Defense method and system for confrontation sample of modulation signal

Abstract

The invention discloses an adversarial sample defense method and system for a modulation signal, and relates to signal adversarial, and the method comprises the steps: processing a modulation signal data set through employing a fast gradient symbol method, and generating an FGSM adversarial sample data set; combining the original modulation signal data set with the corresponding FGSM confrontation sample data set to generate an FGSM confrontation training data set; constructing a modulation signal identification model based on a neural network; training a modulation signal identification model by using the FGSM confrontation training data set to obtain an FGSM confrontation training model; inputting a to-be-identified signal into the FGSM adversarial training model to obtain an initial prediction label of the to-be-identified signal; performing FGSM countermeasure purification processing on the to-be-identified signal by using the initial prediction label to obtain a purification signal; and inputting the purified signal into the FGSM confrontation training model to obtain an identification result of the to-be-identified signal. For the poor adaptability to unknown attack strategies, the security robustness performance of the system in an actual communication scene is enhanced.

Description

Technical Field

[0001] The present application relates to the field of signal countermeasures, and more specifically, to a method and system for defending against adversarial samples of modulated signals. Background Art

[0002] With the rapid development of wireless communication technology, modulation recognition tasks in communication systems have gradually evolved from traditional manual feature extraction and classification methods to end-to-end recognition models based on deep learning. Deep neural networks can automatically learn latent feature information from large-scale samples, significantly improving the accuracy of modulation recognition under complex channel conditions. However, research has shown that deep neural networks are highly sensitive to input perturbations; even extremely small perturbations can cause the model to output incorrect recognition results. These precisely designed perturbations are called adversarial examples. In the field of electromagnetic spectrum and communication security, attackers can use adversarial examples to launch highly covert perturbation attacks on modulation recognition systems, thereby misleading the receiver's recognition judgment and seriously threatening the stability and robustness of communication systems.

[0003] In communications security scenarios, attackers can exploit adversarial examples to interfere with the modulation of communication signals, causing the receiver's intelligent recognition system to misclassify them. This highly concealed and disruptive attack has been shown to be significantly destructive across various neural network architectures, posing a serious threat to the stability and security of communication intelligent recognition systems. However, approaches that rely solely on training to improve robustness still face challenges in practical deployments, such as insufficient generalization and ineffectiveness against specific attacks, and thus fail to fully address the risks posed by adversarial examples.

[0004] Prior art primarily uses adversarial training to enhance the recognition model's adaptability to perturbed samples, specifically introducing adversarial samples into the model training phase. However, such methods typically rely on specific adversarial sample generation algorithms, making their defense capabilities easily limited by the coverage of the training perturbations, significantly reducing their effectiveness against unknown attack strategies. In related art, Chinese patent CN115188384B proposes a voiceprint recognition adversarial sample defense method based on cosine similarity and speech denoising. This method, in the field of speech signal processing, detects and suppresses adversarial perturbations in the input speech signal based on the cosine similarity metric and speech denoising. Specifically, a cosine similarity threshold is first set. The input adversarial sample is then wavelet transformed and reconstructed. The cosine similarity between the reconstructed and unreconstructed output vectors is calculated and compared with the set threshold. If the cosine similarity is less than the threshold, it is considered an adversarial sample; otherwise, it is considered undetected. Undetected adversarial samples are then fed into a trained speech denoising neural network for denoising to remove potential adversarial perturbations. However, this method is primarily designed for speech signal scenarios and relies heavily on the spectral characteristics and semantic continuity of speech signals, making it of limited applicability to electromagnetic interference processing. In actual electromagnetic interference environments, suspected enemy interference signals typically require interception, demodulation, and in-depth analysis, rather than simply discarding them due to signal anomalies.

[0005] From the above, we can see that although relevant technologies have been studied in the field of adversarial sample defense to a certain extent, their applicability and effectiveness in the research of adversarial sample defense in the electromagnetic spectrum and communication fields still have certain limitations. Summary of the Invention

[0006] In response to the following problems in existing modulation signal anti-attack technology: relying solely on adversarial training to improve the robustness of the recognition model has defects such as insufficient generalization ability and poor adaptability to unknown attack strategies; and there is currently a lack of a mechanism for effective purification of input disturbances, which leads to the modulation recognition model being susceptible to interference from adversarial samples and misjudgment in actual scenarios, seriously affecting the reliability and security of the communication system. This application provides a method and system for adversarial sample defense of modulated signals. Through the design of an adversarial purification module, the impact of adversarial signals on the intelligent classification model is weakened, effectively improving the classification accuracy and defense capability of the modulation recognition system under adversarial attacks, and enhancing the security and robustness of the system in actual communication scenarios.

[0007] One aspect of the present application example provides a method for defending against adversarial samples of modulated signals, including: S1, processing a modulated signal dataset using a fast gradient sign method to generate an FGSM adversarial sample dataset; merging the original modulated signal dataset with the corresponding FGSM adversarial sample dataset to generate an FGSM adversarial training dataset; S2, constructing a modulation signal recognition model based on a neural network; training the modulation signal recognition model using the FGSM adversarial training dataset to obtain an FGSM adversarial training model.

[0008] S3, input the signal to be identified into the FGSM adversarial training model to obtain the initial predicted label of the signal to be identified; use the initial predicted label to perform FGSM adversarial purification on the signal to be identified to obtain a purified signal; input the purified signal into the FGSM adversarial training model to obtain the recognition result of the signal to be identified. In particular, traditional adversarial training can only produce a defensive effect on known attack types, while this solution achieves effective response to unknown attacks through the purification mechanism. The initial prediction provides differentiated prediction labels for different types of adversarial samples, and the purification perturbation generates targeted correction directions based on this. For FGSM attacks, the predicted labels are usually correct, and the purification perturbation strengthens the correct features; for unknown attacks such as PGD and MIM, although the predicted labels are wrong, the reverse correction of the purification perturbation can often unexpectedly repair the perturbation components of the unknown attack, achieving a generalized defense capability across attack types.

[0009] The Fast Gradient Sign Method (FGSM) is an attack method for generating adversarial examples. It generates adversarial perturbations by calculating the gradient of the loss function with respect to the input sample and multiplying its sign by a perturbation factor. This method can add small but targeted perturbations to the original sample, causing deep learning models to misclassify while keeping the perturbations imperceptible. In this solution, FGSM is used both to generate adversarial examples and to construct training datasets, and to generate reverse perturbations during the purification process.

[0010] The FGSM adversarial example dataset is a collection of adversarially perturbed samples generated by processing the original modulated signal dataset using the Fast Gradient Sign Method. Each sample in this dataset is an adversarial example with the FGSM attack perturbation added to the original modulated signal. These samples are visually indistinguishable from the original but can cause neural network models to misclassify them. By merging this adversarial example dataset with the original dataset, a complete dataset is formed for model adversarial training.

[0011] Furthermore, the modulation signal data set includes modulation signal samples of different modulation modes under different signal-to-noise ratio conditions; the signal-to-noise ratio value range is -20dB to 20dB;

[0012] Modulation methods include 8PSK, AM-DSB, AM-SSB, BPSK, CPFSK, GFSK, PAM4, QAM16, QAM64, QPSK, and WBFM. Modulation refers to the technical means by which the information parameters (amplitude, frequency, phase, etc.) of the baseband signal are modified according to a certain pattern to the corresponding parameters of the carrier signal. The modulation methods involved in this solution include 11 different digital and analog modulation technologies: 8PSK (8-level phase shift keying), AM-DSB (double-sideband amplitude modulation), AM-SSB (single-sideband amplitude modulation), BPSK (binary phase shift keying), CPFSK (continuous phase frequency shift keying), GFSK (Gaussian frequency shift keying), PAM4 (4-level pulse amplitude modulation), QAM16 (16-bit quadrature amplitude modulation), QAM64 (64-bit quadrature amplitude modulation), QPSK (quadrature phase shift keying), and WBFM (wideband frequency modulation).

[0013] Furthermore, the SNR interval is NdB; the SNR interval refers to the distance between two adjacent SNR sampling points when constructing the modulated signal dataset. The SNR (Signal-to-Noise Ratio) represents the ratio of signal power to noise power, usually measured in decibels (dB). In this solution, the SNR range is -20dB to 20dB, and the SNR interval is 2dB. This means that the dataset contains modulated signal samples under 21 different SNR conditions, including -20dB, -18dB, -16dB, ..., 18dB, and 20dB, covering a variety of communication environments from strong to low noise.

[0014] Furthermore, the modulated signal dataset is processed using the fast gradient sign method to generate an FGSM adversarial sample dataset, including: performing FGSM processing on samples in the modulated signal dataset to obtain FGSM adversarial samples; the FGSM processing uses the following formula: Where x represents the sample in the modulated signal dataset, x adv represents the FGSM adversarial sample corresponding to sample x, L CE (·) is the cross entropy loss function, f sub (·) represents the adversarial alternative recognition model, f sub (·) represents the predicted output of the alternative recognition model for the input sample x, y is the true label of sample x, sign(·) represents the sign function, and α is the perturbation factor;

[0015] in, Calculate the gradient of the loss function with respect to the input sample x. The gradient points to the direction in which the loss function increases fastest, that is, the perturbation direction that is most likely to cause the model to misclassify.

[0016] The sign(*) function converts each element of the gradient vector to -1, 0, or +1. This binarization preserves the gradient's directional information while simplifying the computational complexity of the perturbation, making the generated adversarial perturbation highly effective and controllable. The perturbation factor α determines the strength of the adversarial perturbation. A smaller α value ensures the perturbation is imperceptible, while a larger α value enhances the attack's effectiveness. By adjusting α, a balance can be found between attack success rate and perturbation stealth.

[0017] Furthermore, S2, a modulation signal recognition model based on a neural network is constructed; the modulation signal recognition model is trained using an FGSM adversarial training dataset to obtain an FGSM adversarial training model, including: the modulation signal recognition model adopts a CNN, VGG16, Resnet18, or Resnet34 network model structure; and the modulation signal recognition model parameters are iteratively updated using the following formula: Among them, x FGSM represents the sample in the FGSM adversarial training dataset, and y represents the sample x FGSM The true label, f MR (·) represents the intelligent recognition model of modulated signals, θ is the model parameter, η is the learning rate, and L(·) is the loss function.

[0018] Furthermore, the signal to be identified is input into the FGSM adversarial training model to obtain the initial prediction label of the signal to be identified, including: As input, the FGSM adversarial training model is used for forward reasoning to obtain the initial predicted label of the signal to be identified Among them, f FGSM (·) represents the FGSM adversarial training model, Label(f FGSM (·)) represents the label corresponding to the output of the FGSM adversarial training model, a i Represents the confidence score of the input signal on category i, i = 1, ..., c, c represents the number of categories, Position (max (a1, a2, ..., a c )) represents the position corresponding to the maximum confidence.

[0019] Furthermore, the FGSM adversarial purification process is performed on the signal to be identified using the initial predicted label to obtain a purified signal, including: according to the output of the FGSM adversarial training model and the initial prediction label The loss between the two, adjust the signal to be identified Get the purified signal x pur : Among them, δ pur To purify disturbances;

[0020] The purified signal xpur is the corrected signal obtained after FGSM adversarial purification. It is the sum of the original signal to be identified and the purified disturbance. The core function of the purified signal is to restore the "pure" characteristics of the signal by eliminating or weakening the adversarial disturbance components in the input signal, making it closer to the normal modulation signal state. The purified signal not only maintains the basic modulation characteristics and information content of the original signal, but also reduces the malicious disturbance introduced by the adversarial attack.

[0021] Furthermore, the purified disturbance δ pur The expression is: Among them, β is the purification factor, L CE (·) denotes the cross-entropy loss function, and sign(·) denotes the sign function. The purification perturbation is a correction vector calculated based on the initial predicted labels and the model output loss, which is used to adjust the characteristic distribution of the input signal. By manipulating the sign function and the purification factor, the original adversarial perturbation is effectively suppressed. The magnitude and direction of the purification perturbation are determined by the gradient of the loss function. It intelligently identifies and corrects the characteristic components in the signal that are most likely to cause misclassification, achieving precise perturbation purification.

[0022] Another aspect of the present application example also provides an adversarial sample defense system for modulated signals, including: a dataset module, which uses the fast gradient sign method to process the modulated signal dataset to generate an FGSM adversarial sample dataset, and merges the original modulated signal dataset with the corresponding FGSM adversarial sample dataset to generate an FGSM adversarial training dataset; a model construction module, which constructs a modulated signal recognition model based on a neural network, and uses the FGSM adversarial training dataset to train the modulated signal recognition model to obtain an FGSM adversarial training model; a signal recognition module, which inputs the signal to be recognized into the FGSM adversarial training model to obtain an initial predicted label of the signal to be recognized; uses the initial predicted label to perform FGSM adversarial purification on the signal to be recognized to obtain a purified signal; and inputs the purified signal into the FGSM adversarial training model to obtain a recognition result of the model to be recognized.

[0023] Compared with the existing technology, the advantages of this application are:

[0024] By combining the dual defense mechanisms of FGSM adversarial training and adversarial purification, this technical solution effectively addresses the generalization issues inherent in relying solely on adversarial training. FGSM adversarial training provides fundamental robustness for the model, while the adversarial purification module adaptively processes various unknown attack strategies, such as PGD and MIM. By utilizing initial prediction labels to guide the generation of purified perturbations, the adversarial signal is regressed toward the correct decision boundary, effectively defending against a variety of adversarial attack methods. This significantly improves the model's adaptability and defense success rate against unknown attack strategies.

[0025] This application constructs an FGSM adversarial purification processing mechanism based on the initial predicted label. By calculating the loss gradient between the model output and the predicted label, it generates a reverse purification perturbation to adjust the signal feature distribution, effectively weakening the interference effect of the adversarial perturbation on the model judgment. This purification mechanism can significantly correct the malicious perturbation in the adversarial sample while maintaining the original signal classification performance. In conjunction with the secondary recognition process, it greatly improves the classification accuracy and reliability of the modulation recognition system in the adversarial attack environment, effectively ensuring the security performance of the communication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flowchart of a method for defending against adversarial samples of a modulated signal in one embodiment of the present application.

[0027] Figure 2 The changes in classification accuracy of the four models CNN, VGG16, Resnet18 and Resnet34 provided in one embodiment of the present application at different signal-to-noise ratio levels after FGSM adversarial training.

[0028] Figure 3 The CNN model provided in one embodiment of the present application shows the changes in classification accuracy of various adversarial attack methods at different signal-to-noise ratio levels, as well as the classification accuracy performance of the model after applying the present application.

[0029] Figure 4 The VGG16 model provided in one embodiment of the present application shows the changes in classification accuracy for various adversarial attack methods at different signal-to-noise ratio levels, as well as the classification accuracy performance of the model after applying the present application.

[0030] Figure 5 The Resnet18 model provided in one embodiment of the present application shows the changes in classification accuracy for various adversarial attack methods at different signal-to-noise ratio levels, as well as the classification accuracy performance of the model after applying the present application.

[0031] Figure 6 The Resnet34 model provided in one embodiment of the present application shows the changes in classification accuracy for various adversarial attack methods under different signal-to-noise ratio conditions, as well as the classification accuracy performance of the model after applying the present application. DETAILED DESCRIPTION

[0032] The present application is described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] Figure 1 This is a flowchart of an implementation method of the present invention for defending against adversarial samples of a modulated signal, including the following steps:

[0034] Step 1: FGSM adversarial training dataset construction:

[0035] Step 1.1: Select the RML2016.10a public dataset as the modulation signal dataset. The modulation modes include 8PSK, AM-DSB, AM-SSB, BPSK, CPFSK, GFSK, PAM4, QAM16, QAM64, QPSK, and WBFM. The noise ratio condition is -20dB to 18dB, with an interval of 2dB.

[0036] Step 1.2: Use the fast gradient sign method to process the above modulated signal dataset to generate an FGSM adversarial sample dataset. The method for generating the FGSM adversarial sample dataset is as follows:

[0037]

[0038] Where x represents the sample in the modulated signal dataset, x adv represents the FGSM adversarial sample corresponding to sample x, L CE (·) is the cross entropy loss function, f sub (·) represents the adversarial alternative recognition model, f sub (·) represents the predicted output of the alternative recognition model for the input sample x, y is the true label of sample x, sign(·) represents the sign function, and α is the perturbation factor;

[0039] Perform the above processing on all samples in the modulated signal dataset to obtain the FGSM adversarial sample dataset.

[0040] Step 1.3: Merge the original modulated signal dataset with the corresponding FGSM adversarial sample dataset to generate the FGSM adversarial training dataset.

[0041] Step 2: Adversarial training process: Build a modulated signal intelligent recognition model with a CNN or VGG16 or Resnet18 or Resnet34 network model structure. After initialization, use the FGSM adversarial training dataset to train the modulated signal intelligent recognition model until it is overfitted, save the weights, and obtain the FGSM adversarial training model. During the training process, the model parameter update rules are as follows:

[0042]

[0043] Among them, x FGSM represents the sample in the FGSM adversarial training dataset, and y represents the sample x FGSM The true label, f MR (·) represents the intelligent recognition model of modulated signals, θ is the model parameter, η is the learning rate, and L(·) is the loss function.

[0044] A differentiated training strategy was adopted, employing a separate network strategy for parameter optimization during model training. For the CNN and VGG16 network structures, the initial learning rate was set to 0.001; for Resnet18 and Resnet34, it was set to 0.0002 to ensure the stability of gradient propagation in their deep structures. The Adam optimizer was uniformly used for parameter updates, accelerating convergence with its adaptive learning capabilities. The cross-entropy function was chosen as the loss function to measure model classification error. Furthermore, an appropriate number of training rounds was set for each model's training process. Ultimately, CNN, VGG16, Resnet18, and Resnet34 modulation recognition models with a certain degree of anti-interference capability were obtained, laying the foundation for subsequent purification mechanisms.

[0045] Step 3: Purification and Identification:

[0046] Step 3.1: Input signal to be recognized Input FGSM adversarial training model to obtain the initial prediction label Determined by the category with the highest confidence, it can be expressed as:

[0047]

[0048] Among them, f FGSM (·) represents the FGSM adversarial training model, Label(f FGSM (·)) represents the label corresponding to the output of the FGSM adversarial training model, a i Represents the confidence score of the input signal on category i, i = 1,...,c, c represents the number of categories, Position(max(a1,a2,...,a c )) represents the position corresponding to the maximum confidence;

[0049] Step 3.2: Output of the adversarial training model based on FGSM and the initial prediction label The loss between them guides the generation of purification signals and adjusts the characteristic distribution of the signals so that they are shifted towards the correct category as much as possible. The calculation formula is as follows:

[0050]

[0051] Among them, δ pur is the purification disturbance, β is the purification factor, L CE (·) represents the cross entropy loss function, sign(·) represents the sign function;

[0052] Step 3.3: Transform the purified signal x pur Input FGSM again to identify the adversarial training model and output the recognition result

[0053]

[0054] Complete the final signal classification task.

[0055] Figure 2 The following plot shows the classification accuracy of the CNN, VGG16, Resnet18, and Resnet34 models at different signal-to-noise ratio levels after FGSM adversarial training. The four curves in the figure correspond to the classification accuracy of each model for the original sample under different signal-to-noise ratio conditions.

[0056] Figure 3 This diagram shows the changes in the classification accuracy of the CNN model provided in one embodiment of the present application under various adversarial attack methods at different signal-to-noise ratio levels. It also illustrates the classification accuracy performance of the model for various input samples after applying the electromagnetic signal adversarial purification-based defense method proposed in this application. The curves shown in the figure include the classification accuracy of the original signal, FGSM, PGD, and MIM adversarial attack methods, as well as the classification accuracy results for the original signal and various adversarial signal processing methods after applying the adversarial purification method proposed in this application.

[0057] Figure 4 This diagram shows the changes in the classification accuracy of the VGG16 model under various adversarial attack methods at different signal-to-noise ratio levels, as provided in one embodiment of the present application. It also illustrates the classification accuracy performance of the model for various input samples after applying the electromagnetic signal adversarial defense method based on adversarial purification proposed in this application. The curves shown in the figure include the classification accuracy of the original signal, FGSM, PGD, and MIM adversarial attack methods, as well as the classification accuracy results for the original signal and various adversarial signal processing methods after applying the adversarial purification method proposed in this application.

[0058] Figure 5 This diagram shows the changes in the classification accuracy of the Resnet18 model provided in one embodiment of the present application under various adversarial attack methods at different signal-to-noise ratio levels. It also illustrates the classification accuracy performance of the model for various input samples after applying the electromagnetic signal adversarial purification-based defense method proposed in this application. The curves shown in the figure include the classification accuracy of the original signal, FGSM, PGD, and MIM adversarial attack methods, as well as the classification accuracy results for the original signal and various adversarial signal processing methods after applying the adversarial purification method proposed in this application.

[0059] Figure 6This diagram shows the changes in the classification accuracy of the Resnet34 model provided in one embodiment of the present application under various adversarial attack methods at different signal-to-noise ratio levels. It also illustrates the classification accuracy performance of the model for various input samples after applying the electromagnetic signal adversarial defense method based on adversarial purification proposed in this application. The curves shown in the figure include the classification accuracy of the original signal, FGSM, PGD, and MIM adversarial attack methods, as well as the classification accuracy results for the original signal and various adversarial signal processing methods after applying the adversarial purification method proposed in this application.

[0060] Depend on Figures 3 to 6 As can be seen, without a defense mechanism, the CNN model's recognition performance under various adversarial attacks significantly degrades. However, after applying the defense strategy proposed in this application, the recognition accuracy of various signals significantly recovers, validating the effectiveness and versatility of this method in improving model robustness. Specifically, for the original signal, if it was correctly identified before purification, recognition after purification is equivalent to recognition of a known adversarial signal. If it was incorrectly identified before purification, there is still a high probability of misidentification after purification. However, since the proportion of misidentified original signals is relatively low, the impact on overall recognition performance is relatively small. For other types of adversarial signals, since the model is not specifically trained for these adversarial signals, they are often misidentified before purification, and their maximum confidence recognition results are often incorrect labels. By utilizing these misidentified labels for adversarial purification, TMAP can, to a certain extent, correct the perturbations of non-FGSM adversarial signals, causing them to regress toward the correct decision boundary, thereby effectively reducing the impact of the adversarial signal and improving recognition reliability. However, for FGSM adversarial signals, purification may actually increase the probability of misidentification. This is because the model reaches a robust overfitting state after FGSM adversarial training. Before purification, the classification accuracy of the FGSM adversarial signal is high, and its maximum confidence recognition result is usually the correct label. Purification based on this label information may cause the classification accuracy to decrease.

[0061] In summary, this application discloses a method for defending against adversarial examples of modulated signals, belonging to the field of intelligent electromagnetic signal recognition and adversarial technology. The method includes the following steps: constructing an FGSM adversarial training dataset: selecting a modulated signal dataset, then generating an FGSM adversarial signal using the fast gradient sign method, merging the original signal sample with the corresponding FGSM adversarial signal, performing normalization and shape adjustment, and constructing a dataset for training and testing. The adversarial training process: designing various neural network structures as modulated signal recognition models, training the modulation recognition models using the dataset, saving the weights, and obtaining an adversarial training model. Purification and recognition: During the testing phase, the received signal is fed into the adversarial training model to obtain an initial predicted label. A perturbation purification module is then constructed. By analyzing the signal perturbation characteristics and applying FGSM perturbation direction inverse estimation and reconstruction based on the initial predicted label, a purification mechanism is designed to reduce the interference and impact of the adversarial signal. The signal is then fed back into the adversarial training model for classification and recognition. This method significantly improves classification accuracy under different network models and signal-to-noise ratios, adapting to various adversarial signal strategies, and improving the classification accuracy of the intelligent classification model.

[0062] The invention of the present application and its implementation methods are described schematically above. This description is not restrictive. Without departing from the spirit or basic features of the present application, the present application can be implemented in other specific forms. What is shown in the accompanying drawings is only one of the implementation methods of the invention of the present application, and the actual structure is not limited to this. Therefore, if a person of ordinary skill in the art is inspired by it, without departing from the purpose of the invention, a structural method and embodiment similar to the technical solution are designed without creativity, which should all fall within the scope of protection of the present application. In addition, the word "including" does not exclude other elements or steps, and the word "one" before an element does not exclude the inclusion of "multiple" elements. Words such as first and second are used to indicate names and do not indicate any specific order.

Claims

1. A method for defending against adversarial samples of modulated signals, characterized in that: include: S1, use the fast gradient sign method to process the modulated signal dataset to generate the FGSM adversarial sample dataset; Merge the original modulated signal dataset and the corresponding FGSM adversarial sample dataset to generate an FGSM adversarial training dataset; S2, building a modulation signal recognition model based on neural network; Use the FGSM adversarial training dataset to train the modulation signal recognition model and obtain the FGSM adversarial training model; S3, input the signal to be identified into the FGSM adversarial training model to obtain the initial predicted label of the signal to be identified; Use the initial predicted label to perform FGSM adversarial purification on the signal to be identified to obtain a purified signal; The purified signal is input into the FGSM adversarial training model to obtain the recognition result of the signal to be recognized.

2. The method for defending against adversarial examples of modulated signals according to claim 1, wherein: The modulation signal dataset includes modulation signal samples with different modulation modes under different signal-to-noise ratio conditions; The signal-to-noise ratio range is -20dB to 20dB; Modulation modes include 8PSK, AM-DSB, AM-SSB, BPSK, CPFSK, GFSK, PAM4, QAM16, QAM64, QPSK, and WBFM.

3. The method for defending against adversarial examples of modulated signals according to claim 2, wherein: The signal-to-noise ratio value interval is N, where N is a positive integer.

4. The method for defending against adversarial examples of modulated signals according to claim 1, wherein: The modulated signal dataset is processed using the fast gradient sign method to generate an FGSM adversarial sample dataset, including: Perform FGSM processing on the samples in the modulated signal dataset to obtain FGSM adversarial samples; FGSM processing uses the following formula: Where x represents the sample in the modulated signal dataset, x adv represents the FGSM adversarial sample corresponding to sample x, L CE (*) is the cross entropy loss function, f sub (*) represents the adversarial alternative recognition model, f sub (*) represents the predicted output of the alternative recognition model for the input sample x, y is the true label of sample x, sign(*) represents the sign function, and α is the perturbation factor.

5. The method for defending against adversarial examples of modulated signals according to claim 1, wherein: S2: Build a modulation signal recognition model based on a neural network. Use the FGSM adversarial training dataset to train the modulation signal recognition model to obtain the FGSM adversarial training model, including: The modulation signal recognition model adopts CNN, VGG16, Resnet18 or Resnet34 network model structure; The following formula is used to iteratively update the parameters of the modulation signal recognition model: Among them, x FGSM represents the sample in the FGSM adversarial training dataset, and y represents the sample x FGSM The true label, f MR (*) represents the modulation signal intelligent recognition model, θ is the model parameter, η is the learning rate, and L(*) is the loss function.

6. The method for defending against adversarial examples of modulated signals according to claim 1, wherein: The signal to be identified is input into the FGSM adversarial training model to obtain the initial predicted label of the signal to be identified, including: The signal to be identified As input, the FGSM adversarial training model is used for forward reasoning to obtain the initial predicted label of the signal to be identified Among them, f FGSM (*) indicates the FGSM adversarial training model, Label(f FGSM (*)) indicates the label corresponding to the output of the FGSM adversarial training model, a i Represents the confidence score of the input signal on category i, i=1,......,c, c represents the number of categories, Position(max(a1,a2,......,a c )) represents the position corresponding to the maximum confidence.

7. The method for defending against adversarial examples of modulated signals according to claim 6, wherein: The FGSM adversarial purification process is performed on the signal to be identified using the initial predicted label to obtain the purified signal, including: According to the output of FGSM adversarial training model and the initial prediction label The loss between the two, adjust the signal to be identified Get the purified signal x pur : Among them, δ pur To purify disturbances.

8. The method for defending against adversarial examples of modulated signals according to claim 7, wherein: Purification disturbance δ pur The expression is: Among them, β is the purification factor, L CE (*) represents the cross entropy loss function, and sign(*) represents the sign function.

9. A modulated signal adversarial sample defense system, characterized in that: include: The dataset module uses the fast gradient sign method to process the modulated signal dataset to generate an FGSM adversarial sample dataset, and then merges the original modulated signal dataset with the corresponding FGSM adversarial sample dataset to generate an FGSM adversarial training dataset; The model building module builds a modulation signal recognition model based on a neural network and uses the FGSM adversarial training data set to train the modulation signal recognition model to obtain the FGSM adversarial training model; The signal recognition module inputs the signal to be identified into the FGSM adversarial training model to obtain the initial predicted label of the signal to be identified; Use the initial predicted label to perform FGSM adversarial purification on the signal to be identified to obtain a purified signal; The purified signal is input into the FGSM adversarial training model to obtain the recognition result of the model to be recognized.

Images