Defense method of confrontation sample under radio frequency fingerprint identification system

Abstract

The invention discloses a defense method for an adversarial sample in a radio frequency fingerprint identification system, and the method comprises the steps: carrying out the adversarial training in different signal representation domains, obtaining robust models in different signal representation domains, and carrying out the recognition of a transmitter, according to the method, confrontation training is carried out on the time domain radio frequency fingerprint identification model and the frequency domain radio frequency fingerprint identification model by taking traditional classification loss and robustness loss as targets in the training stage, the robust model obtained through training has defense capability on confrontation sample attacks, and the robustness of the robust model is improved. In the reasoning stage, a final recognition result is obtained by means of weighted average of different dimension features obtained in two different representation domains, and the defense capability of the system to the attack of the countermeasure sample is further improved.

Description

Technical Field

[0001] The present invention relates to the field of physical layer security technology, and in particular to a method for defending against adversarial samples in a radio frequency fingerprint recognition system. Background Art

[0002] Faced with the demand for lightweight security authentication of terminal devices in the IoT scenario, RF fingerprint recognition, as a key method in physical layer security, can meet this demand well. It aims to distinguish different transmitters through the unique hardware preparation difference characteristics of the transmitter. Unlike those labels that can be easily forged, such as user identification or MAC address, the preparation difference inside the transmitter is difficult to forge, and only requires the transmitter to transmit a wireless signal for identification, and does not require the terminal device to perform complex cryptographic operations to achieve authentication. However, in recent years, RF fingerprint recognition systems based on deep learning models are vulnerable to threats such as adversarial sample attacks, backdoor attacks, and poisoning attacks, which makes this type of deep learning-based RF fingerprint recognition system have major security risks. Summary of the invention

[0003] The technical problem to be solved by the present invention is that, in response to adversarial sample attacks existing in a radio frequency fingerprint recognition system based on a deep learning model, a defense method is used to enable the radio frequency fingerprint recognition model to, on the one hand, well identify normal samples, and on the other hand, maintain a high accuracy rate for adversarial samples with malicious disturbances, thereby ensuring the robustness of the radio frequency fingerprint recognition system.

[0004] The technical solution adopted by the present invention to solve the above technical problems is to obtain models under different representation domains through adversarial training, ensure the robustness of the trained models to adversarial disturbances, obtain the final classification result by integrating the model results under different representation domains, and ensure the robustness of the model to adversarial disturbances through different features extracted from models in different representation domains in the inference stage, including the following steps:

[0005] S1: Collect wireless transmitter samples to obtain a wireless transmitter IQ signal sample library;

[0006] S2: The RF fingerprint recognition system performs frequency domain transformation on the IQ signal sample library to obtain its corresponding frequency domain signal sample library; the time domain signal sample library and the frequency domain signal sample library are paired with the label to obtain the time domain data set D r and frequency domain dataset D R ;

[0007] S3: The dataset D r and D R The order of samples in the scrambled, and the first m items were divided into training sets and The last n items are divided into the test set and

[0008] S4: training set in time domain and frequency domain obtained through S3 and The corresponding time domain and frequency domain deep learning models are trained by adversarial training methods respectively, and the trained time domain robust deep learning model f is saved. θ and frequency domain robust deep learning models

[0009] S5: Test set and The corresponding adversarial sample test sets are obtained through the adversarial sample generation method. and Input them into the time-domain robust and frequency-domain robust deep learning models respectively, and obtain the classification probability distribution of the time-domain and frequency-domain adversarial sample data after the deep learning model;

[0010] S6: Adversarial sample dataset obtained through the test set and Perform transformations in the time domain and frequency domain respectively, input them into the deep learning model of the corresponding signal representation, and obtain the classification probability distribution of the adversarial sample data in the time domain and frequency domain after the frequency domain and time domain transformations;

[0011] S7: Integrate the classification probability distribution obtained from the original representation domain of the adversarial sample and the classification probability distribution after frequency domain or time domain transformation to obtain the final classification result.

[0012] The present invention makes full use of the advantages of adversarial training. Through the traditional classification loss and the robust loss of the model, a model that is relatively robust to both time domain and frequency domain data is obtained. It can not only obtain a high accuracy on the sample, but also maintain a high accuracy on the adversarial sample. In addition, with the help of the classification results obtained in different representation domains, the final classification result is obtained through ensemble learning, which can further improve the robustness of the radio frequency fingerprint recognition system to adversarial samples.

[0013] The beneficial effects of the present invention are:

[0014] (1) Through the adversarial training method, robust models are trained for time domain signal and frequency domain signal representation respectively, which improves the model's own defense ability against adversarial samples.

[0015] (2) By integrating the robust model results under different signal representations, the final classification result is obtained, which further improves the defense capability of the RF fingerprint recognition system against adversarial samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1Schematic diagram of how to add adversarial perturbations to the RF fingerprint recognition system.

[0017] Figure 2 Flowchart of the RF fingerprint recognition system obtaining a robust model through adversarial training.

[0018] Figure 3 Flow chart of the radio frequency fingerprint recognition system adding an adversarial disturbance signal to the object to be recognized. DETAILED DESCRIPTION

[0019] The technical solution of the present invention is further described in detail below, but the protection scope of the present invention is not limited to the following description.

[0020] like Figure 1 As shown, in the process of identifying the wireless transmitter signal of the radio frequency fingerprint recognition system, a malicious attacker can add disturbance to the digital signal after the original signal symbol is modulated, and then convert it into an analog signal through a digital-to-analog conversion module, and after up-conversion through the local oscillator, transmit the signal with interference to the wireless channel through a power amplifier and an antenna to interfere with the final recognition result. The attacker can add disturbance inside the transmitter, or transmit the disturbance signal through a jammer, or add disturbance inside the receiver to implement adversarial attacks on the radio frequency fingerprint recognition system; in response to the above adversarial sample attacks, the adversarial sample defense method of the radio frequency fingerprint recognition system provided in this embodiment specifically includes the following steps, and the accuracy of the radio frequency fingerprint recognition system for adversarial samples is maintained by adversarial training and integrated learning methods:

[0021] S1. Collect the kth sample of the wireless transmitter category i:

[0022]

[0023] Among them, χ r The wireless transmitter IQ signal sample library collected for the RF fingerprint recognition system, Represents the i-th time domain sample data collected by the j-th type of transmitter equipment, where i = 1, 2, ... P; j = 1, 2, ... K, where K is the number of wireless transmitters and P is the signal sample collected by each transmitter;

[0024] S2. The radio frequency fingerprint recognition system performs frequency domain transformation on the original IQ signal sample library to obtain its corresponding frequency domain signal sample library:

[0025]

[0026] Among them, X R Represents X r The frequency domain signal sample library of the corresponding wireless transmitter is obtained after frequency domain transformation, represents the i-th frequency domain sample data collected by the j-th type of transmitter equipment;

[0027] Pair the time domain signal sample library and the frequency domain signal sample library with the label y to obtain the time domain training dataset D r And frequency domain training dataset D R :

[0028] D r ={(r 1 ,y 1 ),…,(r 2 ,y 2 ),...,(r P*K ,y K )};

[0029] D R ={(R 1 ,y 1 ),...,(R 2 ,y 2 ),...,(R P*K ,y K )};

[0030] S3. Separate datasets D r and D R The order of samples in the training set is shuffled, and the first m items are divided into the training set and The last n items are divided into the test set and

[0031]

[0032] Where K*P=m+n, training set and The proportion of data set D is Test Set and The proportion of data set D is

[0033] S4. Training sets in time domain and frequency domain obtained through S3 and The corresponding time domain and frequency domain deep learning models are trained by adversarial training methods respectively, and the trained time domain robust deep learning model f is saved. θ and frequency domain robust deep learning models like Figure 2 As shown, it includes the following sub-steps:

[0034] S401. Obtain time domain samples r from the time domain training data set and the frequency domain training data set respectively. i and frequency domain samples Ri ;

[0035] S402. Setting the attack disturbance amplitude ε of adversarial training;

[0036] S403. Initialize the adversarial samples in the time domain and frequency domain in adversarial training:

[0037]

[0038] Where N(0,I) is a Gaussian distribution with mean 0 and variance the unit matrix I; δ is a parameter with a fixed value of 0.001 in practical applications.

[0039] S404. Update the perturbation direction of the adversarial sample through the model gradient information, so that the adversarial samples in the time domain and frequency domain are obtained and More aggressive:

[0040]

[0041] in is the loss function when generating adversarial sample attacks, The generated adversarial sample is projected to the range of the attack perturbation amplitude ε from the original sample, η1 is the distance of a single step when controlling the generation of adversarial samples, sign is the sign function, The loss function is used to find the adversarial sample The gradient of

[0042] S405. When t=1, 2, ...T, repeat step S404, where T is the number of repetitions of adversarial sample generation;

[0043] S406. Time domain and frequency domain adversarial samples obtained through S405 and When updating the gradient, traditional classification loss and robust loss are used to update the model parameters:

[0044]

[0045] Where η2 is the learning rate during training, m is the number of training samples, is the gradient of the loss function with respect to the trainable parameters θ, is the loss function over the trainable parameters The gradient of y i is the label of the i-th sample data, β is the hyperparameter that controls the robustness loss and the traditional classification loss, and controls the trade-off between accuracy and robustness in the final optimization goal; in the adversarial training process of the RF fingerprint recognition model, the trade-off between accuracy and model robustness can be controlled by a parameter, which can be flexibly applied to different application scenarios.

[0046] Where L(f θ (r i ),y i )and is the traditional cross entropy classification loss function, and It is a loss function used to measure the difference in distribution between adversarial samples and original samples. Here, KL divergence is used as its distribution difference loss function, which can ensure the robustness of the model against adversarial sample attacks. The model can not only classify well, but also defend against adversarial samples generated by attackers. The cross entropy classification loss function and the distribution difference loss function of KL divergence are defined as follows:

[0047]

[0048] Among them, C is the total number of categories, and c is the category label corresponding to the sample

[0049] S5. Test set and The corresponding adversarial sample test sets are obtained through the adversarial sample generation method. and Input into the time-domain robust and frequency-domain robust deep learning models respectively:

[0050]

[0051] Among them, r i adv represents the adversarial sample data after the time domain data in the test set is subjected to adversarial perturbation, which is obtained by the same method as steps S401-S405; i = m+1, m+2, …, m+n; the corresponding represents the adversarial sample data after the frequency domain data in the test set is adversarially perturbed, i = m+1, m+2,…, m+n; and Respectively represent the classification probability distribution of time domain and frequency domain adversarial sample data after deep learning model;

[0052] S6. Adversarial sample dataset obtained through the test set and Perform transformations in the time domain and frequency domain respectively, and input them into the deep learning model of the corresponding signal representation:

[0053]

[0054] Among them, DFT and IDFT represent the transformation of the frequency domain and time domain of the adversarial sample data respectively. and Respectively represent the classification probability distribution of time domain and frequency domain adversarial sample data after frequency domain and time domain transformation and input into the deep learning model;

[0055] S7. Through the adversarial training of the time domain and frequency domain models described above, the model is made robust to adversarial samples in the training phase. In the testing phase, the classification probability distribution obtained from the original representation domain of the adversarial sample and the classification probability distribution after frequency domain or time domain transformation are integrated to obtain the final classification result. The robust features extracted from different representation domains are integrated, so that the attacker cannot simply interfere with the RF fingerprint recognition system through the time domain model or the frequency domain model. Figure 3 As shown, this is the flow chart of RF fingerprint recognition when the original signal is represented in the time domain:

[0056]

[0057] in, represents the adversarial sample data r after the time domain data in the test set is adversarially perturbed i adv The final classification result is The adversarial sample data after the frequency domain data in the test set is adversarially perturbed The final classification result, argmax is the function of taking the index corresponding to the maximum value of the vector;

[0058] The simulation in steps S5-S7 is the adversarial signal in two representation domains. In the actual process, the signal to be identified depends on the signal representation form received by the RF fingerprint recognition system. By converting the representation domain of the signal to be identified, the results of the adversarial sample in different representation domains are obtained. By integrating the classification probabilities obtained by observing different features in different representation domains, the RF fingerprint recognition system can be defended against adversarial disturbances.

[0059] The above is a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art do not depart from the spirit and scope of the present invention, and should be within the scope of protection of the claims attached to the present invention.

Claims

1. A method for defending against adversarial samples in a radio frequency fingerprint recognition system, characterized in that: The following steps are involved: S1: Collect wireless transmitter samples to obtain a wireless transmitter IQ signal sample library; S2: The RF fingerprint recognition system performs frequency domain transformation on the IQ signal sample library to obtain its corresponding frequency domain signal sample library; the time domain signal sample library and the frequency domain signal sample library are paired with the label to obtain the time domain data set D r and frequency domain dataset D R ; S3: The dataset D r and D R The order of samples in the scrambled, and the first m items were divided into training sets and The last n items are divided into the test set and S4: training set in time domain and frequency domain obtained through S3 and The corresponding time domain and frequency domain deep learning models are trained by adversarial training methods respectively, and the trained time domain robust deep learning model f is saved. θ and frequency domain robust deep learning models S5: Test set and The corresponding adversarial sample test sets are obtained through the adversarial sample generation method. and Input them into the time-domain robust and frequency-domain robust deep learning models respectively, and obtain the classification probability distribution of the time-domain and frequency-domain adversarial sample data after the deep learning model; S6: Adversarial sample dataset obtained through the test set and Perform transformations in the time domain and frequency domain respectively, input them into the deep learning model of the corresponding signal representation, and obtain the classification probability distribution of the adversarial sample data in the time domain and frequency domain after the frequency domain and time domain transformations; S7: Integrate the classification probability distribution obtained from the original representation domain of the adversarial sample and the classification probability distribution after frequency domain or time domain transformation to obtain the final classification result.

2. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to claim 1, characterized in that: The wireless transmitter IQ signal sample library is formalized as follows: Among them, χ r The wireless transmitter IQ signal sample library collected for the RF fingerprint recognition system, Represents the i-th time domain sample data collected by the j-th type of transmitter equipment, where i = 1, 2, ... P; j = 1, 2, ... K, where K is the number of wireless transmitters and P is the signal sample collected by each transmitter; The frequency domain signal sample library is formalized as follows: Among them, χ R Represents χ r The frequency domain signal sample library of the corresponding wireless transmitter is obtained after frequency domain transformation, Represents the i-th frequency domain sample data collected by the j-th type of transmitter equipment.

3. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to claim 2, characterized in that: The step S4 specifically includes the following sub-steps: S401: Obtain time domain samples r from the time domain training data set and the frequency domain training data set respectively i and frequency domain samples R i ; S402: Setting the attack disturbance amplitude ε of adversarial training; S403: Initialize time domain adversarial samples in adversarial training and frequency domain adversarial examples Where N(0,I) is a Gaussian distribution with mean 0 and variance as the unit matrix I; δ is a parameter; S404: Update the perturbation direction of the adversarial sample through model gradient information: Where L(·) is the loss function when generating adversarial sample attacks, The generated adversarial sample is projected to the range of the attack perturbation amplitude ε from the original sample, η1 is the distance of a single step when controlling the generation of adversarial samples, sign is the sign function, The loss function is used to find the adversarial sample The gradient of S405: When t=1, 2, ...T, repeat step S404, where T is the number of repetitions of adversarial sample generation; S406: Time domain and frequency domain adversarial samples obtained through S405 and When updating the gradient, traditional classification loss and robust loss are used to update the model parameters.

4. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to claim 3, characterized in that: The step S5 is formalized as follows: in, represents the adversarial sample data after the time domain data in the test set is adversarially perturbed, corresponding to represents the adversarial sample data after the frequency domain data in the test set is adversarially perturbed, i = m+1, m+2,…, m+n; and They respectively represent the classification probability distribution of time domain and frequency domain adversarial sample data after deep learning model.

5. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to claim 4, characterized in that: The step S6 is formalized as follows: Among them, DFT and IDFT represent the transformation of the frequency domain and time domain of the adversarial sample data respectively. and They respectively represent the classification probability distribution of the time domain and frequency domain adversarial sample data after being transformed in the frequency domain and time domain and passed through the deep learning model.

6. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to claim 5, characterized in that: The step S7 is formalized as follows: in, Represents the adversarial sample data after the time domain data in the test set has been adversarially perturbed The final classification result is The adversarial sample data after the frequency domain data in the test set is adversarially perturbed The final classification result, argmax is the function that takes the index corresponding to the maximum value of the vector.

7. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to claim 6, characterized in that: The parameters of the model updated using traditional classification loss and robust loss are formalized as follows: Where η2 is the learning rate during training, m is the number of training samples, is the gradient of the loss function with respect to the trainable parameters θ, is the loss function over the trainable parameters The gradient of y i is the label of the i-th sample data, β is a hyperparameter; L(f θ (r i ),y i )and is the traditional cross entropy classification loss function, and It is a loss function used to measure the difference between the distribution of adversarial samples and original samples.

8. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to claim 6, characterized in that: The cross entropy classification loss function is expressed as follows: The loss function used to measure the distribution difference between the adversarial sample and the original sample is specifically a distribution difference loss function of KL divergence, which is expressed as follows: Among them, C is the total number of categories, and c is the category label corresponding to the sample.

9. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to any one of claims 1 to 8, characterized in that: In the actual application of the method, the signal to be identified depends on the representation form of the signal received by the radio frequency fingerprint identification system.

10. The method for defending against adversarial samples in a radio frequency fingerprint recognition system according to any one of claim 9, characterized in that: δ is a fixed value of 0.001.

Images