Information importance cognitive defense method based on interpretable learning in automatic modulation identification

Abstract

The invention discloses an interpretable learning-based information importance cognitive defense method in automatic modulation identification, which comprises the following steps of: generating a trace data set with a label, and dividing the data set; constructing an SHAP gradient interpreter based on the training set and an original modulation classification model; an FGSM attack is applied to the test set to generate a trace of confrontation samples, the trace of confrontation samples are input into an interpreter to be interpreted, negative information carried by the confrontation samples is analyzed according to an output shapley value, and the transferability guidance of the SHAP method is verified; performing addition and dimension reduction processing on the shapley value to obtain sampling points playing a negative role in a classification result, deleting the corresponding sampling points in the training set and the verification set, and performing fine tuning on the model to obtain a new model; and for data attacked in reality, deleting corresponding negative sampling points, and inputting the data into the new model to test the classification performance. According to the method, the defense capability of the model in an attack scene is remarkably improved, and meanwhile, consumption of data calculation and storage resources is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of signal recognition, and in particular to an information importance cognitive defense method based on interpretable learning in automatic modulation recognition. Background Art

[0002] In wireless communications, due to limited spectrum resources, signals need to be transmitted after being modulated in various ways. Therefore, the receiver needs to demodulate the signal after receiving it. The demodulation process is the process of signal modulation classification. Traditional modulation recognition technologies mainly include statistical pattern recognition based on feature extraction and maximum likelihood hypothesis testing based on decision theory. However, the former has fuzzy signal features in non-ideal channels and poor recognition effect; the latter relies on a large amount of prior knowledge. When there is a deviation in parameter estimation or the constructed model does not match the actual channel characteristics, the algorithm performance will drop sharply.

[0003] The rapid development of deep learning (DL) has brought significant progress to signal modulation classification. It has surpassed the limitations of traditional methods and excels in extracting hidden features, so it can achieve high performance in a low-complexity manner. With the widespread application of deep learning, its vulnerability has been exposed, making it vulnerable to various malicious attacks. Existing research has found that small and almost imperceptible perturbations of input data can significantly reduce the performance of the model or even completely deceive the model's decision. For example, if a small pixel perturbation is applied to a truck picture, the picture will be identified as an ostrich. In the field of wireless communications, attackers will use such attacks to change the content of the transmitted information, or impose small perturbations to cause debugging classification errors and misunderstand the information. Therefore, researching and developing effective defense mechanisms to resist these adversarial attacks has become an important issue to ensure the security of deep learning systems.

[0004] Current network attack methods can be divided into white-box attacks and black-box attacks according to the transparency of the target model. Common white-box attack methods can be divided into attack methods based on gradient optimization, such as the Fast Gradient Sign Method (FGSM), attack methods based on decision boundary analysis, such as Deepfool, and optimization-based attacks such as Carlini and Wagner Attack (C&W).

[0005] There are many attack defense methods that have been developed from different angles to defend against the above-mentioned attacks, and have improved model performance to varying degrees, but they also have obvious shortcomings. On the one hand, most defense methods require a large amount of computing resources. For example, the classic adversarial training method requires adding adversarial samples during the training process, which significantly increases the training time and increases the complexity of the model. On the other hand, many defense methods have insufficient generalization capabilities and are only effective against specific types of attacks. In addition, some methods have problems such as difficulty in parameter tuning and insufficient robustness. These problems have brought challenges to the application of defense methods in actual attack scenarios.

[0006] The invention with patent publication number CN118734360A discloses a privacy-preserving large-scale model training and deployment method based on federated learning. Through an adaptive privacy protection layer, data perturbations, access control and encryption strategies are dynamically adjusted to ensure data security. The model robustness enhancement algorithm combines outlier detection and adversarial samples to improve model stability. Smart contracts and blockchain technology achieve tamper-proof recording and verification of model parameter updates, enhancing transparency and traceability. Real-time performance monitoring and model interpretability technologies improve model reliability and decision transparency. The cross-domain knowledge transfer framework and automated parameter adjustment tools solve the problems of uneven data distribution and domain differences, achieving the best balance between privacy protection and model performance. Secure startup technology ensures client startup security. However, the purpose of the SHAP interpretation method in this invention is to enhance the interpretability of complex models and make it easier for users to understand the models. The SHAP method is not used to provide any guidance for improving model performance. In terms of defending against attacks, the invention enhances the robustness of the model by first adding perturbations to obtain adversarial samples, and finally uses the Adverserial Training (AT) method to train the network. This is one of the classic methods for enhancing the defense capabilities of models in existing research. The SHAP method is not combined to remove negative information in adversarial samples and fine-tune the model for enhancement.

[0007] The invention with the publication number CN113780365B discloses a sample generation method and device, firstly obtaining a target sample of structured data; the target sample includes at least one eigenvalue, each eigenvalue corresponds to a feature of the structured data; from at least one feature of the structured data, determining the feature to be disturbed; determining the disturbance range corresponding to the feature to be disturbed; within the disturbance range, disturbing the eigenvalues ​​corresponding to the feature to be disturbed in the target sample to obtain a new sample. The invention uses the SHAP method to evaluate the importance of features. Specifically, important features are obtained through SHAP, thereby disturbing the important features, and further determining the range of disturbance. The ultimate goal is to generate more effective disturbance samples and realize adversarial attacks, rather than using the SHAP method to mine negative information obtained by the attack to guide model defense. That is, the invention belongs to an attack method rather than a defense method.

[0008] The invention with publication number CN118378690A discloses an attack and defense confrontation method, device, equipment and medium for network and power data recognition model. The patent uses an interpretable method to evaluate the importance of features, analyzes the difference between the important features of normal data and adversarial data, and makes targeted modifications to the adversarial data, and finally merges them to obtain data with strong defense. Its interpretable method uses random forests and does not involve the SHAP method, nor does it involve the process of clearing negative information from the data. Summary of the invention

[0009] In view of the problems that many defense methods in the prior art have insufficient generalization ability, are only effective for specific attack types, are difficult to tune parameters, lack robustness, and affect the performance of normal data classification, the present invention provides an information importance cognitive defense method based on interpretable learning in automatic modulation recognition. Based on the SHAP (Shapley Additive exPlanations) method in interpretable artificial intelligence, the real attacked signal data is first simulated to generate a labeled trace data set, and the negative information contained in the adversarial sample is mined by constructing a SHAP interpreter. Based on the use of negative information to guide the fine-tuning of the model, the real attack signal sample is finally input into the fine-tuned model for classification. This method significantly improves the robustness of the model's defense capability under various attack levels, reduces the consumption of data storage and computing resources by deleting some negative feature points, and is applicable to a variety of attacks, showing an effect that is superior to existing attack defense methods.

[0010] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0011] An information importance cognitive defense method based on interpretable learning in automatic modulation recognition, the information importance cognitive defense method comprising the following steps:

[0012] Step 1: simulate real-life signals to generate labeled trace data, which are divided into training set, validation set and test set;

[0013] Step 2, using the training set and the original modulation classification model to build a SHAP interpreter for mining negative information;

[0014] Step 3: attack the test set to generate adversarial samples, input the adversarial samples into the SHAP interpreter for interpretation, analyze the negative information carried by the data after the attack based on the Shapley value output by the SHAP interpreter, and verify the transferability of the SHAP method; transferability means that after SHAP analysis, it can be determined that the adversarial samples do contain negative information, and the SHAP analysis is consistent with the classification results after the adversarial samples are input into the model;

[0015] Step 4, perform summation and dimensionality reduction processing on the Shapley values ​​output by the SHAP interpreter to obtain sampling points that have a negative effect on the classification results; delete the corresponding sampling points in the training set and the validation set and fine-tune the original modulation classification model to obtain a new modulation classification model;

[0016] Step 5: For the data that is attacked in reality, delete the corresponding negative sampling points and input them into the new modulation classification model to test the classification performance.

[0017] Furthermore, in step 1, the RadioML2016.10a public data set is used as the data set, and the modulated signal sample is an IQ signal.

[0018] Further, in step 2, the modulation classification model includes an input layer, a Conv1D convolutional layer, an LSTM layer, a custom Sumlayer layer, a BN layer, a first fully connected layer, a second fully connected layer and an output layer connected in sequence;

[0019] The number of filters in the Conv1D convolutional layer is 128, the kernel size is 8, and the activation function is ReLU. The number of units in the LSTM layer is set to 128, and the units are input to the custom Sumlayer layer for summing and dimensionality reduction. The BN layer normalizes the output of the Sumlayer layer. The number of units in the first and second fully connected layers are 256 and 11, respectively, and the activation functions are ReLU and softmax, respectively.

[0020] The Adam optimizer is used to train the modulation classification model, with the learning rate set to 0.001, the batch size to 200, and a total of 200 iterations; the multi-classification cross entropy loss function used in the training is:

[0021]

[0022] Where Y is the set of true labels of the modulated signal, is the set of predicted values ​​of the modulation signal, m represents the number of samples in the training set, n represents the number of predicted modulation signal types, and the true label of the i-th sample is The predicted value of the i-th sample is

[0023] Furthermore, in step 2, the SHAP interpreter is used to fit the shapley value of the feature using the gradient information of the model:

[0024]

[0025] where φ (i) Represents the Shapley value of the i-th sampling point, which is used to characterize whether the sampling point has a positive or negative effect on the classification result; ExpectedGradients i (x j ) represents the input sample x calculated using the sampling approximate multiple integral method j The expected value of the integrated gradient over all baseline samples.

[0026] Furthermore, in step 3, the FGSM attack is applied to interfere with the test set to obtain a small amount of adversarial samples; including:

[0027] The loss function L is maximized by adding a small perturbation η to the input, making the classification error:

[0028]

[0029] Where f represents the network model, y is the label of input x, and θ is the parameter to be optimized;

[0030] FGSM maximizes the loss by increasing the gradient during back propagation. The formula for solving the perturbation η is:

[0031]

[0032] in is the partial derivative of the loss function L with respect to the input x, sign(·) is the sign function, ∈ is the perturbation level; the adversarial sample generated is

[0033]

[0034] Step 4 further includes:

[0035] Filter out samples with incorrect predictions from trace adversarial samples. These samples contain rich negative information to reflect negative features.

[0036] Take out the Shapley value of the correct modulation label corresponding to the sample with incorrect prediction, and keep the feature sampling point dimension and add it in other dimensions to get the sum of the Shapley values ​​of 128 sampling points on all samples. The m sampling points with negative values ​​indicate that the corresponding features have played a negative role in the classification of the sample as the correct label, and they are recorded as negative points;

[0037] According to the m negative points, after deleting the feature data of the corresponding positions of the training set, the modulation classification model is fine-tuned, and a new modulation classification model is obtained after fine-tuning.

[0038] Step 5 further includes:

[0039] Select several test set samples as the real signal data to be classified, and apply FGSM attack to them to obtain actual adversarial samples, which are used to simulate the large number of adversarial samples received by the receiver under real attack;

[0040] The data of the feature sampling points corresponding to the negative points in the actual adversarial sample are deleted and input into the new modulation classification model for modulation classification.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] First, the information importance cognitive defense method based on interpretable learning in automatic modulation recognition of the present invention aims to solve the problem of degradation of modulation classification performance after the deep network is attacked. Based on the SHAP method, feature attribution is performed on the attacked signal data with known labels, and the negative information contained in the feature sampling points is mined. The transferability of the negative information is proved, and it is used to guide the fine-tuning of the model, thereby increasing the attack defense capability of the model.

[0043] Second, the information importance cognitive defense method based on interpretable learning in the automatic modulation recognition of the present invention can analyze the attacked data, is applicable to a variety of attack scenarios, does not cause performance loss to undisturbed data, and does not require a large number of parameter tuning experiments.

[0044] Third, the information importance cognitive defense method based on interpretable learning in the automatic modulation recognition of the present invention increases the model by reducing the negative information in the data, thereby reducing the resource consumption of data calculation and storage in the modulation classification process, which is more conducive to the deployment of actual scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A flow chart of the information importance cognitive defense method based on interpretable learning in automatic modulation recognition of the present invention;

[0046] Figure 2 A structural diagram of the automatic modulation classification network of the present invention;

[0047] Figure 3 Characteristic Shapley value diagram of the test set under different attack levels of the present invention;

[0048] Figure 4 The Shapley value heat map (left) and confusion matrix (right) of the trace adversarial sample at the attack level of 0.025 of the present invention;

[0049] Figure 5 This is a confusion matrix diagram of the trace adversarial sample and the real adversarial sample at the attack level of 0.025 of the present invention. The left figure corresponds to the trace adversarial sample, and the right figure corresponds to the real adversarial sample;

[0050] Figure 6 It is a flow chart of Shapley value data processing corresponding to the trace adversarial sample of the present invention;

[0051] Figure 7 It is a comparison chart of the performance of the SHAP-based fine-tuning method of the present invention and other methods under different attack levels. DETAILED DESCRIPTION

[0052] The embodiments of the present invention are further described in detail below with reference to the accompanying drawings.

[0053] The present invention discloses an information importance cognitive defense method based on interpretable learning in automatic modulation recognition, which is applied to the field of signal modulation classification. The SHapley Additive exPlanation (SHAP) method in interpretable artificial intelligence is used to calculate the feature contribution of adversarial samples, with the purpose of mining negative information in adversarial samples, and then fine-tuning the model after clearing the negative information to achieve the goal of compressing resource consumption while realizing the model's defense against attacks. The present invention overcomes the shortcomings of existing defense attack methods, significantly reduces the consumption of computing and storage resources, improves the accuracy of model classification under attack, and enhances the model's ability to defend against attacks.

[0054] like Figure 1 The flowchart of the information importance cognitive defense method based on interpretable learning in automatic modulation recognition of the present invention is as follows:

[0055] Step 1: Simulate real signals to generate a labeled trace data set, which is divided into a training set, a validation set, and a test set.

[0056] The details are as follows:

[0057] In the embodiment, the data set with trace labels adopts the RadioML2016.10a public data set, and the signal samples are IQ signals. The data set is divided into Figure 1The training set samples (including a small amount of training set and validation set) and test set samples in .

[0058] Step 2: Use the training set and the original modulation classification model to build a SHAP interpreter for mining negative information. This includes the following sub-steps:

[0059] Taking into account the temporal correlation of the signal, the original modulation classification model structure is as follows Figure 2 As shown. The network consists of an input layer, a Conv1D convolutional layer, an LSTM layer, a custom Sumlayer layer, a BN layer, a first fully connected layer, a second fully connected layer, and an output layer. The convolutional layer has 128 filters, a kernel size of 8, and a ReLU activation function. The LSTM layer sets the number of units to 128 and inputs it to the custom Sumlayer layer for addition and dimensionality reduction. The BN layer normalizes the previous output and is followed by two fully connected layers with 256 and 11 units, respectively, and ReLU and softmax activation functions, respectively. During training, the optimizer is Adam, the learning rate is set to 0.001, the batchsize is 200, and a total of 200 iterations are performed. The multi-class cross entropy loss function used in training is:

[0060]

[0061] Where Y is the set of true labels of the modulated signal, is the set of predicted values ​​of the modulation signal, m represents the number of samples in the training set, n represents the number of predicted modulation signal types, and the true label of the i-th sample is The predicted value of the i-th sample is

[0062] The basic idea of ​​the SHAP method is to analyze the output of the model based on the Shapley value and additive feature attribution method in game theory, and attribute the final output to the contribution of each input feature.

[0063] The output of the complex model f(·) can be explained by fitting a simple model g(·) for feature attribution, where the input x ′ Mapping to the original input x = h x (x ′ ), and further attribute the output of the model to the contribution of each feature:

[0064] g(z)=β0+β1z1+…+β p z p

[0065] where z i represents the i-th input feature, β iis the contribution weight of the input feature. Therefore, the contribution increment of the jth feature is expressed as:

[0066] φ j (g) = β j Z j -β j E(Z j )

[0067] Where E(Z j ) represents the expected value of the feature. The total contribution that needs to be allocated is:

[0068]

[0069] The Shapley value was originally proposed to solve the cooperative game problem in game theory: to reasonably distribute the contributions made by each player in the game. Assuming that N = {1, 2, ..., n} is a set of n input units (i.e., n players), then the Shapley value of the i-th input unit represents the contribution of the i-th player, and its calculation formula is as follows:

[0070]

[0071] Among them, S represents different sets of different input units. S is a subset of N. The information contained in the input units in this set can be normally input into the neural network, while the units not in this set cannot. v(S) represents the output value of the network when the input units in the S set are input. For a certain input unit i, v(S\{i}) represents the output after deleting the i-th input unit from the set S to represent its occlusion effect. The subtraction terms on the right side of the formula represent the marginal contribution created by input unit i in the set S to the whole set. Input unit i has |S|! sorting in the S set, and the remaining members have (|N|-|S|-1)! sorting. Therefore, the fractional term on the left side of the formula is the different sorting combinations for each input unit when participating divided by the random sorting combination of N input units, which represents the weight of the reward that should be allocated to input unit i in the set S. Therefore, this formula shows the benefits that input unit i gets from the total N, which is also the meaning of the Shapley value.

[0072] Considering the structure and meaning of the additive feature attribution algorithm and the Shapley value solution formula, the calculation of the SHAP model based on Shapley value additive feature attribution is as follows

[0073]

[0074] The obtained φ (i)The value, namely the Shapley value, represents the contribution of the i-th input feature of the model to the final result. The significance of the Shapley value is that a positive value indicates that the feature plays a positive role in the classification result, while a negative value indicates that it plays a negative role. The size of the value also reflects the importance of the feature.

[0075] The SHAP method can be divided into a variety of calculation methods from different perspectives. Figure 1 In the framework shown, the expected gradient method is used to calculate the Shapley value, and the corresponding interpreter selects the gradient interpreter. The expected gradient is an extension of the integral gradient, which uses the gradient information of the model to fit the Shapley value of the feature.

[0076] The integrated gradient method measures the contribution of each feature to the prediction by integrating the gradient of the input feature along the path from the baseline (usually all zeros or the average value) to the actual input. For a given model f and input x, the integrated gradient is defined as:

[0077]

[0078] where x ′ is the baseline input (usually all zeros or a reference point). α is a scalar from 0 to 1, indicating the path from the baseline to the input. The formula finally obtains the gradient integral of the input x as the feature contribution. For each input sample x, the expected value of the integrated gradient is calculated over all baseline samples:

[0079]

[0080] where p D is the distribution of the baseline. In actual calculations, considering the time and memory consumption of the integral, sampling is used to collapse these multiple integrals:

[0081]

[0082] Finally, the expected gradients of all samples are accumulated and normalized to obtain the Shapley value approximation for each feature:

[0083]

[0084] For the signal data in the embodiment, the feature is the sampling point, and the obtained φ (i) It represents the Shapley value of the i-th sampling point, which characterizes whether the sampling point has a positive or negative effect on the classification result. Considering the limitations of the SHAP interpreter, 5000 samples in the training set and the original modulation classification model are selected to construct the SHAP gradient interpreter for feature importance analysis.

[0085] Step 3: Artificially attack the test set to generate adversarial samples, and input them into the SHAP interpreter for interpretation. According to the Shapley value output by the interpreter, analyze the negative information carried by the data after the attack, and verify the transferability and guidance of the SHAP method. The specific steps include the following:

[0086] Step 3.1: In the embodiment, a white box FGSM attack is applied to Figure 1 The basic principle of network attack is to inject imperceptible tiny disturbances into the data in a targeted manner. The infinitesimal disturbances will have a great impact on the output results under the superposition of multiple dimensions, causing the model accuracy to decrease.

[0087] In deep learning multi-classification tasks, training the network requires minimizing the loss function L:

[0088]

[0089] Where f represents the network model, y is the label of the input x, and θ is the parameter to be optimized. Adversarial attacks maximize the loss function by adding a small perturbation η to the input, making the classification wrong:

[0090]

[0091] FGSM maximizes the loss by increasing the gradient during back propagation, so the formula for solving the perturbation η is:

[0092]

[0093] in is the partial derivative of the loss function L with respect to the input x, sign(·) is the sign function, and ∈ is the perturbation level. The adversarial sample generated is:

[0094]

[0095] Step 3.2, input the attacked trace adversarial sample into the SHAP gradient interpreter, and output the corresponding shapley value. Analyze the output shapley value to verify the transferability and guidance of the SHAP method. Transferability is mainly to solve the problem that the labels of the actual attacked samples are unknown and the SHAP analysis cannot be directly applied. Therefore, for similar but different data sets, it is proved that they contain similar negative information. In this embodiment, it specifically refers to inputting the trace adversarial sample and the actual adversarial sample into the classification network, and verifying the consistency of the network's classification rules for the two data sets; guidance means that after SHAP analysis, it can be determined that the adversarial sample does contain negative information, and the SHAP analysis is consistent with the classification result after the adversarial sample is input into the model.

[0096] Step 4: Perform summation and dimensionality reduction processing on the Shapley data output by the interpreter to obtain sampling points that have a negative effect on the classification results. Delete the corresponding sampling points in the training set and validation set and fine-tune the model to obtain a new model. The details are as follows:

[0097] First, we filter out the samples with incorrect predictions in the trace adversarial samples. These samples contain rich negative information, so they can more clearly reflect which are negative features. Then we take out the Shapley value of the correct modulation label corresponding to the sample with incorrect predictions, and retain the feature sampling point dimension and add it in other dimensions. Finally, we get the sum of the Shapley values ​​of 128 sampling points on all samples. The m sampling points with negative values ​​indicate that the corresponding features have played a negative role in the classification of the samples as correct labels, that is, they are the main reasons for the classification errors, and they are recorded as negative sampling points. According to these m negative sampling points, after deleting the feature data at the corresponding positions of the training set, we fine-tune the model to obtain a new model after fine-tuning. The new model is more robust and can classify the modulation mode of the attacked signal in reality with higher performance.

[0098] Step 5: For the data that is attacked in reality, delete the corresponding negative sampling points and input them into the new model to test the classification performance. The details are as follows:

[0099] In the embodiment, the real signal data set still uses the RadioML2016.10a public data set. A large number of signal samples are selected as the real signal data to be classified, and FGSM attacks are applied to them to obtain real adversarial samples, which are used to simulate the large number of adversarial samples received by the receiver under real attacks. Finally, the data corresponding to the negative feature points in the real adversarial samples are deleted and input into the new model for modulation classification.

[0100] The following is a detailed description through specific embodiments.

[0101] Example 1

[0102] In this embodiment, the trace data set uses the RadioML2016.10a data set, which contains 11 types of modulation signals, including 3 analog modulation signals: AM-DSB, AM-SSB, WBFM; 8 digital modulation signals: 8PSK, BPSK, CPFSK, GFSK, PAM4, 16QAM, 64QAM, QPSK. This data set is generated by GNU radio, and the data is an orthogonal in-phase (I / Q) signal, covering various widely used modulation modes. At the same time, the data set also has common channel errors such as Gaussian white noise caused by multipath fading and frequency deviation. The specific parameters of this data set are shown in Table 1:

[0103] Table 1 RadioML2016.10a dataset parameters

[0104]

[0105] Combine the micro-training set and the micro-validation set as Figure 1 The training set shown in the figure selects 5000 samples from it and builds it together with the original modulation classification model Figure 1 SHAP gradient interpreter in , for SHAP analysis.

[0106] The original modulation classification model structure is as follows Figure 2 As shown. The network consists of an input layer, a Conv1D convolutional layer, an LSTM layer, a custom Sumlayer layer, a BN layer, a first fully connected layer, a second fully connected layer, and an output layer. The convolutional layer has 128 filters, a kernel size of 8, and a ReLU activation function. The LSTM layer sets the number of units to 128 and inputs it to the custom Sumlayer layer for addition and dimensionality reduction. The BN layer normalizes the previous output and is followed by two fully connected layers with 256 and 11 units, respectively, and ReLU and softmax activation functions, respectively. The optimizer used in the training process is Adam, the learning rate is set to 0.001, the batchsize is 200, and a total of 200 iterations are performed. The multi-class cross entropy loss function used in the training is

[0107]

[0108] Where Y is the set of true labels of the modulated signal, is the set of predicted values ​​of the modulation signal, m represents the number of samples in the training set, n represents the number of predicted modulation signal types, and the true label of the i-th sample is The predicted value of the i-th sample is

[0109] right Figure 1 In the test set in tiny-test, FGSM attack is applied to obtain a small amount of adversarial samples, which are input into the gradient interpreter for calculation to obtain the corresponding Shapley value. Since the original shape of the data is (330, 128, 2), the classification network finally outputs signal samples that are classified into different probabilities of 11 modulation methods. Therefore, the output shape of the interpreter is (330, 128, 2, 11). The (i, j, k, l)th Shapley value represents the contribution of the angle or phase (k = 0 / 1) of the jth feature of the i-th sample in tiny-test to the prediction of the sample as the lth modulation. A positive value indicates a positive effect, and a negative value indicates a negative effect. The larger the absolute value, the greater the negative / positive impact of the feature.

[0110] SHAP Instructable Verification 1:

[0111] FGSM attacks with interference levels of 0.025, 0.05, 0.075 and 0.1 were applied to the test set to obtain trace adversarial samples under different attacks. After being input into the interpreter, the feature sampling point dimension was retained and summed on other dimensions. Finally, the sum of the Shapley values ​​of 128 sampling points on all samples was obtained, as shown in Figure 3 As shown in the figure, it can be found that under different attack levels, some sampling points have negative Shapley values, which means that these feature sampling points have a negative impact on the results, thus causing some samples to be misclassified. The higher the attack level, the smaller the Shapley value of the negatively impacted feature. This shows that the SHAP method can clearly present the negative information in the feature sampling points of the adversarial samples, thereby accurately guiding the improvement of model performance.

[0112] SHAP Instructable Validation 2:

[0113] Under the FGSM attack with an interference level of 0.025, after calculating the Shapley value of the trace adversarial sample, for each modulation, the sum of the Shapley values ​​corresponding to the correct prediction and the incorrect prediction of the other 10 modulations is calculated, and a heat map of the Shapley value can be drawn. In addition, the confusion matrix obtained by the original model predicting the trace adversarial sample is drawn, as shown in Figure 4 shown.

[0114] Observation reveals that Figure 4 In the left figure, the size of the Shapley value at (i, j) indicates the sum of the Shapley values ​​of all sampling points of all corresponding samples when the i-th modulation mode is predicted as the j-th modulation mode. The higher the value, the more characteristic factors play a positive role. The size of the number at (i, j) in the confusion matrix on the right indicates the number of samples for which the model predicts the i-th modulation mode as the j-th modulation mode. The larger the value, the more corresponding predictions. Obviously, the distribution of the two figures is the same, which shows that the higher the Shapley value at the (i, j) position, the more characteristics play a positive role in the relevant samples, and thus the more the i-th modulation mode is predicted as the j-th modulation mode, which proves the reliability of the SHAP analysis results.

[0115] ②SHAP portability verification:

[0116] The aforementioned SHAP guidance verification shows that for an attacked data set, SHAP analysis can be used to determine the negative information that has a negative impact on the results, thereby guiding the next step of improvement. However, in the SHAP analysis process, it is necessary to first extract the Shapley value corresponding to the correct label and then do other data processing. However, the label of the attacked signal data in reality is unknown. Therefore, this part of the transferability verification is to determine whether two similar but different data sets contain similar negative information, so that the generated attacked data with known labels can guide the attacked data with unknown labels in reality.

[0117] The attacked data with known labels is Figure 1 The trace adversarial samples after the FGSM attack are applied in the figure. In reality, the attacked data with unknown labels still uses the RadioML2016.10a public dataset. The data information is consistent with the information in Table 1, and the number of samples is 6600. Apply the FGSM attack to it and get Figure 1 The real adversarial samples in the figure respectively draw the confusion matrix diagram after the trace adversarial samples and the real adversarial samples are input into the original model for classification, as shown in Figure 5 shown.

[0118] observe Figure 5 It can be found that the overall distribution of the model prediction correctness and incorrectness of the micro-adversarial samples and the real adversarial samples after the attack is similar. The aforementioned SHAP guideability verification proves that the information presented by the Shapley value corresponding to tiny-adv is consistent with its confusion matrix. Therefore, the negative information obtained from the micro-adversarial samples through SHAP analysis can guide similar real-life adversarial samples.

[0119] Example 2

[0120] After verifying the effectiveness of SHAP in Example 1, Example 2 will use the SHAP method to guide the defense against attacks in the automatic modulation classification system of real signals based on deep learning, thereby improving performance.

[0121] The test set is subjected to FGSM attacks with interference levels of 0.025, 0.05, 0.075 and 0.1, respectively, to obtain trace adversarial samples under different attacks. After inputting into the interpreter, the corresponding Shapley value of the shape (330, 128, 2, 11) is obtained, and the data is processed. The processing process is as follows Figure 6As shown in the figure, we first screen out the error_n samples that are misclassified in the trace adversarial samples. These samples contain rich negative information, so it is more obvious to identify which are negative features. Then we take out the Shapley value of the correct modulation label corresponding to the sample with incorrect prediction, and keep the feature sampling point dimension and add it in other dimensions. Finally, we get the sum of the Shapley values ​​of 128 sampling points on all samples. The m sampling points with negative values ​​indicate that the corresponding features have played a negative role in the classification of the sample as the correct label, that is, they are the main reason for the classification error, and they are recorded as negative sampling points.

[0122] The number of negative points m obtained under the four attack levels are 73, 78, 64, and 60 respectively. Considering that the proportion of correct and incorrect predictions of the total samples under different attacks is different, for the two more serious attacks of 0.075 and 0.1, the proportion of incorrect predictions in the samples is large. Therefore, deleting all negative points identified by the SHAP method will significantly improve the overall performance.

[0123] For attacks at interference levels of 0.025 and 0.05, the proportion of samples predicted correctly is relatively high. The m negative sampling points obtained through SHAP analysis are for samples predicted incorrectly. They may also play a positive role in predicting the correct samples. If all of them are deleted, the prediction results of the originally predicted correct samples will be affected. Therefore, for samples at low attack levels, the characteristic Shapley values ​​of all correctly classified samples and the characteristic Shapley values ​​of incorrectly classified samples are comprehensively considered, and the characteristic sampling points that have a negative impact on the classification results of both parts of samples are selected as new objects to be deleted. Figure 1 The model is fine-tuned through the process of , and the negative sampling points corresponding to the real adversarial samples are deleted to obtain the cleaned real test set, which is input into the fine-tuned new model for testing, and the results are as follows Figure 7 .

[0124] Figure 7 The classification performance of the cleaned test set under different attack levels is shown by inputting the original model, the adversarial training model, directly fine-tuning the model, and the proposed method. The proposed method is represented as SHAP-FT in the figure. Figure 7 It can be found that direct fine-tuning performs better than the classic adversarial training method AT-FGSM when the attack level is low, but is not as good as AT-FGSM when the attack level is high. SHAP-FT's performance is close to direct fine-tuning under low attacks, but is much better than direct fine-tuning under high attacks, and is also better than AT-FGSM under all attack levels, which proves that the SHAP-FT method has a high defense against attacks.

[0125] In addition, since some features are deleted under the guidance of negative sampling points, the data is also compressed. The model improves robustness while reducing data storage and computing resources.

[0126] The present invention relates to an information importance cognitive defense method based on interpretable learning in automatic modulation recognition, which has great potential in real attack scenarios. The SHAP method attributes the input features of adversarial samples, allowing us to clearly understand the impact of each feature on the classification results, thereby further mining the negative information therein and enhancing the defense capability of the system by fine-tuning the model. This method significantly improves the robustness of the model in the face of various attack levels and ensures classification accuracy under harsh conditions. In addition, by deleting negative feature points, the present invention also reduces the consumption of data storage and computing resources. This not only improves the efficiency of the system, but also reduces the operating cost, making it more valuable for practical applications.

[0127] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0128] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0129] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0130] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0131] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0132] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A cognitive defense method for information importance based on interpretable learning in automatic modulation recognition, characterized in that: The information importance cognitive defense method comprises the following steps: Step 1: simulate real-life signals to generate labeled trace data, which are divided into training set, validation set and test set; Step 2, using the training set and the original modulation classification model to build a SHAP interpreter for mining negative information; Step 3: attack the test set to generate adversarial samples, input the adversarial samples into the SHAP interpreter for interpretation, analyze the negative information carried by the data after the attack based on the Shapley value output by the SHAP interpreter, and verify the transferability of the SHAP method; transferability means that after SHAP analysis, it can be determined that the adversarial samples do contain negative information, and the SHAP analysis is consistent with the classification results after the adversarial samples are input into the model; Step 4, perform summation and dimensionality reduction processing on the Shapley values ​​output by the SHAP interpreter to obtain sampling points that have a negative effect on the classification results; delete the corresponding sampling points in the training set and the validation set and fine-tune the original modulation classification model to obtain a new modulation classification model; Step 5: For the data that is attacked in reality, delete the corresponding negative sampling points and input them into the new modulation classification model to test the classification performance.

2. The information importance cognitive defense method based on interpretable learning in automatic modulation recognition according to claim 1, characterized in that: In step 1, the RadioML2016.10a public dataset is used as the dataset, and the modulated signal sample is an IQ signal.

3. The information importance cognitive defense method based on interpretable learning in automatic modulation recognition according to claim 1, characterized in that: In step 2, the modulation classification model includes an input layer, a Conv1D convolutional layer, an LSTM layer, a custom Sumlayer layer, a BN layer, a first fully connected layer, a second fully connected layer and an output layer connected in sequence; The number of filters in the Conv1D convolutional layer is 128, the kernel size is 8, and the activation function is ReLU. The number of units in the LSTM layer is set to 128, and the units are input to the custom Sumlayer layer for summing and dimensionality reduction. The BN layer normalizes the output of the Sumlayer layer. The number of units in the first and second fully connected layers are 256 and 11, respectively, and the activation functions are ReLU and softmax, respectively. The Adam optimizer is used to train the modulation classification model, with the learning rate set to 0.001, the batch size to 200, and a total of 200 iterations; the multi-classification cross entropy loss function used in the training is: Where Y is the set of true labels of the modulated signal, is the set of predicted values ​​of the modulation signal, m represents the number of samples in the training set, n represents the number of predicted modulation signal types, and the true label of the i-th sample is The predicted value of the i-th sample is 4. The information importance cognitive defense method based on interpretable learning in automatic modulation recognition according to claim 1, characterized in that: In step 2, the SHAP interpreter is used to fit the shapley value of the feature using the gradient information of the model: where φ (i) Represents the Shapley value of the i-th sampling point, which is used to characterize whether the sampling point has a positive or negative effect on the classification result; ExpectedGradients i (x j ) represents the input sample x calculated using the sampling approximate multiple integral method j The expected value of the integrated gradient over all baseline samples.

5. The information importance cognitive defense method based on interpretable learning in automatic modulation recognition according to claim 1, characterized in that: In step 3, the FGSM attack is applied to interfere with the test set to obtain a small amount of adversarial samples; including: The loss function L is maximized by adding a small perturbation η to the input, making the classification error: Where f represents the network model, y is the label of input x, and θ is the parameter to be optimized; FGSM maximizes the loss by increasing the gradient during back propagation. The formula for solving the perturbation η is: in is the partial derivative of the loss function L with respect to the input x, sign(·) is the sign function, ∈ is the perturbation level; the adversarial sample generated is 6. The information importance cognitive defense method based on interpretable learning in automatic modulation recognition according to claim 1, characterized in that: Step 4 further includes: Filter out samples with incorrect predictions from trace adversarial samples. These samples contain rich negative information to reflect negative features. Take out the Shapley value of the correct modulation label corresponding to the sample with incorrect prediction, and keep the feature sampling point dimension and add it in other dimensions to get the sum of the Shapley values ​​of 128 sampling points on all samples. The m sampling points with negative values ​​indicate that the corresponding features have played a negative role in the classification of the sample as the correct label, and they are recorded as negative points; According to the m negative points, after deleting the feature data of the corresponding positions of the training set, the modulation classification model is fine-tuned, and a new modulation classification model is obtained after fine-tuning.

7. The information importance cognitive defense method based on interpretable learning in automatic modulation recognition according to claim 1, characterized in that: Step 5 further includes: Select several test set samples as the real signal data to be classified, and apply FGSM attack to them to obtain actual adversarial samples, which are used to simulate the large number of adversarial samples received by the receiver under real attack; The data of the feature sampling points corresponding to the negative points in the actual adversarial sample are deleted and input into the new modulation classification model for modulation classification.

Images