Confrontation sample defense method based on contrast learning optimization denoising auto-encoder, electronic equipment and storage medium

Abstract

The invention discloses an adversarial sample defense method based on a contrast learning optimization denoising auto-encoder, electronic equipment and a storage medium, and belongs to the technical field of intrusion detection. In order to solve the problem of effective confrontation sample defense, the method comprises the following steps: collecting data from training to construct a training data set; a TripletLoss loss function is used to train a comparative learning model, and a comparative learning model encoder is output; and optimizing a denoising auto-encoder by using the obtained contrast learning model encoder to obtain an optimized denoising auto-encoder and an optimized decoder, and firstly inputting a sample input into the deep learning model into the optimized denoising auto-encoder and the optimized decoder for recoding and decoding operation to realize sample defense. The method is applied to an intrusion detection system and is deployed between a common flow feature extraction module and a deep learning model classification module in the intrusion detection system, and adversarial sample defense is realized through training of a preposed task contrast learning model and training of a downstream task denoising auto-encoder model.

Description

Technical Field

[0001] The present invention belongs to the technical field of intrusion detection, and in particular relates to an adversarial sample defense method, an electronic device and a storage medium based on contrastive learning optimization of a denoising autoencoder. Background Art

[0002] Intrusion Detection System (IDS) is a security technology used to monitor and identify potential intrusion behaviors in computer networks or systems. It monitors and analyzes network traffic, logs and other related data to identify and respond to possible security threats to protect the security of computer networks and systems. The current mainstream intrusion detection algorithm is based on deep learning models, but with the progress of research in the field of adversarial machine learning, researchers have found that deep learning models have attack surfaces. Attackers can construct adversarial samples with tiny, carefully designed adversarial perturbations to cause deep learning models to misclassify. Existing intrusion detection systems often do not consider the existence of adversarial attacks in their design and implementation. This results in the deep learning models in the intrusion detection system being very vulnerable to attacks and causing a large number of missed reports and false positives when facing new adversarial attacks. Summary of the invention

[0003] The problem to be solved by the present invention is the problem of effective adversarial sample defense, and an adversarial sample defense method, electronic device and storage medium based on contrastive learning optimization denoising autoencoder are proposed.

[0004] To achieve the above object, the present invention is implemented through the following technical solutions:

[0005] A method for defending against adversarial samples based on contrastive learning to optimize denoising autoencoders comprises the following steps:

[0006] S1. Collect data from training data and construct a training data set;

[0007] S2. Using the training data set constructed in step S1 as input, the contrastive learning model is trained using the TripletLoss loss function, and the contrastive learning model encoder is output;

[0008] S3. Use the contrastive learning model encoder obtained in step S2 to optimize the denoising autoencoder to obtain the optimized denoising autoencoder and decoder. The samples input into the deep learning model are first input into the optimized denoising autoencoder and decoder for re-encoding and decoding operations to remove the adversarial interference in the samples, thereby achieving adversarial sample defense.

[0009] Furthermore, the training data set constructed in step S1 is {N0, N1…Ni …N n-1}, where N i is the training sample with the training sample number i.

[0010] Furthermore, in step S1, the training data is a public traffic dataset or a network traffic dataset collected independently, and the constructed training dataset is {N0, N1…N i …N n-1}, where N i is the training sample with the training sample number i.

[0011] Furthermore, the public traffic dataset in step S1 is the CICIDS2017 network traffic dataset, and the original dataset exists in the form of pcap files.

[0012] Furthermore, the specific implementation method of step S2 includes the following steps:

[0013] S2.1. Initialize the contrastive learning model encoder F, set the training round epoch to 0 initially, and set the training sample number i to 0 initially;

[0014] S2.2. Judge the training round, set M as the upper limit of the training times. If epoch < M, set the total loss sum-loss to 0, increment the training sample number i by 1, and then execute step S2.3; otherwise, execute step S2.10;

[0015] S2.3. Judge the training sample number, set n as the total number of training samples. If i ≤ n, take out N n-1 from the training dataset {N0, N1……N i} as the anchor sample, and then execute step S2.4; if i > n, execute step S2.10;

[0016] S2.4. Add Gaussian noise to the anchor sample obtained in step S2.3 to generate a positive sample Add adversarial noise to the anchor sample to generate a negative sample Then execute step S2.5;

[0017] S2.5. Input the anchor sample, positive sample, and negative sample into the contrastive learning model encoder F to obtain the feature vector h corresponding to the anchor sample anchor , the feature vector h corresponding to the positive sample pos and the feature vector h corresponding to the negative sample neg ;

[0018] S2.6. Calculate the distances d(a, p) between the anchor samples and the positive samples and d(a, n) between the anchor samples and the negative samples on the feature space obtained in step S2.5 respectively, where a represents the feature corresponding to the anchor sample, p represents the feature corresponding to the positive sample, and n represents the feature corresponding to the negative sample;

[0019] S2.7. Calculate the TripletLoss loss L, and the calculation formula is:

[0020] L = max(d(a, p) - d(a, n) + margin, 0)

[0021] where margin is a hyperparameter;

[0022] S2.8. Accumulate the TripletLoss loss into the total loss sum-loss;

[0023] S2.9. Calculate the average loss avg-loss using sum-loss, update the contrastive learning encoder F using avg-loss, epoch = epoch + 1, and then execute step S2.2;

[0024] S2.10. Output the contrastive learning model encoder F.

[0025] Furthermore, the specific implementation method of step S3 includes the following steps:

[0026] S3.1. Input the denoising autoencoder Encoder', decoder Decoder', and the encoder F obtained by contrastive learning, set the initial training epoch = 0, and the number of training samples i = 0;

[0027] S3.2. Judge the training epoch. If epoch < M, set the total loss sum-loss to 0, increment i by 1, and execute step S3.3; otherwise, execute step S3.9;

[0028] S3.3. Judge the number of training samples. If i < n, take out the original sample x from the training set; otherwise, execute step S3.9;

[0029] S3.4. Add adversarial noise to the x taken out in step S3.3 to obtain the adversarial vector x';

[0030] S3.5. Input the adversarial vector x' into the denoising autoencoder, and obtain the reconstructed vector x” through Encoder' and Decoder';

[0031] S3.6. Input the reconstructed vector x” into the encoder F obtained by contrastive learning to obtain the contrastive reconstructed vector x”';

[0032] S3.7. Input the original sample x into the encoder F obtained by contrastive learning, obtain F(x) and calculate the reconstruction loss Loss with x”’, the expression is:

[0033] Loss = |F(x)-x'||2

[0034] Here, || ||2 represents the bi-norm of the vector;

[0035] S3.8. Add Loss to the total loss sum-loss, use sum-loss to calculate the average loss avg-loss, use avg-loss to update the denoising autoencoder Encoder' and decoder Decoder', then set epoch = epoch + 1, and execute step S3.2;

[0036] S3.9. Output denoising autoencoder Encoder' and decoder Decoder'.

[0037] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the adversarial sample defense method based on contrastive learning optimized denoising autoencoder are implemented.

[0038] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements an adversarial sample defense method based on contrastive learning optimized denoising autoencoder.

[0039] Beneficial effects of the present invention:

[0040] The adversarial sample defense method based on contrastive learning optimized denoising autoencoder described in the present invention is divided into two steps based on the adversarial defense algorithm of contrastive learning optimized denoising autoencoder. First, an encoder is obtained by training using a contrastive learning model, and the encoder can map the input to a new feature space. In the new feature space, the normal samples are close, but the distance between the normal samples and the adversarial samples is far; secondly, the denoising autoencoder is used to remove the noise that may be contained in the input sample. At this stage, the autoencoder obtained by contrastive learning training is used in the process of measuring the effect of the denoising autoencoder. The encoder can better guide the denoising autoencoder to remove adversarial noise in the new mapping space. This method can eliminate the influence of adversarial samples that may exist in the input sample, thereby achieving adversarial defense.

[0041] The adversarial sample defense method based on contrastive learning to optimize the denoising autoencoder described in the present invention obtains a new mapping encoder F through training in the contrastive learning stage of the preceding task, and uses the F obtained in the preceding task to optimize the training of the denoising autoencoder model in the downstream task, and finally realizes adversarial sample defense, thereby effectively counteracting the sample defense problem and improving the robustness of the intrusion detection system in the face of new adversarial attacks.

[0042] The adversarial sample defense method based on contrastive learning optimization of denoising autoencoder described in the present invention is applied to an intrusion detection system and deployed between a common traffic feature extraction module and a deep learning model classification module in the intrusion detection system. Adversarial sample defense is achieved through the training of a preceding task contrastive learning model and a downstream task denoising autoencoder model. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a schematic diagram of a usage scenario of the present invention;

[0044] Figure 2 This is a diagram of the comparative learning model architecture;

[0045] Figure 3 This is the architecture diagram of the contrastive learning model based on TripletLoss;

[0046] Figure 4 Schematic diagram of denoising autoencoder after contrastive learning optimization;

[0047] Figure 5 This is a flow chart of the denoising autoencoder training algorithm optimized based on contrastive learning in the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the specific embodiments described are only part of the embodiments of the present invention, rather than all of the specific embodiments. The components of the specific embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations, and the present invention can also have other embodiments.

[0049] Therefore, the following detailed description of the specific embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected specific embodiments of the present invention. Based on the specific embodiments of the present invention, all other specific embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0050] To further understand the content, features and effects of the present invention, the following specific embodiments are exemplified and are accompanied by the attached Figure 1 - Attachment Figure 5 The details are as follows:

[0051] Example 1:

[0052] An adversarial sample defense method based on contrastive learning to optimize the denoising autoencoder, comprising the following steps:

[0053] S1. Collect data from the training data to construct a training data set;

[0054] Furthermore, in step S1, the training data is a public traffic data set or a self - collected network traffic data set, and the constructed training data set is {N0, N1…N i …N n-1}, where N i is a training sample with the training sample number being i.

[0055] Furthermore, in step S1, the public traffic data set is the CICIDS2017 network traffic data set, and the original data set exists in the form of pcap files.

[0056] S2. Use the training data set constructed in step S1 as the input, and use the TripletLoss loss function to train the contrastive learning model, and output the encoder of the contrastive learning model;

[0057] Furthermore, the specific implementation method of step S2 includes the following steps:

[0058] S2.1. Initialize the encoder F of the contrastive learning model, set the training round epoch to 0 initially, and set the training sample number i to 0 initially;

[0059] S2.2. Judge the training round, set M as the upper limit of the training times. If epoch < M, set the total loss sum - loss to 0, increment the training sample number i by 1, and then execute step S2.3; otherwise, execute step S2.10;

[0060] S2.3. Judge the training sample number, set n as the total number of training samples. If i ≤ n, take out N n-1 from the training data set {N0, N1……N i} as the anchor sample, and then execute step S2.4; if i > n, execute step S2.10;

[0061] S2.4. Add Gaussian noise to the anchor sample obtained in step S2.3 to generate a positive sample Add adversarial noise to the anchor sample to generate a negative sample Then execute step S2.5;

[0062] S2.5. Input the anchor point sample, positive sample, and negative sample into the contrast learning model encoder F to obtain the feature vector h corresponding to the anchor point sample anchor , the positive sample corresponds to the feature vector h pos And the corresponding feature vector h of the negative sample neg ;

[0063] S2.6. Calculate the distance d(a, p) between the anchor sample and the positive sample and the distance d(a, n) between the anchor sample and the negative sample in the feature space obtained in step S2.5, where a represents the feature corresponding to the anchor sample, p represents the feature corresponding to the positive sample, and n represents the feature corresponding to the negative sample;

[0064] S2.7. Calculate the TripletLoss loss L, the calculation formula is:

[0065] L=max(d(a,p)-d(a,n)+margin,0)

[0066] Among them, margin is a hyperparameter;

[0067] S2.8. Add TripletLoss loss to the total loss sum-loss;

[0068] S2.9. Use sum-loss to calculate the average loss avg-loss, use avg-loss to update the contrastive learning encoder F, epoch = epoch + 1, and then execute step S2.2;

[0069] S2.10. Output contrastive learning model encoder F.

[0070] Furthermore, contrastive learning is a discriminative self-supervised learning model that does not require self-supervision to generate samples like generative models such as GAN network models. Contrastive learning assumes that in the embedding space learned by the learning model, similar instances should be closer, while dissimilar instances should be farther away. By treating learning as a discriminative task, contrastive learning allows the model to capture relevant features and similarities in the data. Contrastive models usually include three parts of research: pre-task, model architecture, and loss function. The pre-task is responsible for self-supervising the generation of positive and negative samples corresponding to the anchor point (anchor refers to the training sample selected for generating self-supervised data); the model architecture specifies the structure of contrastive learning training and describes how the deep learning model uses positive and negative samples in contrastive learning training; the loss function plays an important role. Using a reasonable loss function can make contrastive learning achieve closer distances for similar samples and farther distances for dissimilar samples during training.

[0071] S3. Optimize the denoising autoencoder using the contrastive learning model encoder obtained in step S2 to obtain the optimized denoising autoencoder and decoder. The samples input to the deep learning model are first input into the optimized denoising autoencoder and decoder for re-encoding and decoding operations to remove the adversarial interference existing in the samples, thereby achieving adversarial sample defense.

[0072] Further, the specific implementation method of step S3 includes the following steps:

[0073] S3.1. Input the denoising autoencoder Encoder', decoder Decoder', and the encoder F obtained by contrastive learning. Set the initial number of training epochs epoch = 0 and the number of training samples i = 0.

[0074] S3.2. Judge the number of training epochs. If epoch < M, set the total loss sum-loss to 0, increment i by 1, and execute step S3.3; otherwise, execute step S3.9.

[0075] S3.3. Judge the number of training samples. If i < n, take the original sample x from the training set; otherwise, execute step S3.9.

[0076] S3.4. Add adversarial noise to the x taken in step S3.3 to obtain the adversarial vector x'.

[0077] S3.5. Input the adversarial vector x' into the denoising autoencoder, and obtain the reconstructed vector x” through Encoder' and Decoder'.

[0078] S3.6. Input the reconstructed vector x” into the encoder F obtained by contrastive learning to obtain the contrastive reconstructed vector x”'.

[0079] S3.7. Input the original sample x into the encoder F obtained by contrastive learning, obtain F(x), and calculate the reconstruction loss Loss with x”', and the expression is:

[0080] Loss = ||F(x) - x”'||2

[0081] where || ||2 here represents the two-norm of the vector.

[0082] S3.8. Accumulate Loss into the total loss sum-loss, calculate the average loss avg-loss using sum-loss, update the denoising autoencoder Encoder' and decoder Decoder' using avg-loss, then set epoch = epoch + 1, and execute step S3.2.

[0083] S3.9. Output denoising autoencoder Encoder' and decoder Decoder'.

[0084] Furthermore, the Denoising Autoencoder (DAE) is an unsupervised learning algorithm for denoising and feature extraction of data. It is a variant of the autoencoder, which achieves the function of removing noise and restoring data by introducing noise into the input data and trying to restore the original data. The structure of the denoising autoencoder is similar to that of the autoencoder, consisting of an encoder and a decoder. Encoder: The encoder maps the input data to a representation in the latent space. Unlike ordinary autoencoders, after introducing noise into the input data, the encoder is still responsible for mapping the noisy data to the latent representation. Decoder: The decoder maps the latent representation output by the encoder back to the original input space and tries to restore the original data. The goal of the decoder is to minimize the interference of noise and restore a result similar to the original data.

[0085] This implementation method designs an adversarial sample defense algorithm based on contrastive learning to optimize the denoising autoencoder. In response to the above problems, TripletLoss is used to design a contrastive learning architecture, and the feature encoder obtained by contrastive learning training is output to the downstream task denoising autoencoder. After training, the denoising autoencoder is applied to adversarial sample defense. The contrastive learning algorithm improves the similarity between the anchor sample and the positive sample in the new mapping space, and increases the distance between the anchor sample and the negative sample, thereby promoting the denoising autoencoder in the downstream task to distinguish the adversarial noise, effectively solving the problem of removing tiny adversarial noise, and improving the defense effect of adversarial samples in the intrusion detection system scenario.

[0086] This embodiment integrates the contrastive learning framework and the denoising encoder model, and proposes a denoising autoencoder model optimized by contrastive learning, which effectively solves the problem of adversarial sample defense in the intrusion detection system. Considering that adversarial samples are caused by tiny, imperceptible adversarial noise, this embodiment first uses contrastive learning training to obtain a feature encoder, so that the distance between normal samples is smaller and the distance between normal samples and adversarial samples is larger in the new feature space after mapping. Then, in the training process of the denoising autoencoder model, the feature encoder obtained by contrastive learning training is used to accelerate the convergence speed of the model, and better learn the deep learning network mapping that can eliminate the influence of adversarial samples. Combined with the contrastive learning architecture and the denoising autoencoder model, this embodiment can remove the adversarial noise contained in the adversarial sample and realize adversarial sample defense in the intrusion detection system.

[0087] Embodiment 2:

[0088] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of an adversarial sample defense method based on contrastive learning optimized denoising autoencoder described in Example 1 are implemented.

[0089] The computer device of the present invention may be a device including a processor and a memory, such as a single chip microcomputer including a central processing unit. Furthermore, the processor is used to implement the steps of the above-mentioned adversarial sample defense method based on contrastive learning optimization denoising autoencoder when executing the computer program stored in the memory.

[0090] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0091] The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0092] Embodiment 3:

[0093] A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the adversarial sample defense method based on contrastive learning optimized denoising autoencoder described in Example 1 is implemented.

[0094] The computer-readable storage medium of the present invention can be any form of storage medium that can be read by a processor of a computer device, including but not limited to non-volatile memory, volatile memory, ferroelectric memory, etc. A computer program is stored on the computer-readable storage medium. When the processor of the computer device reads and executes the computer program stored in the memory, the steps of the above-mentioned adversarial sample defense method based on contrastive learning optimized denoising autoencoder can be implemented.

[0095] The computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer readable media do not include electric carrier signals and telecommunication signals.

[0096] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0097] Although the present application has been described above with reference to specific embodiments, various modifications may be made thereto and parts thereof may be replaced with equivalents without departing from the scope of the present application. In particular, as long as there is no structural conflict, the various features in the specific embodiments disclosed in the present application may be used in combination with each other in any manner, and the fact that these combinations are not exhaustively described in this specification is only for the sake of omitting space and saving resources. Therefore, the present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A method for defending against adversarial samples based on contrastive learning to optimize denoising autoencoders, characterized in that: It includes the following steps: S1. Collect data from the training data to construct a training data set; S2. Use the training data set constructed in step S1 as input, and train the contrastive learning model using the TripletLoss loss function to output the contrastive learning model encoder; S3. Use the contrastive learning model encoder obtained in step S2 to optimize the denoising autoencoder to obtain the optimized denoising autoencoder and decoder. The samples input to the deep learning model are first input into the optimized denoising autoencoder and decoder for re-encoding and decoding operations to remove the adversarial interference existing in the samples, thereby realizing adversarial sample defense.

2. According to claim 1, the adversarial sample defense method based on contrastive learning optimized denoising autoencoder is characterized in that: The training data in step S1 is a public traffic data set or a self-collected network traffic data set, and the constructed training data set is {N0, N1…N i …N n-1 }, where N i is the training sample with the number of training samples being i.

3. According to claim 2, the adversarial sample defense method based on contrastive learning optimization denoising autoencoder is characterized in that: The traffic data set disclosed in step S1 is the CICIDS2017 network traffic data set, and the original data set exists in the form of pcap files.

4. The adversarial sample defense method based on contrastive learning optimized denoising autoencoder according to claim 3 is characterized in that: The specific implementation method of step S2 includes the following steps: S2.

1. Initialize the contrastive learning model encoder F, set the training round epoch to 0 initially, and set the number of training samples i to 0 initially; S2.

2. Judge the training round, set M as the upper limit of the number of training times. If epoch < M, set the total loss sum-loss to 0, increment the number of training samples i by 1, and then execute step S2.3; otherwise, execute step S2.10; S2.

3. Determine the number of training samples, set n as the total number of training samples, if i≤n, then select the training data set {N0, N1...N n-1 } Take out N i as an anchor sample, and then execute step S2.

4. If i>n, execute step S2.10; S2.

4. Add Gaussian noise to the anchor point sample obtained in step S2.3 to generate positive samples Add adversarial noise to anchor samples to generate negative samples Then execute step S2.5; S2.

5. Input the anchor point sample, positive sample, and negative sample into the contrast learning model encoder F to obtain the feature vector h corresponding to the anchor point sample anchor , the positive sample corresponds to the feature vector h pos And the feature vector h corresponding to the negative sample neg ; S2.

6. Calculate the distances d(a, p) between the anchor sample and the positive sample and d(a, n) between the anchor sample and the negative sample on the feature space obtained in step S2.5 respectively. Here, a represents the feature corresponding to the anchor sample, p represents the feature corresponding to the positive sample, and n represents the feature corresponding to the negative sample; S2.

7. Calculate the TripletLoss loss L, and the calculation formula is: L = max(d(a, p) - d(a, n) + margin, 0) where margin is a hyperparameter; S2.

8. Accumulate the TripletLoss loss into the total loss sum-loss; S2.

9. Calculate the average loss avg-loss using sum-loss, update the contrastive learning encoder F using avg-loss, epoch = epoch + 1, and then execute step S2.2; S2.

10. Output the contrastive learning model encoder F.

5. The adversarial sample defense method based on contrastive learning optimized denoising autoencoder according to claim 4 is characterized in that: The specific implementation method of step S3 includes the following steps: S3.

1. Input the denoising autoencoder Encoder', decoder Decoder', and the encoder F obtained by contrastive learning, and set the initial training round epoch = 0 and the number of training samples i = 0; S3.

2. Judge the training round. If epoch < M, set the total loss sum-loss to 0, increment i by 1, and execute step S3.3; otherwise, execute step S3.9; S3.

3. Judge the number of training samples. If i < n, take out the original sample x from the training set; otherwise, execute step S3.9; S3.

4. Add adversarial noise to the x taken out in step S3.3 to obtain the adversarial vector x'; S3.

5. Input the adversarial vector x' into the denoising autoencoder, and obtain the reconstructed vector x” through Encoder' and Decoder'; S3.

6. Input the reconstructed vector x" into the encoder F obtained by contrastive learning to obtain a contrastive reconstructed vector x"'; S3.

7. Input the original sample x into the encoder F obtained by contrastive learning, obtain F(x) and calculate the reconstruction loss Loss with x”’, the expression is: Loss = ||F(x)-x'||2 Here, ||||2 represents the second norm of the vector; S3.

8. Add Loss to the total loss sum-loss, use sum-loss to calculate the average loss avg-loss, use avg-loss to update the denoising autoencoder Encoder' and decoder Decoder', then set epoch = epoch + 1, and execute step S3.2; S3.

9. Output denoising autoencoder Encoder' and decoder Decoder'.

6. An electronic device, characterized in that: It includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the steps of an adversarial sample defense method based on contrastive learning optimization denoising autoencoder as described in any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the adversarial sample defense method based on contrastive learning optimized denoising autoencoder according to any one of claims 1 to 5 is implemented.

Images