Depth time-frequency denoising transformation defense method for frequency spectrum monitoring model
By setting up the deep denoising module and transformation module in the deep learning model, the problem that the deep learning model is vulnerable to adversarial sample attacks in the spectrum monitoring task is solved, achieving higher robustness and denoising effects.
Patent Information
- Application Number
- CN202410296506.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-03-14
- Publication Date
- 2025-02-14
AI Technical Summary
Existing deep learning models are vulnerable to adversarial sample attacks in spectrum monitoring tasks, resulting in insufficient robustness of the model.
By setting up a deep denoising module, the signal is mapped to the time frequency domain, amplifying the differences caused by anti-perturbation, and reconstructing the signal under the supervision of the feature extractor; at the same time, the transformation module is set up to generate a transformation matrix specific to the signal data to reduce the confrontation The attack capability of the sample.
It enhances the effectiveness of the denoising process, reduces the attack ability of the counter-sample samples, and improves the robustness of the automatic modulation classification model.
Smart Images
Figure CN119441959A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a deep time-frequency denoising transformation defense method for a spectrum monitoring model, and belongs to the technical field of communications. Background Art
[0002] With the continuous development of communication technology, various modulation methods exist in complex electromagnetic space. Spectrum monitoring tasks centered on automatic modulation classification (AMC) play an important role in ensuring the rational use of radio spectrum resources and maintaining the order of radio communications. In the field of AMC, deep learning methods are particularly important in processing and classifying complex modulated signals. The adaptability of deep learning models to fluctuating signal environments is crucial, especially for effective signal classification tasks in dynamic spectrum monitoring environments. However, deep learning models, including automatic modulation classification models, have been found to be highly vulnerable to adversarial sample attacks, which inject tiny and carefully designed perturbations into the input signal. Although these perturbations are almost imperceptible to humans and traditional communication systems, they may cause serious errors in the model.
[0003] In order to improve the adversarial robustness of AMC models, researchers have proposed various defense methods. The adversarial defense methods of AMC models are mainly divided into two strategies: model-centric and data-centric. These methods have mitigated the threat of adversarial samples to AMC models to a certain extent. However, the openness of the electromagnetic spectrum has promoted the development of various adversarial attacks. Understanding and solving these attacks has become an urgent challenge for the safe application of deep learning-based AMC models in spectrum monitoring tasks. Summary of the invention
[0004] The technical problem to be solved by the present invention is to provide a deep time-frequency denoising transformation defense method for a spectrum monitoring model in view of the shortcomings of the prior art. By setting a deep denoising module, the signal is mapped to the time-frequency domain, and the difference caused by the adversarial disturbance is amplified, thereby enhancing the denoising process; by setting a transformation module, a specific example transformation matrix suitable for the signal data is generated, which effectively reduces the attack capability of the adversarial sample and enhances the robustness of the AMC model.
[0005] The technical problem to be solved by the present invention is achieved through the following technical solutions:
[0006] The present invention provides a deep time-frequency denoising transformation defense method for a spectrum monitoring model, and the deep time-frequency denoising transformation defense method comprises the following steps:
[0007] Step 1: Build a deep time-frequency denoising transform defense architecture including a deep denoising module, a transform module, and a pre-trained automatic modulation classification model;
[0008] Step 2: In the deep denoising module, the input data samples are mapped into a time-frequency matrix using short-time Fourier transform, and the original samples x are amplified. s With adversarial sample x a The difference between them is obtained and the time-frequency domain signal is reconstructed under the supervision of the deep features extracted by the feature extractor;
[0009] Step 3: Input the reconstructed original sample and adversarial sample into the transformation module to generate a sample-specific transformation matrix M s and M a , get the transformed original sample And the transformed adversarial sample
[0010] Step 4: The transformed original sample And the transformed adversarial sample Input the pre-trained automatic modulation classification model to realize signal classification decision.
[0011] Preferably, in step 4, the automatic modulation classification model is composed of the feature extractor E and the classifier C. and To classify:
[0012] The automatic modulation classification model calculates and The logits probability distribution function is:
[0013]
[0014]
[0015] Among them, E represents the feature extractor, C represents the classifier, and p s and p a They are and The corresponding logits value, based on which the cross entropy loss function is used to calculate the classification loss:
[0016]
[0017]
[0018] Among them, CE(·) represents the cross entropy loss function, y s and a They represent the true labels respectively.
[0019] Preferably, in step 2, the original sample x is generated using short-time Fourier transform s And the adversarial sample x aThe time-frequency domain representation of is:
[0020] tf s =STFT(x s ),
[0021] tf a =STFT(x a ),
[0022] Among them, STFT represents the short-time Fourier transform function, tf s and tf a Respectively represent the representation of the original sample and the adversarial sample in the time-frequency domain;
[0023] tf s and tf a Input into the deep denoising function to get the denoised time-frequency matrix:
[0024]
[0025]
[0026] Where D represents the depth denoising function, and Respectively represent the time-frequency matrix after reconstruction and denoising; and
[0027] Using the inverse short-time Fourier transform and Restore to time domain:
[0028]
[0029]
[0030] Among them, iSTFT represents the short-time inverse Fourier transform function, and Represent the original samples and adversarial samples after deep denoising respectively.
[0031] Preferably, the deep denoising function D is composed of a convolutional neural network with four layers of 3×3 convolution kernels.
[0032] Preferably, in step three, the original sample after deep denoising is and adversarial examples To transform:
[0033]
[0034]
[0035] Among them, T represents the transformation network, M s and M aRespectively represent the original samples after deep denoising And deep denoised adversarial examples The corresponding transformation matrix;
[0036] Will and The transformed original sample is obtained by the transformation matrix And the transformed adversarial sample
[0037]
[0038]
[0039] in, and Keep the dimension of 2×L before transformation, where L is the length of the signal sequence;
[0040] A joint training mechanism is adopted for the deep denoising module and the transform module, and the training optimization objectives of the deep denoising module and the transform module are:
[0041]
[0042] Where β1, β2 and β3 are the weight factors for the trade-off between calibration reconstruction error loss, depth feature distance loss and classification loss, respectively.
[0043] The reconstruction error loss is expressed as:
[0044]
[0045] Among them, ||·||2 represents the l2 norm;
[0046] The difference loss function between deep features is:
[0047] Where MMD(·,·) is the maximum mean difference distance, and f a and f s They are x s and x a The deep intermediate representation of , E represents the feature extractor.
[0048] Preferably, the automatic modulation classification model is a VGG16 benchmark model.
[0049] In summary, the present invention maps the signal to the time-frequency domain by setting a deep denoising module, amplifies the difference caused by the adversarial disturbance, and thus enhances the denoising process; by setting a transformation module, a specific example transformation matrix suitable for the signal data is generated, which effectively reduces the attack capability of the adversarial sample and enhances the robustness of the AMC model.
[0050] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS
[0051] Figure 1 It is a schematic diagram of the overall model architecture of the present invention;
[0052] Figure 2 Shows the difference between the original sample and the adversarial sample in the time-frequency domain;
[0053] Figure 3 It is a schematic diagram of the denoising effect of the DTFDT algorithm model of the present invention;
[0054] Figure 4 Schematic diagram of the classification accuracy of the DTFDT algorithm model of the present invention for adversarial attacks. DETAILED DESCRIPTION
[0055] Figure 1 Schematic diagram of the overall model architecture of the present invention. Figure 1 As shown, in order to solve the problem that the AMC model is susceptible to the addition of carefully designed imperceptible disturbances to the input, the present invention proposes a data-centric deep time-frequency denoising transform defense method (DTFDT) for spectrum monitoring models, including the following steps:
[0056] Step 1: Build a deep time-frequency denoising transform defense architecture including a deep denoising module, a transform module, and a pre-trained automatic modulation classification model;
[0057] Step 2: In the deep denoising module, the input data samples (exemplarily, including the original samples x) are transformed into s and adversarial examples x a ) is mapped into a time-frequency matrix, enlarging the original sample x s With adversarial sample x a The difference between them is obtained and the time-frequency domain signal is reconstructed under the supervision of the deep features extracted by the feature extractor;
[0058] Step 3: Input the reconstructed original sample and adversarial sample into the transformation module to generate a sample-specific transformation matrix M s and M a , get the transformed original sample And the transformed adversarial sample
[0059] Step 4: The transformed original sample And the transformed adversarial sample Input the pre-trained automatic modulation classification model to realize signal classification decision.
[0060] Exemplarily, in step 2, the original sample x is generated using short-time Fourier transform s And the adversarial sample x a The time-frequency domain representation of is:
[0061] tf s =STFT(x s )(1),
[0062] tf a =STFT(x a )(2),
[0063] Among them, x s represents the original sample, x a represents adversarial samples, STFT represents short-time Fourier transform function (STFT), tf s and tf a Respectively represent the representation of the original sample and the adversarial sample in the time-frequency domain.
[0064] Then tf s and tf a Input into the deep denoising function to get the denoised time-frequency matrix:
[0065]
[0066]
[0067] Where D represents the depth denoising function, and They represent the time-frequency matrices after reconstruction and denoising respectively.
[0068] The deep denoising function D may be composed of, for example, a convolutional neural network with four layers of 3×3 convolution kernels. The use of convolutional neural networks for denoising is an existing technology, so it will not be described in detail here.
[0069] Using the inverse short-time Fourier transform and Restore to time domain:
[0070]
[0071]
[0072] Among them, iSTFT represents the short-time inverse Fourier transform function, and They represent the original samples and adversarial samples restored to the time domain, that is, the original samples and adversarial samples after deep denoising.
[0073] In the above step 2, by mapping the signal to the time-frequency domain, the small differences caused by the adversarial perturbation are amplified, thereby enhancing the denoising effect and achieving more effective denoising. Figure 2 shows the difference between the original sample and the adversarial sample in the time-frequency domain, where Figure 2 The left picture in is the time-frequency domain diagram of the original sample. Figure 2 The right figure in is the time-frequency domain diagram of the adversarial sample. Figure 2 It can be seen that the difference between the original sample and the adversarial sample in the time-frequency domain is significantly amplified, which helps the deep denoising module to effectively distinguish and eliminate adversarial perturbations.
[0074] In step 3, the original sample after deep denoising and adversarial examples To transform:
[0075]
[0076]
[0077] Among them, T represents the transformation network, M s and M a Respectively represent the original samples after deep denoising And deep denoised adversarial examples The corresponding transformation matrix, exemplarily, M s and M a The dimension is 2×3.
[0078] The transformation network T can generate a transformation matrix specific to each sample, thereby obtaining the corresponding signal data after transformation to reduce the effectiveness of the adversarial attack. Exemplarily, the transformation network can be composed of two layers of neural networks with 32 and 6 fully connected layers respectively.
[0079] In order to maintain the consistency of input and output sizes, improve the generalization ability of the model, and ensure that the transformed signal size is still suitable for the pre-trained automatic modulation classification model, and The transformed signal is obtained by transforming the matrix and
[0080]
[0081]
[0082] The transformed signal and The dimension of 2×L before transformation is maintained, where L is the length of the signal sequence.
[0083] A joint training mechanism is adopted for the deep denoising module and the transformation module. In particular, a comprehensive loss function is selected for the deep denoising module. This comprehensive loss function not only targets the reconstruction error between the original time-frequency matrix and the reconstructed matrix, but also utilizes the difference in deep feature representation. The reconstruction error loss can be expressed as:
[0084]
[0085]
[0086] Here, ||·||2 represents the l2 norm.
[0087] The difference loss function between deep features is:
[0088]
[0089] Where MMD(·,·) is the maximum mean difference distance, and f a and f s They are x s and x a The deep intermediate representation of , E represents the feature extractor.
[0090] Based on the above, the training optimization objectives of the deep denoising module and the transformation module are:
[0091]
[0092] where β1, β2, and β3 are weight factors for the trade-off between calibration reconstruction error loss, deep feature distance loss, and classification loss, respectively.
[0093] Through the above step 3, a specific example transformation matrix suitable for signal data can be generated. and It can reduce the effectiveness of adversarial attacks, reduce the attack capability of adversarial samples, and enhance the robustness of the AMC model.
[0094] In step 4, the automatic modulation classification model is composed of the feature extractor E and the classifier C as described above. and To classify:
[0095] Automatic modulation classification model calculation and The logits probability distribution function is:
[0096]
[0097]
[0098] Among them, E represents the feature extractor, C represents the classifier, and p s and p a They are and The corresponding logits value, based on which the cross entropy loss function is used to calculate the classification loss:
[0099]
[0100]
[0101] Among them, CE(·) represents the cross entropy loss function, y s and a They represent the true labels respectively.
[0102] Calculating the logits probability distribution function is actually classification. The logits function represents the original output input to the neural network, which has not been normalized. Passing logits to the softmax function can obtain the normalized probability distribution, that is, the sum of the probabilities of each category is 1, which completes the multi-classification task. Classification is a basic function in the "spectrum monitoring model". The spectrum detection model can identify and classify signal sample data, so it will not be repeated here.
[0103] The automatic modulation classification model is a prior art. For example, as needed, a person skilled in the art may select a model in the prior art (such as the VGG16 benchmark model) as an automatic modulation classification model including a feature extractor E and a classifier C, so it will not be described in detail here.
[0104] The reason why the present invention adopts a pre-trained automatic modulation classification model is that pre-training can learn the commonalities among a large amount of training data collected at low cost through a certain pre-training method, and then "transplant" the commonalities into the model of a specific task. Through pre-training initialization, the model can quickly adapt to the data distribution of the new task without having to learn all the knowledge from scratch.
[0105] In order to verify the effect of the above-mentioned deep time-frequency denoising transform defense method for spectrum monitoring model, the present invention uses the public dataset RML2016.10a for experiments. The RML2016.10a dataset contains 11 digital and analog modulations, and the signal-to-noise ratio (SNR) range extends from -20dB to 18dB with an increment of 2dB.
[0106] Figure 3 It is a schematic diagram of the denoising effect of the DTFDT algorithm model of the present invention; Figure 4This is a schematic diagram of the classification accuracy of the DTFDT algorithm model of the present invention against adversarial attacks. Figure 3 It can be seen from the figure that compared with not defending or using the existing Deepfilter and CAFD methods, the DTFDT in the present invention can achieve the lowest fitting difference, so it can more effectively reduce the strength of the adversarial disturbance in the signal space; Figure 4 It can be seen from the figure that under different disturbance levels, the classification accuracy of the DTFDT algorithm model and other defense algorithms for adversarial attacks can verify the superior performance of the present invention in defending against a series of adversarial attacks.
[0107] In summary, the present invention maps the signal to the time-frequency domain by setting a deep denoising module, amplifies the difference caused by the adversarial disturbance, and thus enhances the denoising process; by setting a transformation module, a specific example transformation matrix suitable for the signal data is generated, which effectively reduces the attack capability of the adversarial sample and enhances the robustness of the AMC model.
Claims
1. A deep time-frequency denoising transform defense method for spectrum monitoring models, characterized in that: The deep time-frequency denoising transform defense method comprises the following steps: Step 1: Build a deep time-frequency denoising transform defense architecture including a deep denoising module, a transform module, and a pre-trained automatic modulation classification model; Step 2: In the deep denoising module, the input data samples are mapped into a time-frequency matrix using short-time Fourier transform, and the original samples x are amplified. s With adversarial sample x a The difference between them is obtained and the time-frequency domain signal is reconstructed under the supervision of the deep features extracted by the feature extractor; Step 3: Input the reconstructed original sample and adversarial sample into the transformation module to generate a sample-specific transformation matrix M s and M a , get the transformed original sample And the transformed adversarial sample Step 4: The transformed original sample And the transformed adversarial sample Input the pre-trained automatic modulation classification model to realize signal classification decision.
2. The deep time-frequency denoising transform defense method according to claim 1, characterized in that: In step 4, the automatic modulation classification model is composed of the feature extractor E and the classifier C. and To classify: The automatic modulation classification model calculates and The logits probability distribution function is: Among them, E represents the feature extractor, C represents the classifier, and p s and p a They are and The corresponding logits value, based on which the cross entropy loss function is used to calculate the classification loss: Among them, CE(·) represents the cross entropy loss function, y s and a They represent the true labels respectively.
3. The deep time-frequency denoising transform defense method according to claim 2, characterized in that: In step 2, the original sample x is generated using short-time Fourier transform s And the adversarial sample x a The time-frequency domain representation of is: tf s =STFT(x s ), tf a =STFT(x a ), Among them, STFT represents the short-time Fourier transform function, tf s and tf a Respectively represent the representation of the original sample and the adversarial sample in the time-frequency domain; tf s and tf a Input into the deep denoising function to get the denoised time-frequency matrix: Where D represents the depth denoising function, and Respectively represent the time-frequency matrix after reconstruction and denoising; and Using the inverse short-time Fourier transform and Restore to time domain: Among them, iSTFT represents the short-time inverse Fourier transform function, and Represent the original samples and adversarial samples after deep denoising respectively.
4. The deep time-frequency denoising transform defense method according to claim 3, characterized in that: The deep denoising function D is composed of a convolutional neural network with four layers of 3×3 convolution kernels.
5. The deep time-frequency denoising transform defense method according to claim 3, characterized in that: In step 3, the original sample after deep denoising and adversarial examples To transform: Among them, T represents the transformation network, M s and M a Respectively represent the original samples after deep denoising And deep denoised adversarial examples The corresponding transformation matrix; Will and The transformed original sample is obtained by the transformation matrix And the transformed adversarial sample in, and Keep the dimension of 2×L before transformation, where L is the length of the signal sequence; A joint training mechanism is adopted for the deep denoising module and the transform module, and the training optimization objectives of the deep denoising module and the transform module are: Where β1, β2 and β3 are the weight factors for the trade-off between calibration reconstruction error loss, depth feature distance loss and classification loss, respectively. The reconstruction error loss is expressed as: Among them, ||·||2 represents the l2 norm; The difference loss function between deep features is: Where MMD(·,·) is the maximum mean difference distance, and f a and f s They are x s and x a The deep intermediate representation of , E represents the feature extractor.
6. The deep time-frequency denoising transform defense method according to claim 2, characterized in that: The automatic modulation classification model is the VGG16 benchmark model.