A CPE identification system adversarial defense method and device based on TCAE time-domain convolutional autoencoder and multimodal adversarial training

Abstract

The present invention discloses an adversarial defense method and device for a CPE identification system based on a TCAE time-domain convolutional autoencoder and multimodal adversarial training. The method comprises the following steps: first, collecting multimodal data of the CPE identification system for preprocessing and extracting feature vectors; then generating and fusing multimodal adversarial samples; then utilizing TCAE encoding and decoding, noise reduction, and adversarial training; and finally, using an adversarial defense strategy to purify disturbances. Finally, the system is optimized. The present invention combines the feature extraction capability of the time-domain convolutional autoencoder, the adaptability of multimodal adversarial sample fusion to complex attacks, and the defense optimization mechanism of adversarial training. This method can not only improve the model's defense capability against single-modal attacks, but also enhance the model's generalization capability against unknown attacks through multimodal feature fusion and adversarial training, thereby more effectively resisting adversarial attacks and improving the overall security of CPE identification technology based on deep learning.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security and information confrontation technology, and more specifically to a CPE identification system confrontation defense method and device based on TCAE time-domain convolutional autoencoder and multimodal confrontation training. Background Art

[0002] Currently, in the field of network security, Common Platform Enumeration (CPE) identification systems, as a core technology for standardized identification and vulnerability management of network devices, software, and systems, play a vital role in network security protection systems. However, with the widespread application of deep learning technology in CPE identification, its data-driven nature has made it face a serious threat from adversarial attacks. Adversarial attacks, by injecting small perturbations into the input data, can mislead deep learning models into outputting erroneous results, significantly reducing the accuracy of CPE identification. For example, attackers can tamper with training data or inject adversarial samples during the testing phase, preventing the CPE identification system from accurately identifying software components and their versions, thereby compromising the reliability of vulnerability association and security assessments. Furthermore, the stealth and targeted nature of adversarial attacks enable them to bypass traditional security protection mechanisms, further exacerbating security risks in the software supply chain. Therefore, in the context of deep learning empowerment, CPE identification technology urgently needs to introduce efficient adversarial defense mechanisms to enhance its robustness and security and effectively resist the harm caused by adversarial attacks.

[0003] The Temporal Convolutional Auto-Encoder (TCAE) efficiently processes time series data and extracts complex features by combining the local perception capabilities of a Temporal Convolutional Network (TCN) with the feature compression and reconstruction capabilities of an autoencoder. In CPE identification tasks, TCAE encodes the time series features of software components (such as version information and dependencies) into low-dimensional feature representations and reconstructs these features through a decoder to verify their accuracy. This encoder-decoder structure not only extracts key features but also effectively removes noise and redundant information, improving the robustness of the model. Furthermore, through reconstruction error detection and adversarial training mechanisms, TCAE can effectively identify and defend against adversarial sample attacks, providing reliable technical support for vulnerability correlation and security assessment.

[0004] Multimodal adversarial example fusion technology integrates features and information from different modalities to more comprehensively capture the intrinsic structure and semantics of data. Based on the Fast Gradient Sign Method (FGSM), the Basic Iterative Method (BIM), and the Projected Gradient Descent (PGD) method, this technology generates more deceptive adversarial examples for use in adversarial training to enhance the model's defense capabilities. The advantages of multimodal adversarial example fusion in adversarial attack defense are primarily reflected in the following aspects: First, by fusing adversarial examples from different modalities, it can more realistically simulate complex attack scenarios, enhancing the model's adaptability to diverse attacks. Second, multimodal fusion technology improves the model's robustness to input data and mitigates the impact of perturbations from a single modality. Finally, by optimizing the feature extraction process, it enhances the model's ability to identify key features, thereby improving the model's overall performance against adversarial attacks. Therefore, multimodal adversarial example fusion technology is of great significance in deep learning-based CPE identification technology, significantly improving the model's defense capabilities against adversarial attacks and providing more reliable technical support for software security vulnerability management.

[0005] Adversarial training, as a mainstream defense strategy, has been widely used to improve the robustness of deep learning models. Its core idea is to introduce adversarial examples during model training and optimize the loss function to enable the model to learn the feature distribution of adversarial examples, thereby enhancing its resistance to gradient attacks. For example, existing technologies have significantly improved the robustness of models to adversarial attacks by introducing label smoothing corrections and optimizing the loss function for adversarial examples. In the field of CPE recognition, the role of adversarial training is mainly reflected in the following aspects: First, it can enhance the robustness of the model to input data and reduce the impact of single-modal perturbations on recognition results; second, adversarial examples generated through adversarial training can be used as a form of data augmentation to enrich the training dataset and improve the model's adaptability to complex attack scenarios; finally, adversarial training can optimize the feature extraction process and enhance the model's ability to recognize key features, thereby maintaining a high recognition accuracy rate in the face of adversarial attacks.

[0006] However, existing technologies still have the following limitations:

[0007] Although the Temporal Convolutional Network (TCN) can capture long-term correlations through a large receptive field when processing time series data, its reliance on temporal pooling layers to expand the receptive field may lead to the loss of fine-grained information when processing low-resolution temporal data.

[0008] When processing complex multimodal data, TCN has difficulty in effectively fusing features from different modalities, which limits its application in multimodal CPE identification.

[0009] The generation and fusion of multimodal adversarial examples is complex and computationally expensive, and there are still challenges with heterogeneity between different modalities, which may lead to unstable defense effects of the model against cross-modal attacks.

[0010] Although adversarial training can improve the robustness of the model, it may cause the model to overfit on adversarial samples, reducing its generalization ability in unknown attack scenarios. At the same time, it requires a large amount of computing resources to generate and process adversarial samples, which limits its practical application efficiency.

[0011] Therefore, how to make up for the lack of robustness of existing CPE identification technology in the face of adversarial attacks is an urgent problem that those skilled in the art need to solve. Summary of the Invention

[0012] In view of this, the present invention provides a CPE identification system adversarial defense method and device based on TCAE time-domain convolutional autoencoder and multimodal adversarial training, aiming to solve the problem of insufficient robustness of existing CPE identification technology in the face of adversarial attacks.

[0013] In order to achieve the above object, the present invention adopts the following technical solutions:

[0014] A CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training, including:

[0015] Collect multimodal data from the CPE identification system, preprocess the multimodal data, and extract feature vectors;

[0016] Generate multimodal adversarial samples and fuse adversarial samples of different modalities to simulate complex attack scenarios;

[0017] Use the time-domain convolutional autoencoder to encode and decode the preprocessed feature vector, extract the time series features and perform noise reduction on the adversarial samples;

[0018] The fused multimodal adversarial samples and normal samples are input into the CPE recognition system for adversarial training.

[0019] Use adversarial defense strategies to purify adversarial perturbations in input data;

[0020] Optimize the CPE recognition system after adversarial training.

[0021] Optionally, the method for generating multimodal adversarial samples includes FGSM, BIM and PGD.

[0022] Optionally, the process of generating adversarial samples by FGSM is:

[0023] Prepare clean samples, the true labels of clean samples, the loss function of the target network, and the perturbation ratio;

[0024] Select a pre-trained deep learning model for CPE identification;

[0025] Prepare a normal clean input sample, which is CPE information that the deep learning model can correctly identify;

[0026] Use the model to forward propagate the input sample to obtain the output of the model;

[0027] Calculate the loss function, usually using the cross-entropy loss function, which is used to measure the difference between the model prediction result and the true label;

[0028] FGSM determines the direction of the perturbation by calculating the gradient with respect to the input clean sample;

[0029] Calculate the gradient of the loss function with respect to the input clean sample and generate perturbations;

[0030] Add the generated perturbations to the clean samples to obtain adversarial samples.

[0031] Optionally, the process of generating adversarial samples by BIM is as follows:

[0032] First, α = ε / k, where k is the number of iterations, then, When k=0 to k=K-1, the disturbance is The adversarial example is

[0033] Optionally, the process of generating adversarial samples by PGD is:

[0034] First, initialize θ, when the round e = 0 to e = K ep -1, g0=0, Then, when k = 0 to k = K-1, the perturbation is The adversarial example is At this time, the stochastic gradient descent method is used to update θ, that is, θ e+1 =θ e -τg e , through continuous iteration, adversarial samples are generated.

[0035] Optionally, the time-domain convolutional autoencoder is constructed as follows:

[0036] In the encoder module, three residual units (RU1, RU2, and RU3) are stacked in the TCN extractor. The first residual unit RU1 contains a residual map, two dropout layers, two ReLU layers, and two dilated causal convolutional layers with a dilation factor of d = 1 and a kernel size of ker = 4. Unlike RU1, the dilation factors of RU2 and RU3 are d = 8 and d = 16, respectively.

[0037] The residual connection and dilated causal convolution as the key elements of TCN are expressed as:

[0038]

[0039] Where f(·) and * refer to the convolution filter and convolution operation respectively; the index of the prior information is represented by (sd)·ker, and the range of the receptive field is defined as L d =d·ker;

[0040] The residual unit consists of residual connections and stacked dilated causal convolutions; F d (x) is defined as the output of the superimposed dilated causal convolution, and the residual connection is expressed as:

[0041] Z=Φ(x+F d (x))

[0042] Where Φ(·) represents the ReLU activation function;

[0043] The corresponding decoder module structure is exactly opposite to the encoder structure, and the two are symmetrical structures.

[0044] Optionally, the output of the three residual units is expressed as:

[0045] Z1=RU1(x,d,ker)=RU1(x,1,4)

[0046] Z2=RU2(Z1,d,ker)=RU2(Z1,8,4)

[0047] Z3=RU3(Z2,d,ker)=RU3(Z2,16,4)

[0048] Where Z1, Z2 and Z3 represent the outputs of the three residual units; d represents the dilation factor; and ker represents the filter size.

[0049] Optionally, it also includes contrast difference calculation: calculate the input clean sample x and adversarial sample x adv The contrast between the feature representations of

[0050] Anomaly detection: Determine whether the input data is an adversarial sample based on the contrast difference D; if D exceeds the preset value, the input data is considered an adversarial sample and corresponding defense processing is performed.

[0051] A CPE identification system adversarial defense device based on TCAE time-domain convolutional autoencoder and multimodal adversarial training, comprising:

[0052] Data acquisition module, used to collect multimodal data and perform preprocessing;

[0053] Feature extraction module, including time-domain convolutional autoencoder, used to extract time series features;

[0054] Adversarial sample generation module, used to generate multimodal adversarial samples and fuse them;

[0055] An adversarial training module, configured to input the adversarial samples and normal samples into the CPE recognition system for training;

[0056] Defense module, used to reduce adversarial perturbations in input data;

[0057] The system optimization module is used to optimize and test the CPE identification system.

[0058] As can be seen from the above technical solution, compared with the existing technology, the present invention provides a CPE identification system adversarial defense method and device based on TCAE time-domain convolutional autoencoders and multimodal adversarial training. By combining the feature extraction capabilities of the time-domain convolutional autoencoder, the adaptability to complex attacks of multimodal adversarial sample fusion, and the defense optimization mechanism of adversarial training, the robustness and accuracy of the CPE identification system under adversarial attacks are significantly improved. This invention not only enhances the model's adaptability to complex attack scenarios and reduces system resource consumption, but also improves the efficiency and reliability of vulnerability management, providing a more efficient and accurate technical solution for software security vulnerability management. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0060] Figure 1 A schematic diagram of the defense framework structure of the CPE identification system provided by the present invention;

[0061] Figure 2 Schematic diagram of the adversarial sample features provided by the present invention;

[0062] Figure 3 The working principle of the automatic encoder provided by the present invention in countering attacks;

[0063] Figure 4 This is a schematic diagram of the TCAE framework structure provided by the present invention. DETAILED DESCRIPTION

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0065] The embodiment of the present invention discloses a CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training, such as Figure 1 Shown, including:

[0066] Collect multimodal data from the CPE identification system, including but not limited to vulnerability signatures, software version information, operation logs, network traffic data, etc., and preprocess the multimodal data (including adversarial samples) to extract feature vectors. Preprocessing steps include data cleaning, normalization, dimensionality reduction, and feature extraction to ensure the quality and consistency of the input data.

[0067] Multimodal adversarial examples are generated using methods such as FGSM (Fast Gradient Sign Method), BIM (Basic Iterative Method), and PGD (Projected Gradient Descent). These adversarial examples from different modalities are then fused to simulate complex attack scenarios. Fusion strategies include weighted averaging, feature concatenation, and dynamically adjusting the importance of each modality through an attention mechanism to enhance the diversity and complexity of adversarial examples.

[0068] A time-domain convolutional autoencoder is used to encode and decode the preprocessed feature vectors, extracting temporal features and performing noise reduction on adversarial examples. Through convolutional and deconvolutional layers, the time-domain convolutional autoencoder captures the local features and long-term dependencies of temporal data while removing noise and redundant information from the input data, enhancing feature robustness.

[0069] The fused multimodal adversarial samples are fed into the CPE recognition system along with normal samples for adversarial training to enhance the system's robustness. Adversarial training optimizes the loss function, enabling the model to simultaneously learn the characteristics of both normal and adversarial samples during training, thereby improving the model's resistance to adversarial attacks.

[0070] Design an adversarial defense module, including a noise reducer, to purify adversarial perturbations in input data. This module uses defense strategies generated through feature reconstruction, anomaly detection, or adversarial training to further mitigate the impact of adversarial examples on the model, improving the system's overall defense capabilities.

[0071] Optimize the adversarially trained CPE recognition system, including adjusting the model structure, optimizing hyperparameters, and applying regularization techniques to improve system performance and robustness. Test the system in real or simulated environments to verify its robustness and accuracy, ensuring it can operate stably and maintain high recognition accuracy in the face of adversarial attacks.

[0072] In a specific embodiment, adversarial attacks involve adding subtle, imperceptible perturbations to input data, altering the output of a machine learning model. These perturbations can be mathematically represented as a vector η, designed to maximize the impact on the model's loss function J. Adversarial attack defenses for CPE identification systems, which are also based on deep learning neural networks, are also susceptible to adversarial attacks. Therefore, adversarial training techniques are needed to enhance security.

[0073] Fast Gradient Sign Method (FGSM) is a simple yet effective adversarial attack method. The mathematical principle of FGSM is based on the gradient ascent algorithm. In contrast to the gradient descent algorithm, FGSM maximizes the loss function by adding the sign of the gradient to the original input. Specifically, it leverages the gradient information of a deep learning model to generate adversarial examples by adding carefully crafted perturbations to the input data. These examples, while remaining similar to the original data, can mislead the model into making incorrect predictions. The core idea of ​​FGSM is to leverage the model's gradient information to generate adversarial examples that, while remaining similar to the original data, can mislead the model into making incorrect predictions. This method achieves this by adding subtle perturbations to the original input that are barely visually noticeable but sufficient to cause the model to produce different outputs. FGSM has significant negative impacts on deep learning-based CPE identification systems, primarily manifesting in model misclassifications, reduced robustness, and exposed security vulnerabilities. However, by implementing defense strategies such as data augmentation, gradient regularization, model regularization, and feature extraction, system security can be effectively improved to mitigate the threat posed by FGSM attacks.

[0074] The Basic Iterative Method (BIM) attack is a gradient-based iterative adversarial attack method, an extension of the Fast Gradient Sign Method (FGSM). It gradually increases perturbations through multiple iterations, thereby increasing the success rate of adversarial examples. BIM's core features include iterative optimization, a pruning mechanism, and flexibility. The adversarial examples generated through iterative optimization can more effectively simulate real-world attack scenarios, helping researchers assess the model's vulnerability to complex attacks. Furthermore, adversarial examples generated by BIM are used in adversarial training. By introducing adversarial examples during training, the model's generalization and robustness against unknown attacks is improved. In the application of CPE identification systems, the BIM method generates multimodal adversarial examples (such as vulnerability signatures and software version information) and fuses them to simulate complex attack scenarios. This fusion strategy enhances the model's adaptability to cross-modal attacks. Using BIM-generated adversarial examples for adversarial training, combined with the feature extraction capabilities of a time-domain convolutional autoencoder, further optimizes the defense mechanism of the CPE identification system. The robustness of the CPE identification system in the face of adversarial attacks is tested through BIM attacks, and the stability of the system is comprehensively evaluated by combining methods such as noise injection and data loss simulation.

[0075] The Projected Gradient Descent Attack (PGD) attack is a powerful iterative adversarial attack method and an iterative gradient optimization method. It is widely used to generate adversarial examples to evaluate and enhance the robustness of deep learning models. It is an extension of the Fast Gradient Sign Method (FGSM), which generates more aggressive adversarial examples by optimizing the perturbation over multiple iterations. PGD attacks are characterized by robust adversarial example generation, high transferability, stability, and iterative optimization, making them a key tool for assessing model security. PGD is widely used in adversarial training, improving the robustness of models against adversarial attacks by introducing adversarial examples during training. PGD has also been used to study model stability and security.

[0076] Adversarial training is a method that enhances model robustness by introducing adversarial examples during the training process. Its core is to construct adversarial examples and incorporate them into the training set, enabling the model to learn to recognize and resist these perturbations during training. Adversarial training can: 1) improve robustness: Adversarial training significantly enhances the model's robustness against adversarial attacks; 2) regularize: As an effective regularization method, adversarial training helps improve the model's generalization ability; and 3) reduce the burden of data preprocessing: The model is capable of handling input perturbations, reducing the need for data preprocessing.

[0077] The Temporal Convolutional Autoencoder (TCAE) is a deep learning model that combines a Temporal Convolutional Network (TCN) with an autoencoder. It is primarily used to process time series data, effectively capturing long-term dependencies within the sequence and extracting low-dimensional features from the data through the compression and reconstruction capabilities of the autoencoder. By combining the advantages of capturing long-term dependencies, feature extraction, and model robustness, TCAE reduces data noise and improves the model's robustness to noise and outliers.

[0078] In order to cope with the adversarial attacks faced by the CPE identification system, this paper uses FGSM, BIM and PGD to generate adversarial samples of different modalities. The features of adversarial samples are as follows: Figure 2 As shown in the figure, adversarial training is used to improve the robustness of the model by using adversarial samples of different modalities, while TCAET is used to filter and reduce the noise in the data center, thereby improving the robustness and security of the CPE identification system. The specific implementation is as follows:

[0079] 1. Multimodal Adversarial Sample Fusion

[0080] 1. FGSM adversarial sample generation

[0081] The core idea of ​​FGSM is to use the gradient information of the model to guide the addition of perturbations. The process of generating adversarial samples is as follows: prepare clean samples x, the true label of clean samples x The loss function J of the target network and the perturbation ratio ε.

[0082] Select a pre-trained deep learning model for CPE identification;

[0083] Prepare a normal clean input sample x, which is the CPE information that the model can correctly identify;

[0084] Use the model to forward propagate the input sample x to obtain the output of the model;

[0085] Calculate the loss function L, usually using the cross entropy loss function to measure the difference between the model prediction result and the true label The difference between . Generate x and Gradient loss function

[0086] FGSM calculates the gradient with respect to the input x To determine the direction of the disturbance;

[0087] Calculate the gradient ▽ of the loss function L with respect to the input sample x xL, this step is achieved through back propagation; through operation, the perturbation is generated Here, ε is a small constant used to control the size of the perturbation. Choosing an appropriate value of ε is crucial. A perturbation that is too small may not be enough to change the model's prediction, while a perturbation that is too large may make the adversarial sample visually significantly different from the original sample.

[0088] Add the generated perturbation to the clean sample to obtain the adversarial sample:

[0089]

[0090] Among them, w is the weight, b is the bias vector, and FGSM calculates the loss function. The optimization goal of FGSM is to maximize the loss function of the model, that is: In ||η|| ∞ <ε, where ||·|| ∞ represents the infinity norm.

[0091] Through the above steps, effective adversarial samples can be generated in the deep learning-based CPE identification system to test and evaluate the robustness and security of the model.

[0092] 2. BIM adversarial sample generation

[0093] Based on the idea of ​​gradient attack, the input is iteratively updated to obtain more effective adversarial samples. BIM is an extension of FGSM attack. It searches for the optimal attack through multiple iterations. The core idea of ​​BIM attack is to apply a small perturbation to the input sample according to the gradient direction of the loss function in each iteration, and ensure that the total size of the perturbation does not exceed the preset threshold ε through the loss function. The process of generating adversarial samples by BIM can be expressed as:

[0094] First, α = ε / k, where k is the number of iterations and α is the step size. Then, When k=0 to k=K-1, the disturbance is The adversarial example is:

[0095]

[0096] In the process of adversarial sample generation, 1) BIM gradually adjusts the adversarial sample through multiple iterations, which can generate more effective adversarial samples compared to the single-step attack of FGSM; 2) the total size of the perturbation is limited by the loss function to ensure that the adversarial sample is within a reasonable range; 3) BIM attack is computationally efficient and suitable for generating adversarial samples for large-scale data.

[0097] 3. PGD adversarial sample generation

[0098] Similar to BIM, the Projected Gradient Descent (PGD) algorithm projects each attack result onto the ε norm, so that the direction of the gradient attack falls within the feasible domain. The execution of PGD is similar to BIM:

[0099] First, initialize θ, when the round e = 0 to e = K ep -1, g0=0, Then, when k = 0 to k = K-1, the perturbation is The adversarial example is:

[0100]

[0101] At this time, the stochastic gradient descent method is used to update θ.

[0102] Right now θ e+1 =θ e -τg e ,

[0103] Among them, θ is the target model parameter, K ep is the number of iterations of the outer loop, g0 is the initial gradient, θ e+1 represents the model parameters at the e+1th iteration, g e represents the gradient at the e-th iteration, represents the adversarial sample generated at step k, represents the expected value of the sample (x, y) in the dataset D, and τ represents the learning rate.

[0104] Through continuous iteration, adversarial samples are generated.

[0105] 4. The generated adversarial samples are combined with adversarial samples from different modalities through a fusion algorithm to simulate complex attack scenarios. A deep learning algorithm is used to fuse multimodal features, and an adaptive learning mechanism is used to adjust the weights of each modal data to enhance the model's sensitivity to different modal data.

[0106] Adversarial Training

[0107] Adversarial training refers to the use of adversarial examples to perform secondary training on the model, reducing overfitting through regularization, thereby improving the robustness of the DL model. Mathematically, this is a Min-Max problem, which can be expressed as:

[0108]

[0109] Where, is the adversarial loss, κ is the network weight, x adv refers to adversarial samples, is the true label, D(x,x adv ) represents x and x adv That is, we first achieve the maximum attack effect by finding the most effective adversarial sample, and then achieve the minimum prediction or classification loss.

[0110] The optimization goal of adversarial training can be expressed as a two-level optimization problem, specifically:

[0111]

[0112] Among them, θ represents the parameters of the model, Represents the input and label sampled from the data distribution D. L represents the loss function, and f(x+η; θ) represents the prediction result of the model after adding the perturbation. Adversarial training refers to 1) inner layer maximization, that is, generating adversarial samples x+η to maximize the loss L of the model f on these samples. In this invention, it is achieved through the attack algorithms FGSM, BIM and PGD; 2) outer layer minimization, the goal is to minimize the loss of the model on the adversarial samples by optimizing the model parameters θ. The working principle of the autoencoder in adversarial attack is as follows Figure 3 As shown;

[0113] Adversarial training is an effective method to improve model robustness. In the CPE recognition system, the specific implementation method is as follows:

[0114] 1. Data preprocessing: Preprocess the input data of the CPE identification system, including data cleaning, normalization and other operations, to improve data quality and provide a good foundation for subsequent training.

[0115] 2. Initial model training: Using the preprocessed data, the CPE identification system is initially trained through traditional machine learning methods or deep learning models to obtain the initial model.

[0116] 3. Adversarial Sample Generation:

[0117] Select a suitable adversarial attack method (the ones used in this invention are FGSM, BIM, PGD, etc.), and generate adversarial samples on the input data based on the gradient information of the initial model. The specific formula is: adv =x+ε·sign(▽ x L), where x is the input clean sample, x adv is the generated adversarial sample, ε is the perturbation intensity parameter, ▽ x L is the gradient of the loss function L with respect to the input data x. The generated adversarial examples should maintain visual or logical similarity with the original data while being able to cause the model to produce incorrect outputs.

[0118] 4. Adversarial Training

[0119] The generated adversarial examples are mixed with the original data to form a new training dataset.

[0120] The initial model is retrained using a new training dataset, and the model parameters are adjusted so that the model can also produce correct outputs on adversarial examples. In this way, the model learns more robust feature representations and enhances its ability to resist adversarial attacks.

[0121] During the training process, strategies such as gradually increasing the proportion of adversarial samples and adjusting the perturbation intensity can be adopted to gradually improve the robustness of the model.

[0122] 5. Model Evaluation and Optimization: Use an independent test dataset to evaluate the trained model, including metrics such as accuracy and robustness. Based on the evaluation results, further optimize the model, such as adjusting the network structure and hyperparameters, to improve model performance.

[0123] 6. Defense Effectiveness Verification: The effectiveness of the defense method based on adversarial training is verified by comparing the performance of the model before and after training under adversarial attacks. Specifically, the defense effectiveness can be evaluated by calculating indicators such as the improvement in the model's accuracy on adversarial examples and the reduction in the false positive rate.

[0124] The present invention is a CPE identification system defense method based on TCAE, wherein TCAE is an autoencoder based on TCN (Temporal Convolutional Network), that is, the encoder and decoder parts of the TCAE method are mainly based on the TCN model architecture. TCN is a deep learning model specifically designed for processing time series data. It uses convolutional layers rather than recurrent layers to process sequence dependencies. It is an efficient and powerful time series feature extraction network with many advantages, including the ability to implement parallel processing, variable receptive field size, and stable gradients. TCN is also a network with causal convolution, which can prevent information from leaking from the past to the future.

[0125] In addition, the TCN model can effectively learn the features related to non-stationary sequences and better fit the temporal shape of multi-carrier signal features. TCN can capture action composition, segment duration, and long-range dependencies, and its training speed is an order of magnitude faster than that of LSTM-based recurrent neural networks. Figure 4 As shown;

[0126] 1. Input data acquisition: Get the CPE data x to be identified;

[0127] 2. Construction of time-domain convolutional autoencoder

[0128] In the encoder module, three residual units (RU1, RU2, and RU3) are stacked in the TCN extractor to improve the discrimination between modulation modes. Figure 4 In

[15] , the first residual unit RU1 contains a residual map, two Dropout layers, two ReLU layers, and two dilated causal convolution layers (dilation factor d = 1 and kernel size ker = 4). In this residual unit, the input sample first passes through the first dilated causal convolution layer, then passes through the first ReLU layer, the first Dropout layer, then enters the second dilated causal convolution layer, and then passes through the second ReLU layer and the second Dropout layer before being output. At the same time, the residual unit has a residual map, that is, the input data is directly connected to the output of the superimposed dilated causal convolution through the residual map; unlike RU1, the dilation factors of RU2 and RU3 are d = 8 and d = 16, respectively. From a mathematical point of view, the outputs of the three residual units can be expressed as:

[0129] Z1=RU1(x,d,ker)=RU1(x,1,4)

[0130] Z2=RU2(Z1,d,ker)=RU2(Z1,8,4)

[0131] Z3=RU3(Z2,d,ker)=RU3(Z2,16,4)

[0132] Where Z1, Z2, and Z3 represent the outputs of the three residual units; d represents the dilation factor; and ker represents the filter size. The residual connection and extended causal convolution as the key elements of TCN can be expressed as:

[0133]

[0134] Where f(·) and * refer to the convolution filter and convolution operation respectively. The index of the prior information can be expressed as (sd)·ker, and the range of the receptive field can be defined as L d =d·ker. The residual unit consists of residual connections and stacked dilated causal convolutions. d (x) is defined as the output of the superimposed dilated causal convolution, and the residual connection can be expressed as:

[0135] Z=Φ(x+F d (x))

[0136] Where Φ(·) represents the ReLU activation function, and the 1×1 convolution can be considered as an identity mapping that dominates the residual connection. This 1×1 convolution can maintain the model input x and the residual output F dThe width between (x) is the same, and the gradient disappearance can be avoided. The corresponding decoder module structure is exactly the opposite of the encoder structure, and the two are symmetrical structures.

[0137] 3. Comparative difference calculation: Calculate the input clean sample x and adversarial sample x adv The contrast difference between the feature representations is as follows:

[0138] D=||φ(x)-φ(x adv )||

[0139] Among them, φ is the feature extraction function and D is the contrast difference.

[0140] 4. Anomaly Detection: Determine whether the input data is an adversarial example based on the difference D. If D exceeds a preset value, the input data is considered an adversarial example and appropriate defense measures are taken, including data noise reduction.

[0141] 5. Use TCAE to extract the disturbance noise in the input data, and after removing the disturbance noise, input the data into the CPE identification system.

[0142] The present invention provides a more comprehensive defense strategy by combining the temporal feature extraction capability of TCAE, the fusion advantage of multimodal adversarial samples, and the robustness optimization mechanism of adversarial training. Specifically, TCAE can effectively process the temporal features in CPE identification and capture the dynamic changes of software features; multimodal adversarial samples enhance the adaptability of the model to complex attack scenarios by fusing features of different modalities; and adversarial training optimizes the robustness of the model by introducing adversarial samples. The combination of the three can not only improve the model's defense capability against single-modal attacks, but also enhance the model's generalization capability against unknown attacks through multimodal feature fusion and adversarial training, thereby more effectively resisting adversarial attacks and improving the overall security of CPE identification technology based on deep learning.

[0143] A CPE identification system adversarial defense device based on TCAE time-domain convolutional autoencoder and multimodal adversarial training, comprising:

[0144] Data acquisition module, used to collect multimodal data and perform preprocessing;

[0145] Feature extraction module, including time-domain convolutional autoencoder, used to extract time series features;

[0146] Adversarial sample generation module, used to generate multimodal adversarial samples and fuse them;

[0147] An adversarial training module, configured to input the adversarial samples and normal samples into the CPE recognition system for training;

[0148] Defense module, used to reduce adversarial perturbations in input data;

[0149] The system optimization module is used to optimize and test the CPE identification system.

[0150] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0151] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training, characterized by: include: Collect multimodal data from the CPE identification system, preprocess the multimodal data, and extract feature vectors; Generate multimodal adversarial samples and fuse adversarial samples of different modalities to simulate complex attack scenarios; Use the time-domain convolutional autoencoder to encode and decode the preprocessed feature vector, extract the time series features and perform noise reduction on the adversarial samples; The fused multimodal adversarial samples and normal samples are input into the CPE recognition system for adversarial training. Use adversarial defense strategies to purify adversarial perturbations in input data; Optimize the CPE recognition system after adversarial training; The construction of the time domain convolutional autoencoder is specifically as follows: In the encoder module, three residual units are 、 and Stacked in the TCN extractor; the first residual unit Contains a residual map, two Dropout layers, two ReLU layers, and two dilated causal convolution layers, with a dilation factor of and kernel size ;and The difference is, and The expansion factors are and ; The residual connection and dilated causal convolution as the key elements of TCN are expressed as: Where, As the key element of TCN, and They refer to convolution filters and convolution operations respectively; the index of prior information is used Represents, and the range of the receptive field is defined as ; The residual unit consists of residual connections and stacked dilated causal convolutions; Defined as the output of the superimposed dilated causal convolution, the residual connection is expressed as: Where, To input clean samples, Represents the ReLU activation function; The corresponding decoder module structure is exactly opposite to the encoder structure, and the two are symmetrical structures.

2. The CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training according to claim 1 is characterized in that: The method for generating multimodal adversarial samples includes FGSM, BIM and PGD.

3. The CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training according to claim 2 is characterized in that: The process of generating adversarial samples by FGSM is as follows: Prepare clean samples, the true labels of clean samples, the loss function of the target network, and the perturbation ratio; Select a pre-trained deep learning model for CPE identification; Prepare a normal clean input sample x, which is the CPE information that the deep learning model can correctly identify; Use the model to forward propagate the input sample to obtain the output of the model; Calculate the loss function, usually using the cross-entropy loss function, which is used to measure the difference between the model prediction result and the true label; FGSM determines the direction of the perturbation by calculating the gradient with respect to the input clean sample; Calculate the gradient of the loss function with respect to the input clean sample and generate perturbations; Add the generated perturbations to the clean samples to obtain adversarial samples.

4. The CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training according to claim 2 is characterized in that: The process of generating adversarial samples by BIM is as follows: first, ,Then, ,when arrive When the disturbance is , the adversarial sample is , ; in is the step length, is the disturbance ratio, is the number of iterations, To input clean samples, is the generated adversarial sample, W is the weight, b is the bias vector, For clean samples, For clean samples The true label, is the loss function of the target network, For input The gradient, are the target model parameters.

5. The CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training according to claim 4 is characterized in that: The process of PGD generating adversarial samples is as follows: First, initialize , when the round arrive hour, , , To input a clean sample, then, when arrive When the disturbance is , the adversarial sample is , , at this time, the stochastic gradient descent method is used to update ,Right now , , through continuous iteration, generate adversarial samples; in, are the target model parameters, is the number of iterations of the outer loop, is the initial gradient, represents the model parameters at the e+1th iteration, represents the model parameters at the e-th iteration, represents the gradient at the e-th iteration, represents the adversarial sample generated at step k, Represents the expected value of the sample (x, y) in the data set D, Represents the learning rate.

6. The CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training according to claim 1 is characterized in that: The output of the three residual units is expressed as: Where, 、 and represents the output of the three residual units; represents the expansion factor; Represents the filter size.

7. The CPE identification system adversarial defense method based on TCAE time-domain convolutional autoencoder and multimodal adversarial training according to claim 6 is characterized in that: Also includes contrast difference calculation: Calculate the input clean sample and adversarial examples The contrast between the feature representations of Anomaly detection: based on contrast differences Determine whether the input data is an adversarial sample; if If it exceeds the preset value, the input data is considered an adversarial sample and corresponding defense processing is performed.

8. A CPE identification system adversarial defense device based on TCAE time-domain convolutional autoencoder and multimodal adversarial training, characterized in that: A CPE identification system adversarial defense method based on a TCAE time-domain convolutional autoencoder and multimodal adversarial training, as described in any one of claims 1 to 7, comprising: Data acquisition module, used to collect multimodal data and perform preprocessing; Feature extraction module, including time-domain convolutional autoencoder, used to extract time series features; Adversarial sample generation module, used to generate multimodal adversarial samples and fuse them; An adversarial training module, configured to input the adversarial samples and normal samples into the CPE recognition system for training; Defense module, used to reduce adversarial perturbations in input data; The system optimization module is used to optimize and test the CPE identification system.

Images