A method, device, medium and product for countering attacks on individual signals of radiation sources
By generating adversarial signals through multiple external two-dimensional convolutional layer models and gradient calculations, the real-time and security issues of traditional radiation source individual identification technology in complex environments are solved, and efficient misleading effects are achieved in white-box and black-box environments.
Patent Information
- Application Number
- CN202410921269.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-10
- Publication Date
- 2025-09-23
- Estimated Expiration
- 2044-07-10
AI Technical Summary
Traditional radiation source individual identification technology has difficulty meeting the requirements of real-time performance and processing massive data when faced with complex communication signals and environments, and deep learning models are vulnerable to malicious data attacks, leading to identification errors.
Multiple external two-dimensional convolutional layer models are used to process the individual signals of the radiation source. The gradient is calculated using the trained individual radiation source identification model, and disturbances are added to generate adversarial signals. The adversarial signals are then combined with the individual radiation source signals for communication to mislead the eavesdropper.
It effectively improves the ability to resist eavesdroppers from identifying the individual device information of the radiation source and enhances communication security. The generated adversarial signals have high attack success rate and migration in both white-box and black-box environments.
Smart Images
Figure CN118921669B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of counter-attack technology, and in particular to a method, device, medium and product for countering attacks on individual signals of radiation sources based on migration. Background Art
[0002] The rapid development of wireless communications has driven economic, information-based, and intelligent development, providing support for social and technological progress and making human life more convenient and enriching. Signal recognition technology is a key driver of wireless communications. Within this technology, individual radiator identification (ID) uses only the external features of the received signal to identify the individual radiator. As modern communication technology rapidly advances, traditional ID technology faces severe challenges in the face of new communication signals and complex environments. This is because traditional ID technology relies too heavily on manual experience for feature extraction and model construction. Faced with today's rapidly increasing data volume, this approach is no longer able to meet the real-time requirements and process massive amounts of data, thus limiting the model's generalizability and replicability. To address these challenges, the engineering and academic communities are focusing on developing adaptive, robust, and efficient intelligent ID technologies to meet these pressing needs. In recent years, deep learning has emerged as a mainstream technology in the field of artificial intelligence. In the field of intelligent signal recognition, deep learning-based methods have demonstrated excellent feature extraction and recognition capabilities, providing strong technical support for adapting to complex and changing signal environments, and can become an adaptive, highly robust, and efficient intelligent radiation source individual recognition technology.
[0003] While deep learning has demonstrated remarkable performance in intelligent signal recognition, its widespread application has also raised a significant security challenge. Research has found that malicious data cleverly crafted by attackers can disrupt the decision-making process of deep learning-based AI models, yet remain difficult for humans to detect. This artificially crafted malicious data is known as adversarial signals (or adversarial examples), and the presence of adversarial signals can put AI models at risk of making erroneous decisions.
[0004] From the perspective of attack resistance, adversarial signals are generated by ingeniously leveraging features extracted by AI models to ensure correct identification of transmitted signals. By cleverly combining adversarial signals with the original individual emitter signals, eavesdroppers are misidentified as our own signals, thereby cleverly enhancing our ability to deceive and mislead targets. The core of this strategy lies in leveraging the complexity and flexibility of AI models to achieve a higher degree of fidelity in the deception of adversarial signals, thereby more effectively achieving our objectives. As can be seen from the above, relevant technologies are needed to mislead eavesdroppers into misidentifying our individual emitter signals and protect our individual emitter device information. Summary of the Invention
[0005] The purpose of the present invention is to provide a method, device, medium and product for countering attacks on individual radiation source signals, which can effectively improve the ability to resist the eavesdropping party from identifying the device information of our individual radiation source.
[0006] To achieve the above object, the present invention provides the following solutions:
[0007] A method for countering attacks against individual signals of a radiation source, comprising:
[0008] Acquiring an individual radiation source signal emitted by an individual radiation source;
[0009] Using each of the multiple external models to perform two-dimensional convolution on the individual signal of the radiation source, respectively, to obtain a convolution-processed signal corresponding to each external model; all the external models are two-dimensional convolution layers, and the sizes of the convolution kernels of all the two-dimensional convolution layers are different;
[0010] For each of the external models, using the convolution-processed signal corresponding to the external model as input, and using the trained radiation source individual identification model to obtain predicted identification information of the radiation source individual;
[0011] Calculating a gradient based on all the predicted identification information and the actual identification information of the radiation source individual;
[0012] Use the gradient to add disturbance to the individual signal of the radiation source to obtain a gradient-processed signal; determine whether the iteration termination condition is met; if so, use the gradient-processed signal as the countermeasure signal; if not, use the gradient-processed signal as the individual signal of the radiation source for the next iteration, and return to the step of "performing two-dimensional convolution on the individual signal of the radiation source using each of the multiple external models to obtain the convolution-processed signal corresponding to each external model"; during communication, the individual radiation source is used to emit the individual radiation source signal, and at the same time, the transmitting device is used to emit the countermeasure signal.
[0013] In some embodiments, the gradient is calculated based on all the predicted identification information and the actual identification information of the radiation source individual, specifically including:
[0014] For each of the predicted identification information, using the predicted identification information and the actual identification information of the radiation source individual as input, a cross entropy loss function is used to calculate the loss;
[0015] The maximum value of all the losses is selected as the gradient.
[0016] In some embodiments, using the gradient to add a disturbance to the individual signal of the radiation source to obtain a gradient-processed signal specifically includes:
[0017] Taking the gradient as input, the cumulative enhanced gradient is calculated using the gradient enhancement formula;
[0018] The cumulative enhanced gradient is used as input and a gradient processing formula is used to calculate a gradient processed signal.
[0019] In some embodiments, the gradient boosting formula specifically includes:
[0020]
[0021] Among them, g n+1 is the cumulative gradient after the nth iteration; β is the first momentum coefficient of the signal gradient; g n is the cumulative gradient before the nth iteration; is the gradient of the nth iteration; ||.|| is the Euclidean distance;
[0022]
[0023] in, is the cumulative enhanced gradient after the nth iteration; θ is the second momentum coefficient of the signal gradient.
[0024] In some embodiments, the gradient processing formula specifically includes:
[0025]
[0026] in, is the gradient processed signal after the nth iteration; is the gradient processed signal before the nth iteration; α is the perturbation factor added to the signal; sign(.) is the sign function; is the cumulative enhanced gradient after the nth iteration.
[0027] In some embodiments, before using the gradient processed signal as the individual radiation source signal of the next iteration, the method further includes: correcting the gradient processed signal using a gradient accumulation formula to obtain a corrected signal, and using the corrected signal as a new gradient processed signal;
[0028] The gradient accumulation formula specifically includes:
[0029]
[0030] Among them, x nes is the corrected signal; is the gradient processed signal before the nth iteration; α is the disturbance factor added to the signal; μ is the attenuation factor; g n is the cumulative gradient before the nth iteration.
[0031] In some embodiments, after obtaining the gradient-processed signal, the method further includes: clipping the gradient-processed signal to obtain a clipped signal, and using the clipped signal as a new gradient-processed signal.
[0032] A computer device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-mentioned method for countering attacks on individual signals of radiation sources.
[0033] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for countering attacks on individual signals of a radiation source.
[0034] A computer program product includes a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for countering attacks on individual signals of radiation sources.
[0035] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:
[0036] The present invention provides a method, device, medium and product for countering attacks on individual radiation source signals. The method uses multiple external models to perform two-dimensional convolution on the individual radiation source signals, uses a trained individual radiation source recognition model to obtain predicted recognition information of the individual radiation source, calculates the gradient based on all the predicted recognition information and the actual recognition information of the individual radiation source, uses the gradient to add disturbance to the individual radiation source signal, obtains the gradient-processed signal, and uses the gradient until the iterative termination condition is reached. The gradient-processed signal is used as the countermeasure signal. During communication, the individual radiation source sends out the individual radiation source signal, and other transmitting devices send out countermeasure signals. Since the identification of the individual radiation source signal may identify the correct device information of the individual radiation source, but the identification of the countermeasure signal cannot identify the correct device information of the individual radiation source, the individual radiation source signal and the countermeasure signal are sent out simultaneously, which can guide the eavesdropper to misjudge our individual radiation source signal, thereby effectively improving the ability to resist the eavesdropper from identifying our individual radiation source device information. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0038] Figure 1 A schematic diagram of a method flow for countering attacks on individual radiation source signals provided in Example 1 of the present invention.
[0039] Figure 2 A schematic diagram of the principle of a method for countering attacks on individual signals of a radiation source provided in Example 1 of the present invention.
[0040] Figure 3 Schematic diagram of the attack effect of the adversarial signal sample generated by Vgg19 provided in Example 1 of the present invention in a white box environment.
[0041] Figure 4 Schematic diagram of the attack effect of the adversarial signal sample generated by ResNet34 provided in Example 1 of the present invention in a white box environment.
[0042] Figure 5 Schematic diagram of the attack effect of the adversarial signal sample generated by Vgg19 provided in Example 1 of the present invention in a black box environment.
[0043] Figure 6 Schematic diagram of the attack effect of the adversarial signal sample generated by ResNet34 provided in Example 1 of the present invention in a black box environment.
[0044] Figure 7 A schematic diagram of the migration rate of the adversarial signal sample provided in Example 1 of the present invention from a white box environment to a black box environment.
[0045] Figure 8 Schematic diagram comparing the waveforms of the adversarial signal sample and the test sample provided in Example 1 of the present invention. DETAILED DESCRIPTION
[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0047] The purpose of the present invention is to provide a method, device, medium and product for countering attacks on individual radiation source signals, which can effectively improve the ability to resist the eavesdropping party from identifying the device information of our individual radiation source.
[0048] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.
[0049] Example 1
[0050] like Figure 1 and Figure 2 As shown, a method for countering attacks on individual radiation source signals in this embodiment includes:
[0051] S1: Acquire the radiation source individual signal emitted by the radiation source individual.
[0052] S2: Use each of the multiple external models to perform two-dimensional convolution on the individual signal of the radiation source to obtain a convolution-processed signal corresponding to each external model; all the external models are two-dimensional convolution layers, and the sizes of the convolution kernels of all the two-dimensional convolution layers are different.
[0053] S3: For each of the external models, the convolution-processed signal corresponding to the external model is used as input, and the predicted identification information of the individual radiation source is obtained using the trained radiation source individual identification model.
[0054] S4: Calculate a gradient based on all the predicted identification information and the actual identification information of the radiation source individual.
[0055] S5: Use the gradient to add disturbance to the individual signal of the radiation source to obtain a gradient-processed signal; determine whether the iteration termination condition is met; if so, use the gradient-processed signal as the countermeasure signal; if not, use the gradient-processed signal as the individual signal of the radiation source for the next iteration, and return to the step of "using each of the multiple external models to perform two-dimensional convolution on the individual signal of the radiation source to obtain the convolution-processed signal corresponding to each external model"; during communication, the individual radiation source is used to emit the individual radiation source signal, and at the same time, the transmitting device is used to emit the countermeasure signal.
[0056] In this embodiment, an individual radiation source refers to a transmitter that emits signals during communication, including WiFi devices, radar devices, and the like. The signal emitted by an individual radiation source is the individual radiation source signal, which can be IQ data. By identifying the individual radiation source signal, it is possible to obtain the correct device information of the individual radiation source. Device information refers to the model of the individual radiation source. Identifying the individual radiation source signal can pose a security risk to the individual radiation source. The purpose of this embodiment is to generate a countermeasure signal based on the individual radiation source signal. Subsequently, the individual radiation source is instructed to transmit the individual radiation source signal, and other transmitting devices are instructed to transmit the countermeasure signal simultaneously. This prevents the eavesdropper from misjudging the individual radiation source's device information and thus improves security.
[0057] In this embodiment, a two-dimensional convolution layer is used as an external model to process the noise of the individual signal of the radiation source. The convolution kernel of the two-dimensional convolution layer can be a Gaussian convolution kernel. At this time, when the two-dimensional convolution layer performs two-dimensional convolution on the individual signal of the radiation source, the calculation formula used is as follows:
[0058]
[0059] In formula (1), G(x,y) is a two-dimensional Gaussian function, x and y represent the spatial position of the Gaussian convolution kernel, which are the x-coordinate and y-coordinate of the Gaussian convolution kernel respectively; σ is the standard deviation of the two-dimensional Gaussian function, which controls the distribution range and shape of the two-dimensional Gaussian function.
[0060] In this embodiment, multiple external models are set, all of which are two-dimensional convolution layers. The sizes of the convolution kernels of all two-dimensional convolution layers are different. The convolution kernels can be Gaussian convolution kernels. In this case, the two-dimensional convolution layer can be called a two-dimensional Gaussian convolution layer. The sizes of the Gaussian convolution kernel include x, y, and σ. When the external model adopts a size of r×r and a standard deviation of When the Gaussian convolution kernel is used, then x and y are both equal to r, and σ is equal to By setting r to different external models, multiple different external models can be obtained. In this embodiment, Gaussian convolution kernels with r of 3, 5, 7, 9, and 11 are selected respectively to form five external models.
[0061] In this embodiment, each of the multiple external models is used to perform two-dimensional convolution on the individual signal of the radiation source to obtain the convolution signal corresponding to each external model. When the external model adopts a size of r×r and a standard deviation of When the Gaussian convolution kernel is used, the convolution method of the individual signal of the radiation source through the Gaussian convolution kernel is as follows:
[0062]
[0063] In formula (2), g r (x) is the signal after convolution processing, g(·) is the external model, and x is the input individual signal of the radiation source; is of size r×r and has a standard deviation of The two-dimensional Gaussian function corresponding to the Gaussian convolution kernel.
[0064] Using formula (2), we can get the convolution signal corresponding to each external model. It should be noted that the size of the convolution signal obtained after two-dimensional convolution with the Gaussian convolution kernel is consistent with the size of the original radiation source individual signal.
[0065] In this embodiment, for each external model, the convolution-processed signal corresponding to the external model is used as input, and the trained individual radiation source identification model is used to obtain predicted identification information for the individual radiation source. The trained individual radiation source identification model can be any existing neural network model. Since the model parameters of the trained individual radiation source identification model are known, it can be called a white-box model. Each external model is connected to the white-box model to form a virtual model, and the number of virtual models is the same as the number of external models. The predicted identification information of the individual radiation source refers to the device information of the individual radiation source predicted by the trained individual radiation source identification model. The device information is the model of the individual radiation source.
[0066] In this embodiment, a gradient is calculated based on all predicted identification information and the actual identification information of the individual radiation source. Specifically, for each predicted identification information, the predicted identification information and the actual identification information of the individual radiation source are used as inputs, and the loss is calculated using a cross-entropy loss function; the maximum value of all losses is selected as the gradient. The actual identification information of the individual radiation source refers to the actual device information of the individual radiation source.
[0067] The individual signals of the radiation source are input into different virtual models, and the respective losses are calculated using the cross entropy loss function. Finally, the maximum loss is taken as the gradient information of this iteration. The gradient calculation formula is as follows:
[0068]
[0069] In formula (3), is the gradient of the individual signal of the radiation source, f(x) represents the predicted recognition information, x represents the signal after convolution processing, and y represents the real recognition information; r represents the external model, p represents the set of all external models, and r~p represents an external model r in p; J r (f(x n ),y) is the loss corresponding to the virtual model including the external model r, f(x n ) is the prediction identification information output by the virtual model including the external model r, x n is the signal after convolution processing of the external model r; crossentropy(,) is the cross entropy loss function.
[0070] The individual radiation source signal sent by the individual radiation source passes through multiple virtual models to generate multiple losses. From these losses, the loss that can maximize the damage to the model decision boundary (i.e., the largest loss) is selected as the gradient, that is, as the perturbation of one iteration. In multiple iterations, the perturbation is continuously updated to finally generate an adversarial signal. The size of the final generated adversarial signal is the same as that of the original individual radiation source signal, and only the waveform of the important characteristic part of the original individual radiation source signal is slightly changed, making it impossible for the eavesdropper to identify the device information of our individual radiation source.
[0071] In this embodiment, a gradient is used to add disturbances to the individual signals of the radiation source to obtain a gradient-processed signal, specifically including: taking the gradient as input and using the gradient enhancement formula to calculate the cumulative enhanced gradient; taking the cumulative enhanced gradient as input and using the gradient processing formula to calculate the gradient-processed signal.
[0072] After calculating the gradient, this embodiment uses a quasi-hyperbolic momentum operator (Quasi-hyperbolicMomentum) to enhance the stability of the gradient descent direction. The calculation formula of the quasi-hyperbolic momentum operator (i.e., the gradient enhancement formula) is as follows:
[0073]
[0074] In formula (4), g n+1 is the cumulative gradient after the nth iteration, that is, the cumulative gradient before the n+1th iteration, which represents the high-order gradient of the signal accumulated after n iterations; β is the first momentum coefficient of the signal gradient; g n is the cumulative gradient before the nth iteration, which represents the high-order gradient of the signal accumulated before the nth iteration. At the initial iteration, the cumulative gradient g0 = 0; is the gradient of the nth iteration, which represents the high-order gradient of the signal generated by the nth iteration, that is, ||.|| is the Euclidean distance.
[0075]
[0076] In formula (5), is the cumulative enhancement gradient after the nth iteration, that is, the cumulative enhancement gradient before the n+1th iteration; θ is the second momentum coefficient of the signal gradient.
[0077] In this embodiment, the gradient processing formula is as follows:
[0078]
[0079] In formula (6), is the gradient processed signal after the nth iteration, that is, the gradient processed signal before the n+1th iteration; is the gradient processed signal before the nth iteration, that is, the individual signal of the radiation source input at the nth iteration. At the initial iteration, is the original individual signal of the radiation source; α is the perturbation factor added to the signal at each iteration; sign(.) is the sign function; is the cumulative enhanced gradient after the nth iteration.
[0080] Before each gradient calculation, Nesterov acceleration cumulative momentum is introduced to help escape the local optimal solution. Before using the gradient-processed signal as the individual radiation source signal of the next iteration, the radiation source individual signal counter-attack method of this embodiment further includes: using the gradient accumulation formula to correct the gradient-processed signal to obtain a corrected signal, and using the corrected signal as the new gradient-processed signal.
[0081] The gradient accumulation formula is as follows:
[0082]
[0083] In formula (7), x nes is the corrected signal; is the gradient processed signal before the nth iteration, that is, the individual signal of the radiation source input at the nth iteration; α is the disturbance factor added to the signal at each iteration; μ is the perturbation factor added to g at each iteration n Attenuation factor on g n is the cumulative gradient before the nth iteration.
[0084] In this embodiment, the size of α is the ratio of the set disturbance size ε to the number of iterations N, expressed as α=ε / N, the attenuation factor μ is 0.5, and the momentum coefficients β and θ are both 0.99.
[0085] After each iteration, a disturbance is added to the individual signal of the radiation source to generate a gradient-processed signal, and the generated gradient-processed signal is clipped. That is, after obtaining the gradient-processed signal, the radiation source individual signal counter-attack method of this embodiment further includes: clipping the gradient-processed signal to obtain a clipped signal, and using the clipped signal as a new gradient-processed signal.
[0086] The calculation formula used for clipping is as follows:
[0087]
[0088] In formula (8), is the clipped gradient processed signal, also known as the clipped signal; Clip x,ε The representative clipping range is [x-ε,x+ε], where x is the original individual signal of the radiation source and ε is the disturbance size.
[0089] In this embodiment, the iteration termination condition may be reaching a maximum number of iterations, which may be 20 times.
[0090] In this embodiment, the radiation source individual signal counter-attack method of this embodiment is used to pre-generate multiple counter-attack signals. During communication, the radiation source individual can only send the radiation source individual signal. Along with the radiation source individual sending process, other transmitting devices send counter-attack signals to achieve the purpose of confusion.
[0091] This embodiment may also provide a migration-based radiation source individual signal adversarial sample generator, which applies the radiation source individual signal adversarial attack method of this embodiment to generate adversarial signals.
[0092] The countermeasure signal for the individual signal of a radiation source meets the following conditions: it cannot destroy the continuity of the individual signal of the radiation source, preserves the characteristics of the signal waveform, destroys the characteristics that reveal the information of the host device, and ensures that the eavesdropper cannot recognize the countermeasure signal; the added disturbance must be as small as possible to ensure the concealment of the host signal and make the added disturbance undetectable and unfilterable. The countermeasure signal generated by the method for countering attacks on the individual signal of a radiation source in this embodiment meets the above conditions.
[0093] In response to the need in existing technologies to improve the migration of adversarial signals and ensure the attack effect of adversarial signals in a black box environment, this embodiment provides a method for countering attacks based on the migration of individual signals of radiation sources. It slightly changes the information of individual signals of radiation sources to generate adversarial signals that can be migrated to a black box environment, effectively improving the ability of anti-eavesdroppers to identify the information of our equipment and protecting the individual signals of radiation sources.
[0094] This embodiment uses an external model (i.e., a two-dimensional convolutional layer) to change the fingerprint features of the individual signals of the radiation source, and finds the fingerprint features that cause the trained individual radiation source recognition model to make decision errors. At the same time, the combination of the external model and the white box model is equivalent to a data enhancement at the data level, that is, the similarity information of the individual signals of the radiation source is expanded. At the adversarial signal level, it is equivalent to screening the generated disturbances, and finally selecting the best disturbance, so that a more effective adversarial signal can be generated.
[0095] This embodiment introduces a Nesterov momentum acceleration accumulation strategy and a quasi-hyperbolic momentum operator to find the optimal gradient descent direction and stabilize gradient updates. By adding Nesterov momentum before gradient generation, the adversarial signal is prevented from falling into a local optimal solution and the iteratively accumulated gradient is corrected. After gradient generation, the quasi-hyperbolic momentum operator is added to correct the gradient descent direction, improving the transferability of the adversarial signal and the generalization of the attack and eavesdropper identification model.
[0096] Here, this embodiment also verifies the effectiveness of the above-mentioned radiation source individual signal anti-attack method, as follows:
[0097] Step 1, input data and preprocess: input individual radiation source signal samples of multiple individual radiation sources, and preprocess the individual radiation source signal samples. The preprocessing includes slicing processing and normalization processing to obtain training samples and test samples. The training samples and test samples each correspond to a label, and the label represents the true identification information of the radiation source individual to which the training sample and the test sample belong.
[0098] In preprocessing, slicing involves dividing (segmenting) the individual signal samples of the radiation source into multiple samples. For example, if the individual signal samples of the radiation source consist of 4096 sampling points, each 256 sampling points constitutes a sample, resulting in multiple samples. Normalization involves normalizing the values of each sampling point in the sample to a value between 0 and 1, generating normalized samples. These normalized samples are then randomly divided into training and test samples.
[0099] Step 2, training data: obtain pre-processed training samples, use the training samples as feature data, and use the labels of the training samples as label data. Through multiple trainings, multiple different training models are obtained.
[0100] The training model includes the white-box model required to generate adversarial signal samples and the black-box model required to test adversarial signal samples.
[0101] This embodiment further generates multiple virtual models, which include an external model and a white box model. Specifically, multiple external models g(·) are added before the white box model f(·). The external model adopts a two-dimensional convolution layer, and the convolution kernel adopts a Gaussian convolution kernel. Each external model g(·) is connected to the white box model f(·) to form a virtual model g(·)⊙f(·).
[0102] Step 3, adversarial signal sample generation: obtain the gradient of each test sample through the model parameters in the virtual model, and iteratively generate a specific adversarial signal sample based on the gradient.
[0103] The method for generating adversarial signal samples using a virtual model is as follows: A test sample is input into an external model to obtain a convolutional signal sample with multiple subtle feature changes. The output of the external model is then input into a white-box model. Based on the predicted recognition information output by the white-box model and the actual recognition information, a gradient is generated. Adversarial signal samples are then iterated based on the gradient. The steps for generating adversarial signal samples through multiple iterations after inputting the test sample into the virtual model are similar to the steps for generating adversarial signals through multiple iterations after inputting the individual radiation source signal into the virtual model, and are not repeated here.
[0104] Step 4, test the adversarial signal sample: After using the test sample to generate the adversarial signal sample, test the model recognition rate of the adversarial signal sample in the white box environment and the black box environment, that is, test whether the legitimate interference party (ie, the authorized user) and the illegal interference party (ie, the eavesdropper) can identify our device information.
[0105] When testing adversarial signal samples, if the model used to test the adversarial signal sample is the same as the model used to generate it, it is a white-box attack, testing whether the legitimate party can obtain information about our device. If the model used to test the adversarial signal sample is different from the model used to generate it, the adversarial signal sample is considered to have no knowledge of the model parameters, and this is a black-box attack, testing whether the illicit party can obtain information about our device. The test results show that both legitimate and illicit parties can be prevented from obtaining information about our device.
[0106] This embodiment can use the WiSig dataset, which is a large-scale public WiFi signal dataset containing 10 million data packets from 174 WiFi transmitters and 41 USRP receivers. This embodiment can use the IQ data received by 28 WiFi transmitters and 1 USRP receiver in the SingleDay data of the WiSig dataset, and preprocess the IQ data into 2*256 I and Q channels, and further perform slicing and normalization.
[0107] Using the preprocessed data, two models with significantly different structures were trained as white-box models to generate adversarial signal samples. The white-box models included Vgg19 and ResNet34. The generated adversarial signal samples were then used to attack five widely used recognition models: Vgg19, ResNet18, ResNet34, SR2CNN, and DenseNet. 10% of the WiSig dataset was used to generate adversarial signal samples, and the white-box models achieved a 100% recognition rate on this data.
[0108] This embodiment measures the attack effect according to two indicators: Attack Success Rate (ASR) and Average Distortion (AD).
[0109] Set a dataset of correctly classified samples ASR is defined as the ratio of the number of samples that the attack causes the recognition model to misidentify to the number of samples that are correctly classified. The formula is:
[0110]
[0111] In formula (9), y pre represents the predicted value of the adversarial signal sample in the recognition model, y true Represents the true value of the adversarial signal sample in the recognition model.
[0112] AD represents the difference between the original signal and the adversarial signal sample. The smaller the AD value, the closer the waveforms are. The formula is:
[0113]
[0114] In formula (10), N represents the number of signal samples; and x represent the nth adversarial signal sample and the original signal, respectively.
[0115] like Figures 3 to 8 As shown, Figure 3 Schematic diagram of the attack effect of the adversarial signal sample generated by Vgg19 in a white box environment. Figure 4 This is a schematic diagram of the attack effect of the adversarial signal sample generated by ResNet34 in a white box environment. VGA (Virtual Model Gradient Attack) is the method of this embodiment, and MIM (MI-FGSM) is the existing method. Obviously, the attack success rate of the method of this embodiment is better. Figure 5 Schematic diagram of the attack effect of the adversarial signal sample generated by Vgg19 in a black box environment. Figure 6 Schematic diagram of the attack effect of the adversarial signal sample generated for ResNet34 in a black-box environment. Both are attack effects under a perturbation factor of 0.007. The adversarial signal sample is used to attack the four models Res18, Res34, Sr2cnn, and DenseNet. Obviously, the performance of the radiation source individual signal adversarial attack method of this embodiment ensures a higher attack effect in a white-box environment than other algorithms, and the attack success rate in a black-box environment is increased by 5%-13.8%. Figure 7 This is a diagram of the migration rate of adversarial signal samples from the white box environment to the black box environment. The ratio of the attack success rate of the adversarial signal sample attacking the black box to the attack success rate of the white box is called the migration rate. Figure 8 This is a schematic diagram comparing the waveforms of the adversarial signal sample and the test sample. It is obvious that the waveform of the adversarial signal sample generated by the radiation source individual signal adversarial attack method of this embodiment is basically unchanged compared to the waveform of the original signal, and has high mobility and excellent concealment.
[0116] This embodiment discloses a method for countering attacks on individual radiation source signals based on migration, including the following steps: inputting data and preprocessing: inputting individual radiation source signal samples and preprocessing them to obtain test samples and training samples; training data: obtaining preprocessed training samples and obtaining different training models through multiple training; generating adversarial signal samples: obtaining the gradient of each test sample through a certain model parameter in the training model, and generating specific adversarial signal samples based on the gradient; testing adversarial signal samples: generating adversarial signal samples using the test samples, and testing the model recognition rate of the adversarial signal samples in white-box and black-box environments. Compared with the existing technology, the advantages of this embodiment are: by combining an external model with a white-box model into a virtual model, the white-box model has multiple decision boundaries, which can better select perturbations that destroy the model decision boundaries; through a gradient update strategy, the rapid convergence of the model gradient is utilized to improve the effectiveness of the algorithm attack, and the gradient is prevented from falling into a local optimum during the rapid convergence process, ultimately generating an adversarial signal with high migration; and when the radiation source device sends an individual signal, it can effectively prevent an eavesdropper from identifying the information of the radiation source device.
[0117] Example 2
[0118] A computer device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of a method for countering an attack on an individual signal of a radiation source as described in Example 1.
[0119] Example 3
[0120] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for countering attacks on individual signals of a radiation source as described in Example 1.
[0121] Example 4
[0122] A computer program product includes a computer program, which, when executed by a processor, implements the steps of the method for countering attacks on individual signals of a radiation source described in embodiment 1.
[0123] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0124] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The above examples are only intended to help understand the method and core concept of the present invention. At the same time, those skilled in the art will find that the specific implementation methods and application scopes may vary based on the concept of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.
Claims
1. A method for countering attacks on individual radiation source signals, characterized in that: include: Acquiring an individual radiation source signal emitted by an individual radiation source; Using each of the multiple external models to perform two-dimensional convolution on the individual signal of the radiation source, respectively, to obtain a convolution-processed signal corresponding to each external model; all the external models are two-dimensional convolution layers, and the sizes of the convolution kernels of all the two-dimensional convolution layers are different; For each of the external models, using the convolution-processed signal corresponding to the external model as input, and using the trained radiation source individual identification model to obtain predicted identification information of the radiation source individual; Calculating a gradient based on all the predicted identification information and the actual identification information of the radiation source individual; Using the gradient to add a disturbance to the individual signal of the radiation source to obtain a gradient-processed signal, specifically including: taking the gradient as input, using the gradient enhancement formula to calculate the cumulative enhanced gradient, taking the cumulative enhanced gradient as input, using the gradient processing formula to calculate the gradient-processed signal; judging whether the iteration termination condition is met; if so, using the gradient-processed signal as the countermeasure signal; if not, using the gradient-processed signal as the individual signal of the radiation source for the next iteration, and returning to the step of "respectively using each of the multiple external models to perform two-dimensional convolution on the individual signal of the radiation source to obtain the convolution-processed signal corresponding to each external model"; during communication, the individual radiation source is used to emit the individual radiation source signal, and at the same time, the transmitting device is used to emit the countermeasure signal; The gradient enhancement formula specifically includes: Among them, g n+1 is the cumulative gradient after the nth iteration; β is the first momentum coefficient of the signal gradient; g n is the cumulative gradient before the nth iteration; is the gradient of the nth iteration; ||.|| is the Euclidean distance; in, is the cumulative enhanced gradient after the nth iteration; θ is the second momentum coefficient of the signal gradient; The gradient processing formula specifically includes: in, is the gradient processed signal after the nth iteration; is the gradient processed signal before the nth iteration; α is the disturbance factor added to the signal; sign(.) is the sign function.
2. The method for countering attacks on individual radiation source signals according to claim 1, characterized in that: Based on all the predicted identification information and the actual identification information of the radiation source individual, a gradient is calculated, specifically including: For each of the predicted identification information, using the predicted identification information and the actual identification information of the radiation source individual as input, a cross entropy loss function is used to calculate the loss; The maximum value of all the losses is selected as the gradient.
3. The method for countering attacks on individual radiation source signals according to claim 1, characterized in that: Before using the gradient processed signal as the radiation source individual signal of the next iteration, the method further includes: correcting the gradient processed signal using a gradient accumulation formula to obtain a corrected signal, and using the corrected signal as a new gradient processed signal; The gradient accumulation formula specifically includes: Among them, x nes is the corrected signal; is the gradient processed signal before the nth iteration; α is the disturbance factor added to the signal; μ is the attenuation factor; g n is the cumulative gradient before the nth iteration.
4. The method for countering attacks on individual radiation source signals according to claim 1, characterized in that: After obtaining the gradient-processed signal, the method further includes: clipping the gradient-processed signal to obtain a clipped signal, and using the clipped signal as a new gradient-processed signal.
5. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of a method for countering an attack on an individual signal of a radiation source as described in any one of claims 1 to 4.
6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for countering attacks on individual signals of a radiation source as described in any one of claims 1 to 4 are implemented.
7. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method for countering attacks on individual signals of a radiation source as described in any one of claims 1 to 4 are implemented.