Confrontation training method based on bidirectional disturbance generation

Abstract

The invention discloses an adversarial training method based on bidirectional disturbance generation, which comprises the following steps of: firstly, generating forward adversarial disturbance, and dynamically adjusting the training disturbance amplitude of each attack category in a training process to realize targeted disturbance intensity adaptation; meanwhile, reverse adversarial disturbance is generated for each sample, and the model is guided to make correct classification on adversarial samples. Experimental results prove that the anti-robustness of the model can be effectively improved, and meanwhile it is guaranteed that the model can keep high robustness on different attack categories.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial control system security, and relates to an intrusion detection technology for resisting sample attack of an industrial control system, in particular to an adversarial training method based on bidirectional perturbation generation. BACKGROUND

[0002] Industrial Control System (ICS) is a system specially used for monitoring and controlling industrial processes, devices or facilities. It is widely used in manufacturing, energy industry, transportation, public facilities (such as water supply and sewage treatment), petrochemical industry and other key infrastructures. In order to effectively detect network attacks, deep learning-based intrusion detection systems have made significant progress in the field of ICS. However, with the rise of adversarial sample attack concept, deep learning intrusion detection models also show significant vulnerability to adversarial sample attack. Adversarial sample attack means that the attacker adds malicious perturbation that does not interfere with human cognition to the input sample, causing the model to give wrong output with high confidence. Classic attack algorithms include fast gradient sign method (FGSM), and projected gradient descent (PGD) and the like. In industrial control systems, attackers can add small perturbations to sensor data (such as voltage, current or temperature) to make deep learning-driven intrusion detection systems unable to detect abnormal behavior, thus concealing malicious operations (such as overload, short circuit or device damage), causing significant economic losses. Therefore, it is crucial to improve the ability of intrusion detection models to resist adversarial samples.

[0003] In order to cope with adversarial sample attack, adversarial training as the most effective defense method against attack, helps the model to correctly identify adversarial samples by adding adversarial samples in training. Some adversarial training methods focus on improving the generation of adversarial perturbation, trying to find the most attackable adversarial perturbation, such as setting initial perturbation, constraining perturbation space, etc.; some advanced adversarial training studies regularize the difference between the output probabilities of adversarial samples and their corresponding original samples. However, in the face of adversarial sample attack in ICS, there are still the following limitations:

[0004] Firstly, the conventional method usually generates more diverse adversarial perturbations for model training, although it enables the model to distinguish more adversarial samples in general, it does not consider that different classes require different training perturbation amplitudes, resulting in significant differences in adversarial robustness of different classes. Therefore, for a multi-class dataset, the same training perturbation amplitude may result in poor resistance of the model to some classes of adversarial samples. Secondly, when regularizing the difference between the output probabilities of the adversarial sample and its corresponding original sample, if an original sample is misclassified, it may make it more difficult for the model to identify its corresponding adversarial sample. Some existing methods try to generate a general inverse adversarial sample to replace the original sample, however, this method adjusts the inverse adversarial perturbation by forcibly reducing the output distance of the model to the inverse adversarial sample and the original sample, which may cause the perturbation to be ineffective, and the required inverse adversarial perturbation direction of different samples may conflict, and the output obtained by it may mislead the model classification, thereby reducing the overall robustness of the model. SUMMARY

[0005] The purpose of the present application is to design a two-way perturbation-based adversarial training method, which generates forward and reverse adversarial perturbations in adversarial training to improve the adversarial robustness of the model.

[0006] To achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0007] A two-way perturbation-based adversarial training method, the specific process is as follows:

[0008] Step 1: Set a training perturbation amplitude for each class, and in the current training round, generate forward adversarial perturbations according to the training perturbation amplitude of each class using the PGD method.

[0009] Step 2: Use the adversarial perturbations generated in step 1 to perturb the original samples to obtain adversarial samples, and calculate the classification accuracy of the model on the adversarial samples, which is used to measure whether the current adversarial perturbation amplitude of each class is suitable.

[0010] Step 3: Update the training perturbation amplitude using the classification accuracy of different classes obtained in step 3 as a measure.

[0011] Step 4: Generate reverse adversarial perturbations for each sample along the gradient descent direction, which guide the sample to further approach the high confidence region of the correct class, so that the classification loss of the model on the reverse adversarial sample is smaller than the original loss.

[0012] Step 5: Update the parameters of the model according to the forward adversarial samples and reverse adversarial samples obtained in steps 2 and 4, and enter the next training round until the model training is completed.

[0013] The key technical point of the present application is that:

[0014] First, a novel method for dynamically adjusting the amplitude of adversarial perturbations is proposed. During training, positive adversarial perturbations are first generated, and then the amplitude of adversarial perturbations for different categories is dynamically adjusted according to the changes in classification accuracy on adversarial samples of the model, so as to ensure that the model has good adversarial robustness for all categories.

[0015] Second, a novel method for generating inverse adversarial perturbations is proposed, which generates inverse adversarial perturbations for each training sample based on the gradient of an individual sample. By reducing the output distribution gap between the inverse adversarial sample and the adversarial sample, the overall ability of the model to cope with adversarial attack is improved.

[0016] The method described in this patent can improve the adversarial robustness of the model, and has the following advantages compared with existing related technologies:

[0017] I. This invention dynamically adjusts the magnitude of adversarial perturbations during adversarial training based on the changes in the model's classification accuracy on adversarial examples in each round, thus finding suitable training perturbation magnitudes for different categories of samples. Practice has proven that this method enables the model to have stronger adversarial robustness on adversarial examples of different categories.

[0018] Second, this invention generates a gradient-based inverse adversarial perturbation for each training sample. This inverse adversarial perturbation guides the model to classify adversarial examples in the correct direction without causing misleading information, thereby enhancing the model's ability to resist adversarial attacks. Practical application has proven that this method improves the model's adversarial robustness against various attack methods and attacks. Attached Figure Description

[0019] Figure 1 This is a schematic diagram illustrating the process of dynamically adjusting the amplitude of training perturbations for different categories according to the present invention.

[0020] Figure 2 This is a schematic diagram of the process of generating reverse adversarial examples based on the gradient descent direction according to the present invention.

[0021] Figure 3 This is a schematic diagram illustrating the process of updating the model based on positive and negative counter-disturbances according to the present invention.

[0022] Figure 4 This is a schematic diagram illustrating the simulation of adversarial sample attacks in the field of industrial control according to the present invention.

[0023] Figure 5 The figure shows the experimental results of comparing R-values ​​with other adversarial training methods on different categories of samples. Detailed Implementation

[0024] The workflow of this invention includes three stages: category adversarial perturbation control, reverse adversarial perturbation generation, and perturbation learning. In the category adversarial perturbation control stage, a unique training perturbation amplitude is designed for each category and continuously adjusted as the model trains. The classification accuracy of the model on adversarial examples for each category is used to measure the impact of the current perturbation amplitude on the adversarial robustness of that category. In the reverse adversarial perturbation generation stage, the direction of gradient downwards is obtained based on the classification loss, and reverse adversarial perturbations that improve the classification accuracy of the perturbated samples are generated, thereby guiding the model to classify adversarial examples in the correct direction. In the perturbation learning stage, KL divergence is introduced as a constraint term based on the loss function of the original adversarial training, and the model parameters are continuously updated based on the positive and reverse perturbations generated in the first two stages.

[0025] In the category adversarial perturbation control phase, the key technology of this invention lies in dynamically adjusting the training perturbation amplitude for each attack category during training, as follows: Figure 1 As shown. The input for this stage is the original sample, and the output is the adversarial sample. The specific implementation steps are as follows:

[0026] Step 1: Consider input samples from k classes, and set an initial training perturbation magnitude ε1 for each class. 0 ε2 0 , ...ε k 0 .

[0027] Step 2, in the t-th round of training, for the original sample x of the i-th class... i We use the PGD method based on the current perturbation amplitude ε i t The process of generating adversarial examples can be represented by the following formula:

[0028]

[0029] in Here, α represents the adversarial example, n is the number of iterations of the PGD method, and α is the step size for each update of the adversarial perturbation.

[0030] Step 3, calculate the model in adversarial examples Classification accuracy A i t , used to measure ε i t Does it apply to the current category? (A) i t The calculation formula is as follows:

[0031]

[0032] Where n iIt is the number of samples in the i-th category, cor i This represents the number of adversarial samples that were correctly classified.

[0033] Step 4: When the accuracy in the current round improves compared to the previous round, increase the training perturbation amplitude based on the magnitude of the accuracy change, allowing the model to learn larger adversarial perturbations. The greater the change in accuracy, the greater the increase in training perturbation amplitude. Conversely, if the change in accuracy is small, it indicates that the current training perturbation amplitude is too large, so the amplitude of the training perturbation in the next training round is reduced. Furthermore, when the accuracy remains unchanged between adjacent rounds, the training perturbation is increased slightly. i t The update process is as follows:

[0034]

[0035] Where △A i t It represents the change in classification accuracy of the model on adversarial examples of class i in round t compared to round t-1. The hyperparameters c and q are used to control the step size of the change in the magnitude of adversarial perturbation during training.

[0036] Step 5: Feed the perturbed samples of different categories to the model for training.

[0037] In the reverse adversarial perturbation generation stage, the key technology of this invention lies in generating reverse adversarial perturbations that reduce sample classification loss, and the process is as follows: Figure 2 As shown, the input data is the original sample, and the output data is the sample after adding an inverse adversarial perturbation. The specific steps are as follows:

[0038] Step 1: Input sample x into the model for classification and obtain the classification result.

[0039] Step 2: Based on the classification results obtained in Step 1, use the classification loss function to calculate the classification loss of the model on this sample. The classification loss for the classification task can be calculated using the following formula:

[0040]

[0041] Where k is the total number of categories, p i It is the model's prediction result for the sample.

[0042] Step 3: Based on the classification loss obtained in Step 2, calculate the gradient of the classification loss of the input sample relative to the input features. A perturbation direction d can be obtained based on the sign of the gradient. However, unlike the adversarial perturbation, the direction of the reverse adversarial perturbation is not along the direction of gradient ascent, but along the direction of gradient descent, i.e., the "opposite" direction -d to the adversarial perturbation.

[0043] Step 4: Based on the direction obtained in Step 3, generate a reverse adversarial perturbation and generate reverse adversarial samples. The creation of reverse adversarial samples can be written in the following form:

[0044]

[0045] Where x pre 'a' represents the reverse adversarial sample, and 'a' is the step size for generating the reverse adversarial perturbation. During training, we generate reverse adversarial perturbations for each sample and update them continuously as the model trains.

[0046] In the perturbation learning phase, the key technology of this invention lies in continuously updating the model parameters based on the perturbations generated in the previous two phases, as follows: Figure 3 As shown, the input data includes adversarial examples and reverse adversarial examples, and the output is the trained model. The specific steps are as follows:

[0047] Step 1: Based on the original adversarial training loss function, introduce KL divergence as a constraint term.

[0048] Step 2, by minimizing the KL divergence, can reduce the distribution gap between the output values ​​of the adversarial examples and the perturbation samples, thus enabling the model's output on the adversarial examples to more closely resemble the model's classification results on the adversarial examples, ultimately achieving the goal of moving the decision boundary away from the adversarial examples. The loss function for model updates can be expressed as the following formula:

[0049]

[0050] Here, η is the parameter balancing the two terms. In the loss function, the first term is used to reduce the classification loss of adversarial examples, while the second term, guided by reverse adversarial examples, further pushes the decision boundary to classify adversarial examples into the high-confidence region of the correct category.

[0051] In the verification experiments, this invention used three industrial flow datasets for validation: SWaT, WADI, and Morris. SWaT and WADI are derived from real-world operating environments of water treatment and distribution systems, respectively, and are two publicly available datasets widely used in ICS security research, developed by the Singapore University of Technology and Design (SUTD). Morris, launched in March 2014 by Thomas Morris's team in the Department of Electrical and Computer Engineering at the University of Alabama at Huntsville, is a public dataset for industrial control systems used to study network attack detection and defense technologies in industrial environments.

[0052] In terms of evaluation methodology, the model's adversarial robustness is measured by the percentage of adversarial examples it successfully defends against. To make the evaluation more accurate, we need to know the number of adversarial examples that successfully attacked. For example... Figure 4As shown, during the testing phase, adversarial attacks are launched against the model to generate a batch of perturbated attack samples. After these samples pass the detection of the target classifier, samples that successfully alter the model's classification results are selected. However, not all of these samples are offensive, as some may have lost their offensive nature due to excessive perturbation. To eliminate these overly perturbed samples, three additional intrusion detection models are introduced, all of which have good classification accuracy for the original samples. The intersection of the classification results of the three models is used to identify which samples still retain their original offensive nature; samples whose classification results match the labels are considered successfully attacked adversarial samples, while the rest are successfully defended adversarial samples.

[0053] Since the model outputs the probabilities of different classes, the classification result is obtained using the following formula:

[0054]

[0055] Where h(·) represents the classification model. Referring to the traditional method of calculating robust accuracy, the adversarial robustness of the intrusion detection model will be evaluated using the following metrics:

[0056]

[0057] Where n is the total number of attack samples, y nor and y att The labels represent the normal category and the attack category, respectively. f1, f2, and f3 represent three different auxiliary evaluation models. R represents the model's success rate against adversarial attacks; a higher R value indicates stronger adversarial robustness.

[0058] In addition to evaluating adversarial robustness, it is also necessary to evaluate the model's classification performance on the original samples. In classification tasks, accuracy, precision, recall, and F1 score are the core metrics for evaluating model performance.

[0059] For the WADI dataset, we padded each data entry with zeros to expand the data dimension to (1, 144), then converted it to (1, 12, 12). Since the ratio of normal to attack samples in WADI is severely imbalanced, directly using these samples would make it difficult for the model to learn the features of the attack samples. Therefore, we used a random downsampling technique on the normal samples, randomly selecting 10,000 normal samples for training. For SWAT and WADI, we used two-dimensional and one-dimensional ResNet-18 for training, respectively, with a learning rate of 0.01. For the Morris dataset, we used one-dimensional LeNet for training, with a learning rate of 0.1. During training, the batch size for all three datasets was set to 128, and the SGD optimizer was used, with the Nesterov momentum factor set to 0.9 and the weight decay factor set to 5 × 10⁻⁴. During training, the step size 'a' for benign perturbations was set to 4 / 255, and the balancing parameter 'η' was 3.5. Simultaneously, we used a PGD attack algorithm with 10 iterations for training. The training epochs for SWAT and WADI were 10, and for Morris, they were 20. The initial magnitude of the adversarial perturbation trained on WADI was 0.1, while the initial magnitude for the adversarial perturbation trained on Morris and SWAT was 0.05. The c-value was set to 0.01. The c-values ​​and a-values ​​for the three datasets were set to 0.01 and 0.5, respectively.

[0060] For the WADI dataset, we introduced LeNet, AlexNet, and Convolutional Neural Network (CNN) to assist in the evaluation. The performance of the three models on WADI is shown in Table 1.

[0061] Table 1: Performance of the auxiliary evaluation model on the original samples of the WADI dataset.

[0062]

[0063] For the SWaT dataset, we introduced Random Forest (RF), K-Nearest Neighbor (KNN), and GBC to assist in evaluation. The classification performance of the three models on SWaT is shown in Table 2.

[0064] Table 2: Performance of the auxiliary evaluation model on the original samples in the SWaT dataset

[0065]

[0066] For the Morris dataset, we introduced GBC and two different KNN models. The classification performance of the three models on Morris is shown in Table 3.

[0067] Table 3: Performance of the auxiliary evaluation model on the original samples in the Morris dataset.

[0068]

[0069] We compared our method with other state-of-the-art adversarial training methods, and the results are shown in Table 4. We present the adversarial robustness evaluation of the target model using different training methods on the WADI, SWAT, and Morris datasets. Three model gradient-based adversarial attack algorithms were used in the experiments: FGSM, PGD, and MIM, with PGD and MIM having 20 iterations each. The maximum attack perturbation was set to 0.2 on the WADI and Morris datasets, and 0.1 on the SWAT dataset. Experimental results show that under these three adversarial attacks, the R-value of our invention is higher than other state-of-the-art methods, and generally reaches over 99%. This indicates that our invention significantly enhances the adversarial robustness of the model on the three datasets, strongly validating the effectiveness of BPAT in resisting adversarial attacks.

[0070] Table 4: Experimental results of R-value (%) of this invention compared with other adversarial training methods under different attacks.

[0071]

[0072] Note: The best result in each column is shown in bold, and the second best result is shown in underline.

[0073] Furthermore, this invention not only significantly improves the model's adversarial robustness but also outperforms existing methods on raw samples. To verify this, we compared the model's detection performance on raw samples with other methods, and the results are shown in Table 5. As can be seen, on the WADI dataset, our method improved the model's recall by 1.5% and F1 score by 1.1%, indicating that for raw samples that have not been perturbed by attacks, this invention can still accurately identify different types of attacks. Similarly, on SWAT and Morris, the model's classification performance on raw samples also surpasses other state-of-the-art methods, verifying that this invention can improve adversarial robustness while maintaining the model's classification ability for raw samples.

[0074] Table 5: Experimental results comparing the present invention with other adversarial training methods on the original samples under different attacks.

[0075]

[0076] To verify whether our invention exhibits high adversarial robustness under different attack configurations, we compared the R-values ​​of various methods under different L∞ norm attack radii. Furthermore, since WADI and Morris have multiple attack categories, we also tested the performance of different methods under PGD targeted attacks (intentionally causing the model to identify the attack category as the normal category) and PGD untargeted attacks, with 20 iterations for each PGD attack. The results in Tables 6 and 7 show that on WADI and Morris, BPAT demonstrates stronger resistance to adversarial attacks regardless of the size of the attack perturbation. For example, in the targeted attack scenario, our method improved the model's R-value on WADI by 1% (perturbation magnitude of 0.15). On SWAT, as shown in Table 8, unlike most methods that cannot withstand large adversarial perturbations, our method consistently maintains an R-value above 99%. Since CFA also applies perturbation adjustment techniques during training, CFA also exhibits good adversarial robustness under large adversarial perturbations; however, this method is not suitable for datasets with fewer attack samples, such as WADI and Morris. In contrast, BPAT enables the model to achieve better adversarial robustness across three industrial datasets, further demonstrating that the invention not only resists adversarial example attacks with different configurations but also exhibits good generalization ability.

[0077] Table 6: Experimental results of the R-value (%) of this invention compared with other adversarial training methods on WADI under different attack perturbations.

[0078]

[0079] Table 7: Experimental results of R-value (%) of the present invention compared with other adversarial training methods on Morris under different attack perturbations.

[0080]

[0081] Table 8: Experimental results of R-value (%) of the present invention compared with other adversarial training methods on SWaT under different attack perturbations.

[0082]

[0083] In addition to outperforming other advanced adversarial training methods in overall adversarial robustness, this invention also demonstrates higher adversarial robustness on adversarial samples within a single attack class. To investigate the effectiveness of different methods across all attack classes, we calculated the R-values ​​of the model on adversarial samples across all attack classes in WADI and Morris. Figure 5(a) shows a comparison of the R-values ​​of the model on each class after applying a PGD-based untargeted attack with a maximum perturbation of 0.2 to the WADI dataset. It can be observed that WADI has a total of 13 attack classes, with classes 4, 9, and 10 being more vulnerable to adversarial examples. Our method outperforms other adversarial training strategies in almost all classes. While maintaining robustness against adversarial attacks in other classes, our method improves the R-value by 4.4% on the four most difficult attack classes. Similarly, as... Figure 5 As shown in (b), our R-values ​​are 10.6% higher than other methods on the six most difficult attack classes to train, which demonstrates that BPAT enables the model to effectively defend against adversarial examples in each class.

[0084] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An adversarial training method based on bidirectional perturbation generation, characterized in that, include: Step 1: Set a training perturbation amplitude for each category. In the current training round, generate positive adversarial perturbations using the PGD method based on the training perturbation amplitude for each category. Step 2: Use the adversarial perturbation generated in Step 1 to perturb the original samples to obtain positive adversarial samples, and calculate the classification accuracy of the model on the adversarial samples to measure whether the current adversarial perturbation magnitude for each category is applicable. Step 3: Use the classification accuracy of different categories obtained in Step 2 as a metric to update the training perturbation amplitude; Step 4: Generate inverse adversarial perturbation samples for each sample along the direction of gradient descent, guiding the samples to move closer to the high-confidence region of the correct class, so that the model's classification loss on the inverse adversarial samples is smaller than the original loss; Step 5: Based on the positive and negative adversarial samples obtained in Step 2 and Step 4, update the model parameters and proceed to the next training round until the model training is completed.

2. The adversarial training method based on bidirectional perturbation generation according to claim 1, characterized in that, The specific method for calculating the classification accuracy in step 2 is as follows: Step 2.1: In the t-th round of training, take adversarial examples of k categories as input and let the model classify them; Step 2.2, calculate the model's classification accuracy A on adversarial examples. i t A is used to measure whether the training perturbation magnitude is appropriate for each category. i t The calculation formula is as follows: ； Where n i It is the number of samples in the i-th category, cor i This represents the number of adversarial samples that were correctly classified.

3. The adversarial training method based on bidirectional perturbation generation according to claim 1, characterized in that, The specific method for updating the training perturbation amplitude as described in step 3 includes: Step 3.1: After obtaining the classification accuracy for different categories, the adversarial perturbation amplitude will be updated according to the following formula: ； Step 3.2: When the accuracy of this round is improved compared to the previous round, increase the training perturbation amplitude according to the magnitude of the change in accuracy, so that the model learns a larger amount of adversarial perturbation. Step 3.3: If the accuracy of this round is lower than that of the previous round, it proves that the current training perturbation is too large. Therefore, the training perturbation should be reduced in the next training round. Step 3.4: When the accuracy of adjacent rounds remains unchanged, slightly increase the training perturbation.

4. The adversarial training method based on bidirectional perturbation generation according to claim 1, characterized in that, The specific method for generating the reverse counter-perturbation in step 4 includes: Step 4.1: Input sample x into the model for classification to obtain the classification result; Step 4.2: Use the classification loss function to calculate the model's classification loss on this sample. The classification loss for the classification task is calculated using the following formula: ； Where k is the total number of categories, p i It is the model's prediction result for the sample; Step 4.3: Calculate the gradient of the classification loss of the input sample with respect to the input features. Based on the sign of the gradient, obtain a perturbation direction d. Unlike the adversarial perturbation, the direction of the reverse adversarial perturbation is not along the direction of gradient ascent, but along the direction of gradient descent, that is, the opposite direction of the adversarial perturbation -d. Step 4.4: Based on the direction obtained in Step 4.3, generate a reverse adversarial perturbation and generate reverse adversarial samples. The creation of reverse adversarial samples can be written in the following form: ； Where x pre denoted as the reverse adversarial sample, and 'a' is the step size for generating the reverse adversarial perturbation. During training, we generate reverse adversarial perturbations for each sample and update them continuously as the model trains.

5. The adversarial training method based on bidirectional perturbation generation according to claim 1, characterized in that, The specific method for perturbation learning in step 5 includes: Step 5.1: Based on the original adversarial training loss function, introduce KL divergence as a constraint term; Step 5.2: By minimizing the KL divergence, the distribution gap between the output values ​​of the adversarial examples and the perturbation samples is reduced, thereby enabling the model's output on the adversarial examples to be closer to the model's classification results on the adversarial examples, ultimately achieving the goal of moving the decision boundary away from the adversarial examples; the loss function for model updates can be expressed as the following formula: ； Where η is the parameter of the two balancing terms; in the loss function, the first term is used to reduce the classification loss of adversarial examples, and the second term, guided by the reverse adversarial examples, pushes the decision boundary to classify adversarial examples into the high-confidence region of the correct category.

Images