Method, system and equipment for resisting sample attack based on fused noise

Abstract

The invention belongs to the technical field of artificial intelligence security, and particularly relates to a method, a system and equipment for resisting sample attack based on fused noise, which can extract data features of traffic and industrial control data features and train a detection model according to the features; noise is generated and fused from the angles of the time domain and the frequency domain, Gaussian noise conforming to normal distribution is sampled based on the time domain, colored noise conforming to 1 / f alpha distribution is sampled based on the frequency domain, an adversarial sample is generated, and the adversarial sample is implanted into the feature original data set to construct the adversarial sample. According to the method, the classification accuracy of the existing excellent intrusion detection model based on artificial intelligence can be effectively reduced, and the method can be applied to testing the robustness of the intrusion detection model based on artificial intelligence in the industrial internet. According to the invention, the detection accuracy of the model in the industrial internet environment can be greatly improved, the problem that industrial control data is difficult to collect can be effectively overcome, and the experiment efficiency is improved.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security technology in the industrial Internet, and in particular, relates to an adversarial sample attack method, system and equipment based on fusion noise. Background Art

[0002] Industrial Control Systems (ICS) are deeply integrated with the Internet of Things and the Internet, which has greatly improved the informationization and intelligence of ICS, but also brought a series of new security challenges. In recent years, information security technology has developed rapidly, and network intrusion attacks have also appeared in the field of industrial control. Attacks can cause communication interruption of industrial control equipment, making it unable to operate normally, resulting in accelerated equipment loss, delaying project construction, and even causing data tampering and leakage.

[0003] In order to solve the problem of network intrusion attacks on the industrial Internet, researchers have proposed an intrusion detection model based on artificial intelligence. The industrial Internet is different from the traditional Internet. It not only contains network traffic based on industrial control protocols, but also mixed with network traffic based on traditional protocols. An effective feature extraction method is needed to solve the problem of artificial intelligence model training. While the detection methods of network intrusion attacks are becoming more and more mature, the escape methods for detection models are also increasing. Although various models have improved the accuracy of detection, reduced the time spent on detection, and optimized the hardware equipment requirements, they have ignored the robustness of the model, making the detection model easy to be exploited by attackers.

[0004] In the field of network security and intrusion detection, attackers often use adversarial samples to deceive artificial intelligence-based intrusion detection models and bypass intrusion detection systems. The generation and application research of adversarial samples originated in the field of images. For artificial intelligence detection models, samples obtained by adding subtle noise disturbances to the original data set are called adversarial samples. Adversarial sample attacks are divided into white-box attacks and black-box attacks according to the different information known to the attacker about the model. White-box attacks generally refer to attackers mastering the data set, the specific parameter settings of the model, and the corresponding output of the model. Black-box attacks generally refer to attackers only knowing the training data set and the output after the data is input into the model. In the field of adversarial sample generation for network traffic intrusion detection, the present invention divides adversarial sample attacks into gradient-based attacks, score-optimization-based attacks, Generative Adversarial Network (GAN)-based attacks, and substitution model-based attacks. Attack methods based on gradient and score optimization require relevant information of the detection model, while attack methods based on GAN and substitution models require extremely high fitting conditions.

[0005] Depending on the method of generating adversarial samples, the type of noise perturbation added is also different, but the essence of generating adversarial samples is to implant noise into the original sample. Noise is a phenomenon that exists in nature, spanning various research fields and spread throughout industrial environments. Gaussian noise is noise whose probability density function conforms to the normal distribution of time domain sampling. In real environments, noise is often not caused by a single source, but a complex of noise from many different sources. Gaussian noise can better simulate time domain noise. Colored noise is a type of random signal process, also known as environmental noise, which is a time series. Blue noise, pink noise, red noise, and purple noise are common noises in nature. Their power spectral density functions in the frequency domain satisfy 1 / f α Distribution, where α is used to measure how fast the frequency decreases. Noise can be used in adversarial training, data enhancement, transfer learning and other fields.

[0006] Through the above analysis, the problems and defects of the prior art are as follows:

[0007] (1) Existing detection models ignore the robustness of the model, which makes the detection model easy to be exploited by attackers;

[0008] (2) Existing methods for generating traffic adversarial samples are only applied to the traditional Internet field and do not involve the industrial Internet field;

[0009] (3) Existing methods for generating adversarial samples of network traffic generally migrate to methods for generating adversarial samples of images, and no novel and interesting methods have been proposed. Summary of the invention

[0010] In view of the problems existing in the prior art, the present invention provides an adversarial sample attack method, system, medium, device and terminal, and more particularly, relates to an adversarial sample attack method, system, medium, device and terminal based on fusion noise.

[0011] The present invention is implemented as follows: an adversarial sample attack method based on fused noise, the adversarial sample attack method includes: an original data set, an adversarial sample data set obtained by combining an attack algorithm, and a network intrusion detection model. In view of the problems existing in the prior art, the present invention combines network traffic characteristics and industrial control protocol identification codes to propose a feature extraction method for traffic packets in the industrial Internet, which can extract data characteristics of traffic and industrial control data characteristics, and use this feature to train the detection model; generate and fuse noise from the time domain and frequency domain perspectives respectively, generate adversarial samples based on Gaussian noise that conforms to the normal distribution based on time domain sampling and colored noise that satisfies the distribution based on frequency domain sampling, and implant it into the feature original data set to construct adversarial samples. The present invention proposes an adversarial sample generation method based on fused noise, which can effectively reduce the classification accuracy of the existing relatively excellent artificial intelligence-based intrusion detection model, and can be applied to test the robustness of artificial intelligence-based intrusion detection models in the industrial Internet.

[0012] Furthermore, the adversarial sample attack method includes the following steps:

[0013] S1, collects traffic data packets in the industrial control environment, extracts traffic data features and industrial control data features by combining network traffic features and industrial control identification codes, and preprocesses the data to create a data set, which is divided into a training set, a validation set, and a test set;

[0014] S2, using the original data set obtained in S1, inputs the original samples into the intrusion detection model to train the intrusion detection model;

[0015] S3, generates different types of noise from both the time domain and the frequency domain, and implants the noise into the original samples of the original dataset to obtain adversarial samples;

[0016] S4, uses the adversarial samples generated by S3 to attack the intrusion detection model trained by S2 to test the robustness of the detection model.

[0017] Furthermore, in S1, data features are extracted according to traffic features and industrial control features to obtain a data set, which specifically includes:

[0018] (1) According to the characteristics of the Industrial Internet, a 9-tuple feature extraction method is proposed based on the address information of the traditional network protocol and the unique identification code of the industrial control protocol;

[0019] (2) Assume that the traditional network protocol address information C = {c 1 ,c 2 …c 7}, representing source IP address, destination IP address, source MAC address, destination MAC address, communication protocol, source port, destination port; industrial control protocol unique identification code I = {i i ,i 2}, representing the industrial control identification codes modbus_trans_id and modbus_func_code in the Modbus-TCP protocol;

[0020] (3) The traditional protocol 7-tuple includes the traditional 5-tuple and the MAC address. The 5-tuple can identify the traditional network protocol, and the information between flows can be extracted based on the 5-tuple. Adding the MAC address can defend against man-in-the-middle attack traffic to a certain extent.

[0021] (4) The industrial control protocol 2-tuple modbus_trans_id can distinguish between traditional network traffic and industrial control protocol traffic, and extract the characteristics of traditional network traffic and industrial control traffic respectively; modbus_func_code can separate the different functions of Modbus-TCP industrial control traffic and obtain the characteristics of different instructions of industrial control equipment; at the same time, the upstream and downstream traffic can be separated, so that the DoS traffic characteristics can be better extracted; according to the 9-tuple, the traffic characteristics of traditional network protocols and industrial control protocols can be extracted. Extracting industrial control data from Modbus packets can prevent attackers from tampering with industrial control data to a certain extent. Combining traffic characteristics with industrial control characteristics can assist in intrusion detection;

[0022] (5) Finally, we get the traffic characteristics X = {x 1 ,x 2 ,…,x p}, industrial control feature Y = {y 1 ,y 2 ,…,y q}, a dataset containing 27 features was extracted using 9-tuples; there were 21 traffic features, including the number of network uplink and downlink traffic packets, payload size, flow duration, and the mean, maximum, minimum, and standard deviation of packet payload and transmission time interval. Industrial control features include the operating characteristics of 6 devices;

[0023] (6) Preprocess the extracted data, including category label processing, data cleaning, and data standardization, and finally divide the data set into training set, validation set, and test set.

[0024] Furthermore, in S2, the detection model must be an artificial intelligence-based intrusion detection model for the industrial Internet; first, set the model parameters, including model layers, activation functions and other options, then set the training parameters, including optimizer, loss function, learning rate, training batch size and number of times and other options, and finally train to obtain the intrusion detection model.

[0025] Furthermore, in S3, noise is generated from both the time domain and the frequency domain to construct adversarial samples, including:

[0026] (1) Assume that there are n data samples to be tested, the flow feature of the data set is p, the industrial control feature is q, and the class label is k, then X = {x 1 ,x 2 ,…,x p},Y={y 1 ,y 2 ,…,y q}, Z={z 1+p+q ,z 2+p+q ,…,z k+p+q};

[0027] (2) Thus, the data set and class labels can be expressed as:

[0028] S={s j {X,Y,Z} j ={x 1 ,…,x p ;y 1 ,…,y q ; z 1+p+q ,…,z k+p+q} j ={x j1 ,x j2 ,…,x jp ;y j1 ,y j2 ,…,y jq ; z j(1+[+q) ,z j(2+p+q) ,…,z j(k+[+q)}|j=1,…,n};

[0029] (3) Assuming there are γ different noises, the standardized noise set is expressed as NOISE = {noise 1 ,noise 2 ,…,noise γ}, the present invention defines the noise fusion process as symbol Fusion noise all It can be expressed as:

[0030] (4) Noise is implanted into the data set as follows:

[0031] in, It means that F features are selected from N features of traffic features and industrial control features as injection points for adversarial sample generation, ρ represents the noise perturbation coefficient of different multiples, Indicates that noise is implanted into the data set, then It is the data set generated after adding noise.

[0032] Furthermore, in S4, the adversarial samples generated in S3 are used to attack the detection model trained in step 2, confuse the classifier, reduce the classification accuracy, and test the robustness of the detection model.

[0033] Another object of the present invention is to provide an adversarial sample attack system based on fusion noise, comprising:

[0034] Dataset acquisition module: used to collect the data required for detection model training and perform preprocessing to form a data set;

[0035] Intrusion detection model building module: used to perform intrusion detection on traffic and distinguish normal traffic from malicious traffic;

[0036] Adversarial sample generation module: used to generate adversarial samples based on fusion noise;

[0037] Adversarial sample attack module: used to attack the intrusion detection model and test the robustness of the detection model.

[0038] Another object of the present invention is to provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the adversarial sample attack method based on fusion noise.

[0039] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the adversarial sample attack method based on fusion noise.

[0040] Another object of the present invention is to provide an information data processing terminal, which is used to implement the adversarial sample attack system based on fusion noise.

[0041] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0042] First, the present invention is applied to the field of industrial Internet, and discloses an adversarial sample attack method for an intrusion detection model based on artificial intelligence. It combines network traffic characteristics and industrial control identification codes to classify traffic packets, and combines the operating status of industrial control equipment to extract traffic characteristics, and uses this feature to train the detection model; it generates and fuses noise from the time domain and frequency domain perspectives, and implants it into the feature original data set to construct adversarial samples. Through three attack scenarios in a real industrial control environment, it is shown that the adversarial sample attack method of the present invention can effectively reduce the classification accuracy of the existing relatively excellent intrusion detection model based on artificial intelligence, and can be applied to test the robustness of the intrusion detection model based on artificial intelligence in the industrial Internet.

[0043] Second, the present invention classifies traffic packets according to network traffic characteristics and industrial control identification codes and combines the status of industrial control equipment to propose a traffic packet feature extraction method for the industrial Internet. This method can greatly improve the detection accuracy of the model in the industrial Internet environment, can effectively overcome the problem of difficulty in collecting industrial control data, and improve experimental efficiency. At the same time, the present invention designs an adversarial sample generation method for an intrusion detection model that integrates time domain and frequency domain sampling noise. It is shown through three attack scenarios in a real industrial control environment that it can effectively reduce the classification accuracy of the existing relatively excellent artificial intelligence-based intrusion detection model, and can be applied to test the robustness of artificial intelligence-based intrusion detection models in the industrial Internet. Therefore, a set of industrial Internet network intrusion detection model robustness testing and evaluation system can be constructed through the present invention.

[0044] Third, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0045] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are:

[0046] The adversarial sample generation method that integrates time domain and frequency domain sampling noise proposed in the present invention can test the robustness of the detection model and promote the improvement of the adversarial sample defense method, so as to avoid the scenario in the future where the detection model loses its detection function when facing adversarial sample attacks, and can greatly reduce the economic losses caused by network intrusion.

[0047] (2) Whether the technical solution of the present invention solves the technical problems that people have been eager to solve but have never been able to solve successfully:

[0048] The industrial Internet traffic feature extraction method proposed in the present invention combines traffic features and industrial control features, can effectively separate traditional traffic from industrial control traffic, and extract different features of malicious traffic compared to normal traffic, which can greatly improve the training effect of intrusion detection models. The fusion noise adversarial sample generation method based on time domain and frequency domain proposed in the present invention can simply and effectively generate adversarial samples and significantly reduce the model detection accuracy, which can be applied to test the robustness of artificial intelligence-based intrusion detection models in the industrial Internet.

[0049] (3) Whether the technical solution of the present invention overcomes technical prejudice:

[0050] This paper starts from the essence of adversarial samples, breaks the traditional thinking, constructs a large amount of noise and integrates it from the perspectives of time domain and frequency domain, and proposes a novel adversarial sample generation method. At the same time, this method is applied to the generation of traffic adversarial samples in the field of industrial Internet for the first time.

[0051] Fourth, the present invention combines the traffic data packets and network traffic characteristics of the industrial control environment and proposes a complete attack process, from data collection and preprocessing to model training, and then to the generation of adversarial samples and model attacks. This method is of great value for evaluating and improving the robustness of intrusion detection models.

[0052] The present invention proposes a 9-tuple feature extraction method that effectively combines the address information of traditional network protocols and the unique identification code of industrial control protocols. This method can generate a richer and more representative data set, which helps to improve the training effect of the model and the ability to identify attacks.

[0053] The model specified in the present invention is an artificial intelligence-based intrusion detection model for the industrial Internet, which is more specifically adapted to the characteristics of this field. In addition, the model parameters and training parameters are set in detail, fully considering the performance and training effect of the model, which helps to improve the accuracy and robustness of the model.

[0054] The present invention generates different types of noise from both the time domain and the frequency domain and implants the noise into the original sample. This method can more effectively generate aggressive adversarial samples. Using these adversarial samples to attack the model can more accurately evaluate and test the robustness of the model, thereby helping to improve the defense capability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0056] Figure 1 is a flow chart of an adversarial sample attack method based on fusion noise provided by an embodiment of the present invention;

[0057] Figure 2 is a structural diagram of an adversarial sample attack system based on fusion noise provided by an embodiment of the present invention;

[0058] Figure 3 is a flow chart of the adversarial sample attack method provided by an embodiment of the present invention;

[0059] Figure 4 is a flow chart of generating an intrusion detection model provided by an embodiment of the present invention;

[0060] Figure 5 is a schematic diagram of a confusion matrix of a detection model provided by an embodiment of the present invention;

[0061] Figure 61 is a schematic diagram of the detection model training accuracy and loss provided by an embodiment of the present invention; wherein (a) is the detection model accuracy, and (b) is the detection model loss;

[0062] Figure 7 is a schematic diagram of a ROC curve of a detection model provided by an embodiment of the present invention;

[0063] Figure 8 It is a schematic diagram of the performance of the detection model in the adversarial sample attack scenario provided by an embodiment of the present invention; wherein, (a) the perturbation coefficient is 0, (b) the perturbation coefficient is 0.1, (c) the perturbation coefficient is 0.2, (d) the perturbation coefficient is 0.3, (e) the perturbation coefficient is 0.4, and (f) the perturbation coefficient is 0.5. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0065] In view of the problems existing in the prior art, the present invention provides a method, system and device for adversarial sample attack based on fusion noise. The present invention is described in detail below in conjunction with the accompanying drawings.

[0066] like Figure 1 The adversarial sample attack method based on fusion noise provided in an embodiment of the present invention comprises the following steps:

[0067] S1, collects traffic data packets in the industrial control environment, extracts traffic data features and industrial control data features by combining network traffic features and industrial control identification codes, and preprocesses the data to create a data set, which is divided into a training set, a validation set, and a test set;

[0068] S2, using the original data set obtained in S1, inputs the original samples into the intrusion detection model to train the intrusion detection model;

[0069] S3, generates different types of noise from both the time domain and the frequency domain, and implants the noise into the original samples of the original dataset to obtain adversarial samples;

[0070] S4, uses the adversarial samples generated by S3 to attack the intrusion detection model trained by S2 to test the robustness of the detection model.

[0071] Furthermore, in S1, data features are extracted according to traffic features and industrial control features to obtain a data set, which specifically includes:

[0072] (1) According to the characteristics of the Industrial Internet, a 9-tuple feature extraction method is proposed based on the address information of the traditional network protocol and the unique identification code of the industrial control protocol;

[0073] (2) Assume that the traditional network protocol address information C = {c 1 ,c 2 …c 7}, representing source IP address, destination IP address, source MAC address, destination MAC address, communication protocol, source port, destination port; industrial control protocol unique identification code I = {i i ,i 2}, representing the industrial control identification codes modbus_trans_id and modbus_func_code in the Modbus-TCP protocol;

[0074] (3) The traditional protocol 7-tuple includes the traditional 5-tuple and the MAC address. The 5-tuple can identify the traditional network protocol, and the information between flows can be extracted based on the 5-tuple. Adding the MAC address can defend against man-in-the-middle attack traffic to a certain extent.

[0075] (4) The industrial control protocol 2-tuple modbus_trans_id can distinguish between traditional network traffic and industrial control protocol traffic, and extract the characteristics of traditional network traffic and industrial control traffic respectively; modbus_func_code can separate the different functions of Modbus-TCP industrial control traffic and obtain the characteristics of different instructions of industrial control equipment; at the same time, the upstream and downstream traffic can be separated, so that the DoS traffic characteristics can be better extracted; according to the 9-tuple, the traffic characteristics of traditional network protocols and industrial control protocols can be extracted. Extracting industrial control data from Modbus packets can prevent attackers from tampering with industrial control data to a certain extent. Combining traffic characteristics with industrial control characteristics can assist in intrusion detection;

[0076] (5) Finally, we get the traffic characteristics X = {x 1 ,x 2 ,…,x p}, industrial control feature Y = {y 1 ,y 2 ,…,y q}, a dataset containing 27 features was extracted using 9-tuples; there were 21 traffic features, including the number of network uplink and downlink traffic packets, payload size, flow duration, and the mean, maximum, minimum, and standard deviation of packet payload and transmission time interval. Industrial control features include the operating characteristics of 6 devices;

[0077] (6) Preprocess the extracted data, including category label processing, data cleaning, and data standardization, and finally divide the data set into training set, validation set, and test set.

[0078] In S2, the detection model must be an AI-based intrusion detection model for the industrial Internet. First, set the model parameters, including model layers, activation functions, and other options. Then, set the training parameters, including optimizer, loss function, learning rate, training batch size, and number of times. Finally, train the intrusion detection model.

[0079] In S3, noise is generated from both the time domain and the frequency domain to construct adversarial samples, including:

[0080] (1) Assume that there are n data samples to be tested, the flow feature of the data set is p, the industrial control feature is q, and the class label is k, then X = {x 1 ,x 2 ,…,x p},Y={y 1 ,y 2 ,…,y q}, Z={z 1+p+q ,z 2+p+q ,…,z k+p+q};

[0081] (2) Thus, the data set and class labels can be expressed as:

[0082] S={s j {X,Y,Z} j ={x 1 ,…,x p ;y 1 ,…,y q ; z 1+p+q ,…,z k+p+q} j ={x j1 ,x j2 ,…,x jp ;y j1 ,y j2 ,…,y jq ; z j(1+p+q) ,z j(2+p+q) ,…,z j(k+p+q)}|j=1,…,n};

[0083] (3) Assuming there are γ different noises, the standardized noise set is expressed as NOISE = {noise 1 ,noise 2 ,…,noise γ}, the present invention defines the noise fusion process as symbol Fusion noise all It can be expressed as:

[0084] (4) Noise is implanted into the data set as follows:

[0085]

[0086] in, It means that F features are selected from N features of traffic features and industrial control features as injection points for adversarial sample generation, ρ represents the noise perturbation coefficient of different multiples, Indicates that noise is implanted into the data set, then It is the data set generated after adding noise.

[0087] In S4, the adversarial samples generated in S3 are used to attack the detection model trained in step 2, confuse the classifier, reduce the classification accuracy, and test the robustness of the detection model.

[0088] like Figure 2 As shown, the adversarial sample attack system based on fusion noise provided by the embodiment of the present invention includes:

[0089] Dataset acquisition module: used to collect the data required for detection model training and perform preprocessing to form a data set;

[0090] Intrusion detection model building module: used to perform intrusion detection on traffic and distinguish normal traffic from malicious traffic;

[0091] Adversarial sample generation module: used to generate adversarial samples based on fusion noise;

[0092] Adversarial sample attack module: used to attack the intrusion detection model and test the robustness of the detection model.

[0093] like Figure 3 As shown, as a preferred embodiment, the embodiment of the present invention provides an adversarial sample attack based on fusion noise in the field of network security to evaluate the robustness of the detection model, adopts the industrial Internet intrusion detection data set, and the CNN-LSTM model as the detection model, and constructs an adversarial sample by fusing 5 types of noise. Specifically, it includes the following steps:

[0094] Step 1: Collect normal traffic in the industrial Internet, use malicious programs to attack industrial control equipment, and capture network malicious traffic through the deployed capturer. Analyze the captured traffic packets, extract features, and pre-process the extracted data, including label processing, data cleaning, and data standardization;

[0095] Step 2: Set the model parameters, including model layers, activation functions, etc., then set the training parameters, including optimizer, loss function, learning rate, training batch size and number of times, and finally train to obtain the intrusion detection model;

[0096] Step 3: Generate noise based on the time domain and frequency domain, fuse the two types of noise to generate fused noise, and implant the noise into the data set to generate adversarial samples;

[0097] Step 4: Use adversarial samples to attack the intrusion detection model, reduce the classification accuracy, and circumvent the intrusion detection model.

[0098] In step 1, the present invention combines network traffic features and industrial control features to extract data features, preprocess and divide the data set.

[0099] Step 11: According to the characteristics of the industrial Internet, a 9-tuple feature extraction method is proposed based on the address information of the traditional network protocol and the unique identification code of the industrial control protocol;

[0100] Step 12: Assume that the traditional network protocol address information C = {c 1 ,c 2 …c 7}, representing source IP address, destination IP address, source MAC address, destination MAC address, communication protocol, source port, and destination port. Industrial control protocol unique identification code I = {i i ,i 2}, representing the industrial control identification codes modbus_trans_id and modbus_func_code in the Modbus-TCP protocol;

[0101] Step 13: The traditional protocol 7-tuple includes the traditional 5-tuple and the MAC address. The 5-tuple can identify the traditional network protocol, and the information between flows can be extracted based on the 5-tuple. Adding the MAC address can defend against man-in-the-middle attack traffic to a certain extent.

[0102] Step 14: The industrial control protocol 2-tuple modbus_trans_id can distinguish between traditional network traffic and industrial control protocol traffic, and extract the characteristics of traditional network traffic and industrial control traffic respectively. modbus_func_code can separate the different functions of Modbus-TCP industrial control traffic and obtain the characteristics of different instructions of industrial control equipment. At the same time, the upstream and downstream traffic are separated, so that the DoS traffic characteristics can be better extracted. According to the 9-tuple, the traffic characteristics of traditional network protocols and industrial control protocols can be extracted. Extracting industrial control data from the Modbus package can prevent attackers from tampering with industrial control data to a certain extent. Combining traffic characteristics and industrial control characteristics can assist in intrusion detection;

[0103] Step 15: Finally, we get the traffic feature X = {x 1 ,x 2 ,…,x p}, industrial control feature Y = {y 1 ,y 2 ,…,y q}. A dataset containing 27 features was extracted using 9-tuples. There are 21 traffic features in total, including the number of network uplink and downlink traffic packets, payload size, flow duration, and the mean, maximum, minimum, and standard deviation of packet payload and transmission time interval. Industrial control features include the operating characteristics of 6 devices;

[0104] Step 16: Set the category labels to normal and malicious;

[0105] Step 17: Fill data for samples that do not contain industrial control data;

[0106] Step 18: Standardize the dataset and divide it into training set, validation set and test set.

[0107] In step 2, the dataset is used to train an AI-based intrusion detection model. First, the model parameters are set, including model layers, activation functions, etc., and then the training parameters are set, including optimizer, loss function, learning rate, training batch size and number of times, etc. Finally, the intrusion detection model is trained.

[0108] Step 21: According to Figure 4 Generate intrusion detection models;

[0109] Step 22: Set the model training optimizer to adam;

[0110] Step 23: Set the training loss function to binary_crossentropy;

[0111] Step 24: Set the initial learning rate for training to 0.001;

[0112] Step 25: Set the training batch size to 512;

[0113] Step 26: Set the number of training times to 30;

[0114] Step 27: Train the detection model.

[0115] In step 3, noise is generated based on the time domain and frequency domain, the two types of noise are fused to generate fused noise, and the noise is implanted into the dataset to generate adversarial samples.

[0116] Step 31: Assume that there are n data samples to be tested, the flow feature of the data set is p, the industrial control feature is q, and the class label is k. Then X = {x 1 ,x 2 ,…,x p},Y={y 1 ,y 2 ,…,y q}, Z={z 1+p+q ,z 2+p+q ,…,zk+p+q}

[0117] Step 32: Thus, the data set and class labels can be expressed as:

[0118] s={s j {X,Y,Z} j ={x 1 ,…,x p ;y 1 ,…,y q ; z 1+p+q ,…,z j+p+q} j ={x j1 ,x j2 ,…,x jp ;y j1 ,y j2 ,…,y jq ; z j(1+p+q) ,z j(2+p+q) ,…,z j(k+p+q)}|j=1,…,n};

[0119] Step 33: Assume that there are γ different noises, then the standardized noise set is expressed as NOISE = {noise 1 ,noise 2 ,…,noise γ}, the present invention defines the noise fusion process as symbol Fusion noise all It can be expressed as: The present invention uses 5 different noises, noise i|i∈(1,5) Corresponding to Gaussian noise, red noise, pink noise, blue noise and purple noise respectively;

[0120] Step 34: Implant noise into the data set as: in, It means that F features are selected from N features of traffic features and industrial control features as injection points for adversarial sample generation, ρ represents the noise perturbation coefficient of different multiples, Indicates that noise is implanted into the data set, then It is the data set generated after adding noise;

[0121] In step 4, adversarial samples are used to attack the intrusion detection model, reduce the classification accuracy, and circumvent the intrusion detection model.

[0122] Step 41: Set the disturbance coefficient to 0, 0.1, 0.2, 0.3, 0.4, 0.5;

[0123] Step 42: Test the intrusion detection model using adversarial samples with different perturbation coefficients;

[0124] Step 43: Draw a chart to visually view the model performance.

[0125] An application embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of an adversarial sample attack method based on fusion noise.

[0126] An application embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of an adversarial sample attack method based on fusion noise.

[0127] An application embodiment of the present invention provides an information data processing terminal, which is used to implement an adversarial sample attack system based on fusion noise.

[0128] The adversarial sample attack method based on fused noise proposed in the present invention can effectively reduce the classification accuracy of the detection model. In this patent, the present invention provides a fused noise adversarial sample generation method based on Gaussian noise and four color noises, and also provides an application example for the reader to understand.

[0129] Application example: Adversarial sample attacks on artificial intelligence-based network traffic intrusion detection models in the industrial Internet.

[0130] Network traffic intrusion detection is an important task of cyberspace security. Counterattack against sample attacks is a common method, and prevention is the primary task. In this example, the present invention takes normal traffic and botnet traffic as examples to introduce the application method of the method.

[0131] First, we built an industrial control environment, deployed network intrusion tools, installed traffic capturers on industrial control equipment, collected normal and malicious traffic in the industrial control environment, and extracted network traffic features and industrial control features of data packets based on the proposed feature extraction method to create an industrial Internet intrusion detection dataset.

[0132] Secondly, complete the data preprocessing, including data cleaning, category coding and data standardization, design the intrusion detection model, and use the data set to train the detection model;

[0133] Finally, the generated adversarial sample is used to attack the detection model to test and evaluate the robustness of the detection model.

[0134] The algorithm of the present invention is verified on the industrial Internet intrusion detection dataset. The CNN-LSTM model is used as the detection model, and the adversarial sample is constructed by fusing five types of noise.

[0135] Figure 5 The training confusion matrix of the detection model under the feature extraction method of the present invention is displayed, which shows that the feature extraction is effective and enables the detection model to detect effectively. Figure 6 The detection model training process is demonstrated, showing that it can converge in a short number of rounds. Figure 7 The ROC curve is shown, which also shows that under this feature extraction method, good detection effect can be achieved. Figure 8 The accuracy, precision, recall and F1 value of the model are shown for the original samples without adding disturbances.

[0136] Starting from not adding noise perturbation, the present invention generates 5 groups of adversarial samples with noise perturbation coefficients ranging from 0 to 0.5 with an interval of 0.1, and compares and analyzes the detection performance of the detection model on these adversarial samples. The blue line represents the Accuracy of the detection model, the yellow line represents the Precision of the detection model, the green line represents the Recall of the detection model, and the red line represents the F1 value of the detection model.

[0137] Figure 8 The performance of the detection model under adversarial sample attack scenarios is demonstrated, and all four detection evaluation indicators have dropped significantly.

[0138] Embodiment 1:

[0139] In an industrial Internet environment, this fusion noise-based adversarial sample attack method can be implemented using the following steps:

[0140] 1) Data collection and preprocessing: First, collect the traffic data packets of the industrial control environment, and extract the data features by combining the network traffic features and the industrial control identification code. For example, a 9-tuple feature extraction method can be used to obtain a data set containing 27 features from the address information of the traditional network protocol and the unique identification code of the industrial control protocol. The preprocessing process includes normalization, denoising, padding and other steps.

[0141] 2) Model training: Use the obtained dataset to train an AI-based intrusion detection model for the industrial Internet. You can choose a deep convolutional neural network (CNN) or a recurrent neural network (RNN) as the model, and the training parameters can include optimizer selection (such as Adam or SGD), loss function selection (such as cross entropy), learning rate, batch size, and number of training times.

[0142] 3) Generate adversarial samples: Generate noise from both the time domain and frequency domain, such as using Gaussian noise or salt and pepper noise, and implant these noises into the original samples to generate adversarial samples.

[0143] 4) Model attack and testing: Use the generated adversarial samples to attack the trained intrusion detection model, test and evaluate the robustness of the model.

[0144] Embodiment 2:

[0145] In an intelligent transportation system, this approach can be implemented:

[0146] 1) Data collection and preprocessing: Collect traffic flow data packets and extract data features by combining network flow characteristics and traffic control signals. The preprocessing process includes steps such as removing irrelevant features and normalizing data.

[0147] 2) Model training: Train an AI-based intrusion detection model for traffic networks. You can choose support vector machine (SVM) or random forest (RF) as the model, and the training parameters can include regularization parameters, kernel function type (for SVM), number of trees (for RF), etc.

[0148] 3) Generate adversarial samples: Generate noise from both the time domain and the frequency domain, such as using uniform noise or Poisson noise, and implant these noises into the original samples to generate adversarial samples.

[0149] 4) Model attack and testing: Use the generated adversarial samples to attack the trained intrusion detection model, test and evaluate the robustness of the model.

[0150] The above two embodiments can both effectively evaluate and improve the robustness of the intrusion detection model, thereby improving the security of the system.

[0151] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0152] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for attacking adversarial samples based on fusion noise, characterized in that: The following steps are involved: Collect traffic data packets from the industrial control environment, extract traffic data features and industrial control data features by combining network traffic features and industrial control identification codes, preprocess the data, create a data set, and divide it into training set, validation set, and test set; Using the obtained original data set, input the original samples into the intrusion detection model to train the intrusion detection model; Generate different types of noise from both the time domain and frequency domain, and implant the noise into the original samples of the original dataset to obtain adversarial samples; The generated adversarial samples are used to attack the trained intrusion detection model to test the robustness of the detection model.

2. The adversarial sample attack method based on fusion noise according to claim 1, characterized in that: In the process of collecting traffic data packets in the industrial control environment, according to the characteristics of the industrial Internet, a 9-tuple feature extraction method is proposed based on the address information of the traditional network protocol and the unique identification code of the industrial control protocol. A data set containing 27 features is obtained, including the number of network uplink and downlink traffic packets, payload size, flow duration, and the mean, maximum, minimum, and standard deviation of the packet payload and transmission time interval. The industrial control features include the operating characteristics of 6 devices.

3. The adversarial sample attack method based on fusion noise according to claim 1, characterized in that: In the process of training the intrusion detection model, the model should be an artificial intelligence-based intrusion detection model for the industrial Internet. First, the model parameters are set, including model layers, activation functions and other options. Secondly, the training parameters are set, including optimizers, loss functions, learning rates, training batch sizes and times and other options.

4. The adversarial sample attack method based on fusion noise according to claim 1, characterized in that: In the process of generating adversarial samples, different types of noise are generated from the time domain and frequency domain, and the noise is implanted into the original samples of the original data set. The generated adversarial samples are used to attack the trained intrusion detection model to test the robustness of the detection model.

5. The adversarial sample attack method based on fusion noise according to claim 1, characterized in that: Generate noise from both the time domain and frequency domain to construct adversarial samples, including: (1) Assume that there are n data samples to be tested, the traffic feature of the data set is p, the industrial control feature is q, and the class label is k, then X = {x1, x2, …, x p },Y={y1,y2,…,y q }, Z={z 1+p+q ,z 2+p+q ,…,z k+p+q }; (2) Thus, the data set and class labels can be expressed as: S={s j {X,Y,Z} j {x1,…,x p (y1,...,y q ;z 1+p+q ,…,z k+p+q } j {x j1 ,x j2 ,…,x jp ;y j1 ,y j2 ,…,y jq ;z j(1+p+q) ,z j(2+p+q) ,…,z j(k+p+q) }|j=1,…,n}; (3) Assume that there are γ different noises, then the standardized noise set is expressed as NOISE = {noise1, noise2, …, noise γ }, the present invention defines the noise fusion process as symbol ⊕, fusion noise noise all Can be expressed as: noise all =noise1⊕noise2⊕…⊕noise γ ; (4) Noise is implanted into the data set as follows: in, It means that F features are selected from N features of traffic features and industrial control features as injection points for adversarial sample generation, ρ represents the noise perturbation coefficient of different multiples, Indicates that noise is implanted into the data set, then It is the data set generated after adding noise.

6. The adversarial sample attack method based on fusion noise according to claim 1, characterized in that: In S4, the generated adversarial samples are used to attack the trained detection model, confuse the classifier, reduce the classification accuracy, and test the robustness of the detection model.

7. A counter-sample attack system based on fusion noise, characterized in that: include: Dataset acquisition module: used to collect the data required for detection model training and perform preprocessing to form a data set; Intrusion detection model building module: used to perform intrusion detection on traffic and distinguish normal traffic from malicious traffic; Adversarial sample generation module: used to generate adversarial samples based on fusion noise; Adversarial sample attack module: used to attack the intrusion detection model and test the robustness of the detection model.

8. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the adversarial sample attack method based on fusion noise as described in any one of claims 1 to 5.

9. A computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the adversarial sample attack method based on fusion noise as described in any one of claims 1 to 5.

10. An information data processing terminal, used for implementing the adversarial sample attack system based on fusion noise as claimed in claim 6.

Images