Adversarial decoupling defense method for intelligent identification of communication signal modulation modes

Abstract

The embodiments of the present application relate to the field of communication signal modulation recognition technology, and in particular to an adversarial decoupling defense method for intelligent recognition of communication signal modulation modes, comprising: performing empirical mode decomposition on an input signal, performing high-frequency feature enhancement on the decomposed input signal, inputting the input signal after high-frequency feature enhancement into an adversarial detector of a recognition model, and determining the adversarial suspicion of the input signal; utilizing a generative adversarial network to reconstruct the waveform of the input signal; inputting the input signal into the original branch of the recognition model to obtain a prediction vector of the original branch, inputting the waveform-reconstructed input signal into the adversarial branch of the recognition model to obtain a prediction vector of the adversarial branch, fusing the prediction vectors of the two branches according to the adversarial suspicion, and determining the modulation mode of the input signal based on the fusion result. This method effectively improves the recognition accuracy and the robustness of the recognition model against attacks.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of communication signal modulation identification, and in particular to an adversarial decoupling defense method for intelligent identification of communication signal modulation modes. Background Art

[0002] With the development of wireless communication networks, the amount and patterns of data generated by communication devices have surged. Artificial intelligence (AI) has given wireless communication systems the ability to automatically and intelligently process communication data, significantly improving the efficiency of data processing and communication. Automatic modulation recognition (AMR) is a key technology in cognitive radio and non-cooperative communication. This technology identifies the modulation mode of a signal based on features or likelihood, providing important information for subsequent steps such as demodulation. However, traditional AMR technology relies on manually extracted features or prior knowledge of the channel, resulting in low recognition efficiency. In recent years, many researchers have attempted to apply deep learning (DL) to recognition tasks, using deep neural networks (DNNs) to extract intrinsic signal features and classify them, significantly improving recognition speed and accuracy. Intelligent recognition models based on deep learning have demonstrated significant advantages in communication scenarios such as cognitive radio, edge computing, interference detection, and radio monitoring. For AMR systems with complex and variable channels, DL, by leveraging its powerful nonlinear mapping capabilities, can automatically extract signal features and accurately identify the modulation mode.

[0003] However, DNN-based intelligent recognition models have been proven to be vulnerable to adversarial attacks that are imperceptible to humans. Attackers can exploit the broadcast nature of wireless channels to inject carefully crafted, tiny adversarial perturbations into the receiver, severely impacting the reliability of intelligent recognition models. Depending on the attack phase, common attacks include poisoning attacks that contaminate training data during training and evasion attacks that mislead model predictions during inference. Since poisoning attacks require knowledge of the target model's training set, which is often difficult to achieve due to data privacy concerns, evasion attacks pose a greater threat to intelligent modulation recognition models. Depending on the level of knowledge of the target model, common evasion attacks typically include white-box attacks targeting known models and black-box attacks targeting unknown models. Lin et al. introduced attack methods such as the Fast Gradient Sign Method (FGSM), the Basic Iterative Method (BIM), and the Momentum Iterative Method (MIM) from the imaging field to the communications field, demonstrating the vulnerability of DL-based modulation recognition models. Liu et al. proposed a dynamic iterative method (DIM) to attack white-box modulation classifiers, improving the attack success rate. In practice, attackers do not know the model's structure and parameters and often exploit the transferability of adversarial examples to carry out black-box attacks. Hu et al. proposed a substitute meta-learning black-box attack method that combines meta-learning with training of substitute models, improving training efficiency and attack performance. Dong et al. generated adversarial examples on a reconstructed substitute model and directly transferred these adversarial examples to an inaccessible black-box model to carry out the attack.

[0004] To address the security risks posed by adversarial attacks to intelligent recognition models, researchers have conducted research on adversarial example detection, which aims to reject adversarial examples as input to the model after detection. To protect intelligent modulation recognition models from attacks, Xu et al. achieved adversarial signal detection by integrating multiple features of radio signals. However, in many application scenarios, simply detecting whether an input is an adversarial example is insufficient; adversarial defense methods are also required to identify the true category of the input. Zhang et al. used homomorphic filtering to attenuate adversarial perturbations with high-frequency features in the signal, improving the robustness of the AMC model. Chen et al. utilized the principles of distillation learning to perform multiple knowledge extractions through adversarial training (AT) and normal training, improving the robustness of the AMR model against attacks. AT is a simple and effective defense method that uses knowledge from adversarial examples to train a classifier, reducing its vulnerability to adversarial examples. However, AT is robust only against specific attacks and is difficult to adapt to new, more aggressive attacks. Therefore, Kim et al. proposed a Gaussian smoothing (GS) method, which uses Gaussian noise to enhance training data and improve the robustness of the modulation classifier against unknown attacks. However, while GS reduces the adversarial nature of the sample, it also reduces the classifier's recognition accuracy for the original sample.

[0005] With the development of generative artificial intelligence, generative adversarial networks (GANs) have emerged. Researchers have used autoencoders and GANs to eliminate adversarial perturbations in input data. Autoencoders can learn data representations through their encoders and decoders, while GANs learn data distributions through their generators and discriminators, enabling more advanced data generation tasks. Sahay et al. developed a denoising autoencoder that improves the reliability of deep learning-based power allocation models by learning the mapping between potential adversarial examples and their corresponding original examples. Dong et al. constructed a defensive GAN-based end-to-end communication system through triple training, enhancing its robustness against adversarial attacks. Traditional GANs use random noise as input, which can easily lead to mode collapse during training. Instead of using noise with a prior distribution as input, Wang et al. used adversarial signals as input to the GAN generator, trained and applied the generator to eliminate adversarial perturbations, and reduced the impact of attacks on the modulation classifier. However, some perturbations still remain in the GAN-processed signal, making it difficult to further improve the model's recognition accuracy.

[0006] Through the above analysis, it is found that the currently proposed defense methods still have the following problems: First, the currently proposed defense methods are not effective in detecting adversarial samples under weak perturbation power, and it is difficult to accurately detect the adversarial nature hidden in the samples; Second, when the currently proposed defense methods filter out the adversarial perturbations in the samples, some perturbations still remain, which limits the further improvement of the performance of the intelligent modulation recognition model; Third, the currently proposed defense methods mainly focus on improving the robustness of the model to adversarial samples, and it is difficult to guarantee the recognition accuracy of the model for the original clean samples. Summary of the Invention

[0007] In view of this, the embodiments of the present application propose an adversarial decoupling defense method for intelligent identification of communication signal modulation modes. It detects the adversarial nature of the signal based on empirical mode decomposition, overcomes the problem of poor adversarial detection performance under weak perturbations, and utilizes a generative adversarial network to reconstruct the signal waveform and perform random shaping, thereby overcoming the problem of residual adversarial perturbations in adversarial samples. It decouples the adversarial training process into the original branch and the adversarial branch, and integrates the predicted signal modulation mode according to the adversarial detection results. While ensuring the recognition accuracy of the original sample, it effectively improves the robustness of the intelligent modulation recognition model to attacks, thereby effectively improving the recognition accuracy and robustness to attacks.

[0008] To achieve the above-mentioned objectives, an embodiment of the present application proposes an adversarial decoupling defense method for intelligent identification of communication signal modulation modes, comprising the following steps: performing empirical mode decomposition (EMD) on an input signal, decomposing the input signal into a combination of several intrinsic mode function (IMF) components and a residual component, and performing high-frequency feature enhancement on the first IMF component, inputting the input signal after high-frequency feature enhancement into an adversarial detector of a pre-trained recognition model to determine the adversarial suspicion of the input signal; using a pre-trained generative adversarial network to reconstruct the waveform of the input signal to weaken hidden adversarial features; inputting the input signal into the original branch of the pre-trained recognition model to obtain a prediction vector of the original branch, inputting the waveform-reconstructed input signal into the adversarial branch of the pre-trained recognition model to obtain a prediction vector of the adversarial branch, fusing the prediction vector of the original branch and the prediction vector of the adversarial branch based on the adversarial suspicion, and determining the modulation mode of the input signal based on the final prediction vector obtained by fusion.

[0009] To achieve the above-mentioned objectives, an embodiment of the present application also proposes an adversarial decoupling defense system for intelligent identification of communication signal modulation modes, including: an adversarial detection module, a waveform reconstruction module and an adversarial training decoupling prediction module; the adversarial detection module is used to perform empirical mode decomposition on the input signal, decompose the input signal into a combination of several IMF components and residual components, and enhance the high-frequency features of the first IMF component, and input the input signal after high-frequency feature enhancement into the adversarial detector of the pre-trained recognition model to determine the adversarial suspicion of the input signal; the waveform reconstruction module is used to use the pre-trained generative adversarial network to reconstruct the waveform of the input signal to weaken the hidden adversarial features; the adversarial training decoupling prediction module is used to input the input signal into the original branch of the pre-trained recognition model to obtain the prediction vector of the original branch, input the waveform-reconstructed input signal into the adversarial branch of the pre-trained recognition model to obtain the prediction vector of the adversarial branch, fuse the prediction vector of the original branch and the prediction vector of the adversarial branch based on the adversarial suspicion, and determine the modulation mode of the input signal based on the final prediction vector obtained by fusion.

[0010] To achieve the above-mentioned objectives, an embodiment of the present application also proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the adversarial decoupling defense method for intelligent identification of communication signal modulation modes as described above.

[0011] To achieve the above-mentioned purpose, an embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement the adversarial decoupling defense method for intelligent identification of communication signal modulation modes as described above.

[0012] The embodiment of the present application proposes an adversarial decoupling defense method for intelligent identification of communication signal modulation modes. It uses empirical mode decomposition to enhance the high-frequency adversarial features in the input signal, and designs an adversarial detector to detect hidden threats in the input signal. It overcomes the problem of poor adversarial detection performance under weak perturbations, improves the detection effect of weak perturbations, and provides necessary information for adversarial defense. The waveform of the input signal is reconstructed using a generative adversarial network, and the reconstructed perturbation is used to flexibly perform random shaping on the waveform, which overcomes the problem of residual adversarial perturbations, better restores the original modulation features, and improves the recognition performance of the adversarial branch. The traditional adversarial training process is decoupled into the original branch and the adversarial branch, and the prediction results of the two branches are fused according to the adversarial detection results. This overcomes the problem that the intelligent modulation recognition model is difficult to balance the recognition accuracy of the original sample and the adversarial sample. While ensuring the recognition accuracy of the original sample, the robustness of the intelligent modulation recognition model to attacks is improved, thereby effectively improving the recognition accuracy and robustness to attacks.

[0013] Optionally, performing empirical mode decomposition on the input signal to decompose the input signal into a combination of several IMF components and residual components includes:

[0014] The upper envelope and lower envelope are obtained by connecting the local maximum and local minimum points of the signal through the cubic spline curve, and the average value m1(t) of the upper envelope and lower envelope is calculated. The average value m1(t) is expressed as:

[0015]

[0016] Among them, e max (t) represents the upper envelope, e min (t) represents the lower envelope;

[0017] The intermediate signal C is obtained by subtracting the input signal from the average value m1(t). 1,1 (t), intermediate signal C 1,1 (t) is expressed as:

[0018] C 1,1 (t) = x(t) - m1(t)

[0019] Where x(t) represents the input signal;

[0020] Determine the intermediate signal C 1,1 Is the absolute value of the difference between the number of extreme points and the number of zero crossing points of (t) less than 2? If the intermediate signal C 1,1 If the absolute value of the difference between the number of extreme points of (t) and the number of zero crossing points is less than 2, then the intermediate signal C 1,1(t) is taken as the first IMF component IMF1, and the residual component r1(t) is obtained, r1(t)=x(t)-IMF1, if the intermediate signal C 1,1 If the absolute value of the difference between the number of extreme points and the number of zero-crossing points of (t) is greater than or equal to 2, continue the decomposition;

[0021] After several iterations, the residual component r is obtained n (t), r n (t) = r n-1 (t)-IMF n , when the residual component r n When (t) is monotonic, the empirical mode decomposition ends and the residual component R(t) is obtained, R(t) = r n (t), the input signal x(t) is decomposed into a combination of several IMF components and residual components R(t), which can be expressed as:

[0022]

[0023] Among them, the IMF i represents the i-th IMF component, n is the total number of IMF components;

[0024] The high-frequency feature enhancement of the first IMF component is achieved by the following formula:

[0025]

[0026] Among them, λ is the preset high-frequency feature enhancement factor, Represents the input signal after high-frequency features are enhanced.

[0027] Optionally, the step of inputting the input signal after high-frequency feature enhancement into the adversarial detector of the pre-trained recognition model to determine the adversarial suspiciousness of the input signal comprises: inputting the input signal after high-frequency feature enhancement into the adversarial detector of the pre-trained recognition model to determine the adversarial suspiciousness of the input signal Input into the pre-trained recognition model; the output layer of the recognition model outputs the logits value and will Input into the binary adversarial detector consisting of only three fully connected layers to obtain the detection probability output by the binary adversarial detector The detection probability As the adversarial suspiciousness μ of the input signal x(t).

[0028] Optionally, the pre-trained generative adversarial network consists of a generator G and a discriminator D. When training the generator G and the discriminator D, the original sample x and its corresponding adversarial sample x are trained. * As input;

[0029] Define the loss function L for training the generator GG (x,x * ) and the loss function L for training the discriminator D D (x,x * ) are:

[0030]

[0031] Where M is the number of samples, N is the sample length, and β is the preset identification loss coefficient;

[0032] The training process of the generative adversarial network is to minimize L G (x,x * ) and L D (x,x * ) Continuously update network parameters to enhance the reconstruction ability of the generator G and the identification ability of the discriminator D;

[0033] After training, the test sample is input into the generator G, which reconstructs a modulated signal waveform that is similar to the test sample and can mislead the discriminator D into identifying it as true.

[0034] Optionally, the waveform reconstruction of the input signal using a pre-trained generative adversarial network includes:

[0035] Input the input signal x(t) into the pre-trained generative adversarial network, and record the difference between the input signal x(t) and the output G[x(t)] of the generator G of the generative adversarial network as the reconstructed perturbation Δx(t), Δx(t) = x(t) - G[x(t)];

[0036] Replace the reconstructed disturbance Δx(t) with random noise Δn with the same power as the reconstructed disturbance Δx(t) to obtain the input signal x after waveform reconstruction r (t), the input signal x after waveform reconstruction r (t) is expressed as:

[0037] x r (t) = G[x(t)] + Δn

[0038]

[0039] Where φ is a random signal of length N that follows a standard normal distribution.

[0040] Optionally, the original branch is trained using only original samples, and the adversarial branch is trained using only adversarial samples;

[0041] Projection Gradient Descent (PGD) is used to generate adversarial samples to train the adversarial branch. The adversarial samples are randomly initialized before iteration. The iterative process gradually enhances the adversarial strength of the adversarial samples in multiple directions. The iterative process is expressed as:

[0042]

[0043] Among them, S represents the introduced random perturbation, y is the one-hot encoding of the true label, represents the adversarial sample after the cth iteration, α is the preset proportional coefficient, and sign(·) represents the sign function;

[0044] Using the pre-trained generative adversarial network, the final adversarial sample x * Perform waveform reconstruction to obtain the reconstructed adversarial sample Then reconstruct the adversarial sample Perform Gaussian enhancement to obtain enhanced adversarial samples Enhanced adversarial examples Expressed as:

[0045]

[0046] Where ng represents Gaussian noise with a standard deviation of σ, and s represents the number of samples added with noise.

[0047] Optionally, the prediction vector of the original branch and the prediction vector of the adversarial branch are fused based on the adversarial suspicion, and the modulation mode of the input signal is determined based on the final prediction vector obtained by fusion, which is implemented by the following formula:

[0048] f[x(t)]=(1-μ)f ori [x(t)]+μf adv [x r (t)]

[0049]

[0050] Among them, f ori [x(t)] represents the prediction vector of the original branch, f adv [x r (t)] represents the prediction vector of the adversarial branch, f[x(t)] represents the final prediction vector, K represents the total number of modulation modes, and f[y k |x(t)] represents the predicted probability of the kth modulation mode. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1This is a flowchart of an adversarial decoupling defense method for intelligent identification of communication signal modulation modes provided in one embodiment of the present application;

[0052] Figure 2 This is a schematic diagram of an implementation of an adversarial decoupling defense for intelligent identification of communication signal modulation modes provided in one embodiment of the present application;

[0053] Figure 3 This is a schematic structural diagram of an adversarial decoupling defense system for intelligent identification of communication signal modulation modes provided in another embodiment of the present application;

[0054] Figure 4 This is a comparison result diagram of an adversarial decoupling defense method for intelligent identification of communication signal modulation modes and an Inspection-Net method, provided in another embodiment of the present application;

[0055] Figure 5 This is a comparison result diagram of an adversarial decoupling defense method and a Gaussian smoothing defense method for intelligent identification of communication signal modulation modes, provided in another embodiment of the present application;

[0056] Figure 6 It is a structural diagram of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, each embodiment of the present application will be described in detail below with reference to the accompanying drawings. However, it will be understood by those skilled in the art that in each embodiment of the present application, many technical details are proposed to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in the present application can be implemented. The division of the following embodiments is for convenience of description and should not constitute any limitation on the specific implementation of the present application. The various embodiments can be combined and referenced with each other under the premise of no contradiction.

[0058] In order to solve the technical problem that the currently proposed defense methods have poor defense effects, an embodiment of the present application proposes an adversarial decoupling defense method for intelligent identification of communication signal modulation modes, which is applied to electronic devices, where the electronic device can be a terminal or a server. This embodiment and the following embodiments are all described using the server as an example. The following is a detailed description of the implementation details of the adversarial decoupling defense method for intelligent identification of communication signal modulation modes proposed in this embodiment. The following content is only for the convenience of understanding the implementation details provided and is not necessary for the implementation of this solution.

[0059] The specific process of the adversarial decoupling defense method for intelligent identification of communication signal modulation modes proposed in this embodiment can be as follows: Figure 1 Shown, including:

[0060] Step 101: Perform empirical mode decomposition on the input signal to decompose the input signal into a combination of several IMF components and residual components, and perform high-frequency feature enhancement on the first IMF component. The input signal after high-frequency feature enhancement is input into the adversarial detector of the pre-trained recognition model to determine the adversarial suspicion of the input signal.

[0061] In the specific implementation, after obtaining the input signal, the server first needs to perform empirical mode decomposition on the input signal, decomposing the input signal into a combination of several IMF components and residual components, and then enhance the high-frequency features of the first IMF component. The input signal with high-frequency feature enhancement is then input into the adversarial detector of the pre-trained recognition model to determine the adversarial suspicion of the input signal.

[0062] Most of the currently proposed defense methods are based on DNNs. Due to the high-dimensional nature of DNNs, small differences in the input signal can become increasingly significant as they propagate between network layers, ultimately misleading the network's output. This is why adversarial examples are so potent. Therefore, the output of the recognition model's final feature extraction layer can be used to detect adversarial examples and distinguish between original and adversarial examples. Using the recognition model's logit output, a simple binary detector can be trained as an adversarial detector, achieving good detection results without changing the network structure. The output of a binary detector is typically a probability, which can be interpreted as the threat level of the example to the recognition model. However, this detection method is not ideal when the perturbation power of the adversarial example is very low. To address this, the server uses empirical mode decomposition to detect adversarial examples, improving the accuracy of adversarial detection even with weak perturbations.

[0063] Compared to original samples, adversarial samples often have higher power at high frequencies. Therefore, the high-frequency characteristics of adversarial samples can be used to detect the suspiciousness of samples. EMD is an adaptive signal time-frequency processing method that decomposes signals based on the time scale characteristics of the data itself. Without pre-setting any basis functions, it can separate signals into IMF components and residual functions of different frequencies. It is particularly suitable for analyzing and processing nonlinear and non-stationary signals.

[0064] In one example, when the server performs empirical mode decomposition on the input signal and decomposes the input signal into a combination of several IMF components and residual components, it first connects the local maximum points and local minimum points of the signal using a cubic spline curve to obtain the upper envelope and the lower envelope, and calculates the average value m1(t) of the upper envelope and the lower envelope. The average value m1(t) is expressed as:

[0065]

[0066] Among them, e max (t) represents the upper envelope, e min (t) represents the lower envelope.

[0067] Then, the server needs to use the input signal and the average value m1(t) to make a difference to get the intermediate signal C 1,1 (t), intermediate signal C 1,1 (t) is expressed as:

[0068] C 1,1 (t) = x(t) - m1(t)

[0069] Where x(t) represents the input signal.

[0070] After that, the server needs to determine the intermediate signal C 1,1 Is the absolute value of the difference between the number of extreme points of (t) and the number of zero crossing points less than 2, that is, to judge whether C 1,1 Whether the number of extreme points of (t) is equal to the number of zero-crossing points or differs by at most one, and whether the upper envelope and the lower envelope at any time are locally symmetrical with respect to the time axis.

[0071] If the intermediate signal C 1,1 The absolute value of the difference between the number of extreme points of (t) and the number of zero-crossing points is less than 2, and the upper envelope and the lower envelope at any time are locally symmetrical with respect to the time axis, then the server will 1,1 (t) is taken as the first IMF component IMF1, and the remaining component r1(t) is obtained, r1(t)=x(t)-IMF1.

[0072] If the intermediate signal C 1,1 If the absolute value of the difference between the number of extreme points and the number of zero-crossing points of (t) is greater than or equal to 2, or the upper envelope and the lower envelope at any time are not locally symmetrical with respect to the time axis, the server needs to continue decomposing. After several iterations (n ​​iterations), the server can obtain the residual component r n (t), r n (t) = r n-1 (t)-IMF n , when the residual component rn When (t) is monotonic, the empirical mode decomposition ends and the residual component R(t) is obtained, R(t) = r n (t).

[0073] At this point, the input signal x(t) is decomposed into a combination of several IMF components and residual components R(t):

[0074]

[0075] Among them, the IMF i represents the i-th IMF component, and n is the total number of IMF components.

[0076] Among several IMF components, IMF1 has the highest frequency. The main information of the adversarial perturbation is hidden in IMF1. Under weak perturbations, the high-frequency features of the adversarial sample and the original sample are not significant, which limits the effectiveness of adversarial sample detection. Therefore, the server needs to increase the power of IMF1 to enhance the adversarial hidden in the sample and provide better feature differences for subsequent networks to facilitate detection. The server enhances the high-frequency features of the first IMF component, which can be achieved by the following formula:

[0077]

[0078] Among them, λ is the preset high-frequency feature enhancement factor, Represents the input signal after high-frequency features are enhanced.

[0079] In one example, the server obtains the input signal after high-frequency feature enhancement After that, the input signal with enhanced high-frequency features can be Input into the pre-trained recognition model, and the output layer of the recognition model outputs the logits value and will Input into the binary adversarial detector consisting of only three fully connected layers to obtain the detection probability output by the binary adversarial detector Finally, the recognition model will detect the probability As the adversarial suspiciousness μ of the input signal x(t), the adversarial suspiciousness μ of the input signal x(t) can be expressed as:

[0080]

[0081] Wherein, τ is the preset decision threshold.

[0082] Step 102: Use the pre-trained generative adversarial network to reconstruct the waveform of the input signal to weaken the hidden adversarial features.

[0083] In the specific implementation, after obtaining the input signal, the server also needs to use the pre-trained generative adversarial network to reconstruct the waveform of the input signal to weaken the hidden adversarial features.

[0084] It is worth noting that step 102 and step 101 can be performed simultaneously.

[0085] In an example, the pre-trained generative adversarial network consists of a generator G and a discriminator D. When training the generator G and the discriminator D, the server can send the original sample x and its corresponding adversarial sample x to the server. * as input.

[0086] When training the generator G, the waveform reconstructed by the generator G must be close to the original signal waveform in the time domain and be able to deceive the discriminator D to make an incorrect prediction. When training the discriminator D, it is necessary to reduce the probability of the discriminator D predicting the reconstructed sample while increasing the probability of the discriminator D predicting the original sample. Therefore, the server defines the loss function L for training the generator G G (x,x * ) and the loss function L for training the discriminator D D (x,x * ) are:

[0087]

[0088] Among them, M is the number of samples, N is the sample length, and β is the preset identification loss coefficient.

[0089] The training process of the generative adversarial network is to minimize L G (x,x * ) and L D (x,x * ) Continuously update the network parameters to enhance the reconstruction ability of the generator G and the identification ability of the discriminator D.

[0090] After training, the test sample is input into the generator G, which reconstructs a modulated signal waveform that is similar to the test sample and can mislead the discriminator D into identifying it as true.

[0091] The server inputs the input signal x(t) into the pre-trained generative adversarial network, and records the difference between the input signal x(T) and the output G[x(t)] of the generator G of the generative adversarial network as the reconstructed perturbation Δx(t), Δx(t) = x(t) - G[x(t)].

[0092] Subsequently, the server replaces the reconstructed disturbance Δx(t) with random noise Δn having the same power as the reconstructed disturbance Δx(t) to obtain the input signal x after waveform reconstruction. r (t), the input signal x after waveform reconstructionr (t) can be expressed as:

[0093] x r (t) = G[x(t)] + Δn

[0094]

[0095] Where φ is a random signal of length N that follows a standard normal distribution.

[0096] For generative adversarial networks, when the input is an adversarial sample, Δx(t) contains adversarial information. Replacing it with random noise destroys this adversarial information. When the input is the original sample, Δx(t) contains only random noise, and replacing it with random noise has little impact on the recognition model's predictions. Compared to the traditional method of directly adding random noise to the input sample, the generative adversarial network setting can adaptively adjust the noise power based on the size of the reconstructed perturbation, avoiding the impact of improper noise power settings on the sample's modulation characteristics.

[0097] Step 103: input the input signal into the original branch of the pre-trained recognition model to obtain the prediction vector of the original branch; input the waveform-reconstructed input signal into the adversarial branch of the pre-trained recognition model to obtain the prediction vector of the adversarial branch; fuse the prediction vector of the original branch and the prediction vector of the adversarial branch based on the adversarial suspicion; and determine the modulation mode of the input signal based on the final prediction vector obtained by fusion.

[0098] In its implementation, traditional adversarial training requires adding adversarial samples to the training set alongside the original samples to train the recognition model. This can easily lead to overfitting and reduce the recognition model's accuracy for the original samples. To address this issue, the server decouples adversarial training into an original branch and an adversarial branch. The server feeds the input signal into the original branch to obtain a prediction vector for the original branch, then feeds the reconstructed waveform of the input signal into the adversarial branch to obtain a prediction vector for the adversarial branch. Finally, the server fuses the original and adversarial prediction vectors based on the adversarial suspicion level and determines the input signal's modulation scheme based on the resulting fused prediction vector.

[0099] In one example, the original branch is trained only with original samples, while the adversarial branch is trained only with adversarial samples. The server uses projected gradient descent to generate adversarial samples to train the adversarial branch. The adversarial samples are randomly initialized before iteration. The iterative process gradually enhances the adversarial strength of the adversarial samples in multiple directions. The iterative process is expressed as:

[0100]

[0101] Among them, S represents the introduced random perturbation, y is the one-hot encoding of the true label, represents the adversarial sample after the cth iteration, α is the preset proportional coefficient, and sign(·) represents the sign function.

[0102] In order to further improve the generalization of the adversarial branch to unknown attacks, the server can perform Gaussian enhancement on the reconstructed adversarial sample. Gaussian enhancement uses Gaussian noise to enhance the training set of the model to improve the robustness of the modulation recognition model to possible perturbations in multiple directions. Specifically, the server uses the pre-trained generative adversarial network to generate the final adversarial sample x. * Perform waveform reconstruction to obtain the reconstructed adversarial sample Then reconstruct the adversarial sample Perform Gaussian enhancement to obtain enhanced adversarial samples Enhanced adversarial examples It can be expressed as:

[0103]

[0104] Where ng represents Gaussian noise with a standard deviation of σ, and s represents the number of samples added with noise.

[0105] In one example, the server fuses the prediction vector of the original branch and the prediction vector of the adversarial branch based on the adversarial suspicion degree, and determines the modulation mode of the input signal based on the final prediction vector obtained by the fusion. This can be achieved by the following formula:

[0106] f[x(t)]=(1-μ)f ori [x(t)]+μf adv [x r (t)]

[0107]

[0108] Among them, f ori [x(t)] represents the prediction vector of the original branch, f adv [x r (t)] represents the prediction vector of the adversarial branch, f[x(t)] represents the final prediction vector, K represents the total number of modulation modes, and f[y k|x(t)] represents the predicted probability for the kth modulation mode. If μ = 0, the input signal is treated completely as an original sample. In this case, the recognition model's recognition accuracy is consistent with the original branch, avoiding a decrease in the recognition model's recognition accuracy for the original sample. If 0 < μ < 1, the adversarial detector cannot fully determine the nature of the input signal and needs to combine the results of the original branch and the adversarial branch for recognition. If μ = 1, the input signal is an adversarial sample, and the recognition model's recognition result is consistent with the adversarial branch.

[0109] At this point, the adversarial decoupling defense for intelligent identification of communication signal modulation has been completed. The entire implementation process of the adversarial decoupling defense for intelligent identification of communication signal modulation can be described as follows: Figure 2 shown.

[0110] In this embodiment, empirical mode decomposition is used to enhance the high-frequency adversarial features in the input signal, and an adversarial detector is designed to detect hidden threats in the input signal, thereby overcoming the problem of poor adversarial detection performance under weak perturbations, improving the detection effect of weak perturbations, and providing necessary information for adversarial defense. The waveform of the input signal is reconstructed using a generative adversarial network, and the waveform is flexibly randomly shaped using the reconstructed perturbation, thereby overcoming the problem of residual adversarial perturbations, better restoring the original modulation features, and improving the recognition performance of the adversarial branch. The traditional adversarial training process is decoupled into the original branch and the adversarial branch, and the prediction results of the two branches are fused according to the adversarial detection results, thereby overcoming the problem that the intelligent modulation recognition model is difficult to balance the recognition accuracy of the original sample and the adversarial sample. While ensuring the recognition accuracy of the original sample, the robustness of the intelligent modulation recognition model to attacks is improved, thereby effectively improving the recognition accuracy and robustness to attacks.

[0111] Another embodiment of the present application proposes an adversarial decoupling defense system for intelligent identification of communication signal modulation modes. The details of the adversarial decoupling defense system for intelligent identification of communication signal modulation modes proposed in this embodiment are described in detail below. The following content is only the implementation details provided for the convenience of understanding and is not necessary for the implementation of this embodiment. Figure 3 This is a schematic diagram of the adversarial decoupling defense system for intelligent identification of communication signal modulation modes proposed in this embodiment, including: an adversarial detection module 201, a waveform reconstruction module 202 and an adversarial training decoupling prediction module 203.

[0112] The adversarial detection module 201 is used to perform empirical mode decomposition on the input signal, decompose the input signal into a combination of several IMF components and residual components, enhance the high-frequency features of the first IMF component, and input the input signal after high-frequency feature enhancement into the adversarial detector of the pre-trained recognition model to determine the adversarial suspicion of the input signal.

[0113] The waveform reconstruction module 202 is used to reconstruct the waveform of the input signal using a pre-trained generative adversarial network to weaken hidden adversarial features.

[0114] The adversarial training decoupling prediction module 203 is used to input the input signal into the original branch of the pre-trained recognition model to obtain the prediction vector of the original branch, input the waveform-reconstructed input signal into the adversarial branch of the pre-trained recognition model to obtain the prediction vector of the adversarial branch, fuse the prediction vector of the original branch and the prediction vector of the adversarial branch based on the adversarial suspicion, and determine the modulation method of the input signal based on the final prediction vector obtained by fusion.

[0115] It is not difficult to find that this embodiment is a system embodiment corresponding to the above-mentioned method embodiment, and this embodiment can be implemented in conjunction with the above-mentioned method embodiment. The relevant technical details and technical effects mentioned in the above-mentioned embodiments are still valid in this embodiment, and to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above-mentioned embodiments.

[0116] It is worth mentioning that all modules involved in this embodiment are logical modules. In actual applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, to highlight the innovation of this application, this embodiment does not include units that are not closely related to solving the technical problem proposed by this application. However, this does not mean that other units do not exist in this embodiment.

[0117] The adversarial decoupling defense method and system for intelligent identification of communication signal modulation modes proposed in this application can be used to defend against adversarial attacks on intelligent modulation identification of communication signals, including white-box attacks, black-box attacks, reliability attacks, and targeted attacks. It can also be used to defend against adversarial attacks in other fields such as image recognition based on deep learning.

[0118] In another embodiment, to evaluate the performance of the adversarial decoupling defense method and system for intelligent recognition of communication signal modulation modes (hereinafter referred to as EMD-AD) proposed in this application, technicians conducted a series of simulation experiments. In the simulation experiments, a ResNet network was selected as the intelligent modulation recognition model to be protected. Three fully connected layers were used to construct an adversarial detector for detecting adversarial samples, and dropout was used to prevent overfitting. The modulation signal types to be identified included eight digital signals: 8PSK, QPSK, BPSK, GFSK, CPFSK, PAM4, QAM16, and QAM64, as well as two analog signals: WBFM and AM-DSB. The simulation parameters for studying the impact of perturbation level on defense performance were set as follows: the modulation signal-to-noise ratio (SNR) was 10dB, the perturbation level ε∈[0, 0.003] with an interval of 0.0003, and the decision threshold for detecting adversarial samples was set to 0.5. In each simulation experiment, 1000 samples were taken to verify the attack performance against adversarial samples generated by the test signal. When verifying the performance of adversarial sample detection, the EMD-AD proposed in this application is compared with the more mature Inspection-Net, and the two detection performance indicators of Accuracy and F1-Score are compared. The simulation results are as follows: Figure 4 When verifying the defense performance, the proposed adversarial decoupling defense (hereinafter referred to as ADD) is compared with the more mature Gaussian smoothing (GS) defense method to compare the defense effects of the two on FGSM, MIM, and DIM attacks. The simulation results are shown in Figure 2. Figure 5 As shown. Figure 4 It can be seen that EMD-AD outperforms Inspection-Net in adversarial detection and has better detection results under weak perturbations. Furthermore, as shown in Figure 5, compared to GS, the ADD method not only ensures the recognition accuracy of the recognition model for the original samples, but also enhances the model's robustness against attacks.

[0119] Another embodiment of the present application provides an electronic device, the structure of which is as follows: Figure 6 As shown, it includes: at least one processor 301; and a memory 302 communicatively connected to the at least one processor 301; wherein the memory 302 stores instructions that can be executed by the at least one processor 301, and the instructions are executed by the at least one processor 301 to enable the at least one processor 301 to execute the adversarial decoupling defense method for intelligent identification of communication signal modulation modes described in the above-mentioned method embodiments.

[0120] The memory and processor are connected using a bus, which can include any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and are therefore not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor.

[0121] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0122] Another embodiment of the present application proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement the adversarial decoupling defense method for intelligent identification of communication signal modulation modes described in the above-mentioned method embodiments.

[0123] That is, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (which may be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard drive, a ROM (Read-Only Memory), a RAM (Random Access Memory), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0124] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and that in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for adversarial decoupling defense for intelligent identification of communication signal modulation modes, characterized in that: include: Perform empirical mode decomposition (Empirical Mode Decomposition) on the input signal to decompose it into a combination of several IMF components and residual components. Then, perform high-frequency feature enhancement on the first IMF component. The enhanced input signal is fed into the adversarial detector of the pre-trained recognition model to determine the adversarial suspicion of the input signal. Using a pre-trained generative adversarial network, the input signal waveform is reconstructed to weaken the hidden adversarial features; Input the input signal into the original branch of the pre-trained recognition model to obtain a prediction vector for the original branch. Input the waveform-reconstructed input signal into the adversarial branch of the pre-trained recognition model to obtain a prediction vector for the adversarial branch. The prediction vectors of the original branch and the adversarial branch are fused based on the adversarial suspicion degree, and the modulation mode of the input signal is determined based on the final fused prediction vector. Inputting the input signal after high-frequency feature enhancement into the adversarial detector of the pre-trained recognition model to determine the adversarial suspicion of the input signal includes: The input signal after high-frequency features are enhanced Input into the pre-trained recognition model; The output layer of the recognition model outputs the logits value , and Input into the binary adversarial detector consisting of only three fully connected layers to obtain the detection probability output by the binary adversarial detector ; The detection probability As input signal The adversarial suspicion .

2. The adversarial decoupling defense method for intelligent identification of communication signal modulation modes according to claim 1 is characterized in that: The empirical mode decomposition is performed on the input signal to decompose the input signal into a combination of several IMF components and residual components, including: The local maximum and local minimum points of the signal are connected by cubic spline curves to obtain the upper envelope and lower envelope, and the average value of the upper envelope and lower envelope is calculated. ,average value Expressed as: ； in, represents the upper envelope, represents the lower envelope; Using the input signal and the average value Do the difference and get the intermediate signal , intermediate signal Expressed as: ； in, represents the input signal; Judging the intermediate signal Whether the absolute value of the difference between the number of extreme points and the number of zero-crossing points is less than 2, and whether the upper envelope and the lower envelope at any time are locally symmetrical with respect to the time axis; If the intermediate signal The absolute value of the difference between the number of extreme points and the number of zero crossing points is less than 2, and the upper envelope and the lower envelope at any time are locally symmetrical with respect to the time axis, then the intermediate signal As the first IMF component , and get the remaining component , ; If the intermediate signal If the absolute value of the difference between the number of extreme points and the number of zero-crossing points is greater than or equal to 2, or the upper envelope and the lower envelope at any time are not locally symmetrical with respect to the time axis, then continue to decompose; After several iterations, the remaining components are obtained , , when the remaining component When monotonic, the empirical mode decomposition ends and the residual component is obtained , , input signal It is decomposed into several IMF components and residual components The combined form is expressed as: ； in, Indicates the IMF components, is the total number of IMF components; The high-frequency feature enhancement of the first IMF component is achieved by the following formula: ； in, is the preset high-frequency feature enhancement factor, Represents the input signal after high-frequency features are enhanced.

3. The adversarial decoupling defense method for intelligent identification of communication signal modulation modes according to claim 1 is characterized in that: The pre-trained generative adversarial network consists of a generator and discriminator Composition, in training the generator and discriminator When the original sample and its corresponding adversarial examples As input; Defining the training generator The loss function and train the discriminator The loss function They are: ； ； in, is the sample size, is the sample length, is the preset identification loss coefficient; The training process of the generative adversarial network is to minimize and Continuously update network parameters and enhance the generator Reconstruction capabilities and discriminators the ability to identify; After training, the test sample is input into the generator In the generator Reconstruct a sample that is similar to the test sample and can mislead the discriminator Identify it as a real modulated signal waveform.

4. The adversarial decoupling defense method for intelligent identification of communication signal modulation modes according to claim 3 is characterized in that: The waveform reconstruction of the input signal using the pre-trained generative adversarial network includes: The input signal Input into the pre-trained generative adversarial network, and transform the input signal Generators with Generative Adversarial Networks Output The difference between them is recorded as the reconstruction perturbation , ; Reconstructing the perturbation Replace with and reconstruct the perturbation Random noise with the same power , get the input signal after waveform reconstruction , the input signal after waveform reconstruction Expressed as: ； ； in, The length is And it is a random signal that obeys the standard normal distribution.

5. The adversarial decoupling defense method for intelligent identification of communication signal modulation modes according to claim 4 is characterized in that: The original branch is trained only with original samples, and the adversarial branch is trained only with adversarial samples; The projected gradient descent method is used to generate adversarial samples to train the adversarial branch. The adversarial samples are randomly initialized before iteration. The iterative process gradually enhances the adversarial strength of the adversarial samples in multiple directions. The iterative process is expressed as: ； in, represents the random disturbance introduced, is the one-hot encoding of the true label, represents the adversarial sample after the cth iteration, is the preset scale factor, represents a symbolic function; Use the pre-trained generative adversarial network to generate the final adversarial sample Perform waveform reconstruction to obtain the reconstructed adversarial sample , and then reconstruct the adversarial sample Perform Gaussian enhancement to obtain enhanced adversarial samples , enhanced adversarial examples Expressed as: ； in, The standard deviation is Gaussian noise, Indicates the number of samples added with noise.

6. The adversarial decoupling defense method for intelligent identification of communication signal modulation modes according to claim 5 is characterized in that: The prediction vector of the original branch and the prediction vector of the adversarial branch are fused based on the adversarial suspicion, and the modulation mode of the input signal is determined based on the final prediction vector obtained by fusion, which is achieved by the following formula: ； ； in, represents the prediction vector of the original branch, represents the prediction vector of the adversarial branch, represents the final prediction vector, Indicates the total number of modulation modes, Indicates the The predicted probability of each modulation mode.

7. An adversarial decoupling defense system for intelligent identification of communication signal modulation modes, characterized in that: include: Adversarial detection module, waveform reconstruction module and adversarial training decoupling prediction module; The adversarial detection module is used to perform empirical mode decomposition (Empirical Mode Decomposition) on the input signal, decomposing it into a combination of several IMF components and residual components. The module then enhances the high-frequency features of the first IMF component and feeds the enhanced input signal into the adversarial detector of the pre-trained recognition model to determine the adversarial suspicion of the input signal. The waveform reconstruction module is used to reconstruct the waveform of the input signal using a pre-trained generative adversarial network to weaken hidden adversarial features; An adversarial training decoupling prediction module is configured to input an input signal into the original branch of a pre-trained recognition model to obtain a prediction vector for the original branch, input the waveform-reconstructed input signal into the adversarial branch of the pre-trained recognition model to obtain a prediction vector for the adversarial branch, fuse the prediction vectors of the original branch and the adversarial branch based on adversarial suspicion, and determine the modulation mode of the input signal based on the final fused prediction vector. Inputting the input signal after high-frequency feature enhancement into the adversarial detector of the pre-trained recognition model to determine the adversarial suspicion of the input signal includes: The input signal after high-frequency features are enhanced Input into the pre-trained recognition model; The output layer of the recognition model outputs the logits value , and Input into the binary adversarial detector consisting of only three fully connected layers to obtain the detection probability output by the binary adversarial detector ; The detection probability As input signal The adversarial suspicion .

8. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; In which, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the adversarial decoupling defense method for intelligent identification of communication signal modulation modes as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it is capable of implementing the adversarial decoupling defense method for intelligent identification of communication signal modulation modes as described in any one of claims 1 to 6.

Images