Adversarial sample generation method and device for modulation identification in real scene

Abstract

The invention discloses an adversarial sample generation method and device for modulation recognition in a real scene, and the method comprises the steps: constructing a modulation signal recognition model which simulates a recognition device of a modulation signal; a disclosed modulation signal data set RML2016.10b is adopted to train the modulation signal identification model, and a high-precision modulation signal identification model is obtained; constructing a physical confrontation sample generation model used for generating pulse type disturbance; training an adversarial sample generation model by adopting the constructed modulation signal recognition model and the disclosed modulation signal data set RML2016.10b to obtain an effective adversarial sample generation method; and inputting the normal signal sample into an adversarial sample generation model to obtain an adversarial sample with an attack effect. The confrontation sample with a physical attack effect is generated, and modulation signal recognition model confrontation in a real environment is realized.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a method and device for generating adversarial samples of a modulation recognition model in a real scenario. Background Art

[0002] Electronic warfare is an important area in modern military operations, involving the use and control of the electromagnetic spectrum. The core of electronic warfare is to weaken the enemy's combat capability by interfering, deceiving or destroying its electronic equipment and communication systems, while protecting its own electromagnetic resources and ensuring its combat effectiveness in a complex electromagnetic environment. Therefore, the theft and prevention of theft of electromagnetic signals have become the key to electronic warfare.

[0003] With the rapid development of deep learning technology, its application in the field of communication signal processing is becoming increasingly widespread. However, the advancement of this technology has also brought new security threats, namely the risk of signal theft using deep learning technology. Deep learning algorithms can extract and analyze useful information from massive radio signals by training models, thereby inferring the original communication content. The application of this technology has challenged traditional encryption and signal protection methods, especially when faced with complex attack models. This technology of signal theft using deep learning has already threatened information security to a certain extent, especially in the fields of critical infrastructure and military communications. In order to meet this challenge, researchers are exploring new signal protection methods, including strengthening signal encryption, introducing signal camouflage technology, and developing adversarial algorithms that can detect and defend against deep learning attacks. With the further development of deep learning technology, the need to prevent signal theft will become more urgent, and related security technologies will continue to evolve.

[0004] Adversarial examples refer to adding carefully designed small perturbations to the input data, causing the deep learning model to make incorrect predictions or classifications when processing this data. Although these perturbations are almost imperceptible to humans, they can significantly affect the output of the model and even cause the model to make completely wrong decisions. This phenomenon reveals the potential of adversarial examples in combating deep learning models.

[0005] The effectiveness of adversarial samples in deep learning models has been verified in many fields, especially in image and text recognition tasks. However, when adversarial samples are applied to modulated signal recognition models, their effectiveness is often significantly reduced due to the influence of physical factors such as channels. In wireless communication environments, electromagnetic signals are affected by a variety of channel effects during transmission, such as fading, noise, interference, path loss, etc. These factors change the characteristics of the original signal, thereby weakening the effect of adversarial perturbations. In addition, due to the randomness and uncontrollability of wireless signals, adversarial samples may no longer have the original characteristics after passing through the channel, allowing deep learning models to correctly identify signals. Studies have shown that in actual communication systems, the anti-theft success rate of adversarial samples is significantly lower than that in simulated environments. This phenomenon has prompted researchers to explore more robust adversarial sample generation methods to improve their anti-theft effects under complex channel conditions. Summary of the invention

[0006] In order to solve the above technical problems, the present invention proposes a method and device for generating adversarial samples for modulation recognition in real scenarios, which can generate effective adversarial samples to cope with the weakening of adversarial samples by channels, thereby effectively solving the technical problem of adversarial difficulties in actual communication systems.

[0007] The present invention can generate pulsed adversarial samples with a deep learning model in the case of unknown enemy model parameters to cope with the weakening of adversarial samples in actual communication systems, thereby enabling adversarial samples to maintain their effectiveness and adversarial nature in actual communication systems.

[0008] According to a first aspect of the present invention, a method for generating physical adversarial samples for modulation recognition is provided, the method comprising the following steps:

[0009] Step S1: construct a modulation signal recognition model, the modulation signal recognition model is used to simulate the modulation signal recognition device; the modulation signal recognition model is trained, specifically including: reading different types of modulation signals in the public modulation signal data set RML2016.10b, the modulation signal categories include 8PSK, BPSK, CPFSK, GFSK, PAM4, AM-DSB, 16QAM, 64QAM, QPSK, WBFM; based on the data set, the modulation signal recognition model is trained to obtain a trained modulation signal recognition model;

[0010] Preferably, the modulation signal recognition model is performed by a fully convolutional network for feature extraction, and finally the category output is performed through a Softmax layer. The entire network consists of three basic blocks, a global pooling layer and a Softmax layer. The basic block is a convolution layer, followed by a batch normalization layer and a ReLU activation layer. The convolution operation is performed by two one-dimensional convolution kernels {8, 5, 2}. The basic convolution block is:

[0011]

[0012] s=BN(y) (2)

[0013] h=ReLU(s) (3)

[0014] It is a convolution operator. The convolution network is constructed by stacking three convolution blocks with filter sizes of {128, 256, 128} in each block. Each convolution result is activated by the ReLU activation function and the parameters are normalized by the BN layer to accelerate the convergence process and improve the generalization ability. After the convolution network layer, the features are sent to a global average downsampling pooling layer instead of a fully connected layer to further reduce the number of parameters, improve the generalization ability, and reduce the complexity of the model. The pooling layer uses global mean pooling. Global mean pooling mainly abstracts the feature map obtained by the last layer of convolution kernels. After the features of all convolution kernels are processed, the final feature vector is formed for classification. The advantage of global mean pooling is that it can replace the fully connected layer, reduce the number of parameters, thereby increasing the speed of forward calculation and reducing the complexity of the model. The pooling result is finally calculated and output by the output layer Softmax function for classification.

[0015] Step S2: constructing a physical adversarial sample generation method for modulation recognition, and designing a loss function that ensures adversarial strength and communication quality, wherein step S2 includes:

[0016] Step S21: The adversarial sample generation model is designed to convert normal signals into adversarial signals. The model mainly includes an encoder and two decoder branches. First, the encoder accepts a normal sample x as input and generates a feature code z = E(x). Then, z is sent to two decoders, marked as D1 and D2 respectively.

[0017] D1 generates a vector representing the size of the perturbation, and the projection operator is used to limit the vector to a valid range. The projection is implemented using a scaling operation, and the entire process can be expressed as r = e·D1(z), where e is a hyperparameter that controls the adversarial perturbation, and e is set to a higher value to generate high-amplitude impulse perturbations.

[0018] D2 outputs a value of size δ∈[0,1] NIn order to obtain the discrete vector m that controls the perturbation position, it is necessary to apply a binary quantization operator q to quantize δ. Usually, the quantization operator q is expressed as:

[0019]

[0020] Where τ is the preset threshold, δ i Represents the value at the i-th sampling point of δ. According to formula (4), the value of δ is quantized to 0 or 1. Obviously, using this quantization operator during training will cause the gradient to disappear (the derivatives of all differentiable points are zero). Therefore, quantization is not performed during training, but an operator containing randomness is designed during the training stage. The quantized δ i is considered as a random variable X∈{0,1}. If X=1, then according to Formula 4, δ i Quantize to 0 or 1, otherwise keep its original value. Make X obey Bernoulli distribution. The probability distribution is

[0021] P(X=k)=p k (1-p) 1-k ,k∈{0,1} (5)

[0022] Where p is the probability that X = 1. When X = 1, gradient back propagation is blocked and gradient flow is allowed only when X = 0. In this way, δ i Gradually approaching 0 or 1, and ensuring accurate gradient information during training. In the inference stage, p is set to 1, so the δ of all points i are quantized to binary values.

[0023] Step S22: In order to train an adversarial model that has both adversarial effects and ensures communication quality, it is necessary to construct an efficient loss function.

[0024] The decoder D1 uses the loss function in C&W:

[0025]

[0026] where κ is a confidence factor that controls the strength of the attack, where κ is a confidence factor that controls the strength of the attack, and where y is the target label.

[0027] For general adversarial attacks, the perturbation should also be as small as possible in order to ensure the communication quality of the signal. In this case, the constraint imposed on the perturbation is a small l0 norm. In the framework of , the perturbation generated by r·m is continuous, so the sparsity is mainly controlled by m. Since the l0 norm is not continuous, it cannot be directly used as a regularization term in the objective function, and the l0 minimization can be relaxed to l1 minimization.

[0028] Therefore, l1 regularization with respect to m is used as the regularization loss of encoder D2.

[0029]

[0030] Due to the existence of random operators during training, it is in different states during training and testing. This may cause some test errors because quantization causes information loss. In order to narrow the gap between training and testing, a direct approach is to reduce the quantization error of g. The quantization parameters should be as close to the full-precision parameters as possible, hoping that the test performance can be close to the training. Therefore, the quantization loss needs to be designed as:

[0031]

[0032] So the total loss during training is:

[0033]

[0034] where λ s and λ q are the hyperparameters controlling the sparse loss and quantization loss, respectively. Both the sparse loss and the quantization loss encourage the generated perturbations to become sparse during the inference phase, while the aggressive loss This will optimize the high attack success rate.

[0035] Step S3: Read the modulation signal from the public modulation signal dataset RML2016.10b to obtain the modulation signal, use the signal data as the input in the modulation recognition model for model training, and obtain a modulation signal recognition model with higher accuracy as the adversarial object of the physical adversarial sample generation model. Read the modulation signal from the public modulation signal dataset RML2016.10b, input the modulation signal into the physical adversarial sample generation model, and train the adversarial sample generation model. After the training is completed, the generator G can generate adversarial samples for any input signal and can be tested on the corresponding modulation recognition model. Step S3 includes:

[0036] Step S31: The training process of the modulation recognition model is based on the modulation signal dataset RML2016.10b. First, the 11 different modulation types are pre-processed by loading the signal samples in the dataset, including normalization and signal segmentation. The processed modulation signal data is divided into a training set, a validation set, and a test set in a ratio of 7:1:2. Specifically, 70% of the data is used to train the model, and this part of the data is used to optimize the model parameters so that it can effectively identify different modulation types. Subsequently, 10% of the data is assigned as a validation set to monitor the performance of the model during the training process. Subsequently, the training set is input into the model for multiple rounds of iterative training, and the cross entropy loss function is used to gradually optimize the model parameters to achieve high-precision recognition of different modulation types. The performance on the validation set evaluates the model's ability to accurately distinguish multiple modulation modes under different signal-to-noise ratios.

[0037] Step S32: The adversarial sample generation model is based on the modulation signal dataset RML2016.10b. Similarly, the 11 different modulation types are preprocessed, including normalization and signal segmentation. The processed modulation signal data is divided into training set, validation set and test set in a ratio of 7:1:2. Subsequently, the training set is input into the model for multiple rounds of iterative training, and the model parameters are optimized based on the constructed total loss function to achieve adversarial sample generation for different types of modulation signals.

[0038] Step S33: After the training is completed, an adversarial sample is generated by inputting any signal in the test set based on the adversarial sample generation model, and the adversarial sample can be tested on the corresponding modulation recognition model.

[0039] According to a second aspect of the present invention, a device for generating adversarial samples for radio interference identification is provided, the device comprising:

[0040] Model training module: configured to build a modulation signal recognition model, the modulation signal recognition model simulates the modulation signal recognition device; obtain different types of modulation signals in the modulation signal data set RML2016.10b, the modulation signals include 8PSK, BPSK, CPFSK, GFSK, PAM4, AM-DSB, 16QAM, 64QAM, QPSK, WBFM; perform model training based on the modulation signal recognition model and the modulation signal data set to obtain a trained modulation signal recognition model;

[0041] Adversarial sample generation module: configured to obtain the modulation signal in the modulation signal data set and the trained modulation recognition model. The constructed total loss is used as the loss function, and the adversarial sample generation model is trained to obtain the trained adversarial sample generation model. The modulation signal is input into the adversarial sample generation model to form an adversarial sample.

[0042] Adversarial sample testing module: configured to obtain adversarial sample data and perform adversarial effect testing of adversarial samples based on the trained modulation signal recognition model.

[0043] A third aspect of the present invention provides a device, characterized in that the electronic device comprises:

[0044] A processor, which is used to execute multiple instructions;

[0045] A memory for storing a plurality of instructions;

[0046] The plurality of instructions are used to be stored in the memory and loaded and executed by the processor as described above.

[0047] A fourth aspect of the present invention provides a computer-readable storage medium, characterized in that a plurality of instructions are stored in the storage medium; the plurality of instructions are used by a processor to load and execute the method as described above.

[0048] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, the following is a detailed description of the preferred embodiments of the present invention in conjunction with the accompanying drawings.

[0049] Compared with the prior art, the present invention has the following advantages:

[0050] (1) Adversarial samples can be generated when the detailed model structure and model parameters of the modulation recognition model are unknown.

[0051] (2) The generated high-amplitude disturbance can maintain a good countermeasure effect in complex channel environments.

[0052] (3) The generated perturbations are sparse and can ensure good communication quality while maintaining high adversarial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention, and the present invention is described by providing the following accompanying drawings. In the accompanying drawings:

[0054] Figure 1 is a flow chart of the method of the present invention;

[0055] Figure 2 A schematic diagram of a modulation signal recognition model network structure of an implementation method of the present invention;

[0056] Figure 3 A schematic diagram of an algorithm flow of a modulation signal recognition model according to an embodiment of the present invention;

[0057] Figure 4It is a schematic diagram of the structure of a device for generating physical adversarial samples of modulated signals according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0059] Example 1

[0060] First combine Figure 1 The flowchart of the method for generating physical adversarial samples for modulation recognition according to one embodiment of the present invention is shown in FIG. The method comprises the following steps:

[0061] Step S1: construct a modulation signal recognition model, the modulation signal recognition model is used to simulate the modulation signal recognition device; the modulation signal recognition model is trained, specifically including: reading different types of modulation signals in the public modulation signal data set RML2016.10b, the modulation signal categories include 8PSK, BPSK, CPFSK, GFSK, PAM4, AM-DSB, 16QAM, 64QAM, QPSK, WBFM; based on the data set, the modulation signal recognition model is trained to obtain a trained modulation signal recognition model;

[0062] like Figure 2-Figure 3 As shown in the figure, the modulation signal recognition model is performed by a fully convolutional network for feature extraction, and finally the category output is performed through the Softmax layer. The entire network consists of three basic blocks, a global pooling layer and a Softmax layer. The basic block is a convolution layer, followed by a batch normalization layer and a ReLU activation layer. The convolution operation is performed by two one-dimensional convolution kernels {8, 5, 2}. The basic convolution block is:

[0063]

[0064] s=BN(y) (2)

[0065] h=ReLU(s) (3)

[0066] It is a convolution operator. The convolution network is constructed by stacking three convolution blocks with filter sizes of {128, 256, 128} in each block. Each convolution result is activated by the ReLU activation function and the parameters are normalized by the BN layer to accelerate the convergence process and improve the generalization ability. After the convolution network layer, the features are sent to a global average downsampling pooling layer instead of a fully connected layer to further reduce the number of parameters, improve the generalization ability, and reduce the complexity of the model. The pooling layer uses global mean pooling. Global mean pooling mainly abstracts the feature map obtained by the last layer of convolution kernels. After the features of all convolution kernels are processed, the final feature vector is formed for classification. The advantage of global mean pooling is that it can replace the fully connected layer, reduce the number of parameters, thereby increasing the speed of forward calculation and reducing the complexity of the model. The pooling result is finally calculated and output by the output layer Softmax function for classification.

[0067] In step S2, the present invention constructs a method for generating physical adversarial samples for modulation recognition, and designs a loss function that ensures adversarial strength and communication quality. Step S2 includes:

[0068] Step S21: The adversarial sample generation model is designed to convert normal signals into adversarial signals. The model mainly includes an encoder and two decoder branches. First, the encoder accepts a normal sample x as input and generates a feature code z = E(x). Then, z is sent to two decoders, marked as D1 and D2 respectively.

[0069] D1 generates a vector representing the size of the perturbation, and the projection operator is used to limit the vector to a valid range. The projection is implemented using a scaling operation, and the entire process can be expressed as r = e·D1(z), where e is a hyperparameter that controls the adversarial perturbation, and e is set to a higher value to generate high-amplitude impulse perturbations.

[0070] D2 outputs a value of size δ∈[0,1] N In order to obtain the discrete vector m that controls the perturbation position, it is necessary to apply a binary quantization operator q to quantize δ. Usually, the quantization operator q is expressed as:

[0071]

[0072] Where τ is the preset threshold, δ i Represents the value at the i-th sampling point of δ. According to formula (4), the value of δ is quantized to 0 or 1. Obviously, using this quantization operator during training will cause the gradient to disappear (the derivatives of all differentiable points are zero). Therefore, quantization is not performed during training, but an operator containing randomness is designed during the training stage. The quantized δ iis considered as a random variable X∈{0,1}. If X=1, then according to Formula 4, δ i Quantize to 0 or 1, otherwise keep its original value. Make X obey Bernoulli distribution. The probability distribution is

[0073] P(X=k)=p k (1-p) 1-k ,k∈{0,1} (5)

[0074] Where p is the probability that X = 1. When X = 1, gradient back propagation is blocked and gradient flow is allowed only when X = 0. In this way, δ i Gradually approaching 0 or 1, and ensuring accurate gradient information during training. In the inference stage, p is set to 1, so the δ of all points i are quantized to binary values.

[0075] Step S22: In order to train an adversarial model that has both adversarial effects and ensures communication quality, it is necessary to construct an efficient loss function.

[0076] The decoder D1 uses the loss function in C&W:

[0077]

[0078] where κ is a confidence factor that controls the strength of the attack, where κ is a confidence factor that controls the strength of the attack, and where y is the target label.

[0079] For general adversarial attacks, the perturbation should also be as small as possible in order to ensure the communication quality of the signal. In this case, the constraint imposed on the perturbation is a small l0 norm. In the framework of , the perturbation generated by r·m is continuous, so the sparsity is mainly controlled by m. Since the l0 norm is not continuous, it cannot be directly used as a regularization term in the objective function, and the l0 minimization can be relaxed to l1 minimization.

[0080] Therefore, l1 regularization with respect to m is used as the regularization loss of encoder D2.

[0081]

[0082] Due to the existence of random operators during training, it is in different states during training and testing. This may cause some test errors because quantization causes information loss. In order to narrow the gap between training and testing, a direct approach is to reduce the quantization error of g. The quantization parameters should be as close to the full-precision parameters as possible, hoping that the test performance can be close to the training. Therefore, the quantization loss needs to be designed as:

[0083]

[0084] So the total loss during training is:

[0085]

[0086] where λ s and λ q are the hyperparameters controlling the sparse loss and quantization loss, respectively. Both the sparse loss and the quantization loss encourage the generated perturbations to become sparse during the inference phase, while the aggressive loss This will optimize the high attack success rate.

[0087] Step S3: Read the modulation signal from the public modulation signal dataset RML2016.10b to obtain the modulation signal, use the signal data as the input in the modulation recognition model for model training, and obtain a modulation signal recognition model with higher accuracy as the adversarial object of the physical adversarial sample generation model. Read the modulation signal from the public modulation signal dataset RML2016.10b, input the modulation signal into the physical adversarial sample generation model, and train the adversarial sample generation model. After the training is completed, the generator G can generate adversarial samples for any input signal and can be tested on the corresponding modulation recognition model. Step S3 includes:

[0088] Step S31: The training process of the modulation recognition model is based on the modulation signal dataset RML2016.10b. First, the 11 different modulation types are pre-processed by loading the signal samples in the dataset, including normalization and signal segmentation. The processed modulation signal data is divided into a training set, a validation set, and a test set in a ratio of 7:1:2. Specifically, 70% of the data is used to train the model, and this part of the data is used to optimize the model parameters so that it can effectively identify different modulation types. Subsequently, 10% of the data is assigned as a validation set to monitor the performance of the model during the training process. Subsequently, the training set is input into the model for multiple rounds of iterative training, and the cross entropy loss function is used to gradually optimize the model parameters to achieve high-precision recognition of different modulation types. The performance on the validation set evaluates the model's ability to accurately distinguish multiple modulation modes under different signal-to-noise ratios.

[0089] Specifically, the learning rate is initially set to 0.001 and optimized using the Adam optimizer. The batch size is set to 128 to balance the training speed and memory usage. During the training process, a total of 50 epochs are iterated, and the learning rate is dynamically adjusted after each iteration based on the performance on the validation set. In addition, the input dimension of the signal sample is (1,128,2), where 128 represents the time step and 2 represents the two channels of the I / Q signal.

[0090] Step S32: The adversarial sample generation model is based on the modulation signal dataset RML2016.10b. Similarly, the 11 different modulation types are preprocessed, including normalization and signal segmentation. The processed modulation signal data is divided into training set, validation set and test set in a ratio of 7:1:2. Subsequently, the training set is input into the model for multiple rounds of iterative training, and the model parameters are optimized based on the constructed total loss function to achieve adversarial sample generation for different types of modulation signals.

[0091] Specifically, the variable e that sets the pulse perturbation assignment is set to 1 during the training phase to generate high-amplitude pulses. When applying the binary quantization operator q to δ, the threshold τ is set to 0.5. In the loss function used by decoder D1, the parameter κ is set to 0 to ensure the strength of the adversarial sample. The coefficient λ of the total loss during training s and λ q It is set to 0.1 and 0.2 to ensure the sparsity of adversarial perturbations.

[0092] Step S33: After the above model training is completed, the adversarial sample generation model is based on inputting any signal in the test set to generate an adversarial sample. The adversarial sample is input into the modulated signal recognition model to test whether the classification fails. If the classification fails, the adversarial success.

[0093] Example 2

[0094] Combination Figure 4 The invention provides a schematic diagram of a physical adversarial sample generation device for modulation recognition according to an embodiment of the present invention.

[0095] A physical adversarial sample generation device for modulation recognition, the device comprising:

[0096] Model training module: configured to build a modulation signal recognition model, the modulation signal recognition model simulates the modulation signal recognition device; obtain different types of modulation signals in the modulation signal data set RML2016.10b, the modulation signals include 8PSK, BPSK, CPFSK, GFSK, PAM4, AM-DSB, 16QAM, 64QAM, QPSK, WBFM; perform model training based on the modulation signal recognition model and the modulation signal data set to obtain a trained modulation signal recognition model;

[0097] Adversarial sample generation module: configured to obtain the modulation signal in the modulation signal data set and the trained modulation recognition model. The constructed total loss is used as the loss function, and the adversarial sample generation model is trained to obtain the trained adversarial sample generation model. The modulation signal is input into the adversarial sample generation model to form an adversarial sample.

[0098] Adversarial sample testing module: configured to obtain adversarial sample data and perform adversarial effect testing of adversarial samples based on the trained modulation signal recognition model.

[0099] Example 3

[0100] This embodiment provides a device, characterized in that the electronic device includes:

[0101] A processor, which is used to execute multiple instructions;

[0102] A memory for storing a plurality of instructions;

[0103] The plurality of instructions are used to be stored in the memory and loaded and executed by the processor as described above.

[0104] Example 4

[0105] This embodiment provides a computer-readable storage medium, in which a plurality of instructions are stored; the plurality of instructions are used for a processor to load and execute the aforementioned method.

[0106] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0107] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0108] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0109] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0110] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a physical server, or a network cloud server, etc., which needs to be installed with Windows or Windows Server operating system) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (RandomAccess Memory, RAM), disk or optical disk and other media that can store program codes.

[0111] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention still falls within the scope of the technical solution of the present invention.

Claims

1. A method for generating adversarial samples for modulation recognition in real scenarios, characterized in that: The steps include: Step S1: construct a modulation signal recognition model, the modulation signal recognition model is used to simulate the modulation signal recognition device; the modulation signal recognition model is trained, specifically including: reading different types of modulation signals in the public modulation signal data set RML2016.10b, the modulation signal categories include 8PSK, BPSK, CPFSK, GFSK, PAM4, AM-DSB, 16QAM, 64QAM, QPSK, WBFM; based on the data set, the modulation signal recognition model is trained to obtain a trained modulation signal recognition model; Step S2: construct a method for generating physical adversarial samples for modulation recognition, and design a loss function that ensures adversarial strength and communication quality; Step S3: read the modulation signal of the public modulation signal data set RML2016.10b to obtain the modulation signal, use the signal data as the input of the modulation recognition model to perform model training, and obtain a modulation signal recognition model with higher accuracy as the adversarial object of the physical adversarial sample generation model; read the modulation signal of the public modulation signal data set RML2016.10b, input the modulation signal into the physical adversarial sample generation model, and train the adversarial sample generation model; After training, the generator G can generate adversarial samples for any input signal and can be tested on the corresponding modulation recognition model.

2. The method according to claim 1, characterized in that The modulation signal recognition model described in step S1 is performed by a fully convolutional network for feature extraction, and finally outputs the category through a Softmax layer; it consists of three basic blocks, a global pooling layer and a Softmax layer; the basic block is a convolution layer, followed by a batch normalization layer and a ReLU activation layer; the convolution operation is performed by two one-dimensional convolution kernels {8, 5, 2}; the basic convolution block is: s=BN(y) (2) h=ReLU(s) (3) It is a convolution operator; a convolutional network is constructed by stacking three convolution blocks with filter sizes of {128, 256, 128} in each block. Each layer of convolution results is activated by the ReLU activation function and parameter normalization is performed through the BN layer to accelerate the convergence process and improve generalization ability. After the convolutional network layer, the features are sent to a global average downsampling pooling layer instead of a fully connected layer; the pooling layer uses global mean pooling; global mean pooling further abstracts the feature map obtained by the last layer of convolution kernels, and the features of all convolution kernels are processed to form the final feature vector for classification; the pooling result is calculated and output by the output layer Softmax function for classification.

3. The method for generating adversarial samples for modulation recognition according to claim 1, characterized in that: Step S2 includes: Step S21: The adversarial sample generation model is designed to convert normal signals into adversarial signals; the model mainly includes an encoder and two decoder branches; first, the encoder accepts a normal sample x as input and generates a feature code z = E(x); then, z is sent to two decoders, marked as D1 and D2 respectively; D1 generates a vector representing the size of the perturbation, and uses a projection operator to limit the vector to a valid range. The projection is implemented using a scaling operation. The entire process can be expressed as r = e·D1(z), where e is a hyperparameter that controls the adversarial perturbation. Set e to a higher value to generate high-amplitude impulse perturbations. D2 outputs a value of size δ∈[0,1] N In order to obtain the discrete vector m of the control disturbance position, it is necessary to apply the binary quantization operator q to quantize δ; usually, the quantization operator q is expressed as: Where τ is the preset threshold, δ i represents the value at the i-th sampling point of δ; the value of δ is quantized to 0 or 1 according to formula (4); quantization is not performed during the training process, but an operator containing randomness is designed during the training stage; the quantized δ i is considered as a random variable X∈{0,1}; if X=1, then according to Formula 4, δ i Quantize to 0 or 1, otherwise keep its original value; make X obey Bernoulli distribution; the probability distribution is P(X=k)=p k (1-p) 1-k ,k∈{0,1} (5) Where p is the probability of X = 1; when X = 1, the gradient back propagation is blocked and the gradient flow is allowed only when X = 0; in this way, δ i Gradually approaches 0 or 1 and ensures accurate gradient information during training; in the inference stage, p is set to 1, so the δ of all points i are all quantized into binary values; Step S22: In order to train an adversarial model that has both adversarial effects and guarantees communication quality, it is necessary to construct an efficient loss function; the decoder D1 uses the loss function in C&W: where κ is a confidence factor that controls the strength of the attack, where κ is a confidence factor that controls the strength of the attack, and where y is the target label; For general adversarial attacks, the perturbation should also be as small as possible in order to ensure the communication quality of the signal; in this case, the constraint imposed on the perturbation is a small l0 norm; the perturbation generated by r·m is continuous, and the sparsity is controlled by m; l1 regularization with respect to m is used as the regularization loss of encoder D2: The designed quantization loss is: So the total loss during training is: where λ s and λ q are the hyperparameters controlling the sparsity loss and quantization loss respectively.

4. The method according to claim 1, characterized in that The model training and testing method described in step S3 specifically includes: Step S31: The training process of the modulation recognition model is based on the modulation signal data set RML2016.10b; first, by loading the signal samples in the data set, 11 different modulation types are pre-processed, including normalization and signal segmentation; the processed modulation signal data is divided into a training set, a validation set and a test set in a ratio of 7:1:2; specifically, 70% of the data is used to train the model, and this part of the data is used to optimize the model parameters so that it can effectively identify different modulation types; then, 10% of the data is allocated as a validation set to monitor the performance of the model during the training process; then, by inputting the training set into the model for multiple rounds of iterative training, the model parameters are gradually optimized using the cross entropy loss function to achieve high-precision recognition of different modulation types; the performance on the validation set evaluates the model's ability to accurately distinguish multiple modulation modes under different signal-to-noise ratios; Step S32: the adversarial sample generation model is based on the modulation signal dataset RML2016.10b; similarly, 11 different modulation types are pre-processed, including normalization and signal segmentation; the processed modulation signal data is divided into a training set, a validation set, and a test set in a ratio of 7:1:2; then, the training set is input into the model for multiple rounds of iterative training, and the model parameters are optimized based on the constructed total loss function to achieve adversarial sample generation for different types of modulation signals; Step S33: After the training is completed, an adversarial sample is generated by inputting any signal in the test set based on the adversarial sample generation model, and the adversarial sample can be tested on the corresponding modulation recognition model.

5. A device for generating adversarial samples for modulation recognition, characterized in that: include: Model training module: configured to construct a modulation signal recognition model, wherein the modulation signal recognition model simulates a modulation signal recognition device; Obtain different types of modulation signals in the modulation signal data set RML2016.10b, wherein the modulation signals include 8PSK, BPSK, CPFSK, GFSK, PAM4, AM-DSB, 16QAM, 64QAM, QPSK, and WBFM; perform model training based on the modulation signal recognition model and the modulation signal data set to obtain a trained modulation signal recognition model; An adversarial sample generation module: configured to obtain a modulation signal in a modulation signal data set and a trained modulation recognition model; using the constructed total loss as a loss function, performing model training on the adversarial sample generation model to obtain a trained adversarial sample generation model; inputting the modulation signal into the adversarial sample generation model to form an adversarial sample; Adversarial sample testing module: configured to obtain adversarial sample data and perform adversarial effect testing of adversarial samples based on the trained modulation signal recognition model.

6. A device, characterized in that: The electronic device comprises: A processor, which is used to execute multiple instructions; A memory for storing a plurality of instructions; Among them, the multiple instructions are used to be stored by the memory, and loaded and executed by the processor as a method for generating adversarial samples for modulation recognition in a real scenario as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that: The storage medium stores a plurality of instructions; the plurality of instructions are used by the processor to load and execute a method for generating adversarial samples for modulation recognition in a real scenario as described in any one of claims 1 to 4.

Images