Black box attack detection method, device and system based on multi-feature fusion

Abstract

The invention provides a multi-feature fusion-based black box attack detection method (MFBA), device and system, different features are extracted by using a multi-model fusion strategy, the effectiveness and quality of opposite samples are improved, and the MFBA comprises the following three key steps: firstly, obtaining an initial data set from a target model; a decision boundary is approached by using a multi-feature fusion model; secondly, the stability of the model is enhanced through multiple rounds of training application data expansion and incremental learning technologies; and finally, generating opposite examples by using the optimized fusion model. By constructing the comprehensive attack framework, how to combine various model features to improve the performance against the resistance attack is demonstrated; compared with a single substitution model, the antagonism examples generated by the MFBA have higher mobility under different disturbance levels and have better attack effects; according to the method, an effective solution is provided for black box antagonism attacks, and the model in the generation of the advantage opposite paradigm of multi-feature fusion is verified.

Description

Technical Field

[0001] The present invention relates to a black box attack detection method, device and system based on multi-feature fusion, belonging to the technical field of automatic signal modulation classification. Background Art

[0002] With the application of Internet of Things (IoT) in all aspects of life, the security of its communication has also attracted attention from all walks of life. Automatic modulation classification (AMC) plays an important role in the communication security, spectrum management, robustness and defense against counterattacks of IoT systems. It is one of the key technologies to ensure the safe and reliable operation of IoT devices.

[0003] In recent years, with the successful application of deep learning in fields such as computer vision, experts and scholars have introduced it into AMC. Compared with traditional methods, AMC based on deep learning can automatically extract complex signal features and significantly reduce computational complexity, so it has become one of the main research directions in the field of modulated signal recognition. The basic idea of ​​adversarial sample attack is to introduce tiny perturbations into the input samples so that they cross the decision boundary and are misclassified by the classifier, revealing the vulnerability of machine learning models when facing adversarial samples.

[0004] However, as research deepens, people have discovered that deep learning networks are extremely vulnerable to attacks, which can cause changes in classification or prediction results. Therefore, adversarial attacks, as an important research field, have received widespread attention. Adversarial attacks can not only be applied to electronic warfare, but can also enhance defense effectiveness by improving the robustness of the model. At the same time, research on adversarial attacks plays a key role in improving network security.

[0005] In real-world scenarios, deep learning models usually provide prediction services. Only data needs to be input, and the model directly gives the prediction results without showing the prediction process and model structure. In this case, white-box attacks are basically ineffective because white-box attacks require understanding the detailed structure and parameters of the attacked model. In order to achieve the purpose of attacking the prediction model, black-box attacks can be used, but most black-box attacks require a large number of queries to the prediction model to move the adversarial samples to the decision boundary. This large number of query behaviors will usually alert the prediction model. Transfer attack is an ideal attack method, that is, to generate adversarial samples by replacing the model, and then use the transferability of the adversarial samples to attack the prediction model. This method only requires a small number of queries to complete, but it requires a high accuracy of the replacement model. If the replacement model is not accurate enough, the generated adversarial samples usually cannot achieve the ideal effect. In response to the above problems, this paper proposes a more accurate replacement model and its training method based on the transfer attack.

[0006] Traditional AMC algorithms are divided into likelihood-based (LB) methods and feature-based (FB) methods. Likelihood-based methods require some prior information and have high computational complexity, which makes them difficult to apply in reality. Feature-based methods require setting features based on manual experience and are easily affected by channel noise, resulting in poor performance.

[0007] In recent years, O'Shea et al. introduced convolutional neural networks into AMC and used deep residual networks to classify modulated signals, achieving good results under high signal-to-noise ratio. M. Liu et al. proposed a signal classification method based on feature fusion, which achieved efficient signal classification and privacy protection through federated learning and improved evidence theory. In order to better extract temporal features, O'Shea et al. combined LSTM with CNN and proposed the CLDNN network. Considering that temporal features also play a key role in the recognition of modulated signals, S. Huang et al. combined the gated recurrent unit (GRU) with the deep residual network (ResNet) and proposed the GrrNet ​​network, which achieved good results. P. Qi et al. proposed a heterogeneous federated learning framework (FedBKD) based on bidirectional knowledge distillation for IoT systems. Experimental results show that this method performs well in modulation classification tasks. At present, AMC based on deep learning has tended to be multimodal, that is, by combining multiple features, high-accuracy modulation recognition can be achieved.

[0008] In terms of adversarial attacks, adversarial attacks are divided into white-box attacks and black-box attacks. White-box attacks are more effective because they understand the characteristics of the signal and the structure of the model. White-box attacks include generating adversarial samples, model poisoning attacks, gradient leakage, etc., among which generating adversarial samples is one of the most commonly used attack methods. For example, Carlini, N. et al. proposed an optimization attack to generate adversarial samples by optimizing the objective function. Moosavi-Dezfooli et al. proposed a decision boundary-based attack DeepFool, which gradually approaches the decision boundary and finds the minimum perturbation amount to make the input data cross the decision boundary, thereby generating adversarial samples. Goodfellow et al. proposed a gradient-based attack that uses the gradient information of the loss function to generate adversarial samples and deceives the model by adding small perturbations along the gradient direction to the input data. Gradient-based attack methods have been widely expanded. Y. Dong et al. introduced momentum into gradient attacks to improve the transferability of generated adversarial samples.

[0009] Although white-box attacks are efficient, they are difficult to implement in the physical world, so black-box attacks are more realistic. Black-box attacks usually require querying the target model to obtain the information required by the attacker. Query-based methods require a large number of visits to the target model to optimize the generated adversarial samples by estimating the actual gradient. In order to solve the problem of requiring a large number of queries, Dong, Y. et al. proposed two prior-guided random gradient-free (PRGF) algorithms based on biased sampling and gradient averaging, which achieved a higher success rate of attacking black-box models while reducing the number of queries. Y. Shi et al. proposed a black-box adversarial attack method called Customized Iteration and Sampling Attack (CISA), which successfully attacked image classifiers based on deep neural networks while improving query efficiency. Despite some improved methods, a large number of queries is still an unavoidable problem; the limited accuracy of existing substitute models and training methods urgently need to develop a multi-feature extraction substitute model and a new substitute model training method to improve the success rate of attacks. Summary of the invention

[0010] The purpose of the present invention is to provide a black box attack detection method, device and system based on multi-feature fusion, which can more accurately fit the decision boundary of the target model by fusing the features of multiple alternative models, and use data enhancement and incremental learning techniques to achieve efficient attack with a limited number of queries.

[0011] In order to achieve the above objectives / solve the above technical problems, the present invention is implemented by adopting the following technical solutions.

[0012] In a first aspect, the present invention provides a black box attack detection method based on multi-feature fusion, comprising:

[0013] Input the unlabeled initial data set into the target model to be attacked to obtain the corresponding labeled initial data set;

[0014] Create a multi-feature fusion model, and use the labeled initial data set to cyclically train the multi-feature fusion model through a combination of incremental learning and Jacobian matrix data enhancement until the cross entropy loss function converges;

[0015] Generate adversarial samples based on the trained multi-feature fusion model combined with the adversarial sample generation algorithm;

[0016] Among them, creating a multi-feature fusion model includes:

[0017] The decision layers of two alternative models with similar complexity or similar learning ability are concatenated and fused. After concatenation and fusion, a fully connected layer and a Dropout layer are sequentially connected to form a complete multi-feature fusion model:

[0018] ,

[0019] ,

[0020] ,

[0021] in, Perform splicing and fusion operations on the decision layers of the two replacement models. is the output vector after concatenation and fusion, is the output vector of the first replacement model, is the output vector of the second replacement model, is the output vector of the fully connected layer, is the fully connected layer, is the Dropout regularization operation, is the final classification output layer, It is the prediction result of the multi-feature fusion model.

[0022] The two replacement models have similar complexity or similar learning ability. The replacement models are similar in network structure, the number of convolutional layers is close, and the number of model parameters is in the same order of magnitude. In addition, since the complexity of the models should be equivalent, it can ensure that they perform consistently when the decision layer is fused, avoiding the performance of the fusion model affected by excessive structural differences.

[0023] Furthermore, the step of inputting the unlabeled initial data set into the target model to be attacked to obtain the corresponding labeled data set includes:

[0024] Input an unlabeled initial data set to the target model, obtain the prediction results output by the target model, and combine the prediction results with the initial data set to form a new labeled initial data set;

[0025] The specific expression of the labeled initial data is:

[0026] ,

[0027] in: is the initial labeled dataset, is the data in the unlabeled initial dataset, for Input target model The corresponding prediction results are output later.

[0028] Furthermore, the multi-feature fusion model is cyclically trained by combining incremental learning and Jacobian matrix data enhancement with the labeled initial data set until the cross entropy loss function converges, including:

[0029] Inputting the labeled initial data set as the initial training sample into the multi-feature fusion model to perform model training, including: training the weight parameters of the multi-feature fusion model, with the goal of minimizing the cross entropy loss function between the model output and the label, performing gradient descent through the optimizer, and updating the weight parameters of the multi-feature fusion model;

[0030] After model training, the initial training samples are augmented with Jacobian matrix data to generate new training samples. After the new training samples are input into the target model to obtain labels, the multi-feature fusion model is input into the incremental learning method for iterative training until the cross entropy loss function converges to obtain a trained multi-feature fusion model.

[0031] The incremental learning is: when the current model is trained, the weight parameters of the previous training need to be loaded.

[0032] Furthermore, new training samples are generated through Jacobian matrix data augmentation, including:

[0033] S ρ + 1 ← { x ρ + λ ⋅ sign ( J M F [ y ̂ ( x ρ ) ] ) : x ρ ∈ S ρ } ∪ S ρ ;

[0034] in: For the The training samples after rounds of data augmentation, for The sample data in is the learning rate, is the symbolic function, J M F [] is the Jacobian matrix, Take the training sample The prediction results of the multi-feature fusion model when .

[0035] Furthermore, the method of generating adversarial samples of the target model by combining the trained multiple feature fusion models with the adversarial sample generation algorithm includes:

[0036] , ,

[0037] in: is the adversarial example of the target model, To generate adversarial samples, is the original input sample of the target model, is the intermediate variable, is the gradient information of x, is the loss function of the multi-feature fusion model, is the weight parameter of the trained multi-feature fusion model, for The true label of

[0038] The present invention can screen the generated adversarial samples and select The sample successfully attacked above is screened based on whether the generated adversarial sample can cause the multi-feature fusion model to make prediction errors. The specific expression is as follows:

[0039] ,

[0040] in Indicates to take out the ones that meet the conditions in brackets .

[0041] In a second aspect, the present invention provides a black box attack detection device based on multi-feature fusion, comprising:

[0042] An acquisition module is used to input an unlabeled initial data set into a target model to be attacked to obtain a corresponding labeled initial data set;

[0043] The training module is used to create a multi-feature fusion model. The labeled initial data set is used to cyclically train the multi-feature fusion model through a combination of incremental learning and Jacobian matrix data enhancement until the cross entropy loss function converges;

[0044] A generation module is used to generate adversarial samples based on the trained multi-feature fusion model combined with the adversarial sample generation algorithm;

[0045] Among them, creating a multi-feature fusion model includes:

[0046] The decision layers of two alternative models with similar complexity or similar learning ability are concatenated and fused. After concatenation and fusion, a fully connected layer and a Dropout layer are sequentially connected to form a complete multi-feature fusion model:

[0047] ,

[0048] ,

[0049] ,

[0050] in, Perform splicing and fusion operations on the decision layers of the two replacement models. is the output vector after concatenation and fusion, is the output vector of the first replacement model, is the output vector of the second replacement model, is the output vector of the fully connected layer, is the fully connected layer, is the Dropout regularization operation, is the final classification output layer, It is the prediction result of the multi-feature fusion model.

[0051] In a third aspect, the present invention provides a computer system, comprising:

[0052] Memory, for storing computer programs / instructions;

[0053] A processor is used to execute the computer program / instructions to implement the steps of the above-mentioned black box attack detection method based on multi-feature fusion.

[0054] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program / instruction stored thereon. When the computer program / instruction is executed by a processor, the steps of the above-mentioned black-box attack detection method based on multi-feature fusion are implemented.

[0055] In a fifth aspect, the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned black-box attack detection method based on multi-feature fusion.

[0056] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention significantly reduces the data demand by combining the existing small amount of data with an innovative multi-feature fusion model, while improving the training efficiency of the substitute model, so that the attacker can carry out effective attacks under limited resources, thereby improving the attack efficiency. At the same time, the incremental learning technology is introduced, and through multiple rounds of data enhancement and weight update, the stability of the substitute model and the fitting accuracy of the decision boundary of the target model are significantly improved, thereby improving the stability of the attack effect.

[0057] The present invention uses data enhancement technology based on the Jacobian matrix to reduce the number of visits to the target model while expanding the data set size, thereby effectively improving the quality of adversarial sample generation.

[0058] The present invention prevents overfitting and optimizes the feature extraction process by extracting multiple features and fusion of the decision layer of the replacement model. The generated adversarial samples have stronger attack capabilities, increase the success rate of the attack, and improve the effect of the adversarial attack.

[0059] The present invention generates adversarial samples by simulating the output behavior of the target model and fitting the decision boundary of the target model. It is suitable for different attack scenarios, improves the flexibility of black-box attacks and the migration ability of adversarial samples, and has strong application flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is the workflow diagram of the MFBA method;

[0061] Figure 2 It is the architecture diagram of the information extraction and fusion module;

[0062] Figure 3 The classification accuracy of the target model for the original data samples and adversarial samples generated by different algorithms;

[0063] Figure 4 The impact of adversarial examples generated by different surrogate models using the FGSM algorithm on the recognition accuracy of the target model;

[0064] Figure 5 Illustration of the classification accuracy of the target model for 2200 original data samples and adversarial samples extracted at each signal-to-noise ratio (SNR). DETAILED DESCRIPTION

[0065] It should be noted that:

[0066] The technical solution of the present invention is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations on the technical solution of the present invention. The embodiments of the present invention and the technical features in the embodiments may be combined with each other unless there is a conflict.

[0067] The term "and / or" is only a way to describe the association relationship of associated objects. There can be three kinds of relationships. For example, A and / or B can be: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " generally means that the associated objects before and after are in an "or" relationship.

[0068] Example 1

[0069] like Figure 1 As shown, this embodiment provides a multi-feature fusion black box attack detection method (MFBA), including:

[0070] Dataset determination: The data set is based on the public RadioML2016.10A data set to evaluate the performance of the proposed modulation classification model. The wireless channel effects including delay, time scaling, phase rotation, frequency offset and additional thermal noise are considered to simulate actual wireless communications. The experiment contains 11 types of common modulation signals: 8PSK, AM-DSB, AM-SSB, BPSK, CPFSK, GFSK, PAM4, QAM16, QAM64, QPSK, WB FM, each modulation contains 20 signal-to-noise ratios, each signal-to-noise ratio has 1000 samples, and the total number of samples is 220,000; each sample has two signals, I and Q, and each signal contains 128 points; the total size of the data set is 220,000×2×128, of which there are 132,000 training samples (12,000 for each modulation mode), and 44,000 verification samples (4,000 for each modulation mode). The sampling rate is 200kHz. In order to cover all aspects, the training signal-to-noise ratio is selected in the range of -20dB~18dB with an interval of 2dB.

[0071] Step 1: Figure 1~2 As shown in the figure, first, some samples are randomly selected from the existing data set to construct an unlabeled initial data set; then, multiple models with similar complexity are selected from the alternative model set and fused through the decision layer to create a multi-feature fusion model. ,The above process can be regarded as the preparation stage of the attack, ,where the selection of the replacement model and the construction of the ,dataset both have their specific strategies;

[0072] In order to improve the success rate of the attack and achieve a wider range of attack effects, the VTCNN-2 and ResNet models with similar complexity are selected for fusion to better fit the boundary of the target model; and a new fusion model VTCNN-2-ResNet is formed through decision-layer fusion and named VR model. VR will serve as a substitute model for the MFBA method; in addition, the samples of the dataset should be randomly extracted from different categories and different dB values ​​to ensure that the attack can cover all scenarios and categories, and improve the effectiveness and universality of the attack.

[0073] Step 2: In the training phase of the replacement model, we conduct multiple rounds of training on the multi-feature fusion model. In order to avoid overfitting, we judge the training effect by monitoring the changes in the loss function and adopt an early stopping strategy. A large number of experimental results show that a relatively ideal multi-feature fusion model can usually be obtained after 4 rounds of training. .

[0074] Step 21: Feed the unlabeled dataset constructed in step 1 into the target model , obtain its predicted label and combine it with the unlabeled dataset to generate a new dataset , the formula is as follows:

[0075] ,

[0076] Then Feed The training process is as follows:

[0077] ,

[0078] in: For the In round iteration parameter; is the learning rate, which determines the step size of each update; yes The true label of is the cross entropy loss function of the multi-feature fusion model with respect to the parameter The gradient of is the cross entropy loss function;

[0079] Step 22: After completing a round of training, we need to use the currently trained multi-feature fusion model For the dataset Perform data enhancement and generate , according to the following formula:

[0080] S 1 ← { x 0 + λ ⋅ sign ( J M F [ y ̂ ( x 0 ) ] ) : x 0 ∈ S 0 } ∪ S 0 ,

[0081] In step 2, multiple rounds of data enhancement and training of multi-feature fusion models will be performed. , so the above steps 21 and 22 are repeatedly executed.

[0082] Step 3: The feature fusion model that has been trained according to step 2 , use it to generate adversarial samples, because Complete fit The decision boundary of , and the adversarial sample has transferability, we can get, according to The generated adversarial samples can successfully attack the target model .

[0083] , ,

[0084] in: is the adversarial example of the target model, To generate adversarial samples, is the original input sample of the target model, is the intermediate variable, is the gradient information of x, is the loss function of the multi-feature fusion model, is the weight parameter of the trained multi-feature fusion model, for The real label.

[0085] Step 4: The adversarial samples generated in step 3 need to be screened and used to train the multi-feature fusion model Launch an attack and screen out adversarial samples that successfully implement the attack. The screened samples can be regarded as adversarial samples with stronger attack effects and have a greater possibility of effectively interfering with the target model;

[0086] The specific expression is as follows:

[0087] ,

[0088] in It means to take out the items that meet the conditions in the brackets.

[0089] Example 2

[0090] This embodiment provides the performance of the method of the present invention in different signal-to-noise ratios, and compares the attack strength of adversarial samples generated by different adversarial sample algorithms, such as Figure 3 The target model shows the recognition accuracy of 44,000 original samples and adversarial samples. The adversarial samples generated under different perturbation sizes will have different performances. Four methods for generating adversarial samples are used, namely FGSM, PGD, MI-FGSM and NI-FGSM. From the results, we can see that under the perturbation When equal to 0.1 (disturbance Used to limit the strength of adversarial samples), the adversarial samples generated by the four attack methods have similar effects. When it is equal to 0.2, there is a certain gap between the various methods. FGSM is a single-step attack method, while PGD, MI-FGSM and NI-FGSM are iterative attack methods, which can explore more sophisticated attack strategies. Due to the inclusion of momentum terms, MI-FGSM and NI-FGSM have stronger mobility.

[0091] The formula of the FGSM algorithm can be expressed as:

[0092] ,

[0093] in: The cross entropy loss function is used for the input data The partial derivative of is the symbolic function, is the disturbance amplitude used to constrain the disturbance range;

[0094] The formula of the PGD algorithm can be expressed as:

[0095] ,

[0096] ,

[0097] in: is the adversarial example at step t+1, updated from the adversarial example at step t by applying the gradient sign method; Project the result back to the allowed perturbation set x+S to ensure the validity of the perturbation; is the step length, and is the cross entropy loss function Relative to The sign of the gradient of ;

[0098] The formula of the MI-FGSM algorithm can be expressed as:

[0099] ,

[0100] ,

[0101] in: is the cumulative momentum at step t+1, is the momentum decay factor, and each update is normalized using the L1 norm to maintain consistency between steps;

[0102] The formula of NI-FGSM algorithm can be expressed as:

[0103] ,

[0104] ,

[0105] ,

[0106] in: Based on the current adversarial sample and momentum accumulation gradient The expected example generated, is the step length, is the attenuation factor, is the cumulative gradient of the next step, combining the momentum of the previous step and the current expected sample The L1 norm of normalized gradient.

[0107] In summary, it can be seen that the method of the present invention can generate adversarial samples with strong aggressiveness, and can still significantly affect the recognition rate of the target model without screening.

[0108] Example 3

[0109] This embodiment provides the comparison results of the method of the present invention and the original single replacement model. The compared models are VTCNN-2 and Resnet models. The attack strength of the adversarial samples generated when the FGSM algorithm is used is compared. Figure 4 The target model shows the recognition accuracy of 44,000 original samples and adversarial samples. The adversarial samples generated under different perturbation sizes will have different performances. When the size is 0.2, according to the multi-feature fusion model The recognition accuracy of the generated adversarial samples is significantly lower than that of the adversarial samples generated based on the VTCNN-2 and Resnet models.

[0110] Example 4

[0111] This embodiment provides the comparison results of the method of the present invention and the original single replacement model. The models we compared are VTCNN-2 and Resnet models, and the attack strength of the adversarial samples generated when using the FGSM algorithm is compared; the following results are obtained: Figure 4 The target model shows the recognition accuracy of 44,000 original samples and adversarial samples. The adversarial samples generated under different perturbation sizes will have different performances. When the size is 0.2, according to the multi-feature fusion model The recognition accuracy of the generated adversarial samples is significantly lower than that of the adversarial samples generated based on the VTCNN-2 and Resnet models.

[0112] Example 5

[0113] This embodiment provides a comparison with other attack methods, and the comparison method is an evolutionary decision-based black-box attack (EDBA) method, which obtains results by querying the target model in large quantities to make the adversarial sample far away from the decision boundary of the target model; maintaining consistent experimental conditions, VTCNN-2 is selected as the target model, and the fusion model of VTCNN-2 and ResNet (VR) is used as an alternative model to verify the method of this embodiment; in view of the limited data available for real-world attacks, this embodiment only samples 10 sample modulation categories and signal-to-noise ratios from each attack, for a total of 2200 data samples; the EDBA method pushes the adversarial examples to the decision boundary of the target model through a large number of queries; when the number of iterations T is 100, each sample is queried 201 times, each iteration involves two queries, and additional queries for generating adversarial examples, for a total of 201 queries. When T is 50, each iteration involves 101 queries, and a total of 222,200 queries are performed. In contrast, the method of this embodiment requires a total of 22,660 queries, of which 20,460 are used to train the replacement model and 2,200 are used to verify the effectiveness of the attack. Therefore, when T is 50, the query cost of the EDBA method is about 10 times that of the method of this embodiment. Figure 5 The figure shows how different adversarial attack methods lead to a decrease in the recognition accuracy of the target model. The horizontal axis represents different signal-to-noise ratios, and the vertical axis represents classification accuracy. From the result graph, we can see that under the disturbance When is 0.2, the MFBA method of this embodiment has a stronger impact on the accuracy of the target model than the EDBA method.

[0114] Example 6

[0115] This embodiment provides a black box attack detection device based on multi-feature fusion, including:

[0116] An acquisition module is used to input an unlabeled initial data set into a target model to be attacked to obtain a corresponding labeled initial data set;

[0117] The training module is used to create a multi-feature fusion model. The labeled initial data set is used to cyclically train the multi-feature fusion model through a combination of incremental learning and Jacobian matrix data enhancement until the cross entropy loss function converges;

[0118] The generation module is used to generate adversarial samples of the target model based on the trained multi-feature fusion model combined with the adversarial sample generation algorithm;

[0119] Among them, creating a multi-feature fusion model includes:

[0120] The decision layers of two alternative models with similar complexity or similar learning ability are concatenated and fused. After concatenation and fusion, a fully connected layer and a Dropout layer are sequentially connected to form a complete multi-feature fusion model:

[0121] ,

[0122] ,

[0123] ,

[0124] in, Perform splicing and fusion operations on the decision layers of the two replacement models. is the output vector after concatenation and fusion, is the output vector of the first replacement model, is the output vector of the second replacement model, is the output vector of the fully connected layer, is the fully connected layer, is the Dropout regularization operation, is the final classification output layer, It is the prediction result of the multi-feature fusion model.

[0125] Example 7

[0126] This embodiment provides a computer system, including:

[0127] Memory, for storing computer programs / instructions;

[0128] A processor is used to execute the computer program / instructions to implement the steps of the above-mentioned black box attack detection method based on multi-feature fusion.

[0129] Example 8

[0130] This embodiment provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the above-mentioned black-box attack detection method based on multi-feature fusion are implemented.

[0131] Example 9

[0132] This embodiment provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned black-box attack detection method based on multi-feature fusion when executed by a processor.

[0133] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0134] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0135] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0136] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0137] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which all fall within the protection of the present invention.

Claims

1. A black box attack detection method based on multi-feature fusion, characterized in that: include: Input the unlabeled initial data set into the target model to be attacked to obtain the corresponding labeled initial data set; Create a multi-feature fusion model, and use the labeled initial data set to cyclically train the multi-feature fusion model through a combination of incremental learning and Jacobian matrix data enhancement until the cross entropy loss function converges; Generate adversarial samples of the target model based on the trained multi-feature fusion model combined with the adversarial sample generation algorithm; Among them, creating a multi-feature fusion model includes: The decision layers of two alternative models with similar complexity or similar learning ability are concatenated and fused. After concatenation and fusion, a fully connected layer and a Dropout layer are sequentially connected to form a complete multi-feature fusion model: ， ， ， in, Perform splicing and fusion operations on the decision layers of the two replacement models. is the output vector after concatenation and fusion, is the output vector of the first replacement model, is the output vector of the second replacement model, is the output vector of the fully connected layer, is the fully connected layer, is the Dropout regularization operation, is the final classification output layer, It is the prediction result of the multi-feature fusion model.

2. The black box attack detection method based on multi-feature fusion according to claim 1 is characterized in that: The step of inputting the unlabeled initial data set into the target model to be attacked to obtain the corresponding labeled data set includes: Input an unlabeled initial data set to the target model, obtain the prediction results output by the target model, and combine the prediction results with the initial data set to form a new labeled initial data set; The specific expression of the labeled initial data is: ， in: is the initial labeled dataset, is the data in the unlabeled initial dataset, for Input target model The corresponding prediction results are output later.

3. The black box attack detection method based on multi-feature fusion according to claim 2 is characterized in that: The multi-feature fusion model is cyclically trained by combining incremental learning and Jacobian matrix data enhancement with the labeled initial data set until the cross entropy loss function converges, including: Inputting the labeled initial data set as the initial training sample into the multi-feature fusion model to perform model training, including: training the weight parameters of the multi-feature fusion model, with the goal of minimizing the cross entropy loss function between the model output and the label, performing gradient descent through the optimizer, and updating the weight parameters of the multi-feature fusion model; After model training, the initial training samples are augmented with Jacobian matrix data to generate new training samples. After the new training samples are input into the target model to obtain labels, the multi-feature fusion model is input into the incremental learning method for iterative training until the cross entropy loss function converges to obtain a trained multi-feature fusion model. The incremental learning is: when the current model is trained, the weight parameters of the previous training are loaded.

4. The black box attack detection method based on multi-feature fusion according to claim 3 is characterized in that: Generate new training samples through Jacobian matrix data augmentation, including: ； in: For the The training samples after rounds of data augmentation, for The sample data in is the learning rate, is the symbolic function, is the Jacobian matrix, Take the training samples The prediction results of the multi-feature fusion model when .

5. The black box attack detection method based on multi-feature fusion according to claim 4 is characterized in that: The method of generating adversarial samples of the target model by training multiple feature fusion models and generating adversarial samples by an algorithm includes: ， ， in: is the adversarial example of the target model, To generate adversarial samples, is the original input sample of the target model, is the intermediate variable, is the gradient information of x, is the loss function of the multi-feature fusion model, is the weight parameter of the trained multi-feature fusion model, for The real label.

6. A black box attack detection device based on multi-feature fusion, characterized in that: include: An acquisition module is used to input an unlabeled initial data set into a target model to be attacked to obtain a corresponding labeled initial data set; The training module is used to create a multi-feature fusion model. The labeled initial data set is used to cyclically train the multi-feature fusion model through a combination of incremental learning and Jacobian matrix data enhancement until the cross entropy loss function converges; The generation module is used to generate adversarial samples of the target model based on the trained multi-feature fusion model combined with the adversarial sample generation algorithm; Among them, creating a multi-feature fusion model includes: The decision layers of two alternative models with similar complexity or similar learning ability are concatenated and fused. After concatenation and fusion, a fully connected layer and a Dropout layer are sequentially connected to form a complete multi-feature fusion model: ， ， ， in, Perform splicing and fusion operations on the decision layers of the two replacement models. is the output vector after concatenation and fusion, is the output vector of the first replacement model, is the output vector of the second replacement model, is the output vector of the fully connected layer, is the fully connected layer, is the Dropout regularization operation, is the final classification output layer, It is the prediction result of the multi-feature fusion model.

7. A computer system, characterized in that: include: Memory, for storing computer programs / instructions; A processor is used to execute the computer program / instructions to implement the steps of the black-box attack detection method based on multi-feature fusion as described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instruction is executed by a processor, the steps of the black-box attack detection method based on multi-feature fusion described in any one of claims 1-5 are implemented.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the black-box attack detection method based on multi-feature fusion described in any one of claims 1-5 are implemented.

Images