Radio signal identification method based on time-frequency guided countermeasure sample purification

Abstract

The invention discloses a radio signal identification method based on time-frequency guided confrontation sample purification, and the method comprises the steps: obtaining a radio signal data set which comprises a signal class label and a time domain IQ signal sample, constructing a radio signal training set, and training a signal identification model based on deep learning; according to the forward diffusion process of the diffusion model, Gaussian noise is gradually added to each sample in the radio signal training set, and a noise predictor based on a neural network is trained; adding an anti-disturbance simulation radio signal to be purified to the normalized radio signal test set, introducing a radio signal time-frequency semantic guide item into a reverse process of a diffusion model, and gradually sampling and recovering from standard Gaussian noise by using a noise predictor to obtain a purified radio signal; and sending the purified radio signal to a trained signal identification model for identification. According to the method, the recognition accuracy of the recognition model under the attack of the confrontation sample is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of radio signal recognition, and in particular to a radio signal recognition method based on time-frequency guided adversarial sample purification. Background Art

[0002] Radio signal recognition is one of the key technologies in modern wireless communication systems. It can effectively monitor and manage the use of spectrum resources, promptly identify illegal signals and malicious intrusions, and ensure the security and reliability of wireless communications. Thanks to the development of deep learning technology, radio signal recognition has achieved automation and intelligence. It automatically learns the characteristics of different signals by training neural network models, greatly improving the accuracy of signal recognition.

[0003] However, researchers have found that deep learning models are inherently vulnerable to adversarial perturbations. Illegal signal sources can carefully design these tiny and imperceptible perturbations to generate so-called adversarial perturbations and add them to the original signal, thereby tricking the signal recognition model into making incorrect predictions. This attack process is called a radio signal adversarial attack, the original signal is called a benign radio signal sample, and the attacked signal is called a radio signal adversarial sample. Under radio signal adversarial attacks, the vulnerability of deep recognition models not only affects the accuracy of radio signal recognition, but also poses a serious threat to the security of wireless communication systems.

[0004] In order to mitigate the malicious deception of radio signal recognition models by adversarial attacks, research on radio signal adversarial defense technology has emerged, which can be divided into three categories: adversarial training, adversarial sample detection, and adversarial sample purification. Adversarial sample training is to incorporate radio signal adversarial samples into the training phase of the recognition model, while improving the structure of the model, which can actively improve the robustness of the model itself. This defense method requires reconfiguring the radio signal recognition model, and usually only has a good defense effect on radio signal adversarial samples involved in data enhancement, and has poor generalization. Adversarial sample detection does not require retraining the recognition model, and quickly rejects radio signal adversarial samples by building a detector. However, undetected radio signal adversarial samples may still have a serious impact on the model. Different from them, radio signal adversarial sample purification reconstructs the input sample by inserting an additional module, and the purified radio signal is then input into the signal recognition model, and there is no need to retrain the recognition model. Existing radio signal adversarial sample purification modules are usually implemented based on denoising models (for example, denoising autoencoders) or generative models (for example, adversarial generative networks), and usually face two challenges: first, noise and adversarial perturbations coexist in radio signals, and the adversarial perturbations are submerged in the noise, resulting in limited radio signal adversarial sample purification capabilities under complex noise conditions and poor subsequent signal recognition performance; second, radio signal adversarial samples are required to participate in the training of the purification module. Therefore, when facing unknown radio adversarial attacks, the adversarial sample purification capabilities are limited, which also affects the subsequent signal recognition performance. Summary of the invention

[0005] The purpose of the present invention is to propose a radio signal recognition method based on time-frequency guided adversarial sample purification.

[0006] The technical solution to achieve the purpose of the present invention is: a radio signal recognition method based on time-frequency guided adversarial sample purification, comprising the following steps:

[0007] Step 1: obtain a radio signal dataset, including signal category labels and time-domain IQ signal samples, construct a radio signal training set, and train a signal recognition model based on deep learning;

[0008] Step 2, according to the forward diffusion process of the diffusion model, Gaussian noise is gradually added to each sample in the radio signal training set to train a noise predictor based on a neural network;

[0009] Step 3, adding adversarial perturbations to simulate the radio signals to be purified to the normalized radio signal test set, introducing the radio signal time-frequency semantic guidance term into the inverse process of the diffusion model, and using the noise predictor to gradually sample and restore from the standard Gaussian noise to obtain the purified radio signal;

[0010] Step 4: Send the purified radio signal to the trained signal recognition model for recognition.

[0011] Furthermore, in step 1, a radio signal dataset is obtained, including signal categories and time-domain IQ signal samples, and a signal recognition model based on deep learning is trained. The specific method is as follows:

[0012] Step 1.1, obtain a radio signal dataset, including signal category labels and various time-domain IQ signal samples; set the signal category labels to 0, 1, ..., N-1, where N represents the number of categories; for each radio signal sample, concatenate its I and Q signals into data of size [2, L], where the first row represents the I signal, the second row represents the Q signal, and L represents the number of sampling points of the radio signal sample; for each original radio signal sample x ori Use its effective value for normalization;

[0013] The effective value calculation formula is as follows:

[0014]

[0015] in, and Respectively represent the i-th sampling point of the original radio I-channel signal and Q-channel signal;

[0016] The normalized calculation formula is shown in formula (2):

[0017] x=x ori / e rms (2) constructing a radio signal training set using the normalized radio signal;

[0018] Step 1.2, train the signal recognition model based on deep learning. The signal recognition model based on deep learning uses ResNet18 as the basic network. The input of the network is the normalized radio signal. The input size is [B, 1, 2, L], where B represents the batch size of the training data. The output is the predicted probability of belonging to each category. The output size is [B, N]. The category with the largest probability is taken as the predicted signal category.

[0019] Furthermore, when training the deep learning-based signal recognition model, the loss function is the cross entropy loss function, the learning rate is 0.001, the optimizer is Adam, the training data batch size is 128, and the number of training times is 50.

[0020] Furthermore, in step 2, according to the forward diffusion process of the diffusion model, Gaussian noise is gradually added to each sample in the radio signal training set to train a noise predictor based on a neural network. The specific method is as follows:

[0021] Step 2.1, according to the forward diffusion process of the diffusion model, T represents the total number of steps of the forward diffusion process, and the normalized radio signal x in the training set is used as the initial radio signal sample x0, and standard Gaussian noise is gradually added to x0 to obtain a series of radio signal forward latent variables x t ,t=1,2,...,T, where:

[0022] The transition probability q(x) of the forward latent variable of the radio signal at each step t |x t-1 ) is a Gaussian distribution centered on its previous latent variable, whose mean and variance are a series of predefined hyperparameters, as shown in (3):

[0023]

[0024] Among them, β t ,t=1,2,...,T is a linearly increasing constant, ∈ is the noise that obeys the standard Gaussian distribution;

[0025] Define α t =1-β t , The forward latent variable x of the radio signal at step t is directly calculated from the normalized radio signal x0 t ~q(x t |x0), the calculation formula is shown in (4):

[0026]

[0027] x t ~q(x t |x0) is subject to the mean The variance is Gaussian distribution, at t = T, the radio signal forward latent variable x T Obey standard Gaussian distribution;

[0028] Step 2.2: Train a noise predictor based on a neural network. The input of the noise predictor is the radio signal forward latent variable x calculated by equation (4): t and the current diffusion step t, the output is the same as x t Prediction noise of the same size ∈ θ (x t ,t), expected prediction noise∈ θ (x t ,t) is as different from the standard Gaussian distribution noise currently added as possible.

[0029] Furthermore, a noise predictor is set up based on the DiffWave network architecture, and the input dimension of DiffWave is expanded from a single channel [B, 1, 1, L] to an I and Q dual channel [B, 1, 2, L] adapted to the radio signal, where B represents the batch size of the training data and L represents the number of sampling points of the radio signal samples.

[0030] Furthermore, when training the noise predictor based on the neural network, the loss function is shown in formula (5):

[0031]

[0032] The total number of diffusion steps T is set to 200, β t The starting value is set to 0.0001 and the ending value is set to a uniform linear increasing constant of 0.02. The learning rate is 0.0002, the optimizer is Adam, the training data batch size is 128, and the number of iterations is 100000.

[0033] Furthermore, in step 3, adversarial perturbations are added to the radio signal test set to simulate the radio signal to be purified, and the radio signal time-frequency semantic guidance items are introduced into the inverse process of the diffusion model. The noise predictor is used to gradually sample and restore from the standard Gaussian noise to obtain the purified radio signal. The specific method is as follows:

[0034] Step 3.1: On the radio signal test set data, use the trained signal recognition model as the attack model and add adversarial perturbations to the normalized radio signal test set as the radio signal adversarial sample x to be purified. adv ;

[0035]

[0036] Where, L model (x, y) is the loss function of the signal recognition model, x is the normalized radio signal data, y is the corresponding category label, sign(·) represents the sign function, ε is the adversarial perturbation size, and the relationship between ε and the signal-to-interference ratio SPR is:

[0037] SPR = log(P signal / P perturb ) (7)

[0038]

[0039] Step 3.2, introducing the time domain and frequency domain semantics of the adversarial sample of the radio signal to be purified into the inverse process of the diffusion model, and gradually generating the purified radio signal from the standard Gaussian noise;

[0040] First, calculate the radio signal generated in reverse without guidance, starting at step T, and replace the standard Gaussian noise And the number of steps T are input into the trained noise predictor to obtain the predicted noise value According to the recursive formula (10), the inverse latent variables of the radio signal are calculated step by step:

[0041]

[0042] Then, the logarithmic probability distribution gradient of the radio signal adversarial sample to be fitted in the inverse purification process is calculated According to the Bayesian formula, it is expressed as formula (11):

[0043]

[0044] In the formula, p(x adv ) represents the distribution of adversarial samples of radio signals to be purified. The gradient of is 0; represents the distribution of the inverse latent variable of the radio signal, and its logarithmic probability distribution is relative to The gradient of is related to the predicted noise, i.e. Equivalent to is the distribution of radio signal adversarial samples under the condition of radio signal inverse latent variables, which indicates the probability that the radio signal inverse latent variables are close to the semantics of radio signal adversarial samples. Its logarithmic probability distribution is relative to Gradient As a guidance item based on the adversarial sample of the radio signal to be purified, the guidance item is introduced into the noise prediction, and the noise prediction formula under guidance is obtained as shown in formula (12):

[0045]

[0046] Replace the noise in equation (10) with equation (12): The inverse purification recursive formula guided by the adversarial sample of the radio signal to be purified is further unified into the calculation formula (13):

[0047]

[0048] In the formula, and They represent the inverse latent variables of the radio signal under the guidance of the t-1th step and the tth step respectively. For the inverse latent variables of the radio signal under the guidance of the Tth step, they are sampled from the standard Gaussian distribution, that is, g is the guidance term based on the adversarial sample of the radio signal to be purified. The guidance term is scaled by the scale factor s to control the degree of dependence on the guidance information when purifying the adversarial sample of the radio signal;

[0049] Next, in each step of the reverse purification, the guided reverse latent variables are gradually approached to the semantics of the adversarial sample in the current diffusion step in both the time domain and the frequency domain. Specifically, the adversarial sample x to be purified is calculated according to formula (4): adv The t-th step forward hidden variable The forward latent variable of the adversarial sample and the reverse latent variable under guidance The Manhattan distance metric between them measures the closeness of the two under guidance;

[0050] In the time domain guidance of radio signal adversarial samples, the time domain guidance term of the tth step The calculation formula is shown in formula (14):

[0051]

[0052] In the formula, ||·||1 represents the L1 norm calculation, which is equivalent to calculating the Manhattan distance;

[0053] The temporal guided scaling factor is defined as an increasing value related to t. Then the scale factor of the time-domain guided term is The calculation formula is shown in formula (15):

[0054]

[0055] In the frequency domain guidance of radio signal adversarial samples, the inverse latent variables are respectively And the forward hidden variable of the adversarial sample to be purified Perform short-time Fourier transform, use Manhattan distance, and frequency domain guidance term at diffusion step t The calculation formula is shown in formula (16):

[0056]

[0057] The scale factor after frequency domain transformation The calculation formula is shown in formula (17):

[0058]

[0059] Combining equations (13) to (17), the time-frequency-guided inverse purification recursive formula is shown in equation (18):

[0060]

[0061] After step-by-step recursion, we finally get the purified radio signal sample

[0062] A radio signal recognition system based on time-frequency guided adversarial sample purification implements the radio signal recognition method based on time-frequency guided adversarial sample purification to achieve radio signal recognition based on time-frequency guided adversarial sample purification.

[0063] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the radio signal recognition method based on time-frequency guided adversarial sample purification is implemented to achieve radio signal recognition based on time-frequency guided adversarial sample purification.

[0064] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the radio signal recognition method based on time-frequency guided adversarial sample purification to achieve radio signal recognition based on time-frequency guided adversarial sample purification.

[0065] Compared with the prior art, the present invention has the following significant advantages: it fully considers the characteristics of radio signals and significantly improves the recognition accuracy of the recognition model under adversarial sample attacks without changing the original signal recognition model. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 It is a system framework diagram in the present invention.

[0067] Figure 2 It is a comparison chart of the recognition accuracy of no purification and three purification methods under different SPR conditions in the embodiment of the present invention.

[0068] Figure 3 It is a comparison chart of recognition accuracy of no purification and three purification methods under different SNR conditions in an embodiment of the present invention. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0070] like Figure 1 As shown, the present invention is a novel radio signal recognition method based on time-frequency guided adversarial sample purification, and the specific steps are as follows:

[0071] Step 1, obtaining a radio signal data set, and using the radio signal training set to train a signal recognition model;

[0072] Step 1.1, obtain a radio signal dataset, including signal category labels and various time-domain IQ signal samples. Set the category labels to 0, 1, ..., N-1, where N represents the number of categories. For each radio signal sample, concatenate its I and Q signals into data of size [2, L], where the first row represents the I signal, the second row represents the Q signal, and L represents the number of sampling points of the radio signal sample; for each original radio signal sample x ori Use its effective value for normalization;

[0073] The effective value calculation formula is as follows:

[0074]

[0075] in, and Respectively represent the i-th sampling point of the original radio I-channel signal and Q-channel signal;

[0076] The normalized calculation formula is shown in formula (2):

[0077] x=x ori / e rms (2)

[0078] Using the normalized radio signals to construct a radio signal training set;

[0079] Step 1.2, training the signal recognition model. The radio signal training set data is used as a benign sample of the radio signal, and the benign sample of the radio signal is used to train the signal recognition model based on deep learning. The trained signal recognition model will not be changed later. The present invention does not make specific requirements for the neural network model. In the specific implementation of the present invention, ResNet18 is used as the basic network of the recognition model. The input of the network is a normalized radio signal, and the input size is [B, 1, 2, L], where B represents the batch size of the training data. The network output is the predicted probability of belonging to each category, and the output size is [B, N]. The category with the largest probability is taken as the signal category predicted by the recognition model. The loss function of the recognition model is the cross entropy loss function. The training parameters of the recognition model are: the learning rate is 0.001, the optimizer is Adam, the training data batch size is 128, and the number of training times is 50.

[0080] Step 2, gradually adding Gaussian noise to each sample in the radio signal training set according to the forward diffusion process of the diffusion model, and training a noise predictor based on a neural network to learn the noise value added at each step;

[0081] Step 2.1, according to the forward diffusion process of the diffusion model, T represents the total number of steps of the forward diffusion process, and the normalized radio signal x in the training set is used as the initial radio signal sample x0, and standard Gaussian noise is gradually added to x0 to obtain a series of radio signal forward latent variables x t ,t=1,2,...,T.

[0082] Specifically, the transition probability q(x t |x t-1 ) is a Gaussian distribution centered on its previous latent variable, and its mean and variance are a series of predefined hyperparameters. The calculation formula is shown in (3):

[0083]

[0084] Among them, β t ,t=1,2,...,T is a linearly increasing constant, ∈ is the noise that obeys the standard Gaussian distribution;

[0085] Furthermore, define α t =1-β t and The forward latent variable x of the radio signal at step t can be directly calculated from the normalized radio signal x0 t ~q(x t |x0), the calculation formula is shown in (4):

[0086]

[0087] x t ~q(x t |x0) is subject to the mean The variance is Gaussian distribution. In particular, since the total number of forward diffusion steps T is large enough, at t = T, the radio signal forward latent variable x T It obeys the standard Gaussian distribution.

[0088] Step 2.2, learn the radio signal data distribution p θ (x0) is equivalent to minimizing the number of steps from x0 to x at each step t. t The actual noise value added and the estimated noise value ∈ θ (x t ,t). Therefore, a neural network is constructed as a noise predictor to estimate the difference from x0 to x t The added noise value ∈ θ (x t ,t), expected prediction noise∈ θ (x t,t) is as different from the standard Gaussian distribution noise currently added as possible.

[0089] The noise predictor network input in the present invention is the radio signal forward latent variable x calculated by equation (4): t and the current diffusion step t, the output is the same as x t Prediction noise of the same size ∈ θ (x t ,t), represents the predicted forward latent variable x from the original radio signal x0 to the radio signal t The added noise value. Generally speaking, any neural network architecture that allows such input and output can be used as a noise predictor. In the specific implementation of the present invention, a noise predictor is set based on the existing DiffWave network architecture, and the input dimension of DiffWave is expanded from a single channel [B, 1, 1, L] to an I, Q dual channel [B, 1, 2, L] that adapts to radio signals. Furthermore, the loss function of the noise predictor training stage is shown in formula (5):

[0090]

[0091] In the formula, ∈ θ (x t ,t) is the network output, and the noise ∈ that obeys the standard Gaussian distribution is the label.

[0092] On the radio signal training set, the training parameters of the noise predictor are: the total number of diffusion steps T is set to 200, β t The starting value is set to 0.0001 and the ending value is set to a uniform linear increasing constant of 0.02. The learning rate is 0.0002, the optimizer is Adam, the training data batch size is 128, and the number of iterations is 100000.

[0093] Step 3, adding adversarial perturbations to the radio signal test set to simulate the radio signal to be purified, introducing the proposed radio signal time-frequency semantic guidance term into the inverse process of the diffusion model, and using the noise predictor to gradually sample and restore from the standard Gaussian noise to obtain the purified radio signal; the radio signal test set and the pre-training set are constructed using the same processing method, and the radio signal data is normalized based on the effective value.

[0094] Step 3.1, in a specific implementation of the present invention, adding adversarial perturbations to simulate adversarial samples of radio signals to be purified x to the radio signal test set adv .

[0095] Specifically, the radio signal adversarial attack of the Fast Gradient Sign Method (FGSM) is taken as an example: on the radio signal test set data, the trained signal recognition model is used as the attack model, and the radio signal FGSM adversarial sample is calculated according to formula (6), and it is used as the radio signal adversarial sample to be purified.

[0096]

[0097] Where, L model (x, y) is the loss function of the signal recognition model, x is the normalized radio signal data, y is the corresponding category label, sign(·) represents the sign function, and ε is the size of the adversarial disturbance. Furthermore, the present invention proposes a definition of the signal-to-perturbation ratio (SPR) based on the signal power and the disturbance power to determine the size of the adversarial disturbance, and the relevant calculation formulas are as follows: (7) to (9).

[0098] SPR = log(P signal / P perturb )(7)

[0099]

[0100] In step 3.2, the time domain and frequency domain semantics of the adversarial sample of the radio signal to be purified are introduced into the inverse process of the diffusion model, and the purified radio signal is gradually generated from the standard Gaussian noise.

[0101] First, calculate the radio signal generated in reverse without guidance. The starting step is T, and the standard Gaussian noise And the number of steps T are input into the trained noise predictor to obtain the predicted noise value According to the recursive formula (10), the inverse latent variables of the radio signal are calculated step by step:

[0102]

[0103] Then, the adversarial sample of the radio signal to be purified is regarded as a condition, and the logarithmic probability distribution gradient of the adversarial sample of the radio signal to be fitted in the reverse purification process is According to the Bayesian formula, it is expressed as formula (11):

[0104]

[0105] In the formula, p(x adv ) represents the distribution of the adversarial samples of the radio signal to be purified, because it is the inverse hidden variable of the radio signal is irrelevant, so in the derivation it is relative to The gradient of is 0; represents the distribution of the inverse latent variable of the radio signal. Studies have shown that its logarithmic probability distribution is relative to The gradient of is related to the predicted noise, i.e. Equivalent to is the distribution of radio signal adversarial samples under the condition of radio signal inverse latent variables, which indicates the probability that the radio signal inverse latent variables are close to the semantics of radio signal adversarial samples. Its logarithmic probability distribution is relative to Gradient As a guidance item based on the adversarial sample of the radio signal to be purified, the guidance item is introduced into the noise prediction, and the noise prediction formula under guidance is obtained as shown in formula (12):

[0106]

[0107] Replace the noise in equation (10) with equation (12): The inverse purification recursive formula guided by the adversarial sample of the radio signal to be purified is further unified into the calculation formula (13):

[0108]

[0109] In the formula, and They represent the inverse latent variables of the radio signal under the guidance of the t-1th step and the tth step respectively. For the inverse latent variables of the radio signal under the guidance of the Tth step, they are sampled from the standard Gaussian distribution, that is, g is a guidance term based on the adversarial sample of the radio signal to be purified. The guidance term is scaled with the help of the scale factor s to control the degree of dependence on the guidance information when purifying the adversarial sample of the radio signal.

[0110] Next, in each step of the reverse purification, the inverse latent variables guided by the encouragement gradually approach the semantics of the adversarial sample in the current diffusion step in both the time domain and the frequency domain.

[0111] Specifically, the adversarial sample x to be purified is calculated according to formula (4): adv The t-th step forward hidden variable The forward latent variable of the adversarial sample and the reverse latent variable under guidance The Manhattan distance metric between them measures the closeness of the two under guidance.

[0112] In the time domain guidance of radio signal adversarial samples, the time domain guidance term of the tth step The calculation formula is shown in formula (14):

[0113]

[0114] In the early stage of reverse purification, t is close to T. Close to standard Gaussian noise, the negative impact of adversarial disturbance on radio signals is small at this time. It is expected that the proportion of the guided term of the adversarial sample of radio signals is large enough, which means that the inverse hidden variable of the radio signal under guidance The closer The better the semantics. In the later stage of guiding reverse purification, Close to the radio signal adversarial sample x adv , it is desirable to reduce the weight of the guided term to avoid the adversarial disturbance remaining in the purified radio signal. Therefore, the present invention defines the time domain scaling factor as an increasing value related to t Then the scale factor of the time-domain guided term is The calculation formula is shown in formula (15):

[0115]

[0116] In the frequency domain guidance of radio signal adversarial samples, the inverse hidden variables are guided respectively. And the forward hidden variable of the adversarial sample to be purified The short-time Fourier transform is performed, and the relevant parameters used in the present invention are: the number of FFT points is set to 64, the window length is set to 64, and the interval between adjacent windows is set to 4. Using the Manhattan distance, the frequency domain guide term at the diffusion step t The calculation formula is shown in formula (16):

[0117]

[0118] The calculation formula for the scale factor after frequency domain transformation is as shown in formula (17):

[0119]

[0120] Combining equations (13) to (17), the time-frequency-guided inverse purification recursive formula proposed in the present invention is shown in equation (18):

[0121]

[0122] After step-by-step recursion, we finally get the purified radio signal sample

[0123] Step 4: The purified radio signal x puri The signal recognition model trained in step 1 is sent to the signal recognition model for recognition.

[0124] Example

[0125] To verify the effectiveness of the present invention, in the task of modulated signal type recognition, an experimental verification is performed using the public radio modulation signal dataset RML2016.10a based on the Python language and Pytorch framework. In this embodiment, the dataset is first normalized and divided according to step 1, and a radio signal modulation mode recognition model with ResNet as the network architecture is trained. Secondly, according to step 2, a noise predictor with an improved Diffwave as the network architecture is trained to learn the distribution of benign samples of radio modulation signals. Then, according to step 3, adversarial samples to be purified are generated using the radio signal FGSM attack based on the test set data, and the time domain and frequency domain semantics of the adversarial samples of the radio signal to be purified are used as guides, respectively, and the purified signal is generated using the inverse process of the diffusion model. Finally, in step 4, the purified signal is sent to the modulation mode recognition model for recognition. Figure 2 The effectiveness of the method proposed in the present invention is verified by comparing the recognition accuracy of no purification and three purification methods under different SPR conditions when the SNR is 10dB. Figure 3 The effectiveness of the method proposed in the present invention is verified by comparing the recognition accuracy of the three purification methods without purification under different SNR conditions when the SPR is 10dB. The results show that the method proposed in the present invention can effectively purify the adversarial disturbance under complex attack intensity and noise level conditions, and significantly improve the recognition accuracy of the purified signal.

[0126] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0127] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A radio signal recognition method based on time-frequency guided adversarial sample purification, characterized in that: The steps include: Step 1: obtain a radio signal dataset, including signal category labels and time-domain IQ signal samples, construct a radio signal training set, and train a signal recognition model based on deep learning; Step 2, according to the forward diffusion process of the diffusion model, Gaussian noise is gradually added to each sample in the radio signal training set to train a noise predictor based on a neural network; Step 3, adding adversarial perturbations to simulate the radio signals to be purified to the normalized radio signal test set, introducing the radio signal time-frequency semantic guidance term into the inverse process of the diffusion model, and using the noise predictor to gradually sample and restore from the standard Gaussian noise to obtain the purified radio signal; Step 4: Send the purified radio signal to the trained signal recognition model for recognition.

2. The radio signal recognition method based on time-frequency guided adversarial sample purification according to claim 1 is characterized in that: Step 1: Obtain a radio signal dataset, including signal categories and time-domain IQ signal samples, and train a signal recognition model based on deep learning. The specific method is as follows: Step 1.1, obtain a radio signal dataset, including signal category labels and various time-domain IQ signal samples; set the signal category labels to 0, 1, ..., N-1, where N represents the number of categories; for each radio signal sample, concatenate its I and Q signals into data of size [2, L], where the first row represents the I signal, the second row represents the Q signal, and L represents the number of sampling points of the radio signal sample; for each original radio signal sample x ori Use its effective value for normalization; The effective value calculation formula is as follows: in, and Respectively represent the i-th sampling point of the original radio I-channel signal and Q-channel signal; The normalized calculation formula is shown in formula (2): x=x ori / e rms (2) constructing a radio signal training set using the normalized radio signal; Step 1.2, train the signal recognition model based on deep learning. The signal recognition model based on deep learning uses ResNet18 as the basic network. The input of the network is the normalized radio signal. The input size is [B, 1, 2, L], where B represents the batch size of the training data. The output is the predicted probability of belonging to each category. The output size is [B, N]. The category with the largest probability is taken as the predicted signal category.

3. The radio signal recognition method based on time-frequency guided adversarial sample purification according to claim 2 is characterized in that: When training the deep learning-based signal recognition model, the loss function is the cross entropy loss function, the learning rate is 0.001, the optimizer is Adam, the training data batch size is 128, and the number of training times is 50.

4. The radio signal recognition method based on time-frequency guided adversarial sample purification according to claim 1 is characterized in that: Step 2: According to the forward diffusion process of the diffusion model, Gaussian noise is gradually added to each sample in the radio signal training set to train a noise predictor based on a neural network. The specific method is as follows: Step 2.1, according to the forward diffusion process of the diffusion model, T represents the total number of steps of the forward diffusion process, and the normalized radio signal x in the training set is used as the initial radio signal sample x0, and standard Gaussian noise is gradually added to x0 to obtain a series of radio signal forward latent variables x t ,t=1,2,...,T, where: The transition probability q(x) of the forward latent variable of the radio signal at each step t |x t-1 ) is a Gaussian distribution centered on its previous latent variable, whose mean and variance are a series of predefined hyperparameters, as shown in (3): Among them, β t ,t=1,2,...,T is a linearly increasing constant, ∈ is the noise that obeys the standard Gaussian distribution; Define α t =1-β t , The forward latent variable x of the radio signal at step t is directly calculated from the normalized radio signal x0 t ~q(x t |x0), the calculation formula is shown in (4): x t ~θ(x t |x0) is subject to the mean The variance is Gaussian distribution, at t = T, the radio signal forward latent variable x T Obey standard Gaussian distribution; Step 2.2: Train a noise predictor based on a neural network. The input of the noise predictor is the radio signal forward latent variable x calculated by equation (4): t and the current diffusion step t, the output is the same as x t Prediction noise of the same size ∈ θ (x t ,t), expected prediction noise∈ θ (x t ,t) is as different from the standard Gaussian distribution noise currently added as possible.

5. The radio signal recognition method based on time-frequency guided adversarial sample purification according to claim 4 is characterized in that: The noise predictor is set up based on the DiffWave network architecture, and the input dimension of DiffWave is expanded from a single channel [B, 1, 1, L] to an I, Q dual channel [B, 1, 2, L] adapted to the radio signal. B represents the batch size of the training data, and L represents the number of sampling points of the radio signal samples.

6. The radio signal recognition method based on time-frequency guided adversarial sample purification according to claim 4 is characterized in that: When training a noise predictor based on a neural network, the loss function is shown in formula (5): The total number of diffusion steps T is set to 200, β t The starting value is set to 0.0001 and the ending value is set to a uniform linear increasing constant of 0.

02. The learning rate is 0.0002, the optimizer is Adam, the training data batch size is 128, and the number of iterations is 100000.

7. The radio signal recognition method based on time-frequency guided adversarial sample purification according to claim 4 is characterized in that: Step 3: Add adversarial perturbations to the radio signal test set to simulate the radio signal to be purified, introduce the radio signal time-frequency semantic guidance term into the inverse process of the diffusion model, and use the noise predictor to gradually sample and restore from the standard Gaussian noise to obtain the purified radio signal. The specific method is as follows: Step 3.1: On the radio signal test set data, use the trained signal recognition model as the attack model and add adversarial perturbations to the normalized radio signal test set as the radio signal adversarial sample x to be purified. adv ; Where, L model (x, y) is the loss function of the signal recognition model, x is the normalized radio signal data, y is the corresponding category label, sign(·) represents the sign function, ε is the adversarial perturbation size, and the relationship between ε and the signal-to-interference ratio SPR is: SPR=log(P signal / P perturb )(7) Step 3.2, introducing the time domain and frequency domain semantics of the adversarial sample of the radio signal to be purified into the inverse process of the diffusion model, and gradually generating the purified radio signal from the standard Gaussian noise; First, calculate the radio signal generated in reverse without guidance, starting at step T, and replace the standard Gaussian noise And the number of steps T are input into the trained noise predictor to obtain the predicted noise value According to the recursive formula (10), the inverse latent variable of the radio signal is calculated step by step: Then, the logarithmic probability distribution gradient of the radio signal adversarial sample to be fitted in the inverse purification process is calculated According to the Bayesian formula, it is expressed as formula (11): In the formula, p(x adv ) represents the distribution of adversarial samples of radio signals to be purified. The gradient of is 0; represents the distribution of the inverse latent variable of the radio signal, and its logarithmic probability distribution is relative to The gradient of is related to the predicted noise, i.e. Equivalent to is the distribution of radio signal adversarial samples under the condition of radio signal inverse latent variables, which indicates the probability that the radio signal inverse latent variables are close to the semantics of radio signal adversarial samples. Its logarithmic probability distribution is relative to Gradient As a guidance item based on the adversarial sample of the radio signal to be purified, the guidance item is introduced into the noise prediction, and the noise prediction formula under guidance is obtained as shown in formula (12): Replace the noise in equation (10) with equation (12): The inverse purification recursive formula guided by the adversarial sample of the radio signal to be purified is further unified into the calculation formula (13): In the formula, and They represent the inverse latent variables of the radio signal under the guidance of the t-1th step and the tth step respectively. For the inverse latent variables of the radio signal under the guidance of the Tth step, they are sampled from the standard Gaussian distribution, that is, g is the guidance term based on the adversarial sample of the radio signal to be purified. The guidance term is scaled by the scale factor s to control the degree of dependence on the guidance information when purifying the adversarial sample of the radio signal; Next, in each step of the reverse purification, the guided reverse latent variables are gradually approached to the semantics of the adversarial sample in the current diffusion step in both the time domain and the frequency domain. Specifically, the adversarial sample x to be purified is calculated according to formula (4): adv The t-th step forward hidden variable The forward latent variable of the adversarial sample and the reverse latent variable under guidance The Manhattan distance metric between them measures the closeness of the two under guidance; In the time domain guidance of radio signal adversarial samples, the time domain guidance term of the tth step The calculation formula is shown in formula (14): In the formula, ||·||1 represents the L1 norm calculation, which is equivalent to calculating the Manhattan distance; The temporal guided scaling factor is defined as an increasing value related to t. Then the scale factor of the time-domain guided term is The calculation formula is shown in formula (15): In the frequency domain guidance of radio signal adversarial samples, the inverse latent variables are respectively And the forward hidden variable of the adversarial sample to be purified Perform short-time Fourier transform, use Manhattan distance, and frequency domain guidance term at diffusion step t The calculation formula is shown in formula (16): The scale factor after frequency domain transformation The calculation formula is shown in formula (17): Combining equations (13) to (17), the time-frequency-guided inverse purification recursive formula is shown in equation (18): After step-by-step recursion, we finally get the purified radio signal sample 8. A radio signal recognition system based on time-frequency guided adversarial sample purification, characterized in that: Implement the radio signal recognition method based on time-frequency guided adversarial sample purification as described in any one of claims 1 to 7 to achieve radio signal recognition based on time-frequency guided adversarial sample purification.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for radio signal recognition based on time-frequency guided adversarial sample purification according to any one of claims 1 to 7 is implemented to realize radio signal recognition based on time-frequency guided adversarial sample purification.

10. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for radio signal recognition based on time-frequency guided adversarial sample purification according to any one of claims 1 to 7 is implemented to realize radio signal recognition based on time-frequency guided adversarial sample purification.

Images