Adversarial data detection method and device, equipment and storage medium

Abstract

The invention discloses an adversarial data detection method and device, equipment and a storage medium. The method comprises the following steps: acquiring business data of a user; inputting the service data into a pre-trained lightweight-based convolutional neural network model, and outputting a first prediction result; the convolutional neural network model based on lightweight is deployed on edge equipment; inputting the service data into a pre-trained prediction model based on integration of a plurality of neural network models, and outputting a second prediction result; wherein the training data set based on the lightweight convolutional neural network model and the prediction model is a set number of images and characters, and corresponding adversarial data samples are generated; the prediction model is deployed in a cloud computing platform; the detection algorithms of any two neural network models are different; and determining the type of the business data based on a comparison result of the first prediction result and the second prediction result. According to the method, multiple complex neural network models are deployed at the cloud, and the detection defense effect on the adversarial data is realized by using the computing power of the cloud.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of power safety technology, and in particular to a method, device, equipment and storage medium for detecting adversarial data. Background Art

[0002] The power business has the characteristics of flexibility, openness, and extensive interconnection. These characteristics expand the network attack surface and reduce the difficulty of network attacks, making the power business have to face increasingly severe network security forms and new security risks. The data value of new low-voltage control business is of high quality, so the attack threats are often more frequent.

[0003] Grid edge devices are facing increasingly severe problems under the impact of Internet attacks. Data leaks and malicious control of devices occur from time to time, which may even trigger a chain reaction, leading to grid accidents and threatening the stability of the entire power system. At the same time, the lag problem of software and firmware updates should not be underestimated. Many grid edge devices lack automatic update functions and rely on manual intervention. This backward update method causes the devices to run old versions of software with known vulnerabilities for a long time, which invisibly increases the security risks of the power grid.

[0004] In addition, these lightweight neural networks are vulnerable to adversarial attacks, which poses a security risk. Due to the limited storage space and insufficient computing power, these lightweight neural network models are often deployed in power edge devices. However, lightweight neural networks have low robustness, resulting in poor ability to defend against adversarial attacks, which in turn causes losses to the power system. Summary of the invention

[0005] The embodiments of the present invention provide an adversarial data detection method, apparatus, device and storage medium, which achieve the detection and defense effect for adversarial data by deploying a variety of complex neural network models in the cloud and utilizing the computing power of the cloud.

[0006] In a first aspect, an embodiment of the present invention provides an adversarial data detection method, the method being performed by an adversarial data detection system, the system comprising an edge device and a cloud computing platform; comprising:

[0007] Obtain user business data;

[0008] Inputting the business data into a pre-trained lightweight convolutional neural network model, and outputting a first prediction result; the lightweight convolutional neural network model is deployed on the edge device;

[0009] The business data is input into a pre-trained prediction model based on an integration of multiple neural network models, and a second prediction result is output; wherein the training data set based on the lightweight convolutional neural network model and the prediction model is a set number of images and characters and corresponding adversarial data samples are generated; the prediction model is deployed in the cloud computing platform; the detection algorithms of any two of the neural network models are different;

[0010] Based on the comparison result between the first prediction result and the second prediction result, the type of the business data is determined; the type of the business data includes normal data or adversarial data.

[0011] In a second aspect, an embodiment of the present invention further provides a countermeasure data detection device, the device comprising:

[0012] Data acquisition module, used to obtain user's business data;

[0013] A first prediction module, used for inputting the business data into a pre-trained lightweight convolutional neural network model, and outputting a first prediction result; the lightweight convolutional neural network model is deployed on the edge device;

[0014] A second prediction module is used to input the business data into a pre-trained prediction model based on an integration of multiple neural network models, and output a second prediction result; wherein the training data set based on the lightweight convolutional neural network model and the prediction model is a set number of images and characters and generates corresponding adversarial data samples; the prediction model is deployed in the cloud computing platform; the detection algorithms of any two of the neural network models are different;

[0015] A type determination module is used to determine the type of the business data based on the comparison result of the first prediction result and the second prediction result; the type includes normal data and adversarial data.

[0016] In a third aspect, an embodiment of the present disclosure further provides an electronic device, the electronic device comprising:

[0017] one or more processors;

[0018] a storage device for storing one or more programs,

[0019] When the one or more programs are executed by the one or more processors, the one or more processors implement the adversarial data detection method provided by the embodiment of the present disclosure.

[0020] In a fourth aspect, the embodiments of the present disclosure further provide a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to implement the adversarial data detection method provided by the embodiments of the present disclosure.

[0021] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the adversarial data detection method provided by the embodiment of the present disclosure.

[0022] The present invention discloses a method, device, equipment and storage medium for detecting adversarial data. The method is executed by an adversarial data detection system, and the system includes an edge device and a cloud computing platform; the method includes: obtaining the business data of the user; inputting the business data into a pre-trained lightweight convolutional neural network model, and outputting a first prediction result; the lightweight convolutional neural network model is deployed on the edge device; inputting the business data into a pre-trained prediction model based on integrating multiple neural network models, and outputting a second prediction result; wherein the training data set of the lightweight convolutional neural network model and the prediction model is a set number of images and characters and generates corresponding adversarial data samples; the prediction model is deployed on the cloud computing platform; the detection algorithms of any two of the neural network models are different; based on the comparison result of the first prediction result and the second prediction result, the type of the business data is determined; the type of the business data includes normal data or adversarial data. Utilizing this method: by deploying a variety of complex neural network models in the cloud and utilizing the computing power of the cloud, the detection and defense effect of adversarial data is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0024] Figure 1 A flowchart of an adversarial data detection method provided by an embodiment of the present disclosure;

[0025] Figure 2 An example flow chart of an adversarial data detection method provided in an embodiment of the present disclosure;

[0026] Figure 3 A schematic diagram of the structure of an adversarial data detection device provided by an embodiment of the present disclosure;

[0027] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0029] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0030] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0031] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0032] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0033] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0034] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0035] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0036] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0037] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0038] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0039] Embodiment 1

[0040] Figure 1 A flowchart of an adversarial data detection method provided in an embodiment of the present disclosure is applicable to providing a solution to the problem that edge devices of power business are limited by small storage space, insufficient computing power, etc., and these lightweight neural network models are often deployed, while lightweight neural networks have low robustness and poor ability to defend against adversarial attacks. The method can be executed by an adversarial data detection method device, which can be implemented in the form of software and / or hardware, and optionally, by an electronic device, which can be a mobile terminal, a PC or a server, etc.

[0041] like Figure 1 As shown, an adversarial data detection method provided by an embodiment of the present disclosure is performed by an adversarial data detection system, and the system includes an edge device and a cloud computing platform. Specifically, the following steps may be included:

[0042] S110: Obtain user business data.

[0043] In this embodiment, the business data may be data such as pictures and texts uploaded by users.

[0044] Specifically, this step is used to obtain the user's business data.

[0045] Based on the above embodiment, obtaining the user's service data includes the following steps:

[0046] a1) Obtain business data received in the edge device.

[0047] b1) Copy the business data and upload the copied business data to the cloud computing platform.

[0048] In an embodiment, an edge device may refer to a computing device deployed on the user side or the distributed energy side in a power system. A cloud computing platform may be an infrastructure that provides computing resources, storage resources, and application services through the Internet.

[0049] Specifically, the business data received in the edge device is obtained, the business data is copied, and the copied business data is uploaded to the cloud computing platform.

[0050] S120: Input the business data into a pre-trained lightweight convolutional neural network model, and output a first prediction result.

[0051] Among them, the lightweight convolutional neural network model is deployed on edge devices.

[0052] In this embodiment, the lightweight convolutional neural network model can be a lightweight neural network model, for example, a MobileNetV3-Small model.

[0053] In this embodiment, this step is used to output the prediction result through a lightweight neural network deployed on the edge device.

[0054] S130: Input the business data into a pre-trained prediction model based on an integration of multiple neural network models, and output a second prediction result.

[0055] The training data set based on the lightweight convolutional neural network model and the prediction model is a set number of images and characters and the corresponding adversarial data samples are generated; the prediction model is deployed in the cloud computing platform; the detection algorithms of any two neural network models are different;

[0056] In this embodiment, the training data set may be 1,000 images selected from the ILSVRC2012 validation set to generate adversarial data samples, and the 1,000 clean images and 1,000 adversarial data samples are sent to the edge device for training.

[0057] Specifically, cloud computing platforms are known for their elastic and scalable computing resources, which provide strong support for deploying and running complex neural network models. There are multiple neural network models deployed in the prediction model, and the detection algorithms of any two neural network models are different. Exemplarily, the neural network models in the prediction model can be Inception-v3, VGG16, ResNet50, Inception-v4 and InceptionRseNet-v2 models respectively.

[0058] Specifically, the business data is input into a pre-trained prediction model based on an integration of multiple neural network models, and a prediction result set is output, wherein the prediction result set includes the prediction results output by each neural network model respectively, and the most likely prediction result is selected from the prediction result set as the second prediction result using the maximum likelihood algorithm.

[0059] On the basis of the above embodiment, the business data is input into a pre-trained prediction model based on an integration of multiple neural network models, and outputting the second prediction result specifically includes the following steps:

[0060] a2) Inputting business data into each neural network model in the prediction model and outputting a prediction result set;

[0061] The prediction result set includes the prediction results output by each neural network model.

[0062] b2) Determine a second prediction result from the prediction result set.

[0063] Based on the above embodiment, determining the second prediction result from the prediction result set may specifically be: taking the prediction result with the largest number of occurrences in the prediction result set as the second prediction result.

[0064] For example, Figure 2 This is a flowchart of an adversarial data detection method provided by an embodiment of the present disclosure, such as Figure 2 As shown in the figure, after a series of processing, the business data is input into the Inception-v3, VGG16, ResNet50, Inception-v4 and InceptionRseNet-v2 models, and 5 output results are obtained. Among them, the output g1(x) of the VGG16 model is equal to "bird", the output g2(x) of the Inception-v3 model is equal to "fish", the output g3(x) of the ResNet50 model is equal to "fish", the output g4(x) of the Inception-v4 model is equal to "fish", and the output g5(x) of the InceptionRseNet-v2 model is equal to "fish", then the second prediction result is "fish"

[0065] S140: Determine the type of business data based on a comparison result between the first prediction result and the second prediction result.

[0066] In this embodiment, the type may be whether the service data is adversarial data.

[0067] Specifically, the first prediction result is compared with the second prediction result. If the first prediction result is the same as the second prediction result, the type of the business data is normal data. If the first prediction result is different from the second prediction result, the type of the business data is adversarial data.

[0068] On the basis of the above embodiment, based on the comparison result of the first prediction result and the second prediction result, determining the type of the business data specifically includes the following steps:

[0069] a3) Compare the first prediction result with the second prediction result.

[0070] b3) If the first prediction result is the same as the second prediction result, the type of the business data is normal data.

[0071] c3) If the first prediction result is different from the second prediction result, the type of the business data is adversarial data.

[0072] In this embodiment, the types of service data include normal data or adversarial data.

[0073] Specifically, the first prediction result is compared with the second prediction result. If the first prediction result is the same as the second prediction result, the type of the business data is normal data. If the first prediction result is different from the second prediction result, the type of the business data is adversarial data.

[0074] On the basis of the above embodiment, after determining the type of the service data, the method further includes:

[0075] If the type of business data is adversarial data, the adversarial data detection system will cut off the application programming interface of the edge device and ban the user's account.

[0076] Specifically, if the type of business data is adversarial data, the adversarial data detection system takes a series of defensive measures, such as cutting off the connection of the application programming interface and taking relevant ban measures on the user account.

[0077] The present invention discloses a method for detecting adversarial data, which is executed by an adversarial data detection system, and the system includes an edge device and a cloud computing platform; the method includes: obtaining user business data; inputting the business data into a pre-trained lightweight convolutional neural network model, and outputting a first prediction result; the lightweight convolutional neural network model is deployed on the edge device; inputting the business data into a pre-trained prediction model based on an integration of multiple neural network models, and outputting a second prediction result; wherein the training data set based on the lightweight convolutional neural network model and the prediction model is a set number of images and characters and generates corresponding adversarial data samples; the prediction model is deployed in a cloud computing platform; the detection algorithms of any two neural network models are different; based on the comparison result of the first prediction result and the second prediction result, the type of business data is determined; the type of business data includes normal data or adversarial data. Utilizing this method: by deploying a variety of complex neural network models in the cloud and utilizing the computing power of the cloud, the detection and defense effect of adversarial data is achieved.

[0078] Figure 3 The present invention also provides a schematic diagram of a device structure of a countermeasure data detection method, such as Figure 3 As shown, a data acquisition module 210, a first prediction module 220, a second prediction module 230 and a type determination module 240.

[0079] The data acquisition module 210 is used to acquire the user's business data;

[0080] A first prediction module 220, configured to input the service data into a pre-trained lightweight convolutional neural network model, and output a first prediction result; the lightweight convolutional neural network model is deployed on the edge device;

[0081] The second prediction module 230 is used to input the business data into a pre-trained prediction model based on an integration of multiple neural network models, and output a second prediction result; wherein the training data set based on the lightweight convolutional neural network model and the prediction model is a set number of images and characters and generates corresponding adversarial data samples; the prediction model is deployed in the cloud computing platform; the detection algorithms of any two of the neural network models are different;

[0082] The type determination module 240 is used to determine the type of the business data based on the comparison result of the first prediction result and the second prediction result; the type of the business data includes normal data or adversarial data.

[0083] The technical solution provided in the embodiment of the present disclosure utilizes this method: by deploying a variety of complex neural network models in the cloud and utilizing the computing power of the cloud, the detection and defense effects for adversarial data are achieved.

[0084] Furthermore, the port acquisition module 210 may be used to:

[0085] Acquire the service data received in the edge device;

[0086] The business data is copied, and the copied business data is uploaded to the cloud computing platform.

[0087] Furthermore, the second prediction module 230 may also be used for:

[0088] Input the business data into each neural network model in the prediction model, and output a prediction result set; the prediction result set includes the prediction results output by each neural network model respectively;

[0089] The second prediction result is determined from the prediction result set.

[0090] Furthermore, the second prediction module 230 may also be used for:

[0091] The prediction result with the largest number of occurrences in the prediction result set is used as the second prediction result.

[0092] Furthermore, the type determination module 240 may also be used to:

[0093] comparing the first prediction result with the second prediction result;

[0094] If the first prediction result is the same as the second prediction result, the type of the business data is the normal data;

[0095] If the first prediction result is different from the second prediction result, the type of the business data is the adversarial data.

[0096] Furthermore, the device can also be used for:

[0097] After determining the type of the service data, the method further includes:

[0098] If the type of the business data is the adversarial data, the adversarial data detection system cuts off the application programming interface of the edge device and bans the user's account.

[0099] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not described in detail in this embodiment, please refer to the methods provided by all the above embodiments of the present invention.

[0100] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is given. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0101] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0102] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0103] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 performs the various methods and processes described above, such as the adversarial data detection method.

[0104] In some embodiments, the adversarial data detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the adversarial data detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the adversarial data detection method in any other suitable manner (e.g., by means of firmware).

[0105] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0106] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0107] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0108] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0109] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0110] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0111] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0112] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting adversarial data, characterized in that: The method is performed by an adversarial data detection system, which includes an edge device and a cloud computing platform; including: Obtain user business data; Inputting the business data into a pre-trained lightweight convolutional neural network model, and outputting a first prediction result; the lightweight convolutional neural network model is deployed on the edge device; The business data is input into a pre-trained prediction model based on an integration of multiple convolutional neural network models, and a second prediction result is output; wherein the training data set based on the lightweight convolutional neural network model and the prediction model is a set number of images and characters and corresponding adversarial data samples are generated; the prediction model is deployed in the cloud computing platform; the detection algorithms of any two of the neural network models are different; Based on the comparison result between the first prediction result and the second prediction result, the type of the business data is determined; the type of the business data includes normal data or adversarial data.

2. The method according to claim 1, characterized in that The obtaining of the user's business data includes: Acquire the service data received in the edge device; The business data is copied, and the copied business data is uploaded to the cloud computing platform.

3. The method according to claim 1, characterized in that The business data is input into a pre-trained prediction model based on integrating multiple neural network models, and a second prediction result is output, including: Input the business data into each neural network model in the prediction model, and output a prediction result set; the prediction result set includes the prediction results output by each neural network model respectively; The second prediction result is determined from the prediction result set.

4. The method according to claim 3, characterized in that include: The determining the second prediction result from the prediction result set includes: The prediction result with the largest number of occurrences in the prediction result set is used as the second prediction result.

5. The method according to claim 1, characterized in that The determining the type of the business data based on a comparison result between the first prediction result and the second prediction result includes: comparing the first prediction result with the second prediction result; If the first prediction result is the same as the second prediction result, the type of the business data is the normal data; If the first prediction result is different from the second prediction result, the type of the business data is the adversarial data.

6. The method according to claim 1, characterized in that After determining the type of the service data, the method further includes: If the type of the business data is the adversarial data, the adversarial data detection system cuts off the application programming interface of the edge device and bans the user's account.

7. A countermeasure data detection device, characterized in that: include: Data acquisition module, used to obtain user's business data; A first prediction module, used for inputting the business data into a pre-trained lightweight convolutional neural network model, and outputting a first prediction result; the lightweight convolutional neural network model is deployed on the edge device; A second prediction module is used to input the business data into a pre-trained prediction model based on an integration of multiple neural network models, and output a second prediction result; wherein the training data set based on the lightweight convolutional neural network model and the prediction model is a set number of images and characters and generates corresponding adversarial data samples; the prediction model is deployed in the cloud computing platform; the detection algorithms of any two of the neural network models are different; A type determination module is used to determine the type of the business data based on the comparison result of the first prediction result and the second prediction result; the type of the business data includes normal data or adversarial data.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the adversarial data detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the adversarial data detection method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the adversarial data detection method according to any one of claims 1 to 6.

Images