A gan adversarial sample generation method based on a fusion attention mechanism

Abstract

The application discloses a GAN adversarial sample generation method based on a fusion attention mechanism and belongs to the cross technical field of network security and deep learning. The method comprises the following steps: acquiring network flow sample data, and performing image reconstruction and standardization processing on the input network flow data; constructing a GAN basic model containing an attention mechanism and pre-training the GAN basic model; optimizing core hyperparameters based on the pre-training result, and determining an optimal perturbation size; selecting the pre-trained model for integrated recombination, constructing an integrated GAN model, and completing joint training; generating adversarial samples by using the integrated GAN model, performing performance evaluation on the adversarial samples by using a target intrusion detection system; and outputting optimal adversarial samples that pass the evaluation and corresponding generation strategies. The application can improve the effectiveness and applicability of adversarial sample generation, provide a technical reference for enhancing the robustness of a target IDS, and support network security defense optimization of specific scenes such as EV charging infrastructure.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of network security and deep learning, specifically relating to a GAN adversarial example generation method based on a fusion attention mechanism. Background Technology

[0002] With the application of deep learning technology in the field of cybersecurity, deep learning-based intrusion detection systems (IDS) have become a core tool for protecting electric vehicle (EV) charging infrastructure from DDoS attacks due to their efficient feature extraction and classification capabilities. However, these IDS systems have an inherent vulnerability: they are highly sensitive to even minor perturbations in network traffic data. Attackers can construct adversarial examples to fine-tune the characteristics of malicious traffic, causing it to be misjudged as normal traffic by the IDS while maintaining its malicious attributes, thus leading to defense failure. Although adversarial example generation techniques have been researched, existing traditional generation methods (such as basic GAN models) still face insurmountable technical bottlenecks and defects in practical applications, specifically in the following two aspects:

[0003] 1. The perturbations did not focus on the key sensitive features of the IDS, lacked specificity, and had a low success rate.

[0004] Existing basic GAN models typically generate uniformly or randomly distributed perturbations in the global feature space, failing to distinguish the importance of features. IDS (Input Data Systems) exhibit vastly different sensitivities to different feature dimensions of traffic data; only perturbations targeting key sensitive features (such as specific command count or cycle count patterns) can effectively induce false positives. Traditional methods, lacking attention mechanisms, often make meaningless modifications to non-critical regions (background noise), failing to accurately cover the core regions of interest to the IDS. This indiscriminate perturbation generation method leads to low attack efficiency; under the same number of iterations, the generated adversarial examples are unlikely to effectively deceive high-performance IDS, resulting in a generally low attack success rate (ASR).

[0005] 2. It is difficult to balance the aggressiveness and stealth of adversarial examples. Excessive perturbation is easily detected by IDS, while small perturbation cannot effectively deceive the model.

[0006] In adversarial example generation, attack success rate (aggressivity) and perturbation magnitude (stealth) are often negatively correlated, and traditional methods struggle to find the optimal balance between the two. To improve attack success rate, traditional models tend to increase perturbation amplitude. However, experiments show that if the perturbation amplitude is too large, the statistical distribution of the samples deviates significantly from normal traffic characteristics, making them easily detectable by IDS or blocked by simple preprocessing filtering, leading to attack failure. Conversely, if perturbation is excessively restricted in pursuit of stealth, the lack of precise enhancement of key features means that small perturbations are insufficient to cross the decision boundary of IDS. Therefore, existing techniques often fall into the dilemma of small perturbations being ineffective and large perturbations being easily detected, resulting in generated samples lacking practical value. Summary of the Invention

[0007] To address the problems mentioned in the background, this invention proposes a GAN adversarial example generation method based on a fusion attention mechanism. By introducing a channel / spatial attention mechanism into the GAN generator, it achieves precise perturbation focusing; optimizes the optimal configuration through a single hyperparameter (perturbation size); and uses multi-dimensional indicators for quantitative evaluation to generate high-quality adversarial examples adapted to DDoS perturbation scenarios, providing support for IDS robustness testing.

[0008] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0009] A GAN adversarial example generation method based on a fusion attention mechanism includes the following steps:

[0010] S1. Obtain network traffic sample data and perform image reconstruction and standardization processing on the input network traffic data;

[0011] S2. Construct a basic GAN model with an attention mechanism and pre-train it;

[0012] S3. Optimize the core hyperparameters based on the pre-training results and determine the optimal perturbation size;

[0013] S4. Select the pre-trained GAN model with channel attention and the GAN model with spatial attention, integrate and recombine them to construct an integrated GAN model and complete joint training.

[0014] S5. Generate adversarial examples using an integrated GAN model, and evaluate the performance of the adversarial examples using a target intrusion detection system.

[0015] S6. Output the best adversarial sample that has passed the evaluation and the corresponding generation strategy.

[0016] As a preferred option, the specific implementation process in S1 is as follows:

[0017] S1.1: Select multiple quantifiable features from network traffic data, and sort the selected core quantifiable features according to the data collection time sequence to form a feature value sequence;

[0018] S1.2: Construct an initial image by concatenating the feature value sequence row by row to fill a multi-dimensional feature matrix, and then mapping the multi-dimensional feature matrix to the RGB three channels to generate an initial RGB image;

[0019] S1.3: The initial RGB image is standardized by mapping the feature values ​​to the [0,255] range through Min-Max standardization, converting the image color channels from RGB format to BGR format, and then using bilinear interpolation to scale the image size to 224×224 to obtain the final network traffic image sample.

[0020] S1.4: Divide the network traffic image samples into training set and validation set.

[0021] As a preferred option, the specific implementation process in S2 is as follows:

[0022] S2.1: Construct three types of GAN models: including basic GAN models, GAN models with integrated channel attention, and GAN models with integrated spatial attention modules;

[0023] S2.2: The Adam optimizer is used to independently pre-train the three types of GAN models in S2.1.

[0024] As a preferred option, the specific implementation process in S2.1 is as follows:

[0025] The basic GAN model consists of a generator and a discriminator. The generator extracts features through a 3-layer convolution-batch normalization-LeakyReLU stacked module, and outputs a perturbation that meets the amplitude requirements after Tanh activation and Lambda scaling layer. The discriminator extracts features through a 3-layer convolution-ReLU-batch normalization module, and outputs the probability that the input image is a real sample or an adversarial sample after global average pooling, fully connected layer and Sigmoid activation.

[0026] GAN model with integrated channel attention: This model embeds an SE channel attention module after each layer of LeakyReLU activation in the basic GAN model generator; first, global average pooling is performed on the feature map to generate channel description vectors, then channel weights are learned through two fully connected layers and activation functions, and finally the feature channels are recalibrated by element-wise multiplication;

[0027] GAN model with integrated spatial attention module: This model adds a spatial attention module after each layer of LeakyReLU activation in the basic GAN model generator; first, the feature map is max pooled and average pooled along the channel dimension, then concatenated and generated by 7×7 convolution and Sigmoid activation to generate a spatial attention map, and then multiplied element-wise with the original feature map through a broadcast mechanism.

[0028] As a preferred option, the specific implementation process in S2.2 is as follows:

[0029] Discriminator loss function for:

[0030] ;

[0031] in, This represents the binary cross-entropy loss function. This represents the discriminator network. Represents a real sample; Indicates adversarial examples;

[0032] Generator total loss function for:

[0033] ;

[0034] in, This represents the weights that represent the adversarial loss in GANs. This indicates the adversarial loss of GAN; The weights representing the perturbation regularization loss; This represents the perturbation regularization loss; The weight representing the attack loss; This indicates the damage caused by the attack.

[0035] As a preferred option, the specific implementation process in S4 is as follows:

[0036] S4.1: Integrated architecture settings: The generator core modules containing channel attention GAN model and spatial attention GAN model are retained as two independent sub-generators, and the discriminator complete structure containing channel attention GAN model and spatial attention GAN model is retained as a dual-branch discriminator module.

[0037] S4.2: Result Fusion: The outputs of the dual-branch discriminator module are summed with equal weights to obtain the final prediction probability of the integrated discriminator; the perturbations of the outputs of the two sub-generators are summed with weights according to the EIR proportions in the pre-training stage to obtain the integrated perturbation.

[0038] S4.3: Network Completion: After integrating the initial adversarial sample generated by superimposing the perturbation and the original network traffic image sample, a convolutional calibration layer, a Dense layer, a Dropout layer, and an output layer are added in sequence to construct a complete integrated network.

[0039] S4.4: Layered joint training: Adopting a training strategy of first local and then global;

[0040] First, freeze the parameters of the attention module, convolutional layer, and discriminator core convolutional layer of the sub-generator, and train the calibration layer, Dense layer, and Dropout layer; then unfreeze all parameters and train them together, monitoring EIR, ASR, and perturbation L2 norm in each round. Training is stopped when the EIR improvement is less than 0.5% for 5 consecutive rounds or when the maximum number of training rounds of 30 is reached.

[0041] As a preferred option, the specific implementation process in S5 is as follows:

[0042] S5.1: Adversarial Example Generation: Input the original malicious traffic image into the ensemble model to generate adversarial perturbations. ,according to Generate adversarial examples;

[0043] in, Indicates adversarial examples; Represents a real sample;

[0044] S5.2: Multi-dimensional performance evaluation: Performance evaluation is conducted using metrics including the original detection rate and the adversarial detection rate.

[0045] As a preferred option, the specific process in S5.2 is as follows:

[0046] Original detection rate The calculation process is as follows:

[0047] ;

[0048] in, This indicates the number of original malicious traffic that was correctly detected. This represents the number of incorrect predictions;

[0049] Adversity detection rate The calculation process is as follows:

[0050] ;

[0051] in, This represents the number of correctly detected adversarial samples. This represents the number of incorrect predictions;

[0052] Attack success rate The calculation process is as follows:

[0053] ;

[0054] in, This indicates the number of adversarial examples that were misclassified as normal traffic by the target IDS;

[0055] escape rate The calculation process is as follows:

[0056] ;

[0057] in, Indicates the rate of resistance to detection; This indicates the original detection rate.

[0058] As a preferred option, the specific implementation process in S6 is as follows:

[0059] Output the adversarial examples generated by the ensemble model, select the examples with the highest contribution ratio of the sub-generator containing the spatial attention module as the optimal adversarial examples, and record the corresponding generation strategies, including the attention mechanism type, core hyperparameters, and training parameters.

[0060] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0061] (1) Strong perturbation targeting: By introducing a spatial / channel attention mechanism into the GAN generator, the perturbation is precisely focused on the key sensitive feature regions of IDS (such as image blocks corresponding to the number of cycles and instructions), making the attack success rate of the method of this invention higher than that of the basic GAN model.

[0062] (2) Excellent performance in attack and defense balance: By constraining the perturbation regularization loss (L2 norm) and optimizing the core hyperparameters, while ensuring high perturbation, the perturbation amplitude is kept to a minimum. The adversarial sample is highly similar to the original traffic characteristics, and has strong concealment.

[0063] (3) Good scenario adaptability: Based on the CICEV2023 dataset, it covers four types of DDoS disturbance scenarios (including / excluding Gaussian analysis disturbance) of electric vehicle charging infrastructure. The generated adversarial examples can be directly used for robustness testing of IDS in this scenario.

[0064] (4) High training stability: By using batch normalization, learning rate decay and early stopping strategies, overfitting of model training is avoided. The EIR fluctuation of the three types of models during the pre-training stage is controlled within ±1%, ensuring the consistency of adversarial sample generation. Attached Figure Description

[0065] Figure 1 This is a flowchart of the GAN adversarial example generation method based on the fusion attention mechanism of the present invention;

[0066] Figure 2 This is a schematic diagram of the image reconstruction and standardization process of network traffic samples according to the present invention;

[0067] Figure 3 This is a schematic diagram of the generator network microstructure of the fusion attention mechanism of the present invention;

[0068] Figure 4 This is a diagram of the weighted fusion and joint training architecture of the dual-branch ensemble GAN model of the present invention;

[0069] Figure 5 This is a schematic diagram comparing the performance of the method of this invention with existing attack methods in a scenario containing Gaussian analysis. Detailed Implementation

[0070] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0071] The adversarial sample generation method based on the fusion attention mechanism of GAN (Generative Adversarial Network) provided in this embodiment is used to generate adversarial samples for DDoS (Distributed Denial of Service) disturbance scenarios of electric vehicle charging infrastructure, and provides technical support for the robustness testing of deep learning-based network intrusion detection system (IDS).

[0072] While deep learning-based network intrusion detection systems (IDS) are widely used in network security protection, they are highly sensitive to even minor perturbations in network traffic data. Attackers can bypass detection by constructing adversarial examples, leading to defense failure. To analyze the security of existing IDS and verify their performance in complex perturbation scenarios, this invention proposes a network perturbation adversarial example generation method based on attention-based generative adversarial networks (GANs), using electric vehicle (EV) charging infrastructure DdoS perturbation as an application background.

[0073] The core of this method is to transform the traffic data of EV charging infrastructure into an input format that is compatible with GAN models through image reconstruction. After pre-training of the GAN model with attention mechanism, optimization of core hyperparameters, and generation of adversarial examples, the perturbation and concealment of the samples are evaluated with the help of target IDS (AAFM-Net), and finally the optimal adversarial examples and generation strategy are output.

[0074] like Figure 1 As shown, the method specifically includes six major steps, from step 1 to step 6:

[0075] Step 1: Acquire network traffic data and perform image reconstruction and standardization processing on the input network traffic data;

[0076] For the CICEV2023 dataset (a dedicated dataset for DDoS disturbances in EV charging infrastructure, containing two subsets: "disturbances with Gaussian analysis" and "disturbances without Gaussian analysis"), the traffic data was transformed into standard 224×224 BGR images through feature selection, format conversion, and size adjustment to meet the input requirements of GAN models. The specific method is as follows:

[0077] S1.1: Select multiple quantifiable features from network traffic data, and sort the selected core quantifiable features according to the data collection time sequence to form a feature value sequence;

[0078] From the seven original features of the CICEV2023 dataset, three quantifiable features strongly correlated with DDoS disturbances were selected: number of cycles (the number of CPU cycles consumed by the target device during EV charging certification), number of instructions (the total number of instructions executed by the target device), and number of branches (the number of branch commands executed by the target device). These features were sorted according to the data acquisition time sequence (the time order from the EV initiating the certification request to the GS response) to form a feature value sequence.

[0079] S1.2: Construct an initial image by concatenating the feature value sequence row by row to fill a multi-dimensional feature matrix, and then mapping the multi-dimensional feature matrix to the RGB three channels to generate an initial RGB image;

[0080] Count the total number of selected features and construct the initial image according to the format of "length × width × number of channels = 3 × 3 × 3": fill the feature value sequence into the 3 × 3 feature matrix row by row. If the total number of features is less than 9 (3 × 3), use the feature data of the same type of flow sample (such as the "error EVID perturbation with Gaussian analysis perturbation" sample) to fill in the gaps in the matrix. Map the 3 × 3 matrix to the three RGB channels respectively to generate the initial 3 × 3 × 3 RGB image.

[0081] Step 1.3: Standardize and format the initial RGB image;

[0082] like Figure 2 As shown, it specifically includes the following three sub-steps:

[0083] (1) Data standardization processing;

[0084] First, the feature values ​​(corresponding pixel values) of the initial image are normalized to the [0, 255] interval using Min-Max to eliminate differences between features of different dimensions. The calculation formula is as follows:

[0085] ;

[0086] in, These are the original eigenvalues. , These are the minimum and maximum values ​​of this feature in the training set; These are the feature values ​​after data standardization.

[0087] (2) Color channel format conversion (RGB to BGR): In order to adapt to the input format commonly used by object detection models (such as pre-trained models based on TensorFlow or Caffe), it is necessary to convert the image from RGB color space to BGR color space.

[0088] Specifically, this involves reversing the channel order of the image, mathematically expressed as follows: Let the vector of the pixel at coordinates (i,j) in the initial RGB image be... The converted BGR image corresponds to the pixel vector as follows: ,but:

[0089]

[0090] In this context, R, G, and B represent the red channel component, green channel component, and blue channel component, respectively.

[0091] (3) Image scaling using bilinear interpolation: Bilinear interpolation is used to scale the image. The tiny image of 3 was scaled down to 224. 224 pixels to generate the final network traffic image sample.

[0092] Let the source image (3) 3) is S, target image (224) 224) is D1. For any pixel (x,y) in the target image, its pixel value D1(x,y) is calculated through the following steps:

[0093] Coordinate mapping: Mapping the target image coordinates back to the source image coordinate system to obtain floating-point coordinates (u,v):

[0094]

[0095]

[0096] in, , The x and y coordinates of the pixels in the target image D1 , ; , These are the width and height of the source image, respectively, both of which are 3 in this embodiment; , These are the width and height of the target image, respectively, both of which are 224 in this embodiment.

[0097] Interpolation calculation: Select the four integer coordinate points (i,j), (i+1,j), (i, j+1), and (i+1, j+1) in the source image that are closest to the floating-point coordinate (u, v), where , .make The target pixel value is calculated by weighting the horizontal and vertical deviations, respectively. The calculation formula is:

[0098]

[0099] Then, the RGB image is converted to BGR format (adapted to the TensorFlow framework); and bilinear interpolation is used to scale the 3×3 image to 224×224 pixels to obtain the final traffic image sample.

[0100] in, This indicates the floor function; , All represent interpolation weighting coefficients, with values ​​ranging from... between; This represents the pixel value of the source image at a specific integer coordinate.

[0101] Through the above steps, a final traffic image sample with a size of 224×224×3 is obtained, which is used as input for the subsequent GAN model.

[0102] Step 1.4: Divide the network traffic image samples into a training set and a validation set;

[0103] Network traffic image samples were divided into training and validation sets in a 4:1 ratio. Both the training and validation sets included two subsets: one with Gaussian perturbation and the other without (specifically, the subsets with Gaussian perturbation consisted of 7936 training samples and 1984 validation samples, while the subsets without Gaussian perturbation consisted of 10313 training samples and 2578 validation samples), ensuring consistent data distribution.

[0104] S2: Construct a basic GAN model with an attention mechanism and pre-train it;

[0105] The basic GAN models include three categories: basic GAN models without attention mechanisms, GAN models integrating channel attention (SE module), and GAN models integrating spatial attention module. Each of these three types of models is pre-trained. Specifically, as follows... Figure 3 , Figure 4 As shown.

[0106] S2.1: Construct three types of GAN models (basic GAN, GAN with channel attention, and GAN with spatial attention), and select high-performance models through independent pre-training. The architecture of the three types of GAN models is designed as follows:

[0107] Model A serves as the benchmark model for this invention, generated by the generator. and discriminator It consists of two parts. The specific network architecture setup steps and computational logic are as follows:

[0108] (1) Constructing the generator: The core task of constructing the implementation details generator is to map the input random noise vector z into a perturbation matrix with the same size as the network traffic image.

[0109] The specific construction process is as follows:

[0110] Feature extraction layer (hidden layer): contains 3 stacked convolution-normalization-activation modules.

[0111] Convolutional layers (Conv2d): 64, 128, and 256 convolutional kernels are set sequentially, each with a kernel size of 3×3, a stride of 1, and padding of 'SAME'. For the l-th layer, the convolution calculation formula is:

[0112]

[0113] in, The convolution kernel weight matrix is... For bias terms, For pixel coordinates, This is the output channel index. In the output feature map of layer l, the first... The spatial location of each channel Eigenvalues ​​at; Indicates the channel index of the input feature map; This represents the sliding index of the convolution kernel in the height direction; This represents the sliding index of the convolution kernel along the width direction; Indicates the first In the input feature map of the previous layer, the first... The characteristic values ​​of each channel at the corresponding position. This represents the input feature map.

[0114] Batch Normalization (BN): Placed after each convolutional layer, it accelerates convergence and prevents gradient vanishing. The normalization formula is:

[0115]

[0116] in, This represents the output feature value after batch normalization. and These are the mean and variance of the current batch of data, respectively. and For learnable scaling and translation parameters, To prevent tiny constants with a denominator of 0. This represents the original feature values ​​input to this layer.

[0117] Activation layer (LeakyReLU): Immediately following the BN layer, the LeakyReLU activation function is used to address neuron death. The slope of the negative half-axis is set to... The calculation formula is:

[0118]

[0119] in, This represents the LeakyReLU activation function; This represents the input value of the activation function (i.e., the output of the neuron in the previous layer).

[0120] Output control layer: Tanh activation; after the last convolutional layer, the output value is compressed using the hyperbolic tangent function (Tanh). The interval, specifically:

[0121]

[0122] in, Represents the hyperbolic tangent function; This represents the input feature value entering the Tanh activation layer.

[0123] Lambda scaling layer: To control the magnitude of the generated perturbation and ensure it does not exceed the concealment requirements, a custom Lambda layer is added after Tanh. The preset upper limit for the perturbation size is set to... (e.g., 0.01), then the final output disturbance The calculation is as follows:

[0124]

[0125] in, This represents the adversarial perturbation matrix that is the final output of the generator; This indicates a custom scaling function operation; This indicates the preset upper limit of the perturbation size; This represents the hyperbolic tangent function.

[0126] (2) Constructing the discriminator: The task of constructing the discriminator is to distinguish whether the input image is a real flow image. Or generated adversarial examples .

[0127] Feature extraction layer: It also contains 3 convolutional layers, with the number of convolutional kernels being 32, 64 and 128 respectively, and the kernel size being 3×3.

[0128] Differential activation: Unlike the generator, the discriminator performs ReLU activation after each convolutional layer, followed by batch normalization (BN). The formula for calculating the ReLU activation function is:

[0129]

[0130] in, This represents the output of the ReLU activation function; This represents the output feature value of the discriminator convolutional layer.

[0131] The classification output layer specifically includes:

[0132] Global Average Pooling: This method averages the feature maps output from the last convolutional layer across the spatial dimension, compressing the dimension to 1×1×128. The specific calculation formula is as follows:

[0133]

[0134] in, H represents the output value (scalar) of the k-th feature channel after global average pooling; H represents the height of the input feature map; W represents the width of the input feature map. This indicates that the k-th channel in the input feature map is located at coordinates... The pixel value at that location.

[0135] Fully connected layer and Sigmoid activation: The pooled vector is input into the fully connected layer and mapped by the Sigmoid function. The probability value P is as follows:

[0136]

[0137] in, This represents the probability value mapped by the Sigmoid function; Indicates the activation function; This represents the weight matrix of the fully connected layer; This represents the input vector of the fully connected layer (i.e., the output of the global average pooling layer). This represents the bias vector of the fully connected layer.

[0138] This indicates that the sample was identified as a real sample. This indicates that the sample is being generated.

[0139] Model B (GAN model with channel attention): The SE module (channel attention) is embedded after each layer of LeakyReLU activation in the base GAN model generator.

[0140] The processing flow of the SE module is as follows:

[0141] An SE (Squeeze-and-Excitation Block) module is embedded after each LeakyReLU activation function in the basic GAN model generator. This module recalibrates the feature channel weights by explicitly modeling the dependencies between channels. The specific processing flow and parameter meanings are as follows:

[0142] 1. Squeeze operation: Generates channel description vectors. First, global average pooling is performed on the input feature map, compressing each two-dimensional feature channel into a real number to generate a channel description vector. The calculation formula is:

[0143]

[0144] Where H represents the height of the input feature map; W represents the width of the input feature map. This represents the spatial coordinates of the c-th channel in the input feature map. Pixel value at; This represents the compressed global description value (scalar) of the c-th channel.

[0145] 2. Excitation Operation: Channel Weights are then generated. A gating mechanism consisting of two fully connected (FC) layers is used to learn the nonlinear interactions between channels, generating the final channel weight vector s. The calculation formula is as follows:

[0146]

[0147]

[0148]

[0149] in, This represents the Sigmoid activation function, used to map the output weights to the (0,1) interval; Represents the ReLU activation function, used to introduce nonlinearity; This represents the weight matrix of the first fully connected layer, used to reduce the channel dimension (usually set to ). ,in, It is the original dimension. (for scaling parameters), to reduce computation and increase nonlinearity; This represents the weight matrix of the second fully connected layer, used to restore the channel dimension to the original dimension C; This represents the channel description vector generated in the previous step. x4 represents the feature value output by the fully connected layer (as input to the Sigmoid function).

[0150] 3. Recalibration (Scale) operation: Finally, the generated channel weights s are multiplied element-wise with the original feature map F to achieve recalibration of the original features.

[0151] The specific implementation process and calculation formula are as follows: Each element in the weight vector s... The importance coefficient of the c-th channel is considered, and it is expanded (Broadcast) to the same spatial size (H×W) as the feature map of that channel, and then multiplied by the corresponding original feature value. The resulting new feature map... The calculation formula is:

[0152]

[0153] in, This indicates that after recalibration, the c-th channel is in coordinates The feature value at that location (i.e., the output feature map); This represents the weight coefficient (scalar) of the c-th channel learned through the activation operation. ); This indicates that the c-th channel in the original input feature map is located at coordinates... The original feature value at the location; This indicates a scalar multiplication operation.

[0154] Through this operation, the model can automatically suppress feature channels that contribute less to the generation of adversarial examples. ), and enhance key feature channels ( This improves the targeting of disturbance generation.

[0155] Model C (including spatial attention GAN model): A spatial attention module is added after each layer of LeakyReLU activation in the basic GAN model generator. The processing flow of the spatial attention module is as follows:

[0156] A spatial attention module is added after each LeakyReLU activation function in the basic GAN model generator. This module is mainly used to focus on the spatially critical regions of the feature map (i.e., "where is more important"). The specific processing flow and parameter meanings are as follows:

[0157] 1. Feature integration and spatial attention map generation;

[0158] First, the input feature map is subjected to max pooling and average pooling along the channel dimension, and the results are concatenated; then, a... Convolutional layers generate spatial attention maps The calculation formula is:

[0159]

[0160] in, This represents the Sigmoid activation function, used to map the numerical values ​​of the convolution output to... An interval represents the importance weight of a spatial location. Indicates the kernel size as Convolution operations. Using convolution kernels with larger receptive fields helps capture a wider range of spatial context information. This represents the channel max-pooling feature map. For the input feature map F (size...),... The maximum value is obtained by performing a maximum value operation along the channel axis, and the size is... Preserve the most prominent features of the texture. This represents the channel average pooling feature map. For the input feature map... The value is obtained by averaging along the channel axis, and the size is... Preserve background and other comprehensive information. This indicates a channel concatenation operation. and By splicing along the channel dimension, a structure with a size of [size missing] is formed. The intermediate feature map.

[0161] 2. Spatial Recalibration: Finally, the generated spatial attention map is weighted. Compared with the original feature map Element-wise multiplication is performed to recalibrate spatial features.

[0162] The specific implementation process and calculation formula are as follows: Generated spatial attention map It is a single-channel two-dimensional matrix (size) To match the original feature map F (size) of the multi-channel array. Multiplying these requires using a broadcasting mechanism to distribute the data. The copy is expanded to C channels, and then multiplied at corresponding positions. The resulting new feature map... The calculation formula is:

[0163]

[0164] in, Indicates that after recalibration, the first Each channel in spatial coordinates Feature values ​​at (output feature map); Representing coordinates in the spatial attention graph The weight value at the location (scalar, The larger this value, the more important the spatial location (such as a specific flow waveform area) is to deceiving IDS; Represents the first element in the original input feature map. Each channel is in coordinates The original feature value at the location; The height and width indices of the feature map are represented, with values ​​ranging from 1 to 2. .

[0165] Through this operation, the model is able to suppress background noise regions. Highlighting the core texture areas related to the attack ( This improves the spatial accuracy of generated disturbances.

[0166] S2.2: The Adam optimizer is used to independently pre-train the three types of GAN models in S2.1;

[0167] Optimizer: Adam optimizer is used uniformly (initial learning rate 0.0002, β1=0.9, β2=0.999).

[0168] The loss function for pre-training is set as follows:

[0169] Discriminator loss function for:

[0170]

[0171] in, This represents the binary cross-entropy loss function, used to measure the degree of difference between the probability distribution predicted by the discriminator and the true label (1 or 0). This represents a discriminator network, whose function is to receive an input image and output a probability value between 0 and 1 to determine whether the input image is real or generated. This represents a real sample, i.e., the original network traffic image directly from the dataset and after image reconstruction and standardization (with a corresponding label of 1). This represents an adversarial example, which is a fake image generated by the generator by adding perturbations to a real sample (with a corresponding label of 0).

[0172] Generator total loss function for:

[0173]

[0174] in, The weight of the GAN adversarial loss (set to 1.0) is used to control the degree of importance the generator places on the goal of deceiving the discriminator. This represents the adversarial loss of GAN (using binary cross-entropy loss), which measures how realistic the samples generated by the generator appear to the discriminator, aiming to make the discriminator misclassify fake samples as real. The weight representing the perturbation regularization loss (set to 0.1) is used to adjust the balance between perturbation effect and stealth, preventing excessive perturbation due to an overemphasis on attack success rate. This represents the perturbation regularization loss (calculated using the L2 norm), used to quantify the magnitude of noise added to the original image. The smaller this value, the more similar the adversarial example is to the original sample (i.e., the better the concealment). The weight representing the attack loss (set to 1.0) is used to control the generator's priority in the core task of deceiving the target IDS (Intrusion Detection System). This represents the attack loss (a negative indicator of the probability of a target IDS misclassifying traffic), and is optimized by calculating the binary cross-entropy of the target classifier, aiming to maximize the probability that the target IDS will misclassify malicious traffic as normal traffic.

[0175] Training strategy: After each training round, the escape increase rate (EIR) is monitored using the validation set. Pre-training is stopped when the EIR fluctuation is less than 1% for 3 consecutive rounds or when the maximum number of training rounds (10 rounds) is reached. At the same time, the learning rate decay is set (the learning rate is multiplied by a decay factor of 0.5 after every 2 training rounds).

[0176] S3: Optimize core hyperparameters based on pre-training results and determine the optimal perturbation size;

[0177] The optimal perturbation value for the core hyperparameter ε = 0.01 (multiplication coefficients of the Lambda layer in the generator output layer) was determined through controlled variable experiments, as follows:

[0178] S3.1: Experiment setup;

[0179] On the validation set without Gaussian analysis perturbation, the performance of the three GAN base models was tested with perturbation sizes ε=0.01, 0.05, and 0.10. The evaluation metrics were perturbation success rate (ASR), adversarial detection rate (ADR), and escape increase rate (EIR).

[0180] S3.2: Determine the optimal perturbation size based on the evaluation results;

[0181] Experimental results (as shown in Table 1) show that when ε=0.01, the three basic GAN models have the best perturbation: Model A has an ASR of 13.48% and an EIR of 9.82%, Model B has an ASR of 19.45% and an EIR of 16.04%, and Model C has an ASR of 21.21% and an EIR of 17.88%. However, when ε=0.10, the ASR drops sharply to 2.37%~3.68% (the perturbation is too large and is identified by IDS). Therefore, ε=0.01 is determined to be the optimal perturbation size for all models.

[0182] Table 1. Model performance under different perturbation sizes (excluding Gaussian perturbation scenarios)

[0183]

[0184] S4: Select the pre-trained GAN model with channel attention and the GAN model with spatial attention, integrate and recombine them to construct an integrated GAN model and complete joint training;

[0185] like Figure 4 As shown, the best-performing model B (containing channel attention GAN) from S3 is selected and integrated with model C (containing spatial attention GAN) to construct a more stable generative model. The specific method is as follows:

[0186] S4.1: Integrated Architecture Setup;

[0187] The core generator modules (input layer → convolutional layer → attention module → perturbation output layer) of Model B and Model C are retained as two independent sub-generators, and the complete discriminator structure of both is retained as a dual-branch discriminator module.

[0188] S4.2: Results fusion;

[0189] The best-performing integrated channel attention GAN and integrated spatial attention GAN after pre-training were selected. Their generator core module was retained as a sub-generator and their discriminator was a dual-branch discriminator module. The dual-branch outputs were fused with equal weights.

[0190] The outputs of the dual-branch discriminator are summed with equal weights to obtain the final probability of authenticity; the perturbations of the sub-generator outputs are summed with weights according to the pre-trained EIR ratio (model B:model C=16.04%:17.88%≈0.47:0.53) to obtain the ensemble perturbation.

[0191] S4.3: Network completion;

[0192] After integrating the initial adversarial sample with the perturbation and the original image, one convolutional calibration layer (32 3×3 convolutional kernels, LeakyReLU activation), one Dense layer (256 neurons, ReLU activation), and one Dropout layer (probability 0.2) are added. Finally, the output layer of the tanh activation function constrains the pixel values ​​of the adversarial sample to [0, 255].

[0193] The perturbations of the sub-generators are weighted and summed according to the EIR ratio (≈0.47:0.53). After completing the convolutional calibration layer-Dense layer-Dropout layer-output layer, the layer freeze-joint training is adopted (first freeze the core layer and train the new layer for 10 rounds, then train with full parameters until the EIR improves by <0.5% for 5 consecutive rounds or stops after 30 rounds).

[0194] S4.4: Layered Joint Training;

[0195] First, freeze the parameters of the attention module, convolutional layer, and discriminator core convolutional layer of the sub-generator, and then train only the calibration layer, Dense layer, and Dropout layer for 10 rounds.

[0196] Then unfreeze all parameters and train together, monitoring EIR, ASR and perturbation L2 norm in each round. Stop training when EIR improves by less than 0.5% for 5 consecutive rounds or when the maximum number of training rounds of 30 is reached.

[0197] 1) Freeze training phase: First, freeze the parameters of the attention module, convolutional layer of the sub-generator, and core convolutional layer of the discriminator. Only train the parameters of the newly added convolutional calibration layer, Dense layer and Dropout layer for 10 iterations.

[0198] 2) Full-parameter joint training phase: Subsequently, all parameters are unfrozen and full-parameter joint training is performed. After each training round, the escape increase rate (EIR), attack success rate (ASR), and perturbation L2 norm are monitored in real time. Training is stopped when the EIR increases by less than 0.5% for 5 consecutive rounds or when the maximum number of training rounds (30 rounds) is reached.

[0199] S5: Generate adversarial examples using an integrated GAN model, and evaluate the perturbation and concealment of the adversarial examples using a target intrusion detection system.

[0200] Adversarial examples were generated based on an ensemble GAN model. AAFM-Net (an ensemble CNN with an auxiliary attention filter module, achieving over 90% accuracy on the CICEV2023 dataset) was used as the target IDS (AAFM-Net's detection rate on the CICEV2023 dataset: 95.94% without Gaussian perturbation, 89.22% with Gaussian perturbation). Performance was evaluated using raw detection rate (ODR), adversarial detection rate (ADR), perturbation success rate (ASR), and efficiency index (EIR), as detailed below:

[0201] S5.1: Adversarial Example Generation: Input the original malicious traffic image into the ensemble model to generate adversarial perturbations. ,according to (If the pixel value exceeds [0, 255], it will be truncated) to generate adversarial examples;

[0202] in, This represents the generated adversarial example. This represents a real sample.

[0203] S5.2: Multi-dimensional performance evaluation;

[0204] The following four core indicators will be used for evaluation:

[0205] Raw detection rate (ODR):

[0206]

[0207] in, This represents the number of correctly detected malicious traffic. This represents the number of incorrect predictions.

[0208] Adversarial Detection Rate (ADR):

[0209]

[0210] in, To counteract the number of correctly detected samples, This represents the number of incorrect predictions.

[0211] Attack Success Rate (ASR):

[0212]

[0213] in, This indicates the number of adversarial samples that are misclassified as normal traffic by the target IDS.

[0214] Escape Increment Rate (EIR):

[0215] .

[0216] An adversarial example is considered a qualified adversarial example when its ASR is greater than or equal to 19%, EIR is greater than or equal to 9%, and the perturbation L2 norm is less than or equal to 0.01.

[0217] Evaluation results show that the adversarial examples generated by the ensemble model have an ASR of 22.15% and an EIR of 18.53% in scenarios without Gaussian perturbation, and an ASR of 20.32% and an EIR of 10.21% in scenarios with Gaussian perturbation, which outperforms the single model.

[0218] Step 6: Output the best adversarial sample that has passed the evaluation and the corresponding generation strategy.

[0219] Output adversarial examples generated by the ensemble model (prioritizing samples with a high contribution from sub-generators containing spatial attention modules), and record the generation strategy: attention mechanism type (channel + spatial attention), core hyperparameters (perturbation size ε = 0.01, batch size 32), and training parameters (Adam optimizer, ...). =1.0、 =0.1、 =1.0), IDS robustness test adapted to DdoS disturbance scenarios of EV charging infrastructure.

[0220] The effectiveness and efficiency of the method of the present invention are verified through the following experiments:

[0221] Comparison models: Basic GAN (Model A), GAN with channel attention (Model B), GAN with spatial attention (Model C), BoundaryAttack, ATN (Adversarial Transformation Network), DDPG (Deep Deterministic Policy Gradient).

[0222] Experimental scenarios: without Gaussian analysis perturbation, with Gaussian analysis perturbation.

[0223] Evaluation metrics: Perturbation success rate (ASR, core perturbation metric), escape increase rate (EIR, comprehensive perturbation metric), and perturbation L2 norm (coverage metric, the smaller the better).

[0224] Experimental Results and Analysis:

[0225] In scenarios without Gaussian perturbations (as shown in Table 2): the integrated model of this invention has an ASR of 22.15% and an EIR of 18.53%, which is 64.3% higher than the basic GAN model and 4.4% higher than the single attention model (Model C). Moreover, the perturbation L2 norm is 0.008 (<0.01), and the concealment meets the standard.

[0226] For scenarios with Gaussian perturbations (as shown in Table 3): the ensemble model achieves an ASR of 20.32% and an EIR of 10.21%, which are superior to BoundaryAttack (ASR = 16.99%), ATN (ASR = 18.86%), and DDPG (ASR = 18.24%), validating the effectiveness of the method in complex perturbation scenarios. For details, please refer to... Figure 5 As shown.

[0227] Table 2 Comparison of model performance in scenarios without Gaussian perturbation

[0228]

[0229] Table 3 Comparison of model performance in scenarios with Gaussian perturbation

[0230]

[0231] In summary, the method of this invention can significantly improve the perturbation of EV charging infrastructure IDS while ensuring the concealment of adversarial samples, and can be effectively used for IDS robustness testing.

[0232] This application effectively solves the technical challenge of balancing attack success rate and stealth in traditional adversarial example generation methods by introducing a multi-dimensional attention mechanism (channel + space) into Generative Adversarial Networks (GANs) and employing a weighted ensemble strategy. Based on the experimental data in the specification (Tables 1, 2, and 3), this invention achieves significantly better experimental results than existing mainstream algorithms (basic GANs, Boundary Attacks, etc.) on the specific and complex CICEV2023 electric vehicle DDoS attack dataset. This method provides a more threatening and stealthy testing means than existing technologies for evaluating and improving the security of EV charging infrastructure.

[0233] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A GAN adversarial example generation method based on a fusion attention mechanism, characterized in that, Includes the following steps: S1. Obtain network traffic sample data and perform image reconstruction and standardization processing on the input network traffic data; S2. Construct a basic GAN model with an attention mechanism and pre-train it; S3. Optimize the core hyperparameters based on the pre-training results and determine the optimal perturbation size; S4. Select the pre-trained GAN model with channel attention and the GAN model with spatial attention, integrate and recombine them to construct an integrated GAN model and complete joint training. S4.1: Integrated architecture settings: The generator core modules containing channel attention GAN model and spatial attention GAN model are retained as two independent sub-generators, and the discriminator complete structure containing channel attention GAN model and spatial attention GAN model is retained as a dual-branch discriminator module. S4.2: Result Fusion: The outputs of the dual-branch discriminant module are summed with equal weights to obtain the final prediction probability of the integrated discriminant; The perturbations output by the two sub-generators are weighted and summed according to the EIR proportions during the pre-training phase to obtain the integrated perturbation; S4.3: Network Completion: After integrating the initial adversarial sample generated by superimposing the perturbation and the original network traffic image sample, a convolutional calibration layer, a Dense layer, a Dropout layer, and an output layer are added in sequence to construct a complete integrated network. S4.4: Layered joint training: Adopting a training strategy of first local and then global; First, freeze the parameters of the attention module, convolutional layer, and discriminator core convolutional layer of the sub-generator, and train the calibration layer, Dense layer, and Dropout layer; then unfreeze all parameters and train them together, monitoring EIR, ASR, and perturbation L2 norm in each round. Training is stopped when the EIR improvement is less than 0.5% for 5 consecutive rounds or when the maximum number of training rounds of 30 is reached. S5. Generate adversarial examples using an integrated GAN model, and evaluate the performance of the adversarial examples using a target intrusion detection system. S6. Output the best adversarial sample that has passed the evaluation and the corresponding generation strategy.

2. The GAN adversarial example generation method based on fusion attention mechanism according to claim 1, characterized in that: In S1, the specific implementation process is as follows: S1.1: Select multiple quantifiable features from network traffic data, and sort the selected quantifiable features according to the data collection time sequence to form a feature value sequence; S1.2: Construct an initial image by concatenating the feature value sequence row by row to fill a multi-dimensional feature matrix, and then mapping the multi-dimensional feature matrix to the RGB three channels to generate an initial RGB image; S1.3: The initial RGB image is standardized by mapping the feature values ​​to the [0,255] range through Min-Max standardization, converting the image color channels from RGB format to BGR format, and then using bilinear interpolation to scale the image size to 224×224 to obtain the final network traffic image sample. S1.4: Divide the network traffic image samples into training set and validation set.

3. The GAN adversarial example generation method based on fusion attention mechanism according to claim 1, characterized in that: In S2, the specific implementation process is as follows: S2.1: Construct three types of GAN models: including basic GAN models, GAN models with integrated channel attention, and GAN models with integrated spatial attention modules; S2.2: The Adam optimizer is used to independently pre-train the three types of GAN models in S2.

1.

4. The GAN adversarial example generation method based on fusion attention mechanism according to claim 3, characterized in that: In S2.1, the specific implementation process is as follows: The basic GAN model consists of a generator and a discriminator. The generator extracts features through a 3-layer convolution-batch normalization-LeakyReLU stacked module, and outputs a perturbation that meets the amplitude requirements after Tanh activation and Lambda scaling layer. The discriminator extracts features through a 3-layer convolution-ReLU-batch normalization module, and outputs the probability that the input image is a real sample or an adversarial sample after global average pooling, fully connected layer and Sigmoid activation. GAN model with integrated channel attention: This model embeds an SE channel attention module after each layer of LeakyReLU activation in the basic GAN model generator; first, global average pooling is performed on the feature map to generate channel description vectors, then channel weights are learned through two fully connected layers and activation functions, and finally the feature channels are recalibrated by element-wise multiplication; GAN model with integrated spatial attention module: This model adds a spatial attention module after each layer of LeakyReLU activation in the basic GAN model generator; first, the feature map is max pooled and average pooled along the channel dimension, then concatenated and generated by 7×7 convolution and Sigmoid activation to generate a spatial attention map, and then multiplied element-wise with the original feature map through a broadcast mechanism.

5. The GAN adversarial example generation method based on fusion attention mechanism according to claim 3, characterized in that: In S2.2, the specific implementation process is as follows: Discriminator loss function for: ； in, This represents the binary cross-entropy loss function. This represents the discriminator network. Represents a real sample; Indicates adversarial examples; Generator total loss function for: ； in, This represents the weights that represent the GAN's adversarial loss. This indicates the adversarial loss of GAN; The weights representing the perturbation regularization loss; This represents the perturbation regularization loss; The weight representing the attack loss; This indicates the damage caused by the attack.

6. The GAN adversarial example generation method based on fusion attention mechanism according to claim 1, characterized in that: In S5, the specific implementation process is as follows: S5.1: Adversarial Example Generation: Input the original malicious traffic image into the ensemble model to generate adversarial perturbations. ,according to Generate adversarial examples; in, Indicates adversarial examples; Represents a real sample; S5.2: Multi-dimensional performance evaluation: Performance evaluation is conducted using metrics including the original detection rate and the adversarial detection rate.

7. The GAN adversarial example generation method based on fusion attention mechanism according to claim 6, characterized in that: In S5.2, the specific process is as follows: Original detection rate The calculation process is as follows: ； in, This indicates the number of original malicious traffic that was correctly detected. This represents the number of incorrect predictions; Adversity detection rate The calculation process is as follows: ； in, This represents the number of correctly detected adversarial samples. This represents the number of incorrect predictions; Attack success rate The calculation process is as follows: ； in, This indicates the number of adversarial examples that were misclassified as normal traffic by the target IDS; escape rate The calculation process is as follows: ； in, Indicates the rate of resistance to detection; This indicates the original detection rate.

8. The GAN adversarial example generation method based on fusion attention mechanism according to claim 1, characterized in that: In S6, the specific implementation process is as follows: Output the adversarial examples generated by the ensemble model, select the examples with the highest contribution ratio of the sub-generator containing the spatial attention module as the optimal adversarial examples, and record the corresponding generation strategies, including the attention mechanism type, core hyperparameters, and training parameters.

Images