based on the gradient information, which effectively limits the high-frequency components in the adversarial perturbations, ensures that the spectrum distribution of the perturbations is concentrated within the signal bandwidth, and realizes non-targeted attacks and targeted attacks through loss function design;

[0039] (2) The present invention uses four different models as well as qualitative and quantitative indicators to evaluate and analyze the method. While ensuring the concealment in the time domain and frequency domain, it can effectively reduce the recognition accuracy of the modulation recognition model of the illegal receiver and improve the security and reliability of communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of a method for modulated signal countermeasure attack under frequency constraint in one embodiment of the present invention;

[0041] Figure 2 A schematic diagram of the principle of a method for countering attacks on modulated signals under frequency constraints in one embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the recognition accuracy of CNN, VGG16, Resnet18 and Resnet34 networks at different signal-to-noise ratio levels provided in one embodiment of the present invention;

[0043] Figure 4 A schematic diagram of recognition accuracy of adversarial samples generated by CNN under different signal-to-noise ratio levels in a white-box environment CNN provided by an embodiment of the present invention;

[0044] Figure 5 A schematic diagram of recognition accuracy of adversarial samples generated by CNN provided by an embodiment of the present invention at different signal-to-noise ratio levels in a black box environment VGG16;

[0045] Figure 6 A schematic diagram of a QAM-16 targeted attack effect of adversarial samples generated by VGG16 at different signal-to-noise ratio levels provided by an embodiment of the present invention;

[0046] Figure 7 A schematic diagram of the targeted attack effect of QAM-16 on adversarial samples generated by VGG16 in various categories provided by an embodiment of the present invention;

[0047] Figure 8 A schematic diagram of the time domain and frequency domain results of an original signal, FGSM, PGD, MIM, and a modulated signal counter-attack method under a frequency constraint provided in an embodiment of the present invention;

[0048] Fig. 9 A schematic diagram of an out-of-band energy ratio indicator OBER provided by an embodiment of the present invention;

[0049] Fig.10 A schematic diagram of a signal-to-disturbance ratio indicator SPR provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0051] Combination Figures 1 to 10 The present invention provides a method for countering attacks on modulated signals under frequency constraints, and the specific steps are as follows:

[0052] S1. Dataset construction and data preprocessing

[0053] Data set construction and data preprocessing are achieved by performing whitening, symbol mapping, and pulse shaping on the bit stream data. The specific process is as follows:

[0054] S101, whitening bit stream data:

[0055] The random number sequence generated by a computer is used as the bit stream data. Usually, a pseudo-random number generation algorithm or a piece of encoded text is used to generate the bit stream data, that is, a binary data stream composed of 0 and 1; and the bit stream data is whitened. Among them, whitening is a linear transformation, which is an operation to remove redundancy and correlation in the data sequence to make the data more random and uniformly distributed. The purpose is to ensure that the data sequence meets the assumption of independent and identical distribution for subsequent processing.

[0056] By whitening the bit stream data, redundancy and correlation in the data can be eliminated, making the data sequence more random and ensuring that the data sequence meets the assumption of independent distribution.

[0057] S102, symbol mapping:

[0058] The whitened bit stream data is symbol mapped, and each group of bit sequences is mapped to a corresponding modulation symbol.

[0059] S103, pulse shaping:

[0060] The modulation symbols after symbol mapping are pulse shaped by interpolating finite impulse response root raised cosine roll-off filter to adjust the frequency response and time domain characteristics of the signal and achieve the desired sampling of each symbol rate.

[0061] S104, data packaging:

[0062] The signal after pulse shaping processing is packaged, and the modular operation of GNU Radio (an open source toolkit for building software-defined radio systems) can be used to perform signal transmission format and error control coding, including preamble code, data payload and check part. The preamble code is used to synchronize the receiving end clock, the data payload transmits user data, and the check part performs error detection and correction.

[0063] S105. Channel modeling:

[0064] Channel modeling is performed based on factors such as sampling rate offset, random process of center frequency offset, multipath effect and fading, and additive white noise to obtain a designed channel model;

[0065] The packaged signal is sent to the designed channel model to obtain the received signal data. The specific modeling method is described as follows:

[0066] s r (t) = e -j2πf0t ·s tx (t)+N(0,σ 2 );

[0067] Where f0 is the normalized frequency offset, σ 2The variance value given for the signal-to-noise ratio, s tx (t) and s r (t) are the transmitted signal and the received signal respectively, t is the time, e is the base of the natural logarithm, j is the imaginary unit, and N is the additive white noise.

[0068] S106. Dataset production:

[0069] The number of sampling points of the received signal data is set to 128, and each signal vector consists of an in-phase component and an orthogonal component.

[0070] The data set includes eight digital signals: 8PSK, QPSK, BPSK, GFSK, CPFSK, PAM4, QAM16 and QAM64, and three analog signals: wideband frequency modulation (WBFM), double-sideband amplitude modulation (AM-DSB) and single-sideband amplitude modulation (AM-SSB).

[0071] A total of 220,000 data samples were generated, covering 20 signal-to-noise ratios from 18dB to -20dB, with a step size of 2dB.

[0072] S107, shape adjustment:

[0073] The signal shape in the data set is adjusted from [batchsize, 2, 128] to [batchsize, 1, 2, 128] as the input of the neural network model, where batchsize represents the number of samples contained in each batch, which is set to 256 in this embodiment; 1 represents the newly added channel dimension for compatibility with the recognition network architecture; 2 represents the two channels of the signal, namely the real part and the imaginary part of the signal; and 128 represents the length of each signal sample is 128 sampling points.

[0074] S2. Construction and training of modulation recognition network

[0075] The recognition network is trained by using the signal data as a training set to obtain a network that can perform modulation recognition. Through the trained network, the signal data is input and the predicted classification type is finally output.

[0076] S201, build modulation recognition network:

[0077] Artificial intelligence models are used as modulation recognition networks, including CNN, VGG16, Resnet18 and Resnet34; and the size and number of convolution kernels are optimized and adjusted to adapt to the length, width and height of the input signal.

[0078] Among them, CNN is a convolutional neural network; VGG16 is a 16-layer visual geometry group network; Resnet18 is an 18-layer deep residual neural network; Resnet34 is a 34-layer deep residual neural network.

[0079] S202, training modulation recognition network:

[0080] Training the modulation recognition network is achieved by selecting a loss function, selecting an optimizer, and initializing the training configuration.

[0081] Among them, the training configuration includes the learning rate lr, the number of training epochs, and the number of samples in each batch batchsize.

[0082] Specifically, the training process is as follows: first, select the model to be used; second, select the cross entropy loss function to measure the difference between the predicted results and the actual labels; then use the Adam optimizer to optimize the target model, set the CNN and VGG16 learning rates to 0.001, the Resnet18 and Resnet34 learning rates to 0.0002, and the batchsize to 256; finally, save the optimal network weight parameters to obtain the trained CNN, VGG16, Resnet18 and Resnet34 models.

[0083] like Figure 3 The figure shows the recognition accuracy of CNN, VGG16, Resnet18 and Resnet34 networks at different signal-to-noise ratio levels. The four curves are shown in the legend, representing the classification accuracy of the original samples of each model at different signal-to-noise ratios.

[0084] S3, disturbance addition:

[0085] Perturbation addition aims to generate adversarial perturbations and superimpose them on the original signal, deceiving the modulation recognition network by adding tiny perturbations. The superimposed signal can make the intelligent network / model of the illegal receiver misclassify, and ensure that the frequency is concentrated in the low-frequency part of the signal spectrum.

[0086] By calculating and adding carefully designed disturbances to deceive the modulation recognition network of the illegal interceptor and cause it to misjudge, the illegal interceptor is prevented from accurately identifying and decoding the transmission signal, thereby improving the confidentiality and security of communications.

[0087] The original signal at this time is the signal data processed through the above steps.

[0088] S301, loss function calculation:

[0089] The original signal is input into the recognition network as an adversarial signal to obtain the prediction result; the loss functions of untargeted attack and targeted attack are designed to measure the difference between the model prediction result and the true label, providing guidance for the generation of adversarial perturbations.

[0090] Among them, the non-targeted attack loss function is designed to make the prediction result of the adversarial sample as far away from the original label as possible; the targeted attack loss function is designed to make the prediction result of the adversarial sample as close to the target label as possible; among them, the non-targeted loss function is designed as shown in the formula:

[0091]

[0092] Among them, x adv is an adversarial sample, M represents the number of samples, C is the number of categories, y is the true label, f is the target model, It represents the probability that the i-th signal sample belongs to the j-th class.

[0093] In addition, the target attack loss function is designed as shown in the formula:

[0094]

[0095] Among them, x adv is an adversarial sample, M represents the number of samples, C is the number of categories, y is the true label, and y target is the target label, f is the target model, It represents the probability that the nth signal sample belongs to the mth class.

[0096] S302, gradient calculation:

[0097] The gradient of the loss function with respect to the input is calculated by backpropagation. The calculation process is shown in the formula:

[0098]

[0099] in, represents the back propagation algorithm, x adv For adversarial samples, g and g target They are the calculated gradient information of non-targeted attack and gradient information of targeted attack respectively.

[0100] Among them, the gradient with respect to the input refers to the gradient of the network parameters relative to the input data when calculating the loss function. The gradient represents the rate of change of the loss function as the input data changes, which can be used to guide the generation of adversarial samples. The gradient information provides information about how to adjust the input data to maximize the direction and size of the loss function. In addition, backpropagation is an algorithm used to calculate the derivative (gradient) of the loss function with respect to each parameter (including the input). It can calculate the gradient of the loss function with respect to the input signal data, that is, the sensitivity of the loss function to changes in the input signal. In adversarial attacks, the gradient of the input signal data is calculated to find the most effective way to change the input signal to maximize the loss function, thereby changing the model's prediction of the input signal.

[0101] S303, filtering:

[0102] This step uses a Butterworth low-pass filter, sets the Nyquist rate of the Butterworth low-pass filter to 100kHz, the cutoff frequency to 15.6kHz, and the order to 15, and performs a filtering operation on the obtained gradient information through the filter, as shown in the formula:

[0103] g f =filter(b,a,g);

[0104] Among them, b and a are filter coefficients, filter is the filter used, and its frequency response function is:

[0105]

[0106] Where s is the current frequency, ω c is the cutoff frequency of the filter and n is the order of the filter.

[0107] S304, perturbation calculation and iterative update:

[0108] In each iteration, the gradient of the current input with respect to the loss function is first calculated. The loss function selects different labels for calculation according to the attack type, where the attack type includes targeted attack or non-targeted attack;

[0109] Then, the filtered gradient information is processed according to the sign function to generate perturbations, and superimposed on the original signal to obtain new adversarial samples;

[0110] Finally, the prediction result is obtained and fed back by sending it into the network model, and then the perturbation is iteratively optimized according to the update rule, and the optimized adversarial sample is used as the input of the next iteration to ensure the effectiveness of the adversarial sample. The update rule is shown in the formula:

[0111]

[0112] Among them, α is the update step size, n is the current update number, sign is the sign function, Clip is the clipping function, ε is the perturbation factor, is the adversarial sample after the nth iteration update, This is the adversarial sample after the n+1th iterative update, and the above formula is used to iterate and update 30 times.

[0113] like Figure 4 As shown, it is a schematic diagram of the recognition accuracy of adversarial samples generated by CNN in the present invention at different signal-to-noise ratio levels under the white box environment CNN. It includes the recognition accuracy of the original signal, FGSM, PGD, MIM, and FCIAA, among which FGSM, PGD, and MIM are existing single-step and iterative attack methods, and FCIAA is the method of this embodiment. Obviously, the adversarial samples constructed by the method of this scheme cause significant interference to the recognition effect of the known illegal receiver.

[0114] In addition, if Figure 5 As shown, it is a schematic diagram of the recognition accuracy of adversarial samples generated by CNN in the present invention at different signal-to-noise ratio levels in the black box environment VGG16. It includes the recognition accuracy of the original signal, FGSM, PGD, MIM, and FCIAA, among which FGSM, PGD, and MIM are existing single-step and iterative attack methods, and FCIAA is the method of this embodiment. Obviously, the adversarial samples constructed by the method of this scheme cause significant interference to the recognition effect of the unknown illegal receiver.

[0115] The effect diagram of the adversarial samples generated by VGG16 in the present invention on the targeted attack on QAM-16 signals at different signal-to-noise ratio levels is shown in the figure. Figure 6 As shown in the figure, it reflects the effect changes of targeted attack under different signal-to-noise ratio levels. It can be seen that at low signal-to-noise ratio, the target attack effect of PGD algorithm is better than that of the other three algorithms; as SNR increases, when the signal-to-noise ratio is greater than 0dB, the attack effect of FCIAA algorithm is the best.

[0116] The schematic diagram of the effect of using VGG16 to generate adversarial samples to perform targeted attacks on QAM-16 signals in various categories in the present invention is as follows: Figure 7 As shown, it reflects the specific effects of targeted attacks under different categories. The bar chart shows the probability of each signal type being successfully misclassified as 16-QAM under different attack algorithms. The results show that 8PSK, AM-SSB and QAM64 signals are more likely to be misclassified as 16-QAM under PGD, MIM and FCIAA algorithms.

[0117] like Figure 8As shown, the time domain and frequency domain result diagrams of the original signal, FGSM, PGD, MIM and adversarial samples constructed by FCIAA are shown. FCIAA is the method of this embodiment. Through the visualization of time domain and frequency domain, it can be seen that FGSM, PGD and MIM algorithms show a large amount of energy distribution outside the 15.6kHz signal band. This shows that these algorithms tend to introduce disturbances in a wide range of spectrum, increasing the risk of detection and interception by illegal receivers. In contrast, the out-of-band energy distribution of the FCIAA algorithm is extremely low, and its disturbances are mainly concentrated in the signal spectrum, which shows that it is more concentrated on the attack energy within the signal spectrum range. The generated adversarial samples show more concentrated disturbance energy and have better time domain and frequency domain concealment.

[0118] like Fig. 9 As shown in the figure, the OBER is a schematic diagram of the out-of-band energy ratio index provided by the method of this scheme. A quantitative index is introduced to measure the distribution of the disturbance spectrum. Based on specific data and measurement values, the influence of subjective judgment is reduced, making the analysis results more objective and reliable. The formula is as follows:

[0119]

[0120] Among them, OBE is the energy of the perturbation outside the signal band, IBE is the energy of the perturbation within the signal band, out-band is the part outside the signal bandwidth, and all is the entire frequency band; s(i) represents adversarial perturbation; the bar chart shows the percentage of OBE and IBE of four different adversarial attack algorithms FGSM, PGD, MIM and FCIAA under untargeted and targeted attacks, and the corresponding OBER dB values ​​are also marked in the figure, providing a clear view of perturbation quantification. The perturbations of different adversarial attack algorithms have different characteristics in the frequency domain distribution. FGSM introduces significant out-of-band energy under both untargeted and targeted attacks, indicating that its adversarial perturbation is widely distributed outside the spectrum. PGD has higher out-of-band energy under untargeted attacks, but it is significantly reduced under targeted attacks, indicating that in targeted attacks, PGD's perturbations are more concentrated in the spectrum. MIM introduces higher out-of-band energy under both untargeted and targeted attacks, but the out-of-band energy is reduced under targeted attacks, indicating that MIM has relatively less spectrum perturbations in targeted attacks. The out-of-band energy of FCIAA in both untargeted and targeted attacks is very low, indicating that its disturbance is mainly concentrated in the signal spectrum.

[0121] like Fig.10As shown, it is a schematic diagram of the signal disturbance ratio index SPR provided by an embodiment of the present invention, which introduces a quantitative index to measure the strength of the disturbance relative to the original signal and evaluate the impact of different attack algorithms on signal quality. In the present invention, we define the signal disturbance ratio as the ratio of signal power to disturbance power. By performing quantitative analysis of the signal disturbance ratio of adversarial samples generated by different attack algorithms, we can objectively evaluate their impact on signal quality. The formula is as follows:

[0122]

[0123] Among them, x(i) represents the sample value of the original signal, δ(i) represents the sample value of the adversarial perturbation, and P signal is the signal power, P perturbation is the disturbance power, and Num is the number of signal points.

[0124] like Fig.10 As shown in Figure 2, the SPR value of the FCIAA algorithm is the highest, indicating that the generated adversarial samples introduce less perturbations while maintaining signal integrity. In contrast, the adversarial samples generated by other algorithms show a lower signal perturbation ratio, indicating that they introduce a greater degree of signal distortion during the attack.

[0125] As shown in Table 1, the performance diagram of the algorithm proposed in this scheme when facing a known receiver model and an unknown receiver model at a signal-to-noise ratio of 10 dB is shown. Figure 4 and Figure 5 , indicating that the method of this scheme performs better than other methods when facing known or unknown receiver models.

[0126] Table 1 Performance diagram

[0127]

[0128] Experimental results show that the method of this scheme can effectively alleviate the problem of spectrum leakage in the existing modulation signal counterattack method, while maintaining the concealment in the time domain and frequency domain, it significantly improves the counterattack effect of the intelligent recognition model against the illegal receiver.

[0129] In summary, the modulated signal adversarial attack method under frequency constraints disclosed in the present invention utilizes the loss function to iteratively optimize the adversarial sample, and optimizes the adversarial disturbance through the frequency constraint imposed by the low-pass filter, so that the adversarial energy is concentrated in the signal spectrum, while maintaining the concealment in the time domain and frequency domain, significantly improving the adversarial attack effect, including untargeted attack and targeted attack.

[0130] The above schematically describes the invention and its implementation methods, which is not restrictive. Without departing from the spirit or basic features of the invention, the invention can be implemented in other specific forms. What is shown in the accompanying drawings is only one of the implementation methods of the invention. The actual structure is not limited to this, and any figure mark in the claims should not limit the claims involved. Therefore, if a person of ordinary skill in the art is inspired by it, without departing from the purpose of the invention, a structural method and an embodiment similar to the technical solution are designed without creativity, which should all fall within the scope of protection of this patent. In addition, the word "including" does not exclude other elements or steps, and the word "one" before the element does not exclude the inclusion of "multiple" elements. The multiple elements stated in the product claim can also be implemented by one element through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any specific order.

Claims

1. A method for countering attacks on modulated signals under frequency constraints, comprising the following steps: Data set construction and data preprocessing: whiten the bit stream data to eliminate redundancy and correlation in the data and ensure that the data sequence conforms to independent distribution; then perform symbol mapping on the bit stream data to map each group of bit sequences to corresponding modulation symbols; Then, the modulation symbol is pulse-shaped to adjust the frequency response and time domain characteristics of the signal; the signal after pulse shaping is packaged; channel modeling is performed and the packaged signal is sent to obtain the received signal data; Set the number of signal data sampling points, each signal vector consists of an in-phase component and an orthogonal component; create a data set and adjust the signal shape in the data set; Construction and training of modulation recognition network: Use artificial intelligence model as modulation recognition network and train the modulation recognition network; Perturbation addition: Adding disturbances to make the modulation recognition network misjudge to prevent the illegal interceptor from accurately identifying and decoding the transmission signal; The channel modeling process is as follows: channel modeling is performed based on the random process of sampling rate offset, center frequency offset, multipath effect and fading, and additive white noise. The modeling method is: f0 is the normalized frequency offset, σ 2 The variance value given for the signal-to-noise ratio, s tx (t) and s r (t) are the transmitted signal and the received signal respectively, t is the time, e is the base of the natural logarithm, j is the imaginary unit, and N is the additive white noise.

2. The method for countering attacks on modulated signals according to claim 1, characterized in that: The steps for building and training the modulation recognition network include: Use artificial intelligence models as modulation recognition networks, including CNN, VGG16, Resnet18, and Resnet34; optimize and adjust the size and number of convolution kernels to adapt to the length, width, and height of the input signal; initialize the training configuration to realize the training of the modulation recognition network.

3. The method for countering attacks on modulated signals according to claim 1, characterized in that: The steps of adding perturbations include calculating the loss function, calculating the gradient, filtering, and calculating the perturbations and iteratively updating.

4. The method for countering attacks on modulated signals according to claim 3, characterized in that: The steps for calculating the loss function are: input the original signal as the adversarial signal into the recognition network to obtain the prediction result; design the untargeted attack loss function and the targeted attack loss function to measure the difference between the model prediction result and the true label.

5. The method for countering attacks on modulated signals according to claim 4, characterized in that: The untargeted attack loss function is as follows: Among them, x adv is an adversarial sample, M represents the number of samples, C is the number of categories, y is the true label, f is the target model, It represents the probability that the i-th signal sample belongs to the j-th class.

6. The method for countering attacks on modulated signals according to claim 4, characterized in that: The targeted attack loss function is as follows: Among them, x adv is an adversarial sample, M represents the number of samples, C is the number of categories, y is the true label, and y target is the target label, f is the target model, It represents the probability that the nth signal sample belongs to the mth class.

7. The method for countering attacks on modulated signals according to claim 3, characterized in that: The calculation of the gradient is to calculate the gradient of the loss function with respect to the input by backpropagating. The calculation process is as follows: in, represents the back propagation algorithm, x adv For adversarial samples, g and g target They are the calculated gradient information of non-targeted attack and gradient information of targeted attack respectively.

8. The method for countering attacks on modulated signals according to claim 3, characterized in that: The specific steps of filtering are: Set the Nyquist rate of the Butterworth low-pass filter to 100kHz, the cutoff frequency to 15.6kHz, and the order to 15. Perform a filtering operation on the obtained gradient information through the filter. The process is as follows: g f =filter(b,a,g); Among them, b and a are filter coefficients, filter is the filter used, and its frequency response function is: Where s is the current frequency, ω c is the cutoff frequency of the filter and n is the order of the filter.

Images