Adversarial defense method of deep learning model for signal modulation identification

Abstract

The invention provides an adversarial defense method of a deep learning model for signal modulation identification, and relates to the technical field of deep learning. Comprising the steps of obtaining to-be-identified signal modulation data and performing preprocessing to obtain input sample data; inputting the input sample into a defense recognition model to obtain a recognition result; the construction process of the defense recognition model comprises the following steps: constructing a first defense recognition sub-model based on a deep learning model; improving the residual network of the first defense recognition sub-model according to a transmission equation theory to obtain a second defense recognition sub-model; gaussian noise is injected into the second defense recognition sub-model to obtain a third defense recognition sub-model; and obtaining a defense recognition model according to the third defense recognition sub-model and the radial basis function. According to the invention, the problems of unstable defense effect and complex defense measurement of a method for defending against attacks in the prior art are solved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to an adversarial defense method for a deep learning model for signal modulation recognition. Background Art

[0002] With the widespread application of deep neural networks (DNNs) in computer vision, speech recognition, natural language processing and other fields, their security issues have gradually attracted attention. Adversarial attacks can cause significant deviations in the output of DNNs by introducing subtle perturbations in the input signal, affecting the accuracy and reliability of the model.

[0003] Existing methods for defending against adversarial attacks include but are not limited to adversarial training, model structure modification, using randomness and projection to eliminate adversarial perturbations, etc. However, these methods often fail to achieve an ideal balance between defense effect and model performance, resulting in unstable defense effects, complex defense strategies, and adversarial sample diversity issues. Summary of the invention

[0004] In order to overcome the shortcomings of the prior art, the purpose of the present invention is to provide an adversarial defense method for a deep learning model for signal modulation recognition. The present invention solves the problems of unstable defense effect and complex defense measurement in the prior art methods for defending against adversarial attacks.

[0005] To achieve the above object, the present invention provides the following solutions:

[0006] An adversarial defense method for a deep learning model for signal modulation recognition, comprising:

[0007] Acquire the signal modulation data to be identified and perform preprocessing to obtain input sample data;

[0008] Inputting the input sample into a defense recognition model to obtain a recognition result;

[0009] The construction process of the defense identification model is as follows:

[0010] Construct the first defense recognition sub-model based on the deep learning model;

[0011] According to the transmission equation theory, the residual network of the first defense identification sub-model is improved to obtain the second defense identification sub-model;

[0012] Injecting Gaussian noise into the second defense identification sub-model to obtain a third defense identification sub-model;

[0013] A defense identification model is obtained according to the third defense identification sub-model and the radial basis function.

[0014] Preferably, obtaining the signal modulation data to be identified and preprocessing to obtain input sample data includes:

[0015] Performing denoising processing on the signal modulation data to be identified to obtain denoised data;

[0016] Signal filtering is performed on the denoised data to obtain input sample data.

[0017] Preferably, it also includes:

[0018] Obtain adversarial samples and training samples of the original defense recognition model;

[0019] According to the PGD adversarial training algorithm, the defense recognition sub-model is optimized in real time using the adversarial sample and the training sample to obtain an optimized defense recognition sub-model;

[0020] The current unoptimized model is replaced or integrated with the optimized defense identification sub-model.

[0021] Preferably, the currently unoptimized model is replaced or integrated with the optimized defense identification sub-model, including:

[0022] Obtaining data features of input samples and data features of historical input samples;

[0023] Using the optimized defense identification sub-model and the current unoptimized model, the data features of the input sample and the data features of the historical input sample are evaluated for importance to obtain a first evaluation result and a second evaluation result;

[0024] A threshold is set and a final defense identification model is determined according to the first evaluation and the second evaluation results.

[0025] Preferably, setting a threshold and determining a final defense identification model according to the first evaluation and the second evaluation results includes:

[0026] Determine the threshold value;

[0027] If the first evaluation result is greater than the threshold and the second evaluation result is lower than the threshold, the current model is replaced with the optimized defense recognition model;

[0028] If both the first evaluation result and the second evaluation result are higher than a threshold, retaining the two models or performing model integration;

[0029] If both the first evaluation result and the second evaluation result are lower than the threshold, re-evaluate the results or perform model integration.

[0030] Preferably, the final defense identification model is expressed as:

[0031] ydef =y opt (1-e -kT )+Ce -kT ;

[0032] Among them, y def is the defense identification model, y opt is the optimized output, k is the transfer speed constant, T is the time parameter, Ce -kT is the attenuation factor.

[0033] The present invention discloses the following technical effects:

[0034] The present invention provides an adversarial defense method for a deep learning model for signal modulation recognition, including: obtaining signal modulation data to be recognized and preprocessing to obtain input sample data; inputting the input sample into a defense recognition model to obtain a recognition result; the construction process of the defense recognition model is: constructing a first defense recognition sub-model based on a deep learning model; improving the residual network of the first defense recognition sub-model according to the transmission equation theory to obtain a second defense recognition sub-model; injecting Gaussian noise into the second defense recognition sub-model to obtain a third defense recognition sub-model; obtaining a defense recognition model according to the third defense recognition sub-model and a radial basis function. The present invention uses an activation function based on a radial basis function (RBF) to replace the traditional softmax activation function to enhance the learning ability and generalization ability of the deep learning model. By utilizing the powerful interpolation ability of RBF, the activation function can achieve accurate function approximation in a high-dimensional space, significantly improving the model's recognition ability for complex data patterns and its generalization performance in the case of insufficient training data. When facing FGSM attacks, the model using RBF interpolation activation function has significantly improved recognition accuracy compared to the model using softmax, further enhancing the model's ability to resist adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0036] Figure 1 A flow chart of an adversarial defense method for a deep learning model for signal modulation recognition provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0039] like Figure 1 As shown, the present invention provides an adversarial defense method for a deep learning model for signal modulation recognition, comprising:

[0040] Step 100: Acquire the signal modulation data to be identified and perform preprocessing to obtain input sample data;

[0041] Step 200: inputting the input sample into the defense recognition model to obtain a recognition result;

[0042] Specifically, signal modulation data: refers to the original data of the signal to be identified. These data are usually signals generated by some modulation technology, such as frequency modulation (FM), amplitude modulation (AM), phase modulation (PM), etc. Signal modulation data can be a time domain waveform, frequency domain representation, or other forms of signal samples. Recognition result: This is the output of the deep learning model after processing the input sample data, usually a classification of the signal modulation method. The recognition result can be a label (such as "AM", "FM", "PM", etc.) or a probability distribution, indicating the probability that the input signal belongs to each type of modulation method.

[0043] The construction process of the defense identification model is as follows:

[0044] Step 201: constructing a first defense identification sub-model based on a deep learning model;

[0045] Step 202: improving the residual network of the first defense identification sub-model according to the transmission equation theory to obtain a second defense identification sub-model;

[0046] Step 203: injecting Gaussian noise into the second defense identification sub-model to obtain a third defense identification sub-model;

[0047] Step 204: Obtain a defense identification model according to the third defense identification sub-model and the radial basis function.

[0048] Further, the signal modulation data to be identified is obtained and preprocessed to obtain input sample data, including:

[0049] Performing denoising processing on the signal modulation data to be identified to obtain denoised data;

[0050] Signal filtering is performed on the denoised data to obtain input sample data.

[0051] Specifically, an autoencoder is used for feature denoising to reduce the original noise component in the data; an adaptive bandpass filter is used to improve signal quality and filter out irrelevant noise while retaining key information in the adversarial disturbance.

[0052] More specifically, the input data is first denoised by an autoencoder, which consists of an encoder and a decoder. The encoder maps the input data to a low-dimensional feature space, and the decoder reconstructs a clean signal. During the training process, Gaussian noise is injected into the signal to minimize the reconstruction error; the signal is filtered using adaptive bandpass filtering technology. The filtering process is represented by a parameterized impulse response, and the filter parameters are dynamically adjusted according to the signal characteristics to enhance the signal quality while retaining the key information in the adversarial sample.

[0053] The output of each layer of a deep neural network (such as ResNet) is modeled as the characteristics of the transmission equation, and the diffusion term is introduced to simulate the propagation and diffusion behavior of the signal in the network to enhance adversarial robustness. Gaussian noise with a specific variance is injected into the output of each residual map to smooth the feature space and reduce the impact of adversarial perturbations.

[0054] The radial basis function (RBF) interpolation activation is used to replace the traditional softmax function to enhance the model's ability to learn and express complex data patterns. The radial basis function interpolation activation is used in the output layer of the model, and the RBF center is set by the feature points in the training data, and the corresponding weights are calculated.

[0055] RBF interpolation activation can achieve accurate and smooth function approximation in high-dimensional space, thereby improving the stability of the model in the face of adversarial attacks.

[0056] Furthermore, it also includes:

[0057] Obtain adversarial samples and training samples of the original defense recognition model;

[0058] According to the PGD adversarial training algorithm, the defense recognition sub-model is optimized in real time using the adversarial sample and the training sample to obtain an optimized defense recognition sub-model;

[0059] The currently unoptimized model is replaced or integrated with the optimized defense identification sub-model.

[0060] Specifically, the generated adversarial samples are used together with the original samples for training through the PGD adversarial training algorithm to improve the robustness of the model on natural and adversarial samples. The multi-level Monte Carlo algorithm is used for joint training to optimize the linear activation and RBF interpolation activation respectively to improve the generalization ability and stability of the model.

[0061] Furthermore, the optimized defense identification sub-model is used to replace or integrate the current unoptimized model, including:

[0062] Obtaining data features of input samples and data features of historical input samples;

[0063] Using the optimized defense identification sub-model and the current unoptimized model, the data features of the input sample and the data features of the historical input sample are evaluated for importance to obtain a first evaluation result and a second evaluation result;

[0064] A threshold is set and a final defense identification model is determined according to the first evaluation and the second evaluation results.

[0065] Specifically, collect real-time input sample data, which can come from network traffic, user behavior, system logs, etc. For each sample, use feature engineering technology to extract features, which may include the following steps: Data cleaning: remove duplicates, missing values, and outliers.

[0066] Feature selection: Select features that are highly relevant to the target task from the initially extracted features.

[0067] Standardization / Normalization: Standardize feature values ​​to a specific range (such as 0 to 1) to improve model training results.

[0068] Review historical data samples, which are usually data collected over a period of time in the past and may be used for model training and performance benchmarking.

[0069] Similar to the data processing of the current input sample, the same feature extraction process is performed on each historical sample.

[0070] Input the current input sample features and historical sample features into the optimized defense identification sub-model respectively. Calculate the importance score based on the model output and the corresponding features. Common methods include: SHAP value: measures the importance of each feature to the model output. LIME: Locally interpretable model-agnostic method, which evaluates feature importance based on local linear models. Record the first evaluation result. Similar steps, use the current unoptimized model to evaluate the input sample and historical samples, and record the second evaluation result.

[0071] According to business requirements and system characteristics, set one or more thresholds to judge the strength of the evaluation results. For example, a reasonable threshold can be determined based on actual experience or through cross-validation. The threshold can be calculated based on the distribution of model output or the quantile of feature evaluation results.

[0072] Through the above steps, the system can effectively extract and evaluate the features of real-time input samples and historical data, use the output of the model to perform importance analysis, provide a basis for the decision-making of the defense identification model, and assist in subsequent security strategies and adjustments. The whole process is easy to iterate and adjust to continuously improve the performance and defense capabilities of the model.

[0073] Further, setting a threshold and determining a final defense identification model according to the first evaluation and the second evaluation results includes:

[0074] Determine the threshold value;

[0075] If the first evaluation result is greater than the threshold and the second evaluation result is lower than the threshold, the current model is replaced with the optimized defense recognition model;

[0076] If both the first evaluation result and the second evaluation result are higher than a threshold, retaining the two models or performing model integration;

[0077] If both the first evaluation result and the second evaluation result are lower than the threshold, re-evaluate the results or perform model integration.

[0078] Specifically, the final defense identification model is expressed as:

[0079] y def =y opt (1-e -kT )+Ce -kT ;

[0080] Among them, y def is the defense identification model, y opt is the optimized output, k is the transfer speed constant, T is the time parameter, Ce -kT is the attenuation factor.

[0081] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0082] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. An adversarial defense method for a deep learning model for signal modulation recognition, characterized in that: include: Acquire the signal modulation data to be identified and perform preprocessing to obtain input sample data; Inputting the input sample into the defense recognition model to obtain a recognition result; The construction process of the defense identification model is as follows: Construct the first defense recognition sub-model based on the deep learning model; According to the transmission equation theory, the residual network of the first defense identification sub-model is improved to obtain the second defense identification sub-model; Injecting Gaussian noise into the second defense identification sub-model to obtain a third defense identification sub-model; A defense identification model is obtained according to the third defense identification sub-model and the radial basis function.

2. The adversarial defense method of a deep learning model for signal modulation recognition according to claim 1, characterized in that: Obtain the signal modulation data to be identified and perform preprocessing to obtain input sample data, including: Performing denoising processing on the signal modulation data to be identified to obtain denoised data; Signal filtering is performed on the denoised data to obtain input sample data.

3. The adversarial defense method of a deep learning model for signal modulation recognition according to claim 1, characterized in that: Also includes: Obtain adversarial samples and training samples of the original defense recognition model; According to the PGD adversarial training algorithm, the defense recognition sub-model is optimized in real time using the adversarial sample and the training sample to obtain an optimized defense recognition sub-model; The current unoptimized model is replaced or integrated with the optimized defense identification sub-model.

4. The adversarial defense method of a deep learning model for signal modulation recognition according to claim 3, characterized in that: Use the optimized defense identification sub-model to replace or integrate the current unoptimized model, including: Obtaining data features of input samples and data features of historical input samples; Using the optimized defense identification sub-model and the current unoptimized model, the data features of the input sample and the data features of the historical input sample are evaluated for importance to obtain a first evaluation result and a second evaluation result; A threshold is set and a final defense identification model is determined according to the first evaluation and the second evaluation results.

5. The adversarial defense method of a deep learning model for signal modulation recognition according to claim 4, characterized in that: Setting a threshold and determining a final defense identification model according to the first evaluation and the second evaluation results includes: Determine the threshold value; If the first evaluation result is greater than the threshold and the second evaluation result is lower than the threshold, the current model is replaced with the optimized defense recognition model; If both the first evaluation result and the second evaluation result are higher than a threshold, retaining the two models or performing model integration; If both the first evaluation result and the second evaluation result are lower than the threshold, re-evaluate the results or perform model integration.

6. The adversarial defense method of a deep learning model for signal modulation recognition according to claim 4, characterized in that: The final defense identification model is expressed as: y def =y opt 1-e -kT +What -kT ; Among them, y def is the defense identification model, y opt is the optimized output, k is the transfer speed constant, T is the time parameter, Ce -kT is the attenuation factor.

Images