A non-cooperative unmanned aerial vehicle radiation source directional attack method based on CVE-AdvGAN

Abstract

The application discloses a non-cooperative unmanned aerial vehicle radiation source directional attack method based on CVE-AdvGAN, and relates to the technical field of communication.The technical scheme mainly comprises the following steps: sensing the non-cooperative unmanned aerial vehicle radiation source signal, extracting the physical layer and protocol layer features, and establishing a target radiation source feature library; searching the CVE database based on signal correlation information, screening available vulnerabilities, and constructing an attack payload; constructing a CVE-AdvGAN model containing a generator and a discriminator, generating a countermeasure sample meeting concealment and effectiveness; combining the target real-time position through a transmitting module, and directionally transmitting the countermeasure sample; verifying the attack effect, and closing loop optimization of the model and the transmitting parameters if the attack is not successful.The method solves the problems of poor robustness, weak practical applicability, poor directional attack effect and blank application in the field of unmanned aerial vehicles of the existing radiation source attack method, can verify the system robustness, improves the attack accuracy and concealment, realizes the landing of the algorithm from theory to practical application, and guarantees the airspace safety.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, in particular to a non-cooperative unmanned aerial vehicle radiation source directional attack method based on CVE-AdvGAN. BACKGROUND

[0002] With the rapid development of unmanned aerial vehicles, they have become a key role in promoting intelligent railway construction and improving railway communication networking. Unmanned aerial vehicle communication usually uses frequency hopping communication, which has good anti-interference performance, and the random change of frequency points can ensure the secrecy of communication, but it also increases the difficulty of monitoring unmanned aerial vehicle communication, especially for non-cooperative unmanned aerial vehicles (i.e. external, invading, and possibly malicious attack unmanned aerial vehicle individuals or groups). Non-cooperative unmanned aerial vehicles may provide false operation information to railway dispatchers by impersonating legitimate unmanned aerial vehicles, invade railway operating sections to damage trains and tracks, leak critical information from key railway sections, and impersonate legitimate identities to invade railway information networks, thereby endangering railway safety. Therefore, it is necessary to strengthen the electromagnetic spectrum detection and management of non-cooperative unmanned aerial vehicles. Intelligent electromagnetic spectrum attack methods can be used to make non-cooperative controllers mistakenly identify their own unmanned aerial vehicles as our unmanned aerial vehicles, and then launch self-attacks, thereby ensuring railway communication safety and reducing the cost of attacking non-cooperative unmanned aerial vehicles.

[0003] Current electromagnetic spectrum-based radiation source attack methods have obvious defects and cannot meet the needs of non-cooperative unmanned aerial vehicle management in the railway scenario. First, existing methods (such as FGSM method, JSMA method, and some black box attack methods) lack robustness. The FGSM method requires gradient calculation for each electromagnetic signal, but gradient calculation in deep learning is dynamic and subtle, and is easily affected by external environmental disturbances. Some black box attack methods have poor effectiveness, poor adaptability to electromagnetic characteristics, and low attack success rate. Second, these methods have weak practical applicability. Most of them generate disturbance noise based on time domain signals, and the time domain signals of the same radiation source differ greatly due to external environmental influences. It is difficult to fill the electromagnetic differences between the original radiation source and the target radiation source through subtle disturbances, and time domain alignment needs to be implemented, which is difficult to operate. Large disturbances can also be detected by the target party due to time domain deformation. Third, these methods cannot achieve effective directional attacks. Most methods can only make the model lose its identity recognition of the radiation source, and a few black box directional attack methods have low success rates and cannot provide reasonable solutions for non-cooperative unmanned aerial vehicle processing in the railway scenario (such as attacking the non-cooperative party's own unmanned aerial vehicle). Fourth, there are no related radiation source intelligent countermeasures applied in the field of unmanned aerial vehicles, and the above problems collectively hinder railway communication safety, non-cooperative unmanned aerial vehicle attacks, and railway networking unmanned aerial vehicle defense. SUMMARY

[0004] The present application aims to overcome one or more deficiencies in the prior art and provide a CVE-AdvGAN-based non-cooperative unmanned aerial vehicle radiation source directional attack method.

[0005] The purpose of the present application is achieved by the following technical solutions:

[0006] A CVE-AdvGAN-based non-cooperative unmanned aerial vehicle radiation source directional attack method is provided, comprising the following steps:

[0007] S1: sensing and feature extraction of the radiation source signal of the non-cooperative unmanned aerial vehicle, collecting the communication signal and navigation signal of the target unmanned aerial vehicle, extracting the physical layer features and protocol layer features of the signal, and establishing a target unmanned aerial vehicle radiation source feature library;

[0008] S2: CVE vulnerability screening and attack payload construction, based on the protocol type or hardware-related information corresponding to the radiation source signal extracted in S1, searching the CVE database, screening exploitable vulnerabilities that can act on the radiation source, and designing attack payloads for the screened vulnerabilities;

[0009] S3: CVE-AdvGAN adversarial sample generation and optimization, constructing a CVE-AdvGAN model including a generator, a discriminator and a frequency domain disturbance control module, taking the normal signal in S1 as the original sample and the attack payload in S2 as the target information, training the adversarial sample through the frequency domain real and imaginary part processing and step-by-step disturbance mechanism of the model, so that the adversarial sample meets the requirements of concealment and effectiveness at the same time;

[0010] S4: directional electromagnetic attack signal transmission, through a transmission module composed of a signal generator, a power amplifier and a directional antenna, combining the real-time position information of the target unmanned aerial vehicle, adjusting the transmission beam direction and transmission power, and directing the adversarial sample generated in S3 to the radiation source receiving end of the target unmanned aerial vehicle;

[0011] S5: real-time verification and closed-loop adjustment of attack effect, monitoring the state of the target unmanned aerial vehicle at the communication layer, navigation layer and control layer, judging whether the attack is successful, if not, feeding back to the CVE-AdvGAN module of S3 and the transmission module of S4 for parameter optimization until the attack is successful.

[0012] Further, the sensing device in S1 is composed of a directional antenna array, a software-defined radio and a signal analyzer, and the radiation source signal of the target unmanned aerial vehicle is acquired in a passive acquisition mode without the authorization information of the target unmanned aerial vehicle.

[0013] Further, the physical layer features extracted in S1 include frequency, bandwidth, modulation mode, power spectral density and constellation diagram; the protocol layer features extracted include frame structure, check mode and instruction encoding rules.

[0014] Further, the CVE database retrieved in S2 includes a common vulnerability disclosure related database, and the screened exploitable vulnerabilities include radiation source protocol vulnerabilities and radiation source hardware firmware vulnerabilities.

[0015] Further, the attack payload designed in S2 is a precise trigger type attack payload, which can trigger the corresponding CVE vulnerability to achieve the preset attack target after being injected into the target UAV through the radiation source signal.

[0016] Further, in the CVE-AdvGAN model in S3, the generator adopts a network structure of "3 3x3 conv+3 3x3 resnet+3 3x3 deconv", the input is the feature map of the target normal signal in S1, and the output is the adversarial sample fused with the attack payload; the discriminator corresponding to the generator module adopts a network structure of 3 conv modules, the input is the adversarial sample or the normal signal, and the output is the signal authenticity probability to distinguish the adversarial sample and the normal signal.

[0017] Further, the optimization constraints for training the adversarial sample in S3 include: the feature similarity of the adversarial sample and the normal signal is greater than or equal to 95%, the integrity of the attack payload in the adversarial sample is greater than or equal to 98%, and the iteration training rounds are 500-1000 rounds until the constraints are met.

[0018] Further, the transmitting module in S4 includes a programmable signal generator, a power amplifier and a self-adaptive directional antenna array; the transmitting beam direction of the directional antenna array is adjusted through a beamforming algorithm, so that the main lobe energy of the transmitting beam only covers the target UAV, and the beam width is less than or equal to 5°.

[0019] Further, in S4, the transmitting power is adjusted according to the distance between the target UAV and the transmitting module, so that the power of the attack signal reaching the radiation source receiving end of the target UAV satisfies the receivable threshold, and at the same time, the power is prevented from being too large to cause the signal to spread to the surrounding equipment.

[0020] Further, in S5, the attack effect verification dimensions include: monitoring the communication link packet loss rate of the UAV and the remote controller in the communication layer, tracking the flight trajectory deviation of the UAV in the navigation layer, and observing whether the UAV executes the preset attack action in the control layer; the closed-loop adjustment includes feeding back to S3 to adjust the learning rate of the CVE-AdvGAN generator to retrain the adversarial sample, and feeding back to S4 to fine-tune the antenna beam direction and adjust the transmitting power.

[0021] The beneficial effects of the present application are:

[0022] (1) The present application establishes a plurality of unmanned aerial vehicle frequency hopping communication data sets along the railway (including specific interference), which can accurately verify the real robustness of the system under changing environment and the adaptability to non-cooperative unmanned aerial vehicles; solve the problem that the frequency hopping signal data processing of unmanned aerial vehicle data transmission communication system does not have general versatility, and can quickly and universally process the frequency hopping signal to adapt to the input of the deep learning model, and at the same time, the directional frequency domain attack method is adopted, which overcomes the limitation that the time domain attack needs space-time alignment and is easy to be detected in the conventional radiation source identification system counterattack;

[0023] (2) The framework design of the present application solves the accuracy, effectiveness and practicality of the directional frequency domain attack method in the actual algorithm; the core frequency domain mask algorithm designed improves the frequency domain attack accuracy and actual effectiveness, and also solves the problem that the frequency domain attack is easy to be filtered by the filter, and the amplitude limitation and loop step disturbance mechanism of the design avoid the situation that the signal feature form variation is too large to be detected or filtered in the radiation source identification system counterattack; The comprehensive design also improves the effectiveness and practicability of the radiation source identification system counterattack, and in the actual electromagnetic signal radiation source identification attack, not only the attack success rate of the multi-class radiation source is obviously improved compared with the conventional method, but also the directional attack success rate reaches a high level, which can cope with the counterattack of the non-cooperative platform radiation source identification system in practice;

[0024] (3) The present application designs the application way of CVE-AdvGAN in the real unmanned aerial vehicle task load platform, and successfully solves the landing problem of the algorithm from the theoretical level to the practical application. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 is a classification base model structure diagram;

[0026] Figure 2 is a CVE-AdvGAN model framework diagram;

[0027] Figure 3 is a loop step disturbance mechanism diagram;

[0028] Figure 4 is a directional flow process working schematic diagram;

[0029] Figure 5 is a working schematic diagram of multiple boxes;

[0030] Figure 6 is a working schematic diagram of the CVE-AdvGAN model;

[0031] Figure 7 is a comparison diagram of original signals, CVE-AdvGAN and AdvGAN signals under semi-white box attack in frequency domain;

[0032] Figure 8The frequency domain comparison chart of the original signal, the CVE-AdvGAN signal and the AdvGAN signal under black box attack;

[0033] Figure 9 The frequency domain comparison chart of the AdvGAN signal and the CVE-AdvGAN signal;

[0034] Figure 10 The working schematic diagram of the CVE-AdvGAN algorithm on the unmanned aerial vehicle platform. DETAILED DESCRIPTION

[0035] The technical solutions of the present application will be described in detail below in conjunction with embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the present application.

[0036] Embodiment 1:

[0037] A non-cooperative unmanned aerial vehicle radiation source directional attack method based on CVE-AdvGAN is provided, comprising the following steps:

[0038] S1: sensing and feature extraction of the radiation source signal of the non-cooperative unmanned aerial vehicle, collecting the communication signal and the navigation signal of the target unmanned aerial vehicle, extracting the physical layer features and the protocol layer features of the signal, and establishing a target unmanned aerial vehicle radiation source feature library;

[0039] S2: CVE vulnerability screening and attack payload construction, searching the CVE database based on the protocol type or hardware related information corresponding to the radiation source signal extracted in S1, screening the exploitable vulnerabilities that can act on the radiation source, and designing the attack payload for the screened vulnerabilities;

[0040] S3: CVE-AdvGAN adversarial sample generation and optimization, constructing a CVE-AdvGAN model comprising a generator, a discriminator and a frequency domain disturbance control module, taking the normal signal in S1 as the original sample and the attack payload in S2 as the target information, training the adversarial sample through the frequency domain real and imaginary part processing and step-by-step disturbance mechanism of the model, so that the adversarial sample meets the requirements of concealment and effectiveness at the same time;

[0041] S4: directional electromagnetic attack signal emission, through the emission module composed of a signal generator, a power amplifier and a directional antenna, combining the real-time position information of the target unmanned aerial vehicle, adjusting the emission beam direction and the emission power, and directing the adversarial sample generated in S3 to the radiation source receiving end of the target unmanned aerial vehicle;

[0042] S5: Real-time verification of attack effect and closed-loop adjustment are performed, the state of the target UAV in the communication layer, navigation layer and control layer is monitored, and it is judged whether the attack is successful. If not, the parameters are optimized by feeding back to the CVE-AdvGAN module of S3 and the launch module of S4 until the attack is successful.

[0043] In S1, a sensing device composed of a directional antenna array, a software radio device and a signal analyzer is used to passively collect the radiation source signals of the target UAV without the authorization information of the target UAV.

[0044] In S1, the physical layer features extracted include frequency, bandwidth, modulation mode, power spectral density and constellation diagram; the protocol layer features extracted include frame structure, check mode and instruction encoding rule.

[0045] In S2, the CVE database searched includes a general vulnerability disclosure related database, and the exploitable vulnerabilities screened include radiation source protocol vulnerabilities and radiation source hardware firmware vulnerabilities.

[0046] In S2, the attack payload designed is a precise trigger type attack payload, which can trigger the corresponding CVE vulnerability to achieve the preset attack target after being injected into the target UAV through the radiation source signal.

[0047] In the CVE-AdvGAN model in S3, the generator adopts a network structure of "3 3x3 conv+3 3x3 resnet+3 3x3 deconv", the input is the feature map of the target normal signal in S1, and the output is the adversarial sample fused with the attack payload; the discriminator corresponding to the generator module adopts a network structure of 3 conv modules, the input is the adversarial sample or normal signal, and the output is the signal authenticity probability to distinguish the adversarial sample and the normal signal.

[0048] In S3, the optimization constraints for training the adversarial sample include: the feature similarity of the adversarial sample and the normal signal ≥95%, the integrity of the attack payload in the adversarial sample ≥98%, and the iteration training rounds are 500-1000 rounds until the constraints are met.

[0049] In S4, the launch module includes a programmable signal generator, a power amplifier and a self-adaptive directional antenna array; the beam direction of the directional antenna array is adjusted through the beamforming algorithm, so that the main lobe energy of the launch beam only covers the target UAV, and the beam width is ≤5°.

[0050] In S4, the launch power is adjusted according to the distance between the target UAV and the launch module, so that the power of the attack signal reaching the target UAV radiation source receiving end meets the receivable threshold, while avoiding the power being too large to cause signal diffusion to surrounding devices.

[0051] The attack effect verification dimension in S5 includes: monitoring the communication link packet loss rate of the communication layer between the unmanned aerial vehicle and the remote controller, tracking the flight trajectory deviation of the navigation layer, and observing whether the unmanned aerial vehicle performs the preset attack action; the closed-loop adjustment includes feeding back to the S3 adjustment CVE-AdvGAN generator to retrain the learning rate of the adversarial sample, and feeding back to the S4 fine-tuning of the antenna beam direction and adjustment of the transmission power.

[0052] Embodiment 2

[0053] The embodiment provides a non-cooperative unmanned aerial vehicle radiation source directional attack method and application scheme based on CVE-AdvGAN, realizes identity directional attack of the non-cooperative unmanned aerial vehicle radiation source, and through the method of attacking the radiation source signal, makes the non-cooperative platform identify the non-cooperative unmanned aerial vehicle as the unmanned aerial vehicle of the cooperative party, launches an attack on the non-cooperative unmanned aerial vehicle, and identifies the unmanned aerial vehicle of the cooperative party as the non-cooperative unmanned aerial vehicle, thereby protecting the safety of the unmanned aerial vehicle of the cooperative party and ensuring the airspace safety of the cooperative party. First, the unmanned aerial vehicle data set with certain robustness needs to be collected to provide guarantee for model training; second, on the basis of ensuring that the unmanned aerial vehicle frequency hopping communication data is converted into a universal model input, the attack method of deforming the time domain form generated by the conventional time domain attack is modified into a frequency domain directional attack method, which increases the practicability and concealment of the attack method; the focus is on designing the overall framework of the CVE-AdvGAN, so that it has compatibility with electromagnetic signals and has the characteristics of generating accurate frequency domain disturbance, being not easy to be detected, and having strong robustness. At the same time, the loop cycle mechanism and the mask key frequency domain protection mechanism are designed, so that the attack disturbance generated by the CVE-AdvGAN is more accurate and has higher effectiveness. In addition, through the optimization of the model loss function and the comprehensive design of the model, a high-reliability directional identity attack on the radiation source identification system of the non-cooperative unmanned aerial vehicle control platform is realized. Finally, a verification method and an actual application method are provided for the effectiveness and actual application of the embodiment. In order to achieve the above purpose, the non-cooperative unmanned aerial vehicle radiation source directional attack method and application based on CVE-AdvGAN provided by the embodiment include the following technologies:

[0054] Step one, collect and establish the unmanned aerial vehicle data set: in order to verify the effectiveness of the content of the embodiment, a wireless frequency hopping signal database based on real unmanned aerial vehicle equipment collection is established. The database is processed through professional means for pre-signal frequency domain analysis, signal-to-noise ratio processing, and adjustable simulation railway line superimposed noise, forms a data set superimposed with real environment noise, and establishes four data sets: 1) for training and verifying the classification model, 2) for training the distillation model, 3) for training the CVE-AdvGAN, and 4) for verifying the effectiveness of the adversarial algorithm.

[0055] Step two, constructing data preprocessing algorithm and intelligent classification model of radiation source: In order to verify the effectiveness of the adversarial model and the adversarial comprehensive algorithm, an effective and reliable signal feature preprocessing algorithm and intelligent classification model of radiation source are constructed.

[0056] The signal feature preprocessing algorithm mainly intercepts the core time domain segment of the received signal, aligns the signal length, and converts the frequency domain.

[0057] The intelligent classification model of radiation source set in this embodiment mainly identifies the identity of the radiation source based on the frequency domain information of the signal. It should be noted that most papers show that the time domain information is easily affected by external interference and affects the accuracy of identity recognition. Intelligent recognition of radiation sources is generally based on frequency domain information. In addition, direct capture of signals based on frequency domain is more practical in the field of unmanned aerial vehicles. Therefore, this embodiment develops an adversarial attack method based on frequency domain information, which has more practical application value.

[0058] Step three: constructing CVE-AdvGAN adversarial attack network model

[0059] The construction of the CVE-AdvGAN adversarial attack network model realizes electromagnetic interference and radiation source identity attack in the field of intelligent recognition of radiation sources, thereby realizing attack on non-cooperative radiation sources and protection of our radiation sources. Specifically, the CVE-AdvGAN generates a directional frequency domain disturbance signal according to the communication electromagnetic signal form of the current unmanned aerial vehicle data transmission antenna, transmits it through the radio frequency antenna carried by the unmanned aerial vehicle, and at the same time, the data transmission antenna of the unmanned aerial vehicle still sends normal communication data transmission signals. The non-cooperative unmanned aerial vehicle control system receives the electromagnetic signal of our radiation source superimposed with the interference signal. At this time, the non-cooperative unmanned aerial vehicle control system is attacked and loses the function of identifying the identity of our unmanned aerial vehicle signal. Further, this embodiment upgrades and optimizes the loss function of the disturbance generated by the CVE-AdvGAN, changes the identity recognition of the non-cooperative unmanned aerial vehicle control system to the signal source, so that the non-cooperative party identifies the non-cooperative unmanned aerial vehicle radiation source signal as our unmanned aerial vehicle. At this time, the behavior of our unmanned aerial vehicle can be completely protected from the supervision and subsequent attack of the non-cooperative party, and the defense of our airspace against non-cooperative unmanned aerial vehicles is successfully completed.

[0060] CVE-AdvGAN innovatively proposes a frequency disturbance attack based on the frequency range of electromagnetic signals. This disturbance attack does not require time-domain alignment with the signal, and only needs to increase or disturb some fixed frequency points to complete the disturbance attack, which has strong practical applicability. Secondly, through the special design of the network structure, CVE-AdvGAN can generate a very small disturbance in a specific frequency domain. The frequency domain of the disturbance is controlled within the frequency domain error range of the attack signal, and is controlled within a very small amplitude, which is extremely deceptive and deceptive. Finally, CVE-AdvGAN proposes a new mechanism in terms of training method and loss function, so that CVE-AdvGAN can generate effective, very small, and deceptive disturbances within a specific frequency range, and compared with the existing method of directional attack which can only be directed to identify one identity target, the embodiment realizes cross-type directional identity recognition, that is, the target party identifies the non-cooperative unmanned aerial vehicle as our unmanned aerial vehicle, and identifies our unmanned aerial vehicle as a non-cooperative unmanned aerial vehicle.

[0061] The CVE-AdvGAN specifically designed includes the following:

[0062] Firstly, the real and imaginary parts of the frequency domain of the electromagnetic signal are separately processed, so that the disturbance characteristics of the frequency domain are more accurate and less likely to be discovered. It includes the generation network Gi of the I-channel signal frequency domain, the discrimination network Di, the generation network Gq of the Q-channel signal frequency domain, the discrimination network Dq, the synthesis module of the two-channel signal frequency domain, and the generation network Gadv and the discrimination network Dadv of the synthesized signal frequency domain. Secondly, a step-by-step adversarial generation mechanism based on the loop mechanism is innovatively proposed. Through the loop mechanism, the disturbance range and disturbance amplitude are controlled, so that the disturbance effectively attacks the features of the radar signal frequency domain within a very small frequency domain range and a very small amplitude. Finally, the loss function related to the directional attack is added, and other loss functions are optimized based on the CVE-AdvGAN structure, so that the disturbance generated by CVE-AdvGAN is real and effective.

[0063] Step four, classify the attack model and evaluate the attack effectiveness: according to the above steps, the database construction, signal preprocessing, generation of radar intelligent classification model and generation of attack model CVE-AdvGAN are completed. This step evaluates the performance of CVE-AdvGAN in white-box attack, black-box attack and dynamic black-box attack, and comprehensively evaluates the attack effectiveness of CVE-AdvGAN.

[0064] Step five, application of CVE-AdvGAN adversarial attack model in unmanned aerial vehicle radar source attack:

[0065] Steps 1-3 complete the UAV database collection and construction, UAV signal preprocessing, radiation source intelligent classification model construction, and counter-attack model construction. Step 4 completes the effectiveness verification of the present embodiment, and the present step completes the application process of transplanting the algorithm to the UAV platform.

[0066] The counter-attack model is transplanted by embedding to form a complete hardware board card. The board card is placed in the UAV task load, and a dedicated jamming signal transmitting antenna is set to transmit the radio frequency signal of the counter-attack disturbance, realizing the directional attack on the external non-cooperative UAV and the defense of our airspace.

[0067] Example: Based on the example of real railway UAV communication frequency hopping signal:

[0068] Step 1, collect and establish the UAV dataset:

[0069] In order to verify the effectiveness of the content of the present embodiment, a wireless frequency hopping signal database based on real UAV equipment collection is established. The database is processed by professional means for pre-signal frequency domain analysis and processing, signal-to-noise ratio processing, and adjustable simulation railway along noise, forming a data set superimposed with real environment noise. A total of 4 data sets are established: 1) to train and verify the classification model, 2) to train the distillation model, 3) to train CVE-AdvGAN, and 4) to verify the effectiveness of the counter-attack algorithm.

[0070] (1) Signal collection method:

[0071] A real-time spectrum analyzer is used, the collection time length is set to 240 ms, the upper and lower limit frequency of the bandwidth is set to 600 MHz, 1000 MHz (the frequency hopping range of the data transmission of the UAV is generally concentrated in 600 MHz-1000 MHz), and the collection frequency is set to 200 MHz.

[0072] (2) Signal transmission method:

[0073] Ten UAV devices are used to fly along the railway. The school has a 1:1 real simulation railway, which can simulate the flight background of the railway inspection UAV. Among them, 2 UAV devices are used as non-cooperative UAVs, and 8 UAV devices are used as our UAVs.

[0074] (3) Data set establishment:

[0075] 1) Construct a preliminary data set: The collected signals are pre-processed by professional means for signal processing. At this time, the signal-to-noise ratio of the collected UAV communication signals is about -10 dB, and the total amount of data is 6000 signal waveform segments (about 600 signals for each UAV).

[0076] 2) Constructing railway simulation noise: the actual train operation will also have a greater impact on the UAV communication signal, therefore, this part simulates the train operation noise through signal simulation method, so that the signal has a real environment background and combativeness;

[0077] 3) Constructing radiation source identification classification model dataset: the training set adopts 1600 data to train the UAV radiation source identification model; the test set adopts 400 data to test the UAV radiation source identification model; the verification set adopts 400 data to verify the UAV radiation source identification model;

[0078] 4) Constructing training data set of CVE-AdvGAN model: 1600 data remaining from the signal are adopted as the training set of the CVE-AdvGAN model;

[0079] 5) Constructing verification data set of attack model: the remaining data are adopted as the attack effectiveness verification data set of the attack model.

[0080] Step two, constructing radiation source intelligent classification algorithm based on data preprocessing algorithm and deep learning:

[0081] In order to verify the effectiveness of the adversarial model and the adversarial comprehensive algorithm, an effective and reliable signal feature preprocessing algorithm and radiation source intelligent classification model are constructed.

[0082] Signal form preprocessing technology:

[0083] 1) Core time domain segment interception:

[0084] Since the embodiment adopts the UAV radiation source signal, and the UAV number transmission signal is generally a frequency hopping signal, the collected signal contains multiple continuous frequency hopping signals. Therefore, the core time domain segment interception is performed on the first effective time domain signal with a higher average value than the average value of the whole signal by the sliding window average value calculation method, wherein, is the first effective time domain signal with a higher average value than the average value of the whole signal, and is a complete signal collected by the device, so as to complete the core time domain segment.

[0085] 2) Signal length alignment:

[0086] The core time domain segment intercepted by the mutation amplitude may have the problem of non-uniform signal length. This step first counts the longest signal segment of all intercepted segments, aligns the lengths of all segments with the longest signal segment by up-conversion, and stores the length , which is used for subsequent verification, attack training and the like. The signal is up-converted and aligned according to the length, and the data reliability of the input model is increased.

[0087] 3) Signal frequency domain transformation:

[0088] The embodiment is directed to the processing of the frequency domain changes of the signal, and is mainly used for counter analysis and effectiveness analysis based on the frequency domain counter, so the embodiment uses the conventional Fourier transform to transform the signal from the time domain to the frequency domain, and the base feature of the model input is not further processed.

[0089]

[0090] wherein, represents the fast Fourier transform of the discrete time domain signal , and the output is the frequency domain representation, that is, the complex form, which contains amplitude and phase information; is the discrete time domain signal obtained in the above step, is the length of the uniformly aligned time domain signal, is the base-10 exponential, is the complex exponential base function, is the complex exponential part, which is the decomposition base of the Fourier transform, is the imaginary unit, is the digital angular frequency, which represents the frequency scale of the frequency domain, is the index of the time domain sampling point;

[0091] The discrete time domain signal in the time domain is decomposed into signal intensity at each frequency by multiplying and summing with complex exponential signals of different frequencies, so that the characteristics of the signal can be analyzed from the frequency perspective, such as spectrum and bandwidth.

[0092] 4) Constructing a radiation source intelligent identification model:

[0093] The embodiment mainly designs an attack algorithm for other classification models, so the classification model algorithm needs to be reasonably designed to verify the effectiveness of the attack algorithm and compare it with other attack algorithms.

[0094] The classification model is a base model with a certain structure that can be used by the attack algorithm, but does not have too high recognition accuracy (a model with too high accuracy is easy to cause large fluctuations in accuracy due to interference or attack). The recognition accuracy of the classification model is controlled at about 80% in a complex environment, and a too complex and refined structure is not set to improve its accuracy.

[0095] The structure of the classification base model is shown in Figure 1 , which is composed of 3 residual modules, 2 fully connected layers and 1 softmax layer, wherein each residual module contains 2 convolution blocks.

[0096] 5) Training base classification model:

[0097] The classification model dataset of step one contains 10 unmanned aerial vehicle communication data, the training set contains 1600, each unmanned aerial vehicle contains 160, the test set contains 400, each unmanned aerial vehicle contains 40, and the verification set contains 400, each unmanned aerial vehicle contains 40. The training, testing and verification steps are as follows:

[0098] a) Feature processing according to 1)-3) of this step is adopted for all data;

[0099] b) The base classification model parameters are initialized, and the training set is trained in batches according to the parameters of batch_size=32 and epoch=100. The model parameters with the optimal test set test accuracy are saved during training; batch_size=32 means that the number of samples input to the model at a time during each training iteration is 32; epoch=100 means that the model completes a complete training process by traversing all samples of the entire training dataset once, and the batch size is 100.

[0100] c) Load the optimal model parameters, input the processed verification set data features, and get the intelligent classification algorithm result. In this collected data set, the recognition accuracy of 10 types of unmanned aerial vehicle radars containing background noise is 85.2%, and the comprehensive recognition accuracy meets our test requirements for the algorithm.

[0101] Step three, build CVE-AdvGAN adversarial attack network model:

[0102] The construction of CVE-AdvGAN adversarial attack network model realizes electromagnetic interference and radar source identity attack in the field of radar source intelligent identification, so as to realize attack on non-cooperative radar source and protection of our radar source. Specifically, according to the communication electromagnetic signal form of the current unmanned aerial vehicle data transmission antenna, CVE-AdvGAN generates a directional frequency domain disturbance signal, which is transmitted through the radio frequency antenna carried by the unmanned aerial vehicle. At the same time, the unmanned aerial vehicle data transmission antenna still sends normal communication data transmission signal, while the non-cooperative unmanned aerial vehicle control system receives the electromagnetic signal of our radar source superimposed with the interference signal. At this time, the non-cooperative unmanned aerial vehicle control system is attacked and loses the radar source identity recognition function of our unmanned aerial vehicle signal. Further, this embodiment upgrades and optimizes the loss function of the disturbance generated by CVE-AdvGAN, changes the identity recognition of the non-cooperative unmanned aerial vehicle control system to the signal radar source, so that the non-cooperative unmanned aerial vehicle control system identifies the non-cooperative unmanned aerial vehicle signal as our unmanned aerial vehicle. At this time, the behavior of our unmanned aerial vehicle can be completely protected from the supervision and subsequent attack of the non-cooperative party, and the defense of our airspace against non-cooperative unmanned aerial vehicles is successfully completed.

[0103] CVE-AdvGAN innovatively proposes a frequency disturbance attack based on the frequency range of electromagnetic signals, which does not require time-domain alignment with the signal, only needs to increase or disturb part of the fixed frequency points to complete the disturbance attack, and has strong practical applicability. Secondly, through the special design of the network structure, CVE-AdvGAN can generate a very small disturbance in a specific frequency domain. The frequency domain of the disturbance is controlled within the frequency domain error range of the attack signal, and is controlled within a very small amplitude, which is extremely deceptive and deceptive. Finally, CVE-AdvGAN proposes a new mechanism in terms of training method and loss function, so that CVE-AdvGAN can generate effective, very small, and deceptive disturbances within a specific frequency range, and compared with the existing method of directional attack which can only be directed to identify one identity target, the embodiment realizes cross-directional identity recognition, that is, the target party identifies the non-cooperative unmanned aerial vehicle as the unmanned aerial vehicle of our party, and identifies the unmanned aerial vehicle of our party as the non-cooperative unmanned aerial vehicle. The specific setting steps of CVE-AdvGAN are as follows:

[0104] (1) Construct the model framework of CVE-AdvGAN:

[0105] The signal frequency domain of step two is divided into real and imaginary parts for separate processing. The real part is the I-channel signal frequency domain, which is referred to as xi here, and the imaginary part is the Q-channel signal frequency domain, which is referred to as xq. In the CVE-AdvGAN, the real and imaginary parts are decoupled, multiple disturbance generators and supervisors are set up, and the robustness and accuracy of the model framework and the disturbance generation are improved.

[0106] 1) For the I-channel signal, set the generation network Gi and the discrimination network Di. For the Q-channel signal, set the generation network Gq and the discrimination network Dq.

[0107] Among them, the G network is used to generate a disturbance signal according to the input signal, and the D network is used to supervise whether the generated disturbance signal can approach the original signal after being crossed with the original signal and not be detected. The I-channel signal frequency domain and the Q-channel signal frequency domain are independently disturbed, which can more easily control the amplitude and fineness of the disturbance;

[0108] 2) The disturbances generated by the I-channel signal frequency domain and the Q-channel signal frequency domain are superimposed with the I-channel signal frequency domain and the Q-channel signal frequency domain of the original signal frequency domain to synthesize a signal frequency domain;

[0109] The Base identification network determines the identity of radiation source signals based on both the I and Q signal frequency domains. Therefore, it is necessary to superimpose the disturbance generated by the I and Q signal frequency domains with the original I and Q signal frequency domains and synthesize them into a single signal. Here, the synthesis module treats the I and Q signal frequency domains as parallel data and synthesizes them into a single matrix: x_adv = [xi_adv; xq_adv].T, where xi_adv is the output signal frequency domain of the disturbance generated by superimposing the I signal frequency domain (processed by Gi) with the first original xi signal frequency domain, xq_adv is the output signal frequency domain of the disturbance generated by superimposing the Q signal frequency domain (processed by Gq) with the second original xq signal frequency domain, and T is the transpose of the matrix.

[0110] 3) Set up a generator network Gadv and a discriminator network Dadv for the synthesized signal frequency domain x_adv, generate the final perturbation superposition adversarial signal frequency domain x_adv' for the synthesized signal frequency domain, and supervise the synthesized perturbation signal frequency domain;

[0111] 4) Integrate the above modules into a comprehensive design, the specific framework of which is as follows: Figure 2 As shown, the loss function will be explained in subsequent steps.

[0112] (2) Set up a step-by-step loop training mechanism for CVE-AdvGAN. Control the perturbation amplitude through the step-by-step mechanism and limit the perturbation frequency range to reduce the probability of being detected and improve the effectiveness of the perturbation.

[0113] This step sets Gi and Gq into 5 smaller steps, using a loop mechanism. The perturbation generated all at once by the G network of a common AdvGAN network (a conventional adversarial attack network) is divided into 5 steps. The perturbation value generated in each step is set to about 1 / 5 of the original AdvGAN G perturbation. Through the 5-step loop generation method, the total perturbation value generated in the 5 steps is consistent with the perturbation amplitude generated in a single step by a conventional AdvGAN. However, because the perturbation position generated in each loop is different, the final perturbation amplitude superimposed on the original signal frequency domain at the end of the loop is about 1 / 5 of the AdvGAN G perturbation, making it difficult to detect. At the same time, it can still achieve the anti-interference effect of a single perturbation generated by a conventional AdvGAN network (consistent total perturbation amplitude).

[0114] Furthermore, this step first requires setting a mask value to limit the frequency domain perturbation range. The purpose of this setting is to perturb only the key frequency domain. The receiver typically sets a filter to filter out clutter frequencies, and only by setting perturbations in the key frequency domain can effective perturbation be achieved. Secondly, a perturbation amplitude limiting function must be set. The purpose of this setting is to limit the overall amplitude of the perturbation, making it less likely to be detected by the other party. Finally, these two mechanisms are integrated to comprehensively set the five-step loop rule.

[0115] 1) Set mask to limit the frequency domain range of perturbation;

[0116] Under the premise that the signal time domain is T, after being converted into discrete data, the frequency domain expression is carried out based on the FFT Fourier transform formula. At this time, the frequency domain expression is in complex form, including the real part xi and the imaginary part xq.

[0117] At this time, the data frequency domain length is L. According to the frequency domain range and bandwidth requirements of the unmanned aerial vehicle data transmission signal processed by the embodiment, the mask is set as:

[0118]

[0119] Among them, mask is a mask, the number of 1 is the first 0.1L integer, the number of 0 is 0.9L integer, and the final number of bits needs to be consistent with the original number of bits.

[0120] 2) Set 5-step loop perturbation generation process for Gi and Gq, - 5 sets the respective loop perturbation values of the 5-step loop perturbation values obtained for Gi, - 5 sets the respective loop perturbation values of the 5-step loop perturbation values obtained for Gq:

[0121]

[0122]

[0123]

[0124]

[0125]

[0126]

[0127]

[0128]

[0129] 3) Constraint of perturbation value (explanation and effect of limit):

[0130] Taking the I-way perturbation generation as an example, the perturbation and amplitude sum of each step of the 5-step loop perturbation method are calculated :

[0131] ;

[0132] Among them, xi0 is the original input signal i-way frequency domain xik is the k-step perturbation input signal frequency domain, xik-1 is the k-1-step perturbation input signal frequency domain, is the average perturbation amplitude value of the k-step; is the L2 norm (Euclidean norm);

[0133] The average amplitude value of the perturbation generated by the AdvGAN network is , which ensures the perturbation effect and is consistent with the amplitude value of A:

[0134]

[0135] The final perturbation amplitude value of CVE-AdvGAN superimposed on the signal frequency domain is :

[0136] ;

[0137] Since a 5-step loop is used for generation, the perturbation position generated each time is different, only 1 / 5, which is expressed as follows:

[0138]

[0139] The highest effective perturbation value amplitude constraint set by the general AdvGAN is about 0.2 times the maximum data amplitude value, and the embodiment is set as follows, which is still significantly lower than the perturbation amplitude range of the conventional adversarial data generation, limit is set as follows according to the input and output data of the output maximum amplitude constraint range:

[0140]

[0141]

[0142]

[0143] Among them, is the output maximum amplitude constraint range of the I-way, means taking the maximum value in the input signal i-way frequency domain xi, and 0.05 is the constraint weight value; is the output maximum amplitude constraint range of the Q-way, means taking the maximum value in the input signal q-way frequency domain xq, and 0.05 is the constraint weight value; is the output maximum amplitude constraint range of the input network Gadv, means taking the maximum value of the modulus ( ) of the input signal i-way frequency domain and q-way frequency domain, and 0.05 is the constraint weight value.

[0144] 4) The frequency domain of the I and Q channel countermeasure signals and the input Gadv signal frequency domain are as follows:

[0145]

[0146] The 5-step loop step-by-step disturbance generation mechanism can ensure that the disturbance amplitude is greatly reduced while maintaining the original disturbance countermeasure effect, and the frequency domain form of the original signal is maintained, which is not easy to be detected by the other party. The loop mechanism framework diagram and training process are shown in Figure 3 .

[0147] (3) Set the training mechanism and loss function for CVE-AdvGAN:

[0148] 1) Set the CVE-AdvGAN framework loss function:

[0149] ;

[0150] ; ;...; ; ;

[0151] wherein the input value:

[0152] Di is the i-channel supervision function of CVE-AdvGAN, Gi1-Gi5 are the i-channel generation functions of the 5-step disturbance, and Di is set to identify whether the input value is the original signal i-channel value or the signal i-channel value superimposed with Gi generated disturbance;

[0153] xi is the original signal frequency domain i-channel value, xi1 is the first step disturbance value superimposed with Gi1 generated disturbance; xi2 is the second step disturbance value superimposed with Gi2 generated disturbance; xi3 is the first step disturbance value superimposed with Gi3 generated disturbance; xi4 is the fourth step disturbance value superimposed with Gi4 generated disturbance; xi5 is the fifth step disturbance value superimposed with Gi5 generated disturbance;

[0154] Ai' (described in step (2) 3) is the maximum value of the i-channel output limit;

[0155] mask is the frequency domain limit range value described in step (2) 1);

[0156] Output value:

[0157] Di represents the Di decision value of the input true xi value;

[0158] - Di represents the Di decision value of the input superimposed step Gi1-Gi5 disturbance value, respectively;

[0159] For the Gi series loss function, it is to make the generated frequency domain discriminant value of the generated adversarial deception close to the discriminant value of the original signal frequency domain. Therefore, the loss function is set to make the adversarial signal frequency domain close to 1 after being supervised by Di, and the real signal frequency domain is calculated in the opposite direction:

[0160]

[0161]

[0162] Wherein, subscript k∈[1,5];

[0163] Input value: is a full 1 matrix corresponding to the format, is a full 0 matrix corresponding to the format;

[0164] Di represents the Di discriminant value of the input real xi value; Di represents the Di discriminant value of the input k-step Gik superimposed step-by-step disturbance value;

[0165] is a typical MSE loss function, which is used to calculate the difference value between two input matrices. The smaller the value, the higher the similarity between the two input matrices;

[0166] Output value: Di represents the loss value of the i-way frequency domain signal k-step disturbance function Gik generation function. In the calculation, make The smaller the value, the closer the pseudo value of the superimposed Gik generated disturbance to the real value, and the higher the final output of the deception effectiveness;

[0167] For the Di series loss function, it is opposite to the Gi series loss function setting. Di is a supervision function, so the function is responsible for identifying the real signal frequency domain as 1 and the adversarial signal frequency domain as 0:

[0168]

[0169] Wherein, wherein, subscript k∈[1,5];

[0170] Input value: is a full 1 matrix corresponding to the format, is a full 0 matrix corresponding to the format;

[0171] Di represents the Di discriminant value of the input real xi value; Di represents the Di discriminant value of the input k-step Gik superimposed step-by-step disturbance value;

[0172] This is a typical MSE loss function, which calculates the difference between two input matrices. The smaller the value, the higher the similarity between the two input matrices.

[0173] Output value: The Dik judgment value represents the pseudo-value of the perturbation function at the k-th step, representing the superposition of the i-channel frequency domain signals; calculation is underway. The smaller the value, the stronger its ability to identify the perturbation pseudo-values ​​and real values ​​generated by Gik.

[0174] During training, the i-way supervision function Di and the step-by-step perturbation generation functions Gi1-Gi5 supervise each other. Improving the ability of Di helps Gi1-Gi5 generate more realistic perturbation values, while improving the ability of Gi1-Gi5 also helps improve the recognition ability of Di.

[0175] Since the I-path and Q-path use a 5-step loop method, the loss function of the GAN framework for the I-path and Q-path is:

[0176]

[0177] in, Let be the overall generation loss function for the perturbation generated by path i, and let be the step-by-step perturbation generation function for path i. - ,like Figure 3 As shown, It is the average loss value of the i-way step-by-step perturbation generation function Gi1-Gi5;

[0178] Let i be the overall supervision loss function for generating perturbations in path i, and let i be the step-by-step perturbation supervision function for path i. - ,like Figure 3 As shown, The determination of the i-way step-by-step perturbation generation function Gi1-Gi5 step-by-step generation Average loss value

[0179] Similarly, the Q-path also follows the same loss function calculation process: ;

[0180] in, Let be the overall generation loss function for the perturbation generated by the q-path, and let be the step-by-step perturbation generation function for the q-path. - ,like Figure 3 As shown, It is the average loss value of the q-path step-by-step perturbation generation function Gq1-Gq5;

[0181] The overall monitoring loss function for generating perturbations in the q-path is given by [example function]. The step-by-step perturbation monitoring function for the q-path is given by [example function]. - As shown in Figure 3 , is the q-step disturbance generation function Gq1-Gq5 generated by the step average loss value.

[0182] Similarly, the framework loss function of adv has:

[0183] ;

[0184] ;

[0185] Among them, the input value: the frequency domain limited range value mask obtained from step (2) 1);

[0186] The output maximum amplitude constraint range of the input network Gadv obtained from step (2) 3): ;

[0187] Obtained from step (2) 4): As shown in Figure 2 , and are the output values of the i and q paths after the disturbance of the sub-steps Gi1-Gi5 and Gq1-Gq5 respectively;

[0188] As shown in Figure 3 , is the supervised function after superimposing the disturbance of the sub-steps ; is the disturbance generation function of , which sets a double insurance mechanism for the loop cycle in the early stage, which guarantees the authenticity of the generated value, improves the spoofability, and also guarantees the disturbance range of the generated value, so that it is within a reasonable interval;

[0189] Output value: is the judgment value of the input original ; is the judgment value of the input superimposed with Gadv disturbance; ;

[0190] ;

[0191] ;

[0192] Input value: is a full 1 matrix of the corresponding format, is a full 0 matrix of the corresponding format;

[0193] represents the input original ​Dadv decision value; represent the original Dadv decision value of superimposed disturbance value;

[0194] The typical MSE loss function, which calculates the difference between the two input matrices, the smaller the value, the higher the similarity between the two input matrices;

[0195] Output value: represent the original Dadv decision value; in the calculation The smaller, the stronger the ability to identify the superimposed Gadv generated disturbance value and the true value;

[0196] The generated function loss value of the disturbance function Gadv, in the calculation The smaller, the closer the value of the superimposed Gadv generated disturbance to the true value, and the higher the effectiveness of the final output.

[0197] This step has the framework loss function of the generated confrontation :

[0198] ;

[0199] Wherein, the input value: The total generated loss function of the i-th generated disturbance; The total supervised loss function of the i-th generated disturbance;

[0200] The total generated loss function of the q-th generated disturbance; The total supervised loss function of the q-th generated disturbance;

[0201] The total generated loss function of the generated disturbance based on the step-by-step disturbance of x_adv; The total supervised loss function of x_adv based on the step-by-step disturbance; the specific calculation process has been described in the foregoing steps, and the specific process is seen Figure 2 .

[0202] Output value: The total generated loss function of the generated loss function of the patent ; The total supervised loss function of the patent .

[0203] They and mutually supervise and train each other and improve each other's ability, so that The overall disturbance can generate strong concealment and good target feature superposition effect; For supervision Generate superposition disturbance value pseudo value authenticity.

[0204] Set the CVE-AdvGAN amplitude loss function:

[0205] Based on the above restriction of amplitude, set limit in the program amplitude limit function:

[0206] ;

[0207] ;

[0208]

[0209] ;

[0210] ;

[0211] Wherein, k is an integer from 1 to 5;

[0212] Input value: The expected value of the containing formula is calculated with xi, xi1, xi2, xi3, xi4 (the related value described in step (2) 2) as the value range;

[0213] Max is the maximum value of the containing formula;

[0214] -Gi5 is Figure 3 The disturbance function of the first to fifth steps of the i-way;

[0215] The frequency domain limiting value mask can be obtained from step (2) 1);

[0216] The output maximum amplitude constraint range of the I-way can be obtained from step (2) 3);

[0217] Output value: - The amplitude limit loss function of the first to fifth steps of the step disturbance of the i-way frequency domain signal;

[0218] The overall amplitude limit loss function of the i-way is based on the average value of the previous five step loss functions.

[0219] Similarly, xq has :

[0220] ;

[0221] in, - It is the amplitude loss function for the first to fifth steps of the q-path step-by-step perturbation; The overall magnitude-limited loss function for the q-path is based on the average of the loss functions from the previous five steps.

[0222] Accordingly, x_adv has the following magnitude-limited loss function:

[0223] ;

[0224] The input value is: x_adv Figure 2 The superposition shown

[0225] Find the expected value of the formula with x_adv as the range;

[0226] `max` is used to find the maximum value contained in the formula.

[0227] adv is the perturbation function designed for x_adv;

[0228] From step (2)1), the frequency domain limit range value mask can be obtained;

[0229] For this step (2) 3), the final maximum output value constraint range can be obtained;

[0230] Output value: Yes Figure 2 The superposition shown The magnitude loss function of the perturbation generation and superposition value of x_adv of the Gi5 perturbation output is a double-insurance loss function innovatively designed in this patent.

[0231] In summary, we have the magnitude loss function:

[0232] ;

[0233] in, The amplitude limiting loss function of the overall disturbance output in this patent is the amplitude limiting loss function of the i-path, q-path, and step-by-step disturbance superposition x_adv. , Together they form a whole.

[0234] Targeted deception loss function:

[0235] The step is to attack based on the softmax output label of the distillation model, and the softmax is a probability distribution function, also known as a soft label of a deep learning model. The distillation model is learned by input and output of the target model, i.e. the base classification model, to replicate the discrimination of the base classification model on data. In this embodiment, the distillation model is not optimized, but a commonly used distillation model is used. In a black box attack, the attack on the target model is generally based on the soft label output of the distillation model.

[0236] The embodiment uses the method of targeted attack to make the non-cooperative platform misidentify the radiation source of the unmanned aerial vehicle, identify the unmanned aerial vehicle of the our side as the unmanned aerial vehicle of the non-cooperative side, protect the safety of the unmanned aerial vehicle of the our side, identify the unmanned aerial vehicle of the non-cooperative side as the unmanned aerial vehicle of the our side, and make the non-cooperative side launch an attack on itself. Specifically, the embodiment uses 8 radiation source signals of the unmanned aerial vehicles of the our side and 2 radiation source signals of the unmanned aerial vehicles of the non-cooperative side. Here, the numbers of the 8 unmanned aerial vehicles of the our side are m1-m8, the numbers of the 2 unmanned aerial vehicles of the non-cooperative side are e1-e2, and the targeted attack is to make the non-cooperative platform identify m1-m4 as e1, m5-m8 as e2, e1 as m1, and e2 as m2.

[0237] Although the attack seems complex, in fact, under the guarantee of the overall effectiveness of the CVE-AdvGAN by the basic framework functions and constraints such as the loop mechanism, mask setting, and amplitude limitation setting in the early stage, the targeted deception loss function only needs to perform targeted soft label loss and targeted deception feature similarity calculation to easily achieve high reliability of targeted deception.

[0238] The targeted deception loss function is set, and m1-m4 is taken as an example of being identified as e1. The specific diagram is shown in Figure 4

[0239] The soft label outputs of m1-m4 input to the base classification model and the distillation model are The outputs of e1 input to the classification model and the distillation model are

[0240] m1-m4 input to the adversarial deception frequency domain of the CVE-AdvGAN is m1_adv', m2_adv', m3_adv', and m4_adv', and e1 input to the adversarial deception frequency domain of the CVE-AdvGAN is e1_adv';

[0241] The soft label outputs of m1_adv', m2_adv', m3_adv', and m4_adv' input to the distillation model are ​​​​​​, , , e1_adv' input to the soft label output of the distillation model at ;

[0242] The targeted deception loss function includes two parts: the targeted deception soft label loss calculation and the targeted deception feature similarity calculation.

[0243] Targeted deception soft label loss calculation (output feature similarity calculation): The targeted deception soft label loss makes the adversarial deception signals (m1_adv', m2_adv', m3_adv', m4_adv') input to the output of the distillation model (y1, y2, y3, y4) infinitely close to the output of the radiation source signal input model that wants to be targeted deception misidentified , , , ) of the enemy recognition model :

[0244] ;

[0245] Wherein m1-m4 are the numbers of our drones in the warehouse, and e1 is the number of the non-cooperative drone outside the warehouse;

[0246] Input value: is a typical MSE loss function, which calculates the difference value between two input matrices. The smaller the value, the higher the similarity between the two input matrices;

[0247] , , , The radiation signals of m1-m4 are input to the adversarial deception frequency domain values m1_adv', m2_adv', m3_adv', m4_adv' of the CVE-AdvGAN, and then input to the soft label output of the distillation model;

[0248] The radiation signals of e1 are input to the soft label output of the distillation model;

[0249] Output value: is the targeted deception soft label loss function, which is the deception signal frequency domain value generated by the signal processing + CVE-AdvGAN of m1-m4 based on the design of the previous patent, input to the distillation model that simulates the enemy recognition model and outputs the corresponding label value (y1, y2, y3, y4) , , , ), and the difference value between the output label of the distillation model (the enemy recognition model) receiving e1 signal is calculated by the MSE loss function;

[0250] The calculation purpose of the targeted deception soft label loss function is to enable the target m1-m4 signals calculated and disguised based on the patent to be identified as enemy targets e1 by the enemy identification model;

[0251] Targeted deception feature similarity calculation (input characteristic similarity calculation): The targeted deception feature similarity calculation makes the frequency domain characteristics of the adversarial deception signals (m1_adv', m2_adv', m3_adv', m4_adv') infinitely close to the frequency domain characteristics e1 of the radiation source signals that want to be targeted deception misidentified:

[0252] ;

[0253] Where m1-m4 is the number of our in-house UAVs, and e1 is the number of out-of-house UAVs of the non-cooperative party;

[0254] Input values: m1_adv', m2_adv', m3_adv', and m4_adv' are the adversarial deception frequency domain values of the radiation signals of m1-m4 input to the CVE-AdvGAN through processing;

[0255] The radiation signal frequency domain values of the e1 device;

[0256] The classic loss function MAE is adopted, which is a norm calculation to calculate the similarity between input frequency domain features. Since the signal frequency domain belongs to linear characteristics, it is calculated as The calculation complexity increases and the calculation feature concentration is not as good as The calculation effect is good;

[0257] Output values: The targeted deception feature similarity loss function is the difference between the deception signal frequency domain values generated by the signal processing designed in the front of the patent based on m1-m4 signals and the received non-cooperative e1 device signal frequency domain values, calculated by the MAE loss function;

[0258] The calculation purpose of the targeted deception feature similarity loss function is to enable the target m1-m4 signal features calculated and disguised based on the patent to be infinitely close to the signal features of the enemy target e1 radiation, thereby confusing the enemy reconnaissance equipment;

[0259] In summary, the targeted deception loss function is as follows:

[0260] ;

[0261] Where m1-m4 is the number of our in-house UAVs, and e1 is the number of out-of-house UAVs of the non-cooperative party;

[0262] Input value: For the targeted deception soft label loss function, make the enemy model (distillation model) identify the received camouflage signal (actually the signal transmitted by our device m1-m4) as e1 calculated by this patent;

[0263] For the targeted deception feature similarity loss function, make the enemy unable to exclude our signal in the early stage by the difference value or possible mutation value of the signal when receiving the camouflage signal calculated by this patent (actually the signal transmitted by our device m1-m4), which is complementary to the targeted deception soft label loss function;

[0264] Output value: For the targeted deception loss function, make the enemy unable to detect the difference of the signal itself and identify it as target e1 by designing the radiation signal of m1-m4 through this patent.

[0265] 4) Training mechanism of CVE-AdvGAN:

[0266] 1) Input the original signal frequency domain features into CVE-AdvGAN according to the requirements to calculate the loss function: , ;

[0267] 2) Train the distillation model of the base model according to the requirements;

[0268] 3) Input the original signal frequency domain features into the base model, distillation model and CVE-AdvGAN to calculate the loss function according to the requirements: , , , ;

[0269] Among them, the numbers of our 8 unmanned aerial vehicles are m1-m8, and the numbers of the non-cooperative party's 2 unmanned aerial vehicles are e1-e2;

[0270] For the targeted deception loss function, make the enemy identify the signal transmitted by the m1-m4 device as e1;

[0271] For the targeted deception loss function, make the enemy identify the signal transmitted by the m5-m8 device as e2;

[0272] For the targeted deception loss function, make the enemy identify the signal transmitted by the e1 device as m1;

[0273] For the targeted deception loss function, make the enemy identify the signal transmitted by the e2 device as m1.

[0274] Based on this, we can completely deceive the enemy's attack, protect the safety of our unmanned aerial vehicles, and the safety of the airspace.

[0275] 4) Based on , , , , , Step-by-step update of Gi1-Gi5 (Gi1-Gi5 are the 1st network to the 5th network of I-channel signals, respectively), Gq1-Gq5 (Gq1-Gq5 are the 1st network to the 5th network of Q-channel signals, respectively), Di, Dq, Gadv, Dadv of CVE-AdvGAN until the loss value is stable.

[0276] (4) When the input is x, based on Gi1-Gi5, Gq1-Gq5, Gadv, get the adversarial deception output and directional antenna adversarial disturbance output:

[0277] Adversarial deception output: x_adv';

[0278] Directional antenna adversarial disturbance output: x_adv'-x;

[0279] Step four, classify the directional attack model and evaluate the attack effectiveness:

[0280] According to the above steps, the database construction, signal preprocessing, generation of radiation source intelligent classification model and generation of attack model CVE-AdvGAN are completed. This step evaluates the performance of CVE-AdvGAN in white-box attack, black-box attack and dynamic black-box attack (white-box attack, black-box attack and dynamic black-box attack) Figure 5 ) and comprehensively evaluates the attack effectiveness of CVE-AdvGAN.

[0281] Directional attack: make the non-cooperative platform make mistakes in identifying the radiation source of the unmanned aerial vehicle, identify our unmanned aerial vehicle as a non-cooperative unmanned aerial vehicle, protect the safety of our unmanned aerial vehicle, and identify the non-cooperative unmanned aerial vehicle as our unmanned aerial vehicle, so that the non-cooperative party launches an attack on itself. Specifically, this embodiment uses 8 radiation source signals of our unmanned aerial vehicles and 2 radiation source signals of non-cooperative unmanned aerial vehicles. Here, the numbers of our 8 unmanned aerial vehicles are m1-m8, and the numbers of the 2 unmanned aerial vehicles of the non-cooperative party are e1-e2. Through training of CVE-AdvGAN, the non-cooperative platform base classification model identifies m1-m4 as e1, m5-m8 as e2, e1 as m1, and e2 as m2. Specifically as Figure 6As shown, CVE-AdvGAN generates a directional frequency domain disturbance and superimposes it on the target data transmission signal to achieve the purpose of attacking the target signal identity. Here, the process of identifying fixed radion source identities m1-m4 as e1 is taken as an example for subsequent verification.

[0282] White box attack: The white box attack refers to training CVE-AdvGAN based on the output of the target model under the premise of knowing the internal structure of the model, so that the CVE-AdvGAN model can generate a directional attack interference radio frequency signal to destroy the identification ability of the target party's radion source identification system. Here, it is actually a semi-white box directional target attack. The attack means of the embodiment is designed based on a soft target of softmax, so it is not a pure white box attack, but a semi-white box attack.

[0283] Here, as shown in Table 1, the overall comparison of the white box attack success rate of the commonly used AdvGAN (the data set contains 10 radion source identities) has little difference in the identification accuracy after the attack, mainly because the white box attack is highly efficient, and there is no intermediate conversion through the distillation method, and the efficiency is similar. The directional attack success rate (identifying specific m1-m4 as e1) of the embodiment is 75%, and the attack success rate is 88%. AdvGAN does not have this function, and other existing literature has not broken through 80%. Under the premise of 85% identification success rate of the base model, the directional attack success rate is 75%.

[0284] Table 1 Semi-white box attack

[0285]

[0286] In addition, as shown in Figure 7 , the step-by-step loop control of the embodiment can disturb the amplitude, so that the shape of the signal frequency does not change greatly compared with the original signal, so it is not easy to be found. In Figure 7 , the horizontal coordinates of all the figures represent the signal frequency, and the vertical coordinates of all the figures represent the disturbance amplitude.

[0287] Black box attack: The black box attack refers to distilling the target model under the premise of not knowing the internal structure of the model, and training CVE-AdvGAN based on the output of the distilled model of the target model, so that the CVE-AdvGAN model can generate a directional attack interference radio frequency signal to destroy the identification ability of the target party's radion source identification system.

[0288] Here, the commonly used distillation algorithm is used for model distillation, and the attack ability of AdvGAN is compared. The distillation model uses three kinds of structure models for comparison, as shown in Table 2. After increasing the model parameters, the attack efficiency and the directional attack success rate of the method used in the embodiment are obviously better than those of the conventional attack algorithm.

[0289] Table 2 black box attack

[0290]

[0291] In addition, as Figure 8 indicated, in Figure 8 , the abscissa of all graphs represents the signal frequency, and the ordinate of all graphs represents the perturbation amplitude. Under the black box attack, the attack parameters need to be adjusted to improve the attack efficiency. Under the same parameter adjustment, the difference between the attack sample of the CVE-AdvGAN and the original signal is smaller, especially in the narrowband part (the main area after filtering). It is relatively close to the original signal, and the morphology after narrowband filtering can maintain more than 95% similarity, while the signal morphology of AdvGAN has been significantly distorted, which may not be received by the non-cooperative party control equipment at all, losing the attack significance.

[0292] Dynamic black box attack: Dynamic black box attack refers to dynamically training CVE-AdvGAN during the attack process to improve the attack ability of CVE-AdvGAN based on black box attack.

[0293] Only the ResNet model in Table 2 is compared and analyzed here. Under dynamic attack, the success rates of the two adversarial attack models are improved, and the success rate of directional attack is more obvious.

[0294] However, under dynamic attack, the morphology of the signal is not easy to control, as Figure 9 indicated, the first row is the original signal, and the second row is the signal after being attacked. In Figure 9 , the abscissa of all graphs represents the signal frequency, and the ordinate of all graphs represents the perturbation amplitude. In the case of ensuring attack effect and not being detected by the other party, the conventional black box attack can be used to ensure a high degree of security.

[0295] Table 3 dynamic black box attack

[0296]

[0297] Step 5: Application of CVE-AdvGAN adversarial attack model in unmanned aerial vehicle radiation source attack:

[0298] Steps 1-3 complete the unmanned aerial vehicle database collection and construction, unmanned aerial vehicle signal preprocessing, radiation source intelligent classification model construction, and adversarial attack model construction. Step 4 completes the effectiveness verification of the present embodiment, and the present step completes the application process of transplanting the algorithm to the unmanned aerial vehicle platform.

[0299] The anti-attack model is formed into a complete hardware board card through embedded transplantation, the board card is placed in a UAV task load, a dedicated interference signal transmitting antenna is arranged, and the radio frequency signal of the interference is transmitted, so that directional attack on an external non-cooperative UAV and defense of the airspace of the side are realized.

[0300] The present step adopts a black box attack applied to the flow of UAV platform interference, and the specific structure and flow are as shown in Figure 10 1) a soft target of a base classification model is distilled to extract a model; 2) the distilled base model is attacked and trained through a CVE-AdvGAN algorithm, the attack effect of the CVE-AdvGAN on the distilled base model is improved through training, and the attack effect of the CVE-AdvGAN on the target model is improved; 3) the parameters of the trained CVE-AdvGAN attack model are solidified; 4) the trained model parameters are transplanted into the load of the UAV flight platform, the corresponding frequency point interference antenna and power supply adaptation module are configured, and are loaded into the UAV platform, so that the black box attack on the non-cooperative party's detection UAV is realized.

[0301] In the application of directional attack and defense, 8 UAVs of the side are numbered as m1-m8, and 2 UAVs of the non-cooperative party are numbered as e1-e2. Through training of the CVE-AdvGAN, the non-cooperative party platform identifies m1-m4 as e1, m5-m8 as e2, e1 as m1, and e2 as m2. At this time, the non-cooperative party control equipment completely confuses the enemy and me equipment, causes attack confusion, and thus realizes identity protection and security protection of the UAV of the side.

[0302] The above only describes preferred embodiments of the present application, and it should be understood that the present application is not limited to the forms disclosed herein, and should not be considered as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concepts described herein, through the above teaching or related art or knowledge. Changes and modifications made by those skilled in the art without departing from the spirit and scope of the present application shall be within the scope of protection of the appended claims of the present application.

Claims

1. A method for targeted attacks on non-cooperative UAV radiation sources based on CVE-AdvGAN, characterized in that, Includes the following steps: S1: Perceive and extract features from the radiation source signals of non-cooperative UAVs, collect the communication and navigation signals of the target UAVs, extract the physical layer features and protocol layer features of the signals, and establish a radiation source feature library of the target UAVs; S2: Perform CVE vulnerability screening and attack payload construction. Based on the protocol type or hardware-related information of the radiation source signal extracted in S1, search the CVE database, screen for exploitable vulnerabilities that can be applied to the radiation source, and design attack payloads for the screened vulnerabilities. S3: Perform CVE-AdvGAN adversarial sample generation and optimization, construct a CVE-AdvGAN model including generator, discriminator and frequency domain perturbation control module, use the normal signal in S1 as the original sample and the attack payload in S2 as the target information, generate adversarial samples through the model's frequency domain real and imaginary parts separation processing and step-by-step perturbation mechanism, so that the adversarial samples meet the requirements of both concealment and effectiveness. The specific design of CVE-AdvGAN is as follows: The frequency domain generation network Gi and discrimination network Di for the I-channel signal, the frequency domain generation network Gq and discrimination network Dq for the Q-channel signal, the frequency domain synthesis module for the two signals, and the frequency domain generation network Gadv and discrimination network Dadv for the synthesized signal. A step-by-step adversarial generation mechanism based on a cyclic mechanism controls the perturbation range and amplitude through the cyclic mechanism; S4: Conduct directional electromagnetic attack signal transmission. Through the transmission module consisting of signal generator, power amplifier and directional antenna, combined with the real-time position information of the target UAV, adjust the direction of the transmission beam and the transmission power to directionally transmit the adversarial sample generated in S3 to the radiation source receiver of the target UAV. S5: Performs real-time verification and closed-loop adjustment of attack effects, monitors the status of the target UAV in the communication, navigation and control layers, and determines whether the attack is successful. If unsuccessful, it feeds back to the CVE-AdvGAN module in S3 and the launch module in S4 for parameter optimization until the attack is successful.

2. The method according to claim 1, characterized in that, The sensing device in S1 consists of a directional antenna array, software radio equipment, and a signal analyzer, which passively acquires the radiation source signal of the target UAV without requiring authorization information from the target UAV.

3. The method according to claim 1, characterized in that, The physical layer features extracted in S1 include frequency, bandwidth, modulation method, power spectral density, and constellation diagram; the protocol layer features extracted include frame structure, verification method, and instruction encoding rules.

4. The method according to claim 1, characterized in that, The CVE database retrieved in S2 includes general vulnerability disclosure databases, and the exploitable vulnerabilities screened include radiation source protocol vulnerabilities and radiation source hardware firmware vulnerabilities.

5. The method according to claim 1, characterized in that, The attack payload designed in S2 is a precision-triggered attack payload. The attack payload can be injected into the target drone through a radiation source signal to trigger the corresponding CVE vulnerability in order to achieve the preset attack target.

6. The method according to claim 1, characterized in that, In the CVE-AdvGAN model in S3, the generator adopts a network structure of "3 3×3 conv + 3 3×3 resnet + 3 3×3 deconv". The input is the feature map of the target normal signal in S1, and the output is the adversarial sample that fuses the attack payload. The discriminator-generator module adopts a network structure of 3 conv modules. The input is either adversarial sample or normal signal, and the output is the probability of signal authenticity, so as to distinguish between adversarial sample and normal signal.

7. The method according to claim 1, characterized in that, The optimization constraints for training adversarial examples in S3 include: the feature similarity between the adversarial example and the normal signal is ≥95%, the integrity of the attack payload in the adversarial example is ≥98%, and the number of iterative training rounds is 500-1000 rounds until the constraints are met.

8. The method according to claim 1, characterized in that, The transmitting module in S4 includes a programmable signal generator, a power amplifier, and an adaptive directional antenna array; the direction of the transmitting beam of the directional antenna array is adjusted by a beamforming algorithm so that the main lobe energy of the transmitting beam only covers the target UAV, and the beamwidth is ≤5°.

9. The method according to claim 1, characterized in that, In step S4, the transmission power is adjusted according to the distance between the target UAV and the transmission module, so that the power of the attack signal when it reaches the receiver of the radiation source of the target UAV meets the acceptable threshold, while avoiding excessive power that would cause the signal to spread to surrounding devices.

10. The method according to claim 1, characterized in that, The attack effect verification dimensions in S5 include: the communication layer monitors the packet loss rate of the communication link between the UAV and the remote controller, the navigation layer tracks the flight trajectory deviation of the UAV, and the control layer observes whether the UAV executes the preset attack action; the closed-loop adjustment includes feedback to S3 to adjust the learning rate of the CVE-AdvGAN generator to retrain adversarial samples, and feedback to S4 to fine-tune the antenna beam direction and adjust the transmission power.

Images