Concealed gradient sample-based anti-attack method and terminal

Abstract

The invention discloses a hidden gradient sample-based adversarial attack method and terminal, and the method comprises the steps: generating an adversarial sample based on an adversarial sample generation model and an original sample, calculating the training loss between the original sample and the adversarial sample according to a loss function of the model, and taking the training loss as a model gradient; according to the model gradient, selecting an original sample of a front preset proportion with the maximum model gradient as a hidden gradient sample, calculating the similarity between the original sample and the adversarial sample, and according to the similarity, screening hidden gradient samples with the similarity higher than a preset value from the hidden gradient sample set to form an attack sample set, by calculating the training loss between an original sample and an adversarial sample, samples which change drastically due to violent attacks can be determined, and then a high-similarity hidden gradient sample set is screened out from the hidden gradient sample set by calculating the similarity, so that targeted disturbance attacks are carried out on the hidden gradient samples, and the hidden gradient samples are subjected to high-precision disturbance attacks. Therefore, the attack concealment is improved while the attack resisting efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a counterattack method and terminal based on hidden gradient samples. Background Art

[0002] Over the past decade, with the rapid development and application of deep learning technologies, AI (artificial intelligence) systems have achieved remarkable progress in fields such as image recognition, natural language processing, and autonomous driving. However, the vulnerabilities of these systems have also gradually become apparent, especially when faced with adversarial examples. For example, a facial recognition model may fail to correctly identify an intruder due to an adversarial attack, or an AI model used for credit scoring may be tricked into providing unfair credit assessments.

[0003] Adversarial examples are specially crafted input data whose variations, barely perceptible to humans, can cause AI systems to misjudge their decisions. These findings have raised concerns about the security of AI systems, particularly in security-sensitive applications such as financial services, medical diagnostics, and autonomous driving. An effective adversarial attack method can comprehensively test the robustness of the attacked algorithm, helping it to continuously optimize itself to withstand future attacks.

[0004] Existing research on adversarial attack strategies mainly includes white-box attacks, black-box attacks, targeted attacks, and non-targeted attacks. Adversarial sample attacks can adopt a variety of strategies and techniques. A common method is to generate adversarial samples based on data enhancement, which performs data enhancement processing on the attacked image and multiple local images and inputs them into the classification model; another method is to use target masks to generate adversarial samples and conduct attack tests on black-box target detection models. In the field of time series, there is an existing technology that uses SMOTE (Synthetic Minority Over-sampling Technique, a method for processing imbalanced data sets) to enhance the original samples to generate adversarial samples. After using a small number of fault samples to expand the data, a convolutional classifier is used to realize the identification of fault time series. Another existing technology uses a data type rule checker and an invariant rule checker to optimize the initial adversarial sample to obtain the final adversarial sample.

[0005] In summary, some current methods all perturb global samples. This perturbation method will inevitably produce greater differences from the original samples, making the attack easy to detect and lacking refined management. In addition, most methods are applied in the image field and rarely involve time series data. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a method and terminal for countering attacks based on hidden gradient samples, which can improve the efficiency of countering attacks while improving the concealment of attacks.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0008] A hidden gradient sample-based adversarial attack method comprising the following steps:

[0009] Obtaining a time series anomaly classification model and determining original samples of the time series anomaly classification model;

[0010] Generate an adversarial sample based on the adversarial sample generation model and the original sample, and calculate the training loss between the original sample and the adversarial sample according to the loss function of the adversarial sample generation model as a model gradient;

[0011] Selecting a preset proportion of original samples with the largest model gradient as hidden gradient samples according to the model gradient, obtaining a hidden gradient sample set, and calculating the similarity between the original samples and the adversarial samples;

[0012] According to the similarity, hidden gradient samples with a similarity higher than a preset value are screened from the hidden gradient sample set to form an attack sample set, and the attack sample set is used to perform an adversarial attack on the time series anomaly classification model.

[0013] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0014] A terminal for countering attacks based on hidden gradient samples includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0015] Obtaining a time series anomaly classification model and determining original samples of the time series anomaly classification model;

[0016] Generate an adversarial sample based on the adversarial sample generation model and the original sample, and calculate the training loss between the original sample and the adversarial sample according to the loss function of the adversarial sample generation model as a model gradient;

[0017] Selecting a preset proportion of original samples with the largest model gradient as hidden gradient samples according to the model gradient, obtaining a hidden gradient sample set, and calculating the similarity between the original samples and the adversarial samples;

[0018] According to the similarity, hidden gradient samples with a similarity higher than a preset value are screened from the hidden gradient sample set to form an attack sample set, and the attack sample set is used to perform an adversarial attack on the time series anomaly classification model.

[0019] The beneficial effects of the present invention are: based on the adversarial sample generation model and the original sample, the training loss between the original sample and the adversarial sample is calculated according to the loss function of the adversarial sample generation model as the model gradient, and the original samples with the largest model gradient before the preset proportion are selected as hidden gradient samples according to the model gradient, and the similarity between the original sample and the adversarial sample is calculated. According to the similarity, hidden gradient samples with a similarity higher than a preset value are screened from the hidden gradient sample set to form an attack sample set. By calculating the training loss between the original sample and the adversarial sample, samples that have been violently attacked and changed dramatically, that is, samples with a larger model gradient, can be determined and used as hidden gradient samples. Then, by calculating the similarity, a highly similar hidden gradient sample set is screened from the hidden gradient sample set, so as to perform targeted perturbation attacks on the hidden gradient samples, thereby improving the efficiency of the adversarial attack while improving the concealment of the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a flowchart of a data synchronization method for an Internet data center according to an embodiment of the present invention;

[0021] Figure 2 This is a structural diagram of a data synchronization terminal in an Internet data center according to an embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of the attack effect of the FGSM method in the data synchronization method of the Internet data center according to an embodiment of the present invention on the Moscow communication abnormal event dataset;

[0023] Figure 4 This is a schematic diagram of the attack effect of the method of the present invention in the data synchronization method of the Internet data center according to an embodiment of the present invention on the Moscow communication abnormal event dataset. DETAILED DESCRIPTION

[0024] To illustrate the technical content, achieved objectives and effects of the present invention in detail, the following description is given in conjunction with the embodiments and accompanying drawings.

[0025] Please refer to Figure 1 , an adversarial attack method based on hidden gradient samples, comprising the steps of:

[0026] Obtaining a time series anomaly classification model and determining original samples of the time series anomaly classification model;

[0027] Generate an adversarial sample based on the adversarial sample generation model and the original sample, and calculate the training loss between the original sample and the adversarial sample according to the loss function of the adversarial sample generation model as a model gradient;

[0028] Selecting a preset proportion of original samples with the largest model gradient as hidden gradient samples according to the model gradient, obtaining a hidden gradient sample set, and calculating the similarity between the original samples and the adversarial samples;

[0029] According to the similarity, hidden gradient samples with a similarity higher than a preset value are screened from the hidden gradient sample set to form an attack sample set, and the attack sample set is used to perform an adversarial attack on the time series anomaly classification model.

[0030] From the above description, it can be seen that the beneficial effects of the present invention are: based on the adversarial sample generation model and the original sample, the training loss between the original sample and the adversarial sample is calculated according to the loss function of the adversarial sample generation model as the model gradient, and the original samples with the largest model gradient are selected as hidden gradient samples according to the model gradient. The similarity between the original sample and the adversarial sample is calculated, and the hidden gradient samples with a similarity higher than a preset value are screened from the hidden gradient sample set according to the similarity to form an attack sample set. In this way, by calculating the training loss between the original sample and the adversarial sample, the samples that have been violently attacked and changed dramatically, that is, the samples with a larger model gradient, can be determined and used as hidden gradient samples. Then, by calculating the similarity, a highly similar hidden gradient sample set is screened from the hidden gradient sample set, so as to perform targeted perturbation attacks on the hidden gradient samples, thereby improving the efficiency of the adversarial attack while improving the concealment of the attack.

[0031] Furthermore, before obtaining the time series anomaly classification model, the method further includes:

[0032] Acquire a time series data set, and preprocess the time series data set to obtain a preprocessed time series data set;

[0033] Build a two-layer convolutional network and use the convolutional layer to superimpose activation functions to obtain the convolution module;

[0034] Generate an initial time series anomaly classification model based on the double-layer convolutional network, the two convolutional modules, and the linear layer;

[0035] The preprocessed time series data set is used to train the initial time series anomaly classification model to obtain a trained time series anomaly classification model.

[0036] From the above description, it can be seen that preprocessing the time series dataset to obtain a preprocessed time series dataset, and then using the preprocessed time series dataset to train the initial time series anomaly classification model, can ensure data quality and model performance.

[0037] Furthermore, the using the preprocessed time series data set to train the initial time series anomaly classification model to obtain the trained time series anomaly classification model includes:

[0038] Determining that the update target of the initial time series anomaly classification model is to minimize the mean square error between the output sequence and the input sequence;

[0039] Initialize weights and biases, and iteratively update the weights and biases based on the preprocessed time series dataset using the Adam optimization algorithm according to the update target, so that the loss function reaches a minimum value, thereby obtaining a trained time series anomaly classification model.

[0040] As can be seen from the above description, the Adam optimization algorithm is used to iteratively update the weights and biases based on the preprocessed time series dataset according to the update target. After the loss function reaches the minimum value, the trained time series anomaly classification model is obtained, achieving simple and efficient model training.

[0041] Furthermore, generating an adversarial sample based on the adversarial sample generation model and the original sample includes:

[0042] Determine the true label corresponding to the original sample;

[0043] Input the original sample and the true label into the adversarial sample generation model for forward propagation, output a predicted value, and calculate a loss function based on the predicted value and the true label;

[0044] Performing gradient backpropagation on the original sample in the adversarial sample generation model to calculate the gradient of the loss function relative to the original sample;

[0045] generating an adversarial perturbation based on the gradient of the loss function with respect to the original sample;

[0046] Adding the adversarial perturbation to the original sample to obtain an initial adversarial sample;

[0047] The initial adversarial sample is iteratively optimized according to a preset number of iterations and a preset maximum perturbation amount to obtain an adversarial sample.

[0048] From the above description, it can be seen that after adding the adversarial perturbation to the original sample to obtain the initial adversarial sample, the initial adversarial sample is iteratively optimized according to the preset number of iterations and the preset maximum perturbation amount to obtain the adversarial sample, ensuring that the generated adversarial sample is within a reasonable data range and avoiding the generated adversarial sample being unrealistic or unexplainable.

[0049] Furthermore, generating the adversarial perturbation based on the gradient of the loss function relative to the original sample includes:

[0050]

[0051] Where η represents the adversarial perturbation, ∈ represents the control parameter of the perturbation intensity, and sign() represents the function used to extract the sign of the gradient. represents the gradient of the loss function relative to the original sample, represents the loss function, θ represents the model parameters of the time series anomaly classification model, x represents the original sample, and y represents the true label.

[0052] As can be seen from the above description, generating adversarial perturbations based on the gradient of the loss function relative to the original sample can accurately calculate the adversarial perturbations, ensuring that subsequently generated adversarial samples attack the model more effectively and can directly attack the model's weaknesses, making the attack more efficient.

[0053] Furthermore, the iterative optimization of the initial adversarial sample according to a preset number of iterations and a preset maximum perturbation amount to obtain the adversarial sample includes:

[0054] x″=min{x+ε,max(x-ε,x′)};

[0055] Where x″ represents the adversarial sample, x represents the original sample, ε represents the preset maximum perturbation amount, and x′ represents the initial adversarial sample.

[0056] From the above description, we can see that the initial adversarial sample is iteratively optimized according to the preset number of iterations and the preset maximum perturbation amount to obtain the adversarial sample. In this way, an optimization is performed at the beginning of generating the adversarial sample, so that the adversarial sample remains in a small neighborhood of the original time series, making it more realistic.

[0057] Furthermore, the step of selecting a preset proportion of original samples with the largest model gradient as hidden gradient samples according to the model gradient to obtain a hidden gradient sample set includes:

[0058] Sorting the model gradients in descending order to obtain sorted model gradients;

[0059] The original samples corresponding to the model gradients of a preset proportion are selected from the sorted model gradients as hidden gradient samples to obtain a hidden gradient sample set.

[0060] From the above description, we can see that we first sort the model gradients, and then select the original samples corresponding to the preset proportion of model gradients from the sorted model gradients as hidden gradient samples to obtain a hidden gradient sample set. Hidden gradient samples are samples whose internal feature values ​​change significantly after being processed by a specific model. In the future, we only need to focus on these samples to improve the attack efficiency.

[0061] Furthermore, calculating the similarity between the original sample and the adversarial sample includes:

[0062] Calculate the cosine similarity between the original sample and the adversarial sample.

[0063] As can be seen from the above description, by calculating the cosine similarity between the original sample and the adversarial sample, we can accurately screen out highly similar hidden gradient samples, namely the attack sample set. Focusing on a specific local sample set can reduce the number of samples that need to be processed and modified, improve the efficiency of the attack in terms of resources and time, and more effectively deceive the machine learning model without being detected, thereby increasing the stealth of the attack.

[0064] Furthermore, calculating the cosine similarity between the original sample and the adversarial sample includes:

[0065]

[0066] Wherein, x″ represents the adversarial sample, and x represents the original sample.

[0067] As can be seen from the above description, the greater the cosine similarity, the more similar the adversarial sample is to the original sample. Only minor modifications to this part of the original sample are required, which will not affect the overall data distribution and will be more difficult to be detected by existing defense strategies, thereby increasing the stealth of the attack.

[0068] Please refer to Figure 2 Another embodiment of the present invention provides an anti-attack terminal based on hidden gradient samples, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step in the anti-attack method based on hidden gradient samples is implemented.

[0069] The above-mentioned counterattack method and terminal based on hidden gradient samples of the present invention can be applied to the counterattack scenario of the time series anomaly classification model, which is described below through specific implementation methods:

[0070] Please refer to Figure 1 、 Figure 3 and Figure 4 , embodiment 1 of the present invention is:

[0071] A hidden gradient sample-based adversarial attack method comprising the following steps:

[0072] S1. Acquire a time series data set, and preprocess the time series data set to obtain a preprocessed time series data set.

[0073] Specifically, a time series data set with rich feature information is obtained on a public platform, wherein the rich feature information includes timestamps, feature values, abnormal timestamps, etc.; useless features in the time series data set are eliminated, such as explanatory features, specific time features, etc.; after elimination, blank value filling is performed on the time series data set; after filling, the time series data set is divided according to different state labels; after division, the state of the time series data set is merged to obtain a preprocessed time series data set. Wherein, the blank value filling of the time series data set is specifically: the blank value is replaced by the data value of the previous timestamp of the blank value. The division of the time series data set according to different state labels is specifically: the time series data set is divided according to different state labels in a ratio of 7:3. 7 / 10 of the preprocessed time series data set constitutes a training set, and 3 / 10 constitutes a test set.

[0074] S2. Build a two-layer convolutional network and use the convolutional layer to superimpose activation functions to obtain the convolution module.

[0075] Among them, the two-layer convolutional network is used to implement the anomaly detection task.

[0076] S3. Generate an initial time series anomaly classification model based on the double-layer convolutional network, the two convolutional modules, and the linear layer.

[0077] S4, using the preprocessed time series data set to train the initial time series anomaly classification model to obtain a trained time series anomaly classification model, specifically including S41-S42:

[0078] S41. Determine that the update target of the initial time series anomaly classification model is to minimize the mean square error between the output sequence and the input sequence.

[0079] S42. Initialize weights and biases, and iteratively update the weights and biases based on the preprocessed time series dataset using the Adam optimization algorithm according to the update target, so that the loss function reaches a minimum value, thereby obtaining a trained time series anomaly classification model.

[0080] Although the above only points out one type of network structure of the time series anomaly classification model, the above-mentioned anti-attack method of the present invention can also be used for time series anomaly classification models with other network structures.

[0081] S5. Obtain a time series anomaly classification model, and determine original samples of the time series anomaly classification model.

[0082] The preprocessed time series data set is determined as the original sample of the time series anomaly classification model.

[0083] S6, generating an adversarial sample based on the adversarial sample generation model and the original sample, and calculating the training loss between the original sample and the adversarial sample according to the loss function of the adversarial sample generation model as the model gradient, specifically including S61-S67:

[0084] S61: Determine the true label corresponding to the original sample.

[0085] S62: Input the original sample and the true label into the adversarial sample generation model for forward propagation, output a predicted value, and calculate a loss function based on the predicted value and the true label.

[0086] The loss function of the adversarial sample generation model is generated according to the model parameters of the time series anomaly classification model, the original sample and the true label, and is used to measure the error between the predicted value and the true label.

[0087] S63. Perform gradient backpropagation on the original sample in the adversarial sample generation model to calculate the gradient of the loss function relative to the original sample, where the gradient is used to measure the sensitivity of each pixel or feature in the input space to the loss.

[0088] S64: Generate an adversarial perturbation based on the gradient of the loss function relative to the original sample, specifically:

[0089]

[0090] Where η represents the adversarial perturbation, ∈ represents the control parameter of the perturbation intensity, and sign() represents the function used to extract the sign of the gradient. represents the gradient of the loss function relative to the original sample, represents the loss function, θ represents the model parameters of the time series anomaly classification model, x represents the original sample, and y represents the true label.

[0091] S65: Add the adversarial perturbation to the original sample to obtain an initial adversarial sample, specifically:

[0092] x′=x+η;

[0093] Where x′ represents the initial adversarial sample.

[0094] S66: Iteratively optimize the initial adversarial sample according to a preset number of iterations and a preset maximum perturbation amount to obtain an adversarial sample, specifically:

[0095] x″=min{x+ε,max(x-ε,x′)};

[0096] Where x″ represents the adversarial sample and ε represents the preset maximum perturbation amount.

[0097] Among them, the preset number of iterations and the preset maximum perturbation amount determine the degree of change of the generated adversarial sample to the original sample.

[0098] S67. Calculate the training loss between the original sample and the adversarial sample according to the loss function of the adversarial sample generation model as the model gradient.

[0099] Specifically, the original sample is derived according to the loss function of the adversarial sample generation model to calculate the training loss between the original sample and the adversarial sample as the model gradient.

[0100] S7, selecting a preset proportion of original samples with the largest model gradient as hidden gradient samples according to the model gradient, obtaining a hidden gradient sample set, and calculating the similarity between the original samples and the adversarial samples, specifically including S71-S73:

[0101] S71. Sort the model gradients in descending order to obtain sorted model gradients.

[0102] S72 , selecting original samples corresponding to a preset proportion of model gradients from the sorted model gradients as hidden gradient samples to obtain a hidden gradient sample set.

[0103] In an optional implementation, the preset ratio is 20%.

[0104] S73. Calculate the cosine similarity between the original sample and the adversarial sample, specifically:

[0105]

[0106] If the cosine similarity value is 1, it means that the two samples are completely similar.

[0107] S8. According to the similarity, hidden gradient samples with similarity higher than a preset value are selected from the hidden gradient sample set to form an attack sample set, and the attack sample set is used to perform an adversarial attack on the time series anomaly classification model.

[0108] Specifically, according to the similarity, hidden gradient samples with a similarity higher than a preset value are screened from the hidden gradient sample set to form an attack sample set, and after adversarial perturbation is performed on the attack sample set, an adversarial attack is performed on the time series anomaly classification model.

[0109] In an optional implementation manner, after S8, the method further includes:

[0110] If verifying a single-step attack under finite perturbations, set ε = 1 and calculate the performance of the time series anomaly classification model after the adversarial attack;

[0111] If verifying an iterative attack under limited perturbations, set ε>1 and calculate the performance of the time series anomaly classification model after the attack. The performance includes accuracy, precision, recall, and F1 score.

[0112] Obtain two major communication anomaly event time series datasets from Malaysia and Moscow.

[0113] Malaysia communications anomaly: Starting on June 12, 2015, Telekom Malaysia (AS4788) leaked one-third of the IP prefixes in its global routing table to backbone provider Level 3 (AS3549). This flooded the company with data, resulting in severe packet loss and performance degradation.

[0114] Moscow Communications Anomaly: The Moscow power outage occurred on May 25, 2005, and lasted for several hours. The effect was evident in the RIS remote routing collector (rrc05) in Vienna due to a surge in notification messages arriving from peer AS12793.

[0115] (1) Verifying the attack efficiency of the above-mentioned anti-attack method of the present invention based on the Malaysian communication anomaly incident

[0116] As shown in Table 1, a time series dataset of abnormal communication events in Malaysia is used as input and cosine similarity is sorted. The table is now ordered from strongest to weakest in stealth. A cosine similarity of 1 indicates that the generated adversarial example is identical to the original example, meaning it has not been attacked. At this point, all parameter metrics remain unchanged, with both the Euclidean and Manhattan distances being 0. When the F1 score reaches 76.8%, all detection metrics of the detection model after the adversarial example attack are identical, but the distance between the generated adversarial example and the original example differs significantly. All experimental results here are recorded under minimal perturbation, meaning that the cosine similarity is limited to around 0.7.

[0117] Under the traditional FGSM (Fast Gradient Sign Method, fast gradient descent method) attack, when the detection model reaches the F1 score of 76.8%, the accuracy drops by 0.13%, and the cosine similarity of the maximum distortion of the sample in the table is 0.77%. At this time, the detection model under the above-mentioned adversarial attack method of the present invention can reach an F1 score of 76.17% after parameter setting, and when the accuracy drops by 0.38%, the corresponding cosine similarity is 0.8. That is, when the above-mentioned adversarial attack method of the present invention causes a more obvious drop in accuracy, the adversarial sample has a higher similarity with the original sample. In general, compared with more aggressive adversarial samples, the adversarial attack method based on hidden gradient samples of the present invention has higher concealment.

[0118] Table 1 Comparison between the FGSM method and the above method of the present invention

[0119]

[0120]

[0121] (2) Verifying the attack concealment of the above-mentioned anti-attack method of the present invention based on the Moscow communication anomaly incident

[0122] like Figure 3 and Figure 4 As shown, Figure 3 and Figure 4 Experimental results using different attack methods on a time series dataset of Moscow communication anomaly events, Figure 3 and Figure 4 The line graph on the left side of the middle represents the three distances of similarity metrics, the bar graph corresponds to the indicators after the detection model is attacked, and the F1 score is plotted as a curve to indicate the degree of decline. The dark dotted line represents the F1 score of the current attack method, and the light dotted line represents the F1 score of the corresponding comparison method. Figure 3 and Figure 4 It can be analyzed that the above-mentioned anti-attack method of the present invention is more effective than the FGSM method, and the adversarial samples are more concealed. Figure 3 The difference in attack effectiveness between the two attack methods during parameter adjustment is marked. Figure 4 It is emphasized that when the F1 score drops to 64.37%, the cosine similarity between the adversarial sample and the original sample is as high as 0.94, that is, the adversarial sample generated by the above-mentioned adversarial attack method of the present invention has little difference from the original sample and is more concealed.

[0123] Please refer to Figure 2 , the second embodiment of the present invention is:

[0124] A terminal for countering attacks based on hidden gradient samples includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step of the method for countering attacks based on hidden gradient samples in embodiment 1 is implemented.

[0125] In summary, the present invention provides an adversarial attack method and terminal based on hidden gradient samples. The adversarial samples are generated based on the adversarial sample generation model and the original samples. The training loss between the original samples and the adversarial samples is calculated according to the loss function of the adversarial sample generation model as the model gradient. The original samples with the largest model gradient are selected as hidden gradient samples according to the model gradient. The similarity between the original samples and the adversarial samples is calculated. According to the similarity, hidden gradient samples with a similarity higher than a preset value are screened from the hidden gradient sample set to form an attack sample set. In this way, by calculating the training loss between the original samples and the adversarial samples, samples that have been violently attacked and changed dramatically, that is, samples with a larger model gradient, can be determined and used as hidden gradient samples. Then, hidden gradient samples with high similarity are screened from the hidden gradient sample set by calculating the similarity. set, in order to carry out targeted perturbation attacks on hidden gradient samples, thereby improving the efficiency of the adversarial attack while improving the concealment of the attack; in addition, after adding the adversarial perturbation to the original sample to obtain the initial adversarial sample, the initial adversarial sample is iteratively optimized according to the preset number of iterations and the preset maximum perturbation amount to obtain the adversarial sample, ensuring that the generated adversarial sample is within a reasonable data range and avoiding the generated adversarial sample being unrealistic or unexplainable; at the same time, the cosine similarity between the original sample and the adversarial sample is calculated, and the cosine similarity can be used to accurately screen out highly similar hidden gradient samples, namely the attack sample set. Focusing on a specific local sample set can reduce the number of samples that need to be processed and modified, improve the attack efficiency in terms of resources and time, and more effectively deceive the machine learning model without being detected, thereby improving the concealment of the attack.

[0126] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's description and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A counterattack method based on hidden gradient samples, characterized in that: Includes steps: Obtaining a time series anomaly classification model and determining an original sample of the time series anomaly classification model; Generate an adversarial sample based on the adversarial sample generation model and the original sample, and calculate the training loss between the original sample and the adversarial sample according to the loss function of the adversarial sample generation model as a model gradient; According to the model gradient, a preset proportion of original samples with the largest model gradient are selected as hidden gradient samples to obtain a hidden gradient sample set, and the similarity between the original samples and the adversarial samples is calculated; According to the similarity, hidden gradient samples with similarity higher than a preset value are selected from the hidden gradient sample set to form an attack sample set, and the attack sample set is used to perform an adversarial attack on the time series anomaly classification model.

2. The method for countering an attack based on a hidden gradient sample according to claim 1, characterized in that: Before obtaining the time series anomaly classification model, the method further includes: Acquire a time series data set, and preprocess the time series data set to obtain a preprocessed time series data set; Build a two-layer convolutional network and use the convolutional layer to superimpose activation functions to obtain a convolutional module; Generate an initial time series anomaly classification model according to the double-layer convolutional network, the two convolutional modules and the linear layer; The preprocessed time series data set is used to train the initial time series anomaly classification model to obtain a trained time series anomaly classification model.

3. The method for countering an attack based on a hidden gradient sample according to claim 2, characterized in that: The using the preprocessed time series data set to train the initial time series anomaly classification model to obtain the trained time series anomaly classification model comprises: Determining that the update target of the initial time series anomaly classification model is to minimize the mean square error between the output sequence and the input sequence; Initialize weights and biases, and iteratively update the weights and biases based on the preprocessed time series data set using the Adam optimization algorithm according to the update target, so that after the loss function reaches a minimum value, a trained time series anomaly classification model is obtained.

4. The method for countering an attack based on a hidden gradient sample according to claim 1, characterized in that: The generating the adversarial sample based on the adversarial sample generation model and the original sample comprises: Determine the true label corresponding to the original sample; Input the original sample and the true label into the adversarial sample generation model for forward propagation, output a predicted value, and calculate a loss function based on the predicted value and the true label; Performing gradient back propagation on the original sample in the adversarial sample generation model to calculate the gradient of the loss function relative to the original sample; Generating an adversarial perturbation based on the gradient of the loss function with respect to the original sample; Adding the adversarial perturbation to the original sample to obtain an initial adversarial sample; The initial adversarial sample is iteratively optimized according to a preset number of iterations and a preset maximum disturbance amount to obtain an adversarial sample.

5. The method for countering attack based on hidden gradient samples according to claim 4, characterized in that: The generating the adversarial perturbation based on the gradient of the loss function relative to the original sample comprises: Where η represents the adversarial disturbance, ∈ represents the control parameter of the disturbance intensity, sign() represents the function used to extract the sign of the gradient, represents the gradient of the loss function relative to the original sample, represents the loss function, θ represents the model parameters of the time series anomaly classification model, x represents the original sample, and y represents the true label.

6. The method for countering attack based on hidden gradient samples according to claim 4, characterized in that: The iterative optimization of the initial adversarial sample according to a preset number of iterations and a preset maximum disturbance amount to obtain the adversarial sample includes: x″=min{x+ε,max(x-ε,x′)}; In the formula, x″ represents the adversarial sample, x represents the original sample, ε represents the preset maximum perturbation amount, and x′ represents the initial adversarial sample.

7. The method for countering attack based on hidden gradient samples according to claim 1, characterized in that: The step of selecting a preset proportion of original samples with the largest model gradient as hidden gradient samples according to the model gradient to obtain a hidden gradient sample set includes: Sorting the model gradients in descending order to obtain sorted model gradients; The original samples corresponding to the model gradients of a preset proportion are selected from the sorted model gradients as hidden gradient samples to obtain a hidden gradient sample set.

8. The method for countering attack based on hidden gradient samples according to claim 1, characterized in that: The calculating the similarity between the original sample and the adversarial sample comprises: Calculate the cosine similarity between the original sample and the adversarial sample.

9. The method for countering attack based on hidden gradient samples according to claim 8, characterized in that: The calculating the cosine similarity between the original sample and the adversarial sample comprises: In the formula, x″ represents the adversarial sample, and x represents the original sample.

10. A terminal for countering attacks based on hidden gradient samples, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, each step of the counterattack method based on hidden gradient samples according to any one of claims 1 to 9 is implemented.

Images