Attack and defense method of mechanical equipment fault diagnosis model based on conditional generative adversarial network

Abstract

The invention belongs to the technical field of attack and defense of adversarial samples, and provides an attack and defense method of a mechanical equipment fault diagnosis model based on a conditional generative adversarial network, which adopts the conditional generative adversarial network to train a substitution model, simulates the input and output characteristics of a target model, and utilizes the migration characteristics of the adversarial samples to realize the attack and defense of the mechanical equipment fault diagnosis model. And while a better attack effect is achieved, the robustness of the target model is improved through further adversarial training by using the adversarial sample, and the defense capability of the target model to malicious attacks is enhanced. According to the method, the substitution model can be trained under the condition that internal information and original data of the target model are not used, the method is more suitable for scenes which widely exist in mechanical equipment fault diagnosis and are insufficient in original data, and the attack and defense effects are remarkably improved compared with a traditional substitution model pre-training method. According to the method, the safety of the mechanical equipment fault diagnosis model can be protected under the background of big data and cloud computing.

Description

Technical Field

[0001] The present invention relates to the research on the security and attack and defense technologies of a mechanical equipment health management system, and in particular to a method for using a conditional generative adversarial network to perform adversarial sample attacks and defenses on a mechanical equipment fault diagnosis model. Background Art

[0002] With the rapid rise and development of the Industrial Internet and Internet of Things (IoT) technologies, the dense deployment of multi-source sensor networks in mechanical equipment and the increasing volume of monitoring data exchange have ushered in the "big data" era for mechanical fault diagnosis. To effectively tap into the potential value contained in big data and ensure the safe operation of equipment driven by big data, intelligent fault diagnosis technology has emerged. This technology automatically extracts fault information implicit in mechanical monitoring data and intelligently identifies the health status of equipment. It is a key means of ensuring the safe operation of mechanical equipment in the big data era and a core technology for intelligent manufacturing and Industry 4.0. In recent years, with the widespread adoption of big data technologies, the advantages of data-driven intelligent diagnostic models in cloud computing and distributed computing have become increasingly prominent, creating a more urgent need for centralized utilization of distributed data and protection of sensitive data. However, compared to traditional fault diagnosis methods, cloud computing and distributed nature also introduce new security threats. For example, the transmission of sensor data and model parameters over the network poses a greater risk of data leakage, attacks, and spoofing. In industrial applications, false alarms caused by malicious attacks on models can cause abnormal operating conditions of mechanical equipment, leading to downtime for maintenance and other problems, and even resulting in significant economic and financial losses. Therefore, it is necessary to consider the risk of attacks on fault diagnosis models in the context of big data and cloud computing and effectively improve the defense capabilities of the models. However, at this stage, there is still a gap in the application of model security and adversarial sample attack and defense technologies in this scenario, and further research is urgently needed.

[0003] Adversarial example techniques can significantly alter the prediction results of neural network models by adding subtle, modulated noise that is imperceptible to humans to the original data. Existing adversarial example attack methods are categorized into three types based on the extent of information they can obtain during model training and classification: white-box, gray-box, and black-box attacks. White-box attacks fully obtain all information from the target model's training and classification processes, while gray-box attacks can obtain information such as the target model's network structure and input and output data. Black-box attacks only obtain the model's input and output data and classification results, but lack information about the network structure or the gradients generated during network training. Therefore, black-box attacks are more similar to real-world attack scenarios. Detecting and defending against adversarial examples is currently a hot topic in adversarial example research. Defense methods are primarily divided into heuristic and proof-based approaches. Heuristic approaches improve model robustness, have good portability, and can provide limited defense against multiple attack methods. Proof-based approaches offer better defense effectiveness, but are only effective against one or a few attack methods, are easily circumvented, and have poor scalability. The main form of heuristic defense methods is adversarial training, which also requires high-quality surrogate models for generating adversarial samples. In the attack and defense scenarios of mechanical equipment fault diagnosis models, since the equipment is in normal operation for a long time and mechanical failures cannot be simulated through software, it is difficult to collect a large amount of valid fault data, and even more difficult to collect sufficient labeled data to meet the requirements for effective training of the surrogate model. Therefore, generative adversarial networks are commonly used. The dynamic game process between the generator and the discriminator enables the generator to produce virtual data with a distribution similar to the real data, thereby realizing the construction of the surrogate model. However, traditional generative adversarial networks have problems such as insufficient diversity of generated samples, prone to mode collapse, and inability to achieve multimodal output. They cannot meet the needs of high-quality sample generation and surrogate model training in this scenario.

[0004] In order to solve the black-box attack and defense problems of fault diagnosis models in the context of big data and cloud computing, and effectively improve the robustness of fault diagnosis models in the face of malicious attacks, research on adversarial sample attack and defense technologies of fault diagnosis models is carried out, which is conducive to protecting the security of mechanical equipment health management systems. Summary of the Invention

[0005] To combat malicious attacks that fault diagnosis models may face, we study methods for generating and defending against adversarial examples, thereby protecting the model in a network environment. This paper proposes a method for defending against adversarial example attacks on mechanical equipment fault diagnosis models based on a conditional generative adversarial network. Furthermore, we design an adversarial training process based on this attack method, effectively improving the robustness of the fault diagnosis model under attack.

[0006] The technical solution of the present invention is as follows: an attack and defense method for a mechanical equipment fault diagnosis model based on a conditional generative adversarial network, the specific steps of which are as follows:

[0007] Step 1: Train the target model to be attacked.

[0008] The original one-dimensional vibration signal x(m) collected from mechanical equipment belongs to N fault types. The target model takes the original one-dimensional vibration signal as input and outputs the fault type to which it belongs. This pre-trained target model serves as the target to be imitated and attacked. This type of model has been widely used in fault diagnosis systems and has good representativeness.

[0009] Step 2: Construct a surrogate model.

[0010] The surrogate model uses a convolutional neural network architecture, consisting of multiple convolutional layers, max pooling layers, fully connected layers, and nonlinear activation functions. The internal structure of the surrogate model is independent of the target model. However, to simulate the input and output characteristics of the target model, the length of the surrogate model's input data and the N fault types it outputs must be consistent with those of the target model.

[0011] Furthermore, the replacement model includes a feature extractor and a classifier, the feature extractor includes multiple convolution units, each convolution unit includes a convolution layer, a ReLU activation function and a maximum pooling layer; the classifier has a structure of fully connected layer-nonlinear activation function-fully connected layer-nonlinear activation function, and the feature vector of the data is obtained after passing through the feature extractor, and the feature vector is passed through the classifier to obtain the classification result of the replacement model.

[0012] Step 3: Construct the generator model.

[0013] The generator model consists of multiple deconvolution layers, convolution layers, normalization layers, and nonlinear activation functions. It is functionally divided into two parts: the deconvolution expansion part and the convolution classification part. The deconvolution expansion part transforms the input Gaussian random noise and label embedding vector into a feature vector of a specific length in the form of deconvolution expansion by controlling the size, step size, padding number, and number of deconvolution layers of the convolution kernel. The convolution classification part performs convolution processing on the feature vector and controls the length of the final output virtual vibration data; the virtual vibration data has the same dimension and length as the original vibration signal x(m). The number of label embedding vectors is consistent with the number of fault types N, and the label of each fault type corresponds to a randomly generated embedding vector. Among them, the one-dimensional discrete convolution g(n) is defined as:

[0014] g(n)=∑h(n)x(nk)

[0015] Where x(nk) is the input signal sequence, h(n) is the impulse response of the system, n is the sequence number of the input signal sequence, and k is the sequence number of the summation process.

[0016] Furthermore, the output data sizes of the convolutional and deconvolutional layers used in the generator model are (i+2p-k) / s+1 and s(i-1)+2p-k+2, respectively, where i is the input data size, k is the convolution kernel size, s is the stride, and p is the number of paddings. By adjusting these parameters, the output data size is controlled so that the length of the output data is consistent with the original one-dimensional vibration signal.

[0017] Step 4: Train the conditional generative adversarial network.

[0018] The conditional generative adversarial network consists of two parts: a generator and a discriminator. The generator uses Gaussian random noise and label embedding vectors to generate virtual vibration data, while the discriminator's network is the substitute model. The discriminator inputs the virtual vibration data generated by the generator into the target model and the substitute model respectively, and measures their similarity based on the difference between the outputs of the two models. It updates the substitute model to make the output characteristics of the substitute model more similar to those of the target model. During the training process of the conditional generative adversarial network, only the target model is input and output, and the target model is not updated. The original data or other information generated during the classification process of the target model is not required. The loss function used to update the substitute model in the discriminator is a combined loss function, which is expressed as:

[0019] L D =L CE +αL MSE

[0020] Among them, L CE is the cross entropy loss function between the target label and the output probability of the alternative model, L MSE The mean square error loss function for the target model and the alternative model output probability matrix. CE With L MSE The total loss function is obtained by adding together the weighted coefficients α. The constructed overall loss function can measure the similarity of the model output, where L CE Focusing on the accuracy of the output labels of the alternative model, L MSE We focus on the overall similarity of the output probabilities.

[0021] The generator and discriminator have different optimization directions for the overall loss function. The discriminator needs to reduce the loss function, while the generator needs to maximize the loss function. In practical applications, in order to increase the diversity of virtual vibration data generated by the generator and better explore the classification boundaries of the target model, the generator loss function is also in the form of a combined loss function, which is expressed as:

[0022] L G =L Adv +βL Div +γL Anti-Ctr

[0023] Among them, L Adv is the adversarial loss function that performs a negative exponential operation on the discriminator loss, L Div L is the diversity loss function, which calculates the cross entropy loss between the probability matrix output by the replacement model and the target label of the generator. This allows the data generated by the generator to be evenly classified into various labels by the replacement model, with sufficient label diversity to avoid mode collapse. Anti-Ctr This is the inverse center loss function, which uses the probability matrix output by the surrogate model to obtain the intra-class center of each classification label. It then calculates the inverse of the mean squared error loss function between the surrogate model output probability matrix and the intra-class center. This maximizes the intra-class spacing of the data generated by the generator, helping to explore the classification boundaries of the target model and enabling the surrogate model to better mimic the input and output characteristics of the target model. β and γ are weighting coefficients in the loss function that adjust the overall weight of each loss.

[0024] Step 5: Generate and test adversarial examples. After each round of training, the adversarial network is generated and its parameters are updated. The discriminator is tested as follows: Projected gradient descent is used to generate adversarial examples based on the virtual vibration data obtained by the generator in step 4. The discriminator's accuracy is tested by comparing the performance of these adversarial examples on the target model. Due to the transferability of adversarial examples, the similarity between the surrogate model and the target model gradually increases as training progresses, and adversarial examples generated by the surrogate model can achieve better results on the target model.

[0025] Step 6: Conduct adversarial training. After the CGN meets the training requirements in step 5, the original one-dimensional vibration signal is input into the trained CGN surrogate model to generate adversarial samples. The adversarial samples are then mixed with the original one-dimensional vibration signal at a certain ratio to obtain a new dataset and further train the target model. This ultimately improves the robustness of the target model and enhances its defense capabilities.

[0026] Furthermore, the specific process of the conditional generative adversarial network training in step 4 is as follows:

[0027] Step 4.1. Load the target model trained in step 1. Randomly initialize the network parameters of the surrogate model constructed in step 2, that is, assign initial values to the weights in all convolutional layers and fully connected layers. Initialize the deconvolutional layers and convolutional layers of the generator model constructed in step 3 in the same way.

[0028] Step 4.2: Train the discriminator

[0029] First, the Gaussian random noise and label embedding vector are converted into virtual vibration data by calling the generator. Then the target model is called and the output matrix of the target model for the virtual vibration data is obtained through the Softmax function. Then call the substitute model in the same way and obtain the output matrix of the substitute model for the virtual vibration data through the Softmax function. Construct the discriminator loss function and calculate the output matrix of the alternative model And the target model output label matrix y R The cross entropy loss function and the target model output matrix and the output matrix of the surrogate model The discriminator uses the output difference between the surrogate model and the target model to update the network parameters of the surrogate model, making the input and output characteristics of the surrogate model more similar to those of the target model. The specific implementation form of the discriminator loss function is:

[0030]

[0031] Among them, CE(·) is the cross entropy operation, MSE(·) is the mean square error operation. The addition of the weight coefficient α can control the degree of attention paid to the overall difference of the output in the loss function, improve the accuracy of the substitution model and the stability of the generative adversarial network training process.

[0032] Step 4.3: Train the Generator

[0033] Due to the characteristics of the conditional generative adversarial network, the optimization goal of the generator is opposite to that of the discriminator, and the generator adversarial loss function is:

[0034] L Adv =exp(-L D )

[0035] The loss function hopes that L D At the same time, in order to ensure the diversity of the virtual vibration data generated by the generator and make the virtual vibration data generated by the generator have similar characteristics to the original data, the diversity loss function of the generator is constructed:

[0036]

[0037] where y G The loss function is a label matrix assigned to the generator, which enables the generator network to learn the original data features implicit in the target model, and finally correctly generate virtual vibration data of the corresponding category after the size change of the convolutional network and the output network.

[0038] In order to make the data generated by the generator have a sufficiently large intra-class spacing and be able to further explore the classification boundary of the target model, the anti-center loss function of the generator is constructed:

[0039]

[0040] where y C is the class center point matrix in the replacement model output. This loss function can maximize the intra-class spacing of the replacement model output, so that the generator data is sufficiently dispersed within the class while ensuring that it can be correctly classified. Therefore, the final loss function of the generator is:

[0041]

[0042] The Adam optimizer is used to update the parameters of both the generator and the surrogate model.

[0043] After each parameter update, the updated surrogate model is used to attack the target model, generating adversarial examples. The effectiveness of the generated adversarial examples on the target model is then tested. As the similarity between the surrogate model and the target model increases, the effectiveness of the adversarial example attack also increases.

[0044] Beneficial effects of the present invention: In view of the current situation that existing mechanical equipment fault diagnosis models lack research on attacks and defenses against malicious data, the present invention proposes a method for conducting adversarial sample black-box attacks and defenses on mechanical equipment health management systems by training alternative models through conditional generative adversarial networks. This method does not require the structural information of the target model, the gradient information generated during the training and classification process, and the original training data of the target model. The alternative model is trained through a conditional generative adversarial network, and adversarial samples with transfer characteristics to the target model are generated by the alternative model, and the adversarial samples are used for adversarial training, ultimately achieving the purpose of improving the defense capability of the target model. The present invention reveals the vulnerability of existing fault diagnosis models in the face of adversarial sample attacks, and proposes a training mechanism that can effectively defend against adversarial sample attacks, which is beneficial to protecting the security of mechanical equipment fault diagnosis models in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The overall operation process of the algorithm.

[0046] Figure 2 The network structure of the replacement model.

[0047] Figure 3 is the network structure of the generator.

[0048] Figure 4 is the loss function curve for updating the replacement model.

[0049] Figure 5 is the loss function curve for updating the generator model.

[0050] Figure 6 is the attack success rate curve (noise intensity 0.01).

[0051] Figure 7 is the similarity curve between the alternative model and the target model (noise intensity 0.01). DETAILED DESCRIPTION

[0052] The present invention will now be further described with reference to examples and accompanying drawings:

[0053] The implementation of the adversarial sample black box attack and defense method for the mechanical equipment fault diagnosis model includes target model training and loading, construction of the alternative model and the generator model, training of the conditional generative adversarial network (including the generator and the discriminator), and adversarial training of the target model. The operation process is as follows: Figure 1 As shown, the specific implementation steps are as follows.

[0054] 1) Training, loading and testing of target models

[0055] The target model identifies and diagnoses the collected raw one-dimensional vibration signals, each of which is a one-dimensional time-domain signal x(m) with a length of 1024. The target model uses a one-dimensional convolutional neural network to extract features from x(m) and identify the corresponding fault type. After 500 rounds of training, the target model performed well on the test data, achieving a fault identification accuracy of 99% or higher. The trained target model is saved as a .pth file and subsequently loaded with parameters to serve as the target for imitation and attack.

[0056] Before training begins, the accuracy of the target model needs to be tested using the original one-dimensional vibration signal. Then, an untrained alternative model is used to generate adversarial samples and test the target model again. By comparing the accuracy of the target model before and after, the impact of the untrained adversarial samples on the classification accuracy of the target model can be evaluated.

[0057] 2) Constructing an alternative model

[0058] The alternative model is also built using a convolutional neural network, but its internal structure is independent of the target model. The alternative model consists of 4 convolutional layers, 2 fully connected layers, and corresponding maximum pooling layers. Its network structure is as follows: Figure 2As shown. The alternative model uses convolutional layers for feature extraction and maps through nonlinear activation functions. Since the feature vector size is large, the feature size is reduced through the maximum pooling layer to achieve the purpose of improving model robustness and speeding up calculations. A ReLU activation function and a maximum pooling layer are added after each convolutional layer to form a feature extraction structure of convolutional layer-nonlinear activation function-maximum pooling layer. Finally, the final output is formed through the structure of fully connected layer-nonlinear activation function-fully connected layer-nonlinear activation function. The channel parameters of different convolutional layers and fully connected layers are different, and all the maximum pooling layer parameters are the same. The specific structure of each layer is as follows:

[0059]

[0060]

[0061] 3) Constructing the generator model

[0062] The generator is a key component of the adversarial generative network. By learning the information of the original vibration data implicit in the target model, the virtual data generated by the generator from Gaussian white noise can be correctly recognized by the target model.

[0063] The generator network consists of multiple deconvolution layers, convolution layers, normalization layers, and nonlinear activation functions. It can be divided into two main parts: the deconvolution expansion part and the convolution classification part. The network structure of the generator is as follows: Figure 3 As shown in Figure 2. The deconvolution expansion part transforms the input Gaussian random noise and label embedding vector into a feature vector of a specific length in the form of deconvolution expansion by controlling the size of the convolution kernel, the step size, the number of padding, and the number of deconvolution layers. The convolution classification part further processes the feature vector and controls the length of the final output virtual data. The one-dimensional discrete convolution g(n) is defined as:

[0064] g(n)=∑h(n)x(nk)

[0065] Where x(nk) is the input signal sequence, h(n) is the impulse response of the system, n is the sequence number of the input signal sequence, and k is the sequence number of the summation process.

[0066] Deconvolution is also called transposed convolution. It first expands the data size by padding with zeros, and then rotates the convolution kernel for forward convolution. The data sizes output by the convolution and deconvolution layers are (i+2p-k) / s+1 and s(i-1)+2p-k+2, respectively. Among them, i is the input data size, k is the convolution kernel size, s is the stride, and p is the number of boundary padding. The generator network concatenates 128-dimensional Gaussian white noise and the label embedding vector randomly generated before each training, and then passes through the deconvolution expansion network and the convolution classification network to change the dimension and size, and finally obtains one-dimensional virtual data of length 1024. The specific structural parameters of each part of the generator network are:

[0067]

[0068] All deconvolution and convolution layers of the generator are connected to a normalization layer and a LeakReLU activation function layer to form a feature extraction unit. The output of the last convolution layer is activated by the Sigmoid function and then normalized to form virtual data. The specific method of maximum and minimum normalization is as follows:

[0069]

[0070] where x max is the maximum value in the data, x mini is the minimum value in the data, x(i) is a single data point, x s The data are normalized by the maximum and minimum values.

[0071] After the virtual data is generated, the data generated by different label embedding vectors are assigned corresponding labels so that the generator network can be trained based on the recognition results of the replacement model. The labeled data is randomly shuffled and used as a virtual dataset to input into the training process of the conditional generative adversarial network.

[0072] 4) Conditional Generative Adversarial Network Training Update Process

[0073] The training of the conditional generative adversarial network is divided into the generator and the discriminator (alternative model). During the training process, the generator and the discriminator are updated in sequence. The specific process is as follows:

[0074] a) Alternative model training process:

[0075] The discriminator inputs the virtual data generated by the generator into the target model and the substitute model respectively, and updates the substitute model based on the difference between the outputs of the two models, making the input and output characteristics of the substitute model more similar to those of the target model. The loss function used to update the discriminator (substitute model) is a combined loss function, which is expressed as:

[0076]

[0077] Among them, L CE is the cross entropy loss function between the target label and the output probability of the alternative model, L MSE A mean squared error loss function that outputs a probability matrix for the target model and the surrogate model. is the output matrix of the surrogate model, is the element in the output matrix of the surrogate model, y R Output label matrix for target model, Output elements in the label matrix for the target model, Output matrix for the target model, Output the elements in the matrix for the target model. CE With L MSE The total loss function is obtained by adding together the weighted coefficients α. The constructed overall loss function can measure the similarity of the model output, where L CE Focusing on the accuracy of the output labels of the alternative model, L MSE We focus on the overall similarity of the output probabilities. Calling this loss function, L CE for and y R The cross entropy loss function, L MSE for and The generator and discriminator have different optimization directions for the loss function. The discriminator needs to reduce the loss function, while the generator maximizes the loss function, thus forming a generative adversarial network.

[0078] During model training, due to differences in magnitude in the loss function calculation, the weight coefficient α is set to 100. This setting increases the proportion of overall output variance in the loss function, improving the accuracy of the surrogate model and the stability of the conditional generative adversarial network training process.

[0079] b) Training process of the generator model:

[0080] Due to the characteristics of the generative adversarial network, the optimization goal of the generator is opposite to that of the discriminator, and its adversarial loss function is:

[0081] L Adv =exp(-L D )

[0082] The loss function hopes that L D At the same time, in order to ensure the diversity of the virtual data generated by the generator and make the virtual data generated by the generator have similar characteristics to the original data, the generator diversity loss function is constructed:

[0083]

[0084] where y G The loss function is a label matrix assigned to the generator, which enables the generator network to learn the original data features implicit in the target model, and finally correctly generate virtual data of the corresponding category after the size change of the convolutional network and the output network.

[0085] In order to make the data generated by the generator have a sufficiently large intra-class spacing and be able to further explore the classification boundary of the target model, the generator anti-center loss function is constructed:

[0086]

[0087] where y C is the class center point matrix in the replacement model output. This loss function can maximize the intra-class spacing of the replacement model output, so that the generator data is sufficiently dispersed within the class while ensuring that it can be correctly classified. Therefore, the final loss function of the generator is:

[0088]

[0089] in The elements in the label matrix given to the generator, It is the element in the class center point matrix in the surrogate model output.

[0090] After each parameter update of the generator and surrogate model, the updated surrogate model is used to attack the target model, generating adversarial examples. The effectiveness of these adversarial examples on the target model is then tested. The performance of the original data on the surrogate model is also tested as a direct measure of the similarity between the surrogate and target models. As the similarity between the surrogate and target models increases, the effectiveness of the adversarial examples on the target model also increases due to their transferability.

[0091] 5) Adversarial training process

[0092] Using a surrogate model trained with a conditional generative adversarial network, we perform adversarial training on the target model to improve its robustness against adversarial example attacks. Adversarial examples generated using the surrogate model are mixed with the original data at a ratio of 50% to generate a new adversarial training dataset. The target model is further trained using this adversarial training dataset, ultimately achieving a new model with similar classification performance to the original target model while also being more robust against adversarial example attacks.

[0093] 6) Dataset composition

[0094] The training data comes from a bearing failure dataset from Case Western Reserve University in the United States. Failure data from a drive-end bearing (SKF deep groove ball bearing 6205-2RS-JEM) was selected for testing. The test bench operated under no-load conditions (0 horsepower), and an accelerometer with a sampling frequency of 12 kHz was used to monitor vibration signals. To simulate bearing failures, electrical discharge machining (EDM) was used to create faults of varying sizes (0.007, 0.014, and 0.021 inches) at different locations on the bearing (inner race, outer race, and rolling element). This yielded nine different failure modes. Combined with data collected from normal bearing operation, a total of ten bearing states were classified. Bearings with different failure modes were installed on the drive end of the test bench, along with an accelerometer for vibration signal monitoring. A training and testing dataset was created from the collected data files. For each vibration signal segment, 1024 points were used to generate raw vibration signal samples, resulting in 70 samples. This yielded 700 samples corresponding to 10 bearing conditions. These samples were randomly selected to form a test set to verify the fault diagnosis performance of the target model and to measure the similarity between the target model and alternative models. Detailed bearing fault mode classification information is shown in Table 1.

[0095] Table 1 Classification information of bearing failure modes

[0096]

[0097]

[0098] 7) Model training and test result analysis

[0099] The model training lasted for 2500 iterations. The Adam optimizer was used to update both the generator and the replacement model, with a learning rate of 0.0001. During each of the 2500 iterations, the attack effect of the adversarial sample and the similarity between the replacement model and the target model were tested. Figure 4 is the loss function curve of the updated replacement model during model training. Figure 5 Update the loss function curve of the generator model during model training. Figure 6 is the attack success rate curve of the adversarial sample on the target model during training, Figure 7 is the similarity curve between the surrogate model and the target model during training. The attack strength of adversarial examples can be adjusted by adding noise intensity ε. In addition to the noise intensity ε, the mean squared error of the sample before and after the attack is introduced as a more intuitive metric for measuring the strength of the noise addition. The attack success rates of adversarial examples generated by the surrogate model trained using the conditional generative adversarial network and the traditional pre-trained surrogate model under different ε are shown in Table 2:

[0100] Table 2 Comparison of success rates of adversarial attack

[0101]

[0102]

[0103] Compared with the adversarial sample attack generated by the traditional alternative model trained with original data, the adversarial sample attack based on the conditional generative adversarial network proposed in the present invention is more effective, and the attack success rate is 41.4% higher than that of the traditional method under the same attack intensity.

[0104] After adversarial training, the target model's defense performance against adversarial samples generated by black-box attacks is significantly enhanced. The attack success rate under different attack intensities is shown in Table 3:

[0105] Table 3 Comparison of attack success rates after adversarial training

[0106]

[0107] Table 3 shows that the attack effect of adversarial examples on the target model after adversarial training is greatly weakened. Under the same attack intensity, the attack success rate is reduced by an average of 41.45% compared to before adversarial training. This improves the robustness of the model and enhances its ability to defend against adversarial examples.

[0108] In summary, the present invention proposes a method for attacking and defending against adversarial samples of mechanical equipment fault diagnosis models based on conditional generative adversarial networks. This method can train alternative models without using the model's internal information and original data, and is more suitable for scenarios where there is insufficient original data, which is common in mechanical equipment fault diagnosis. The similarity between alternative models and the attack effect of generated adversarial samples is significantly improved compared to traditional pre-trained alternative model methods. Combining the adversarial samples generated by this method with the target model for adversarial training can improve the robustness of the target model when attacked by other types of adversarial samples, and enhance the model's defense against adversarial samples. The method proposed in the present invention has achieved good application results and will help protect the security of mechanical equipment fault diagnosis models in the context of big data and cloud computing.

Claims

1. An attack and defense method for a mechanical equipment fault diagnosis model based on a conditional generative adversarial network, characterized in that: The specific steps are as follows: Step 1: Train the target model to be attacked; The original one-dimensional vibration signal x(m) collected from the mechanical equipment belongs to N fault types. The target model takes the original one-dimensional vibration signal as input and the fault type to which the original one-dimensional vibration signal belongs as output for training. The pre-trained target model is obtained as the object to be imitated and attacked. Step 2: Construct an alternative model; The surrogate model uses a convolutional neural network structure consisting of multiple convolutional layers, maximum pooling layers, fully connected layers, and nonlinear activation functions. The internal structure of the surrogate model is independent of the target model, but the length of the surrogate model's input data and the N fault types it outputs must be consistent with those of the target model. Step 3: Construct the generator model; The generator model consists of multiple deconvolution layers, convolution layers, normalization layers, and nonlinear activation functions. It is functionally divided into two parts: the deconvolution expansion part and the convolution classification part. The deconvolution expansion part transforms the input Gaussian random noise and label embedding vector into a feature vector of a specific length in the form of deconvolution expansion by controlling the size, step size, padding number, and number of deconvolution layers. The convolution classification part performs convolution processing on the feature vector and controls the length of the final output virtual vibration data. The virtual vibration data has the same dimension and length as the original vibration signal x(m). The number of label embedding vectors is consistent with the number of fault types N, and each fault type label corresponds to a randomly generated embedding vector. The one-dimensional discrete convolution g(n) is defined as: g(n)=∑h(n)x(nk) Where x(nk) is the input signal sequence, h(n) is the impulse response of the system, n is the sequence number of the input signal sequence, and k is the sequence number of the summation process; Step 4: Train the conditional generative adversarial network; The conditional generative adversarial network consists of two parts: a generator and a discriminator. The generator uses Gaussian random noise and label embedding vectors to generate virtual vibration data, while the discriminator's network is the surrogate model. The discriminator inputs the virtual vibration data generated by the generator into the target model and the surrogate model respectively, and measures their similarity based on the difference between the outputs of the two models. It updates the surrogate model to make the output characteristics of the surrogate model more similar to those of the target model. The loss function used to update the surrogate model in the discriminator is a combined loss function, which is expressed as: L D =L CE +αL MSE Among them, L CE is the cross entropy loss function between the target label and the output probability of the alternative model, L MSE A mean squared error loss function that outputs a probability matrix for the target model and the surrogate model; The generator and discriminator have different optimization directions for the overall loss function. The discriminator needs to reduce the loss function, while the generator needs to maximize the loss function. The generator loss function is also in the form of a combined loss function, and its expression is: L G =L Adv +βL Div +γL Anti-Ctr Among them, L Adv is the adversarial loss function that performs a negative exponential operation on the discriminator loss, L Div is the diversity loss function, which calculates the cross entropy loss between the output probability matrix of the alternative model and the generator target label; L Anti-Ctr is the anti-center loss function, which obtains the intra-class center of each classification label by surrogate model output probability matrix and calculates the inverse of the mean square error loss function between the surrogate model output probability matrix and the intra-class center; β and γ are weighting coefficients in the loss function, which can adjust the weight of each loss in the overall loss. Step 5: Generate and test adversarial examples. After each round of training, the discriminator is tested. Specifically, projected gradient descent is used to generate adversarial examples based on the virtual vibration data obtained by the generator in step 4. The discriminator's accuracy is tested by the performance of the adversarial examples on the target model. Due to the transferability of adversarial examples, the similarity between the surrogate model and the target model gradually increases as training progresses. Step 6: Conduct adversarial training; after the conditional generative adversarial network meets the training requirements in step 5, the original one-dimensional vibration signal is input into the trained conditional generative adversarial network to replace the model to generate an adversarial sample, and the adversarial sample is mixed with the original one-dimensional vibration signal in a certain proportion to obtain a new data set and further train the target model, ultimately achieving the goal of improving the robustness of the target model and enhancing the defense capability.

2. The attack and defense method of a mechanical equipment fault diagnosis model based on a conditional generative adversarial network according to claim 1, characterized in that: The replacement model includes a feature extractor and a classifier. The feature extractor includes multiple convolution units, each convolution unit includes a convolution layer, a ReLU activation function and a maximum pooling layer; the classifier has a structure of fully connected layer-nonlinear activation function-fully connected layer-nonlinear activation function. After passing through the feature extractor, the feature vector of the data is obtained, and the feature vector is passed through the classifier to obtain the classification result of the replacement model.

3. The attack and defense method of a mechanical equipment fault diagnosis model based on a conditional generative adversarial network according to claim 1, characterized in that: The output data sizes of the convolutional layer and deconvolution layer used in the generator model are (i+2p-k) / s+1 and s(i-1)+2p-k+2, respectively, where i is the input data size, k is the convolution kernel size, s is the stride, and p is the boundary padding number. By adjusting these parameters, the size of the output data is controlled so that the length of the output data is consistent with the original one-dimensional vibration signal.

4. The attack and defense method of a mechanical equipment fault diagnosis model based on a conditional generative adversarial network according to claim 1, characterized in that: The specific process of the conditional generative adversarial network training in step 4 is as follows: Step 4.

1. Load the target model trained in step 1. Randomly initialize the network parameters of the surrogate model constructed in step 2. That is, assign initial values to the weights in all convolutional layers and fully connected layers. Initialize the deconvolutional layers and convolutional layers of the generator model constructed in step 3 in the same way. Step 4.2: Train the discriminator First, the Gaussian random noise and label embedding vector are converted into virtual vibration data by calling the generator; then the target model is called and the output matrix of the target model for the virtual vibration data is obtained through the Softmax function. Then call the substitute model in the same way and obtain the output matrix of the substitute model for the virtual vibration data through the Softmax function. Construct the discriminator loss function and calculate the output matrix of the alternative model And the target model output label matrix y R The cross entropy loss function and the target model output matrix and the output matrix of the surrogate model The mean square error loss function is used; the output difference between the surrogate model and the target model is obtained by combining the weights. The discriminator uses the output difference to update the network parameters of the surrogate model to make the input and output characteristics of the surrogate model and the target model more similar; The specific implementation form of the discriminator loss function is: Among them, CE(·) is the cross entropy operation, and MSE(·) is the mean square error operation; Step 4.3: Train the Generator Due to the characteristics of the conditional generative adversarial network, the optimization goal of the generator is opposite to that of the discriminator, and the generator adversarial loss function is: L Adv =exp(-L D ) The loss function hopes that L D tends to infinity, thus achieving the purpose of antagonistic generation; Construct the diversity loss function of the generator: where y G The label given to the generator; Construct the anti-central loss function of the generator: where y C is the center point of each class in the surrogate model output; The final loss function of the generator is: The Adam optimizer is used to update the parameters of both the generator and the surrogate model. After each parameter update is completed, the updated replacement model is used to attack, generate adversarial samples, and test the attack effect of the adversarial samples generated by this method on the target model; as the similarity between the replacement model and the target model increases, the effectiveness of the adversarial sample attack will also increase.

Images