Ciphertext classification model anti-attack method introducing error correction codes

Abstract

The invention provides a ciphertext classification model anti-attack method introducing error correction codes. The method comprises the following steps: performing redundant information addition processing on original ciphertext data through an ECC (Error Correction Code) scheme; inputting the current adversarial sample into the target ciphertext classification model for forward propagation, and then calculating a model output result and a loss value of a real encryption algorithm label; solving the embedding gradient of the loss value relative to the current adversarial sample through back propagation; combining gradient income, cost and ECC residual error correction quota to construct a comprehensive evaluation index, and screening an optimal character for replacement to generate a candidate confrontation sample; the disturbance amplitude of the candidate adversarial sample is verified through the Hamming distance, and if the disturbance amplitude exceeds the maximum ECC error correction capability, discrete ECC safety projection is executed for constraint, and a new adversarial sample is obtained; and the confrontation sample with successful deception model is verified at the receiving end. According to the method, the integrity and the concealment of communication data are kept while the attack is effectively resisted.

Description

Technical Field

[0001] This invention relates to the technical field of deep learning security, and in particular to a method for adversarial attacks on encrypted classification models. Background Technology

[0002] With the rapid development of deep learning technology, neural network models have achieved significant breakthroughs in the field of cybersecurity, particularly in cryptanalysis and ciphertext recognition. Research shows that deep learning models, such as Convolutional Neural Networks (CNNs) or Long Short-Term Memory Networks (LSTMs), can learn from massive amounts of ciphertext data to execute "ciphertext-only attacks" with high precision, that is, to determine the encryption algorithm (e.g., AES, DES, RC4, etc.) or encryption mode used to generate specific ciphertext. This capability has significant application value in traffic analysis, network surveillance, and security auditing.

[0003] However, as in the image or speech domains, these deep learning models for ciphertext classification also exhibit significant vulnerabilities. Research has found that they are highly susceptible to attacks using "adversarial examples." Adversarial examples are attacks in which attackers deliberately insert carefully designed, usually small, perturbations into the original input (i.e., the original ciphertext), causing the model to output incorrect predictions.

[0004] Currently, white-box attacks are a common and effective method in the field of adversarial example generation, such as the Fast Gradient Sign Method (FGSM), the Basic Iterative Method (BIM), or Projected Gradient Descent (PGD). These methods assume that the attacker has complete knowledge of the target model (such as its structure and parameters) and generate perturbations by calculating the gradient of the loss function with respect to the input, in order to maximize the model's classification error.

[0005] While the aforementioned methods are effective at causing models to misclassify, their direct application to ciphertext attack scenarios presents a significant and unresolved limitation: the adversarial perturbations generated are permanent and destructive. Originally designed for image and speech scenarios, where minor noise does not affect normal image or speech recognition, ciphertext's core purpose is to transmit decryptable information. Even changing a single bit can render the ciphertext completely invalid. In other words, modifications made by attackers to the ciphertext to deceive AI classification models, such as flipping certain bits, directly compromise the integrity of the original ciphertext. This means that although the adversarial example successfully deceives the AI ​​model, such as a network security detection system, the legitimate receiver of the ciphertext will be unable to recover the original plaintext information through normal decryption. This "mutually assured destruction" attack is unacceptable in many real-world scenarios where maintaining communication channel integrity while achieving covert deception is crucial (such as Advanced Persistent Threat (APT) attacks).

[0006] In summary, current adversarial attack techniques targeting ciphertext classification models generally suffer from the problem of disrupting the integrity of the ciphertext, making it difficult to meet the dual requirements of covert attacks and lossless communication in real-world network security scenarios. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention proposes an adversarial attack method for ciphertext classification models that incorporates error-correcting coding. By performing ECC encoding on the ciphertext, the redundant space of the error-correcting coding is used as a carrier for adversarial perturbations, providing a recoverable basis for the ciphertext. This method not only focuses on gradient gains but also emphasizes perturbation efficiency, avoiding inefficient perturbation waste. Based on the perturbation gain / cost ratio and the ECC remaining quota penalty factor, the optimal character is selected as the perturbation replacement. Furthermore, the adversarial perturbation is constrained within the error-correcting capability of the error-correcting code (ECC) through ECC secure projection, achieving effective adversarial attacks while maintaining the integrity and concealment of the communication data.

[0008] To achieve the above objectives, the technical solution of the present invention is implemented as follows:

[0009] A method for adversarial attacks on ciphertext classification models that incorporates error-correcting coding, comprising the following steps:

[0010] S1: Receive the original ciphertext data and the corresponding real encryption algorithm tag;

[0011] S2: Select an ECC scheme and set its maximum error correction capability parameter. Use the ECC scheme to add redundant information to the original ciphertext data to obtain the encoded ciphertext, which is then used as the initial adversarial sample.

[0012] S3: After forward propagating the current adversarial sample into the target ciphertext classification model, calculate the loss value between the model output and the real encryption algorithm label;

[0013] S4: Solve the embedding gradient of the loss value with respect to the current adversarial sample through backpropagation to characterize the sensitivity of the target ciphertext classification model to characters at different positions;

[0014] S5: Combine gradient benefits, costs and remaining ECC error correction quota to construct a comprehensive evaluation index, select the optimal character to replace and generate candidate adversarial samples;

[0015] S6: Verify the perturbation amplitude of the candidate adversarial sample using Hamming distance. If the perturbation amplitude exceeds the maximum error correction capability of ECC, perform discrete ECC secure projection to constrain it and obtain a new adversarial sample.

[0016] S7: Repeat S3 to S6 for iteration until the stopping condition is met, output the adversarial sample of the deception model, and use the adversarial sample of the deception model to verify at the receiving end. After the decoding is valid, the final adversarial sample is obtained.

[0017] Furthermore, the ECC scheme includes any one or more combinations of Hamming codes, BCH codes, Reed-Solomon codes, low-density parity-check codes, or Turbo codes.

[0018] Furthermore, the target ciphertext classification model is any deep learning model based on gradient optimization.

[0019] Furthermore, the gradient-based deep learning model can be any one of the following: feedforward neural network, Naive Bayes, random forest, long short-term memory network, or Transformer model.

[0020] Furthermore, the loss function used when calculating the loss value between the model output and the real encryption algorithm label includes one or more combinations of cross-entropy loss function, mean squared error, KL divergence, or Hinge.

[0021] Furthermore, a comprehensive evaluation index is constructed by combining gradient benefits, costs, and the remaining ECC error correction capacity, including:

[0022] S41: Select a set of candidate characters and calculate the gradient gain based on the embedding gradient of the loss value relative to the current adversarial sample;

[0023] S42: Calculate the perturbation benefit-cost ratio based on gradient benefit;

[0024] S43: Calculate the penalty factor for the remaining ECC error correction quota based on the current number of disturbances;

[0025] S44: Calculate the overall score based on the ratio of the disturbance benefit cost ratio to the ECC remaining error correction quota penalty factor.

[0026] Furthermore, the gradient gain is calculated, including calculating the loss improvement brought by replacing the character at position i with the character j for all positions i and all candidate characters j in the current adversarial example, as a character pair. Corresponding gradient benefits:

[0027] ;

[0028] in, For character pairs The corresponding gradient benefit, Let j be the embedding vector of candidate character j. Let T be the embedding vector of the character at position i in the current adversarial sample, and let T denote the transpose. Gradient The i-th element.

[0029] Furthermore, the perturbation benefit-cost ratio is calculated based on gradient benefits, including:

[0030] Positional importance weights are determined by codeword field type and protocol / format sensitive fields. ;

[0031] Calculate the replacement magnitude metric: When ECC is expressed in bits of error correction, the replacement magnitude metric is represented by binary Hamming distance. When ECC uses symbol correction as the unit, different symbols are substituted. Recorded as 1, with identical symbols replaced. Recorded as 0;

[0032] Calculate the benefit-cost ratio of the disturbance:

[0033] ;

[0034] in, , which represents the cost of replacement.

[0035] Furthermore, the method for calculating the remaining ECC error correction penalty factor based on the current number of disturbances is as follows:

[0036] ;

[0037] in, This is the penalty factor for the remaining error correction quota. The penalty intensity adjustment parameter, To avoid the minimum value where the denominator is zero; This is the remaining error correction quota. This represents the current number of disturbances.

[0038] Furthermore, the perturbation amplitude of the candidate adversarial examples is verified using Hamming distance. If the perturbation amplitude exceeds the maximum error correction capability of ECC, discrete ECC secure projection is performed for constraint, resulting in new adversarial examples, including:

[0039] S61: Calculate candidate adversarial examples With the encoded ciphertext Hamming distance between To characterize the resistance to disturbance;

[0040] S62: Enforce the following constraints:

[0041] If candidate adversarial examples With the encoded ciphertext Hamming distance between If the current character is not found, then the replacement will be accepted.

[0042] If candidate adversarial examples With the encoded ciphertext Hamming distance between Then, perform discrete ECC secure projection: sort all executed replacements from high to low according to the comprehensive score, retain only the first t replacements, and cancel the remaining replacements to obtain new adversarial examples.

[0043] The beneficial effects of this invention are as follows:

[0044] This invention uses ECC encoding on the ciphertext, employing the redundancy space of the error-correcting code as a carrier to counteract disturbances, thus providing a recoverable foundation for the ciphertext. Based on the disturbance benefit / cost ratio and the ECC remaining quota penalty factor, the optimal character is selected as the disturbance for replacement. At the same time, it suppresses high-cost replacements that still occur when approaching the maximum error correction capability t, achieving preliminary constraints against disturbances. Furthermore, through ECC secure projection, the disturbances are constrained within the error correction capability of the error-correcting code (ECC), further constraining the disturbances and achieving effective counterattacks while maintaining the integrity and concealment of the communication data. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 Flowchart of the ciphertext classification model adversarial attack method introduced in this invention using error correction coding

[0047] Figure 2 A schematic diagram illustrating the constraint of ECC error correction capability on the resistance to disturbances in this invention. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] An adversarial attack method for ciphertext classification models that incorporate error-correcting coding, such as Figure 1 As shown, the steps include:

[0050] S1: Receive the original ciphertext data and the corresponding real encryption algorithm tag.

[0051] In this embodiment of the application, in a typical ciphertext classification scenario, the original ciphertext data x is a binary sequence (e.g., one or more data blocks) representing ciphertext generated by a specific encryption algorithm (such as AES, DES, etc.). The real encryption algorithm label y is the real category corresponding to the ciphertext, such as label "0" for AES and label "1" for DES.

[0052] S2: Select an error correction coding (ECC) scheme and set its maximum error correction capability parameter. Add redundant information to the original ciphertext data using the ECC scheme to obtain the encoded ciphertext, which is then used as the initial adversarial sample.

[0053] In this embodiment of the application, the original ciphertext data x is input into a pre-selected error correction encoder. The error correction encoder. The ECC scheme is pre-shared and agreed upon by the attacker (sender) and the legitimate receiver (receiver). This ECC scheme includes, but is not limited to, Hamming codes, BCH codes, and LDPC codes. This ECC scheme has a core parameter, the maximum error correction capability *t*, which defines the maximum number of erroneous bits (or symbols) that the ECC scheme can automatically detect and correct. Encoder Encode the original ciphertext data x, for example, by adding parity bits or other redundant information, to generate a longer encoded ciphertext that contains redundant information. This encoded ciphertext This will serve as the benchmark and central point for all subsequent adversarial attack steps.

[0054] S3: After forward propagating the current adversarial sample into the target ciphertext classification model, calculate the loss value between the model output and the real encryption algorithm label.

[0055] This invention applies to any white-box model based on gradient optimization, meaning that an attacker can have complete access to the model's structure, parameters, and gradient information. Target encrypted text classification models include, but are not limited to, multilayer perceptrons (MLP), convolutional neural networks (CNN), recurrent neural networks (RNN), or long short-term memory networks (LSTM).

[0056] In this embodiment of the application, firstly, the encoded ciphertext... As the initial input for the iterative attack, i.e., the current adversarial sample k is the current iteration number, and the target ciphertext classification model receives the current adversarial example. Then, forward propagation is performed first. Taking a multilayer perceptron (MLP) as an example, the current adversarial example... After passing through the various layers of the neural network, including the input layer, hidden layers, and output layer, a target ciphertext classification model is generated to handle the input adversarial example. Prediction results This prediction result is typically a probability distribution, representing the model's confidence level in classifying the ciphertext as belonging to each encryption algorithm category.

[0057] Furthermore, the model's prediction results are measured using a loss function. With real encryption algorithm tags The difference between the two is quantified by the loss function, which quantifies the degree of error in the model's prediction. In encrypted text classification tasks, the cross-entropy loss function is typically used. Of course, the choice of loss function in this invention is not limited to this; other loss functions can be flexibly selected according to the specific attack target, including but not limited to one or more combinations of mean squared error (MSE), KL divergence, or Hinge.

[0058] S4: Solve the embedding gradient of the loss value with respect to the current adversarial sample through backpropagation to characterize the sensitivity of the target ciphertext classification model to characters at different positions.

[0059] In this embodiment of the application, the loss value is calculated using a loss function. Then, the loss is calculated using the backpropagation algorithm. relative to input adversarial examples Embedded gradient :

[0060] ;

[0061] in, Denotes the gradient operator, indicating the expression for... Find the partial derivative. This represents the embedding operation. The gradient... It is an adversarial example against the input. A vector of the same dimension indicates the direction in which the input data should be modified to maximize the growth of the loss function L. In adversarial attacks, the goal is to increase the loss and cause the model to make misjudgments.

[0062] S5: Combine gradient benefits, costs, and remaining ECC error correction quota to construct a comprehensive evaluation index, select the optimal character for replacement to generate candidate adversarial samples.

[0063] In this embodiment of the application, when obtaining the gradient Subsequently, this invention no longer adopts the continuous perturbation accumulation method of traditional PGD. Instead, it calculates the loss improvement brought by each character replacement based on gradient calculation, i.e., gradient gain, and calculates the perturbation gain-cost ratio of each character replacement. Based on the perturbation gain-cost ratio and the ECC remaining error correction quota penalty factor, a comprehensive score is constructed to select the character with the highest score for replacement.

[0064] Specifically, firstly, a candidate character set is selected to analyze adversarial examples. Calculate the gradient gain for all positions i and all candidate characters j:

[0065] ;

[0066] in, Gradient gain is used to measure the improvement in loss that can be achieved by replacing the character at position i with the character j. The larger the value, the stronger the misleading effect. Let j be the embedding vector of candidate character j. Let T be the embedding vector of the character at position i, and let T denote the transpose. Gradient The i-th element.

[0067] Focusing solely on gradient gains may lead to situations where one character replacement offers slightly higher gradient gains but requires a large amount of perturbation, while another replacement offers slightly lower gradient gains but incurs minimal costs. This results in low cost-effectiveness and may require more iterations to find the most suitable alternative, wasting computational resources and reducing perturbation efficiency. Therefore, this invention addresses this issue by introducing a perturbation gain-cost ratio.

[0068] Furthermore, the perturbation benefit-cost ratio is calculated based on gradient benefits:

[0069] ;

[0070] in, The perturbation benefit-cost ratio is used to measure the misleading effect of a unit cost. To position Replace the character with a candidate character The resulting gradient benefits.

[0071] To avoid situations where all replacement costs are the same, resulting in the item having no impact on the selection, this invention calculates the character replacement cost. Designed with a non-uniform cost that is related to the importance of the ciphertext location and the magnitude of the replacement:

[0072] ;

[0073] in, For position Importance weights (with greater weight given to important positions) are used to characterize the impact of character changes at that position on data integrity, protocol suspicion, or ECC decoding difficulty. To replace the amplitude measurement, used to characterize the original character Replace with The actual magnitude of the introduced disturbance.

[0074] In one implementation, when ECC is implemented in bits for error correction, the following approach can be taken:

[0075] ;

[0076] That is, the number of bit flips caused by the substitution is represented by the binary Hamming distance; when ECC uses symbol error correction as the unit (such as RS code), it can be taken as... The substitution of different symbols is recorded as 1.

[0077] in, For position The importance weight is used to characterize the impact of character replacement at that position on data integrity, ECC decoding difficulty, and detection risk. To reflect the different replacement costs at different positions, this embodiment uses a fixed rule for... Assignment:

[0078] Rule 1: Assign weights based on codeword field type:

[0079] Information bits (carrying the original encrypted content): ;

[0080] Redundant check bits (used only for error correction): ;

[0081] Rule 2: Assign permissions to sensitive fields based on protocol / format:

[0082] Mode / Frame Header / Fixed Identifier Fields: ;

[0083] Ordinary random field: ;

[0084] When position When multiple rules are satisfied simultaneously, a preset priority can be used to determine the priority. For example, rule 2 should be given priority, or... This ensures that replacing sensitive fields is more costly, thus affecting the replacement selection results after comprehensive scoring.

[0085] Furthermore, calculate the penalty factor for the remaining ECC error correction quota:

[0086] ;

[0087] in, This is a penalty factor for the remaining error correction capacity. The less the remaining capacity, the larger the penalty factor, which suppresses high-cost replacements that still occur when the error correction capacity is close to t. This allows the replacement strategy to automatically adjust with the remaining available perturbations of ECC, thus possessing ECC awareness. The penalty intensity adjustment parameter is manually preset; here it is taken as... , To find the minimum value, avoid the denominator being zero; This represents the remaining number of perturbations, i.e., the remaining error correction allowance. This represents the current number of disturbances.

[0088] Furthermore, a comprehensive score is calculated based on the ECC remaining error correction quota penalty factor and the perturbation benefit-cost ratio:

[0089] ;

[0090] in, The final selection metric is chosen to comprehensively score the attack gains, disturbance costs, and ECC constraints.

[0091] Further, select highest character pair Replace the samples to obtain candidate adversarial examples. .

[0092] S6: Verify the perturbation amplitude of the candidate adversarial sample using Hamming distance. If the perturbation amplitude exceeds the maximum error correction capability of ECC, perform discrete ECC secure projection to constrain it and obtain a new adversarial sample.

[0093] In this invention, the key constraint is that the newly generated candidate adversarial sample must be ensured. Always located in the ciphertext after encoding Within the error-correctable range. In other words, adversarial perturbations, i.e., candidate adversarial samples. With the encoded ciphertext The magnitude of the difference must always be less than or equal to the maximum error correction capability of the selected ECC scheme. For binary ciphertext data, this invention uses the Hamming distance to measure resistance to perturbations, i.e., the total number of bits that are flipped.

[0094] In this embodiment of the application, in each iteration:

[0095] First, calculate candidate adversarial examples. With the encoded ciphertext Hamming distance between To characterize the resistance to disturbance;

[0096] Furthermore, the following constraints are enforced:

[0097] If candidate adversarial examples With the encoded ciphertext Hamming distance between If the current character is replaced, then the candidate adversarial sample is accepted. It is already Within the range, then directly order ;

[0098] If candidate adversarial examples With the encoded ciphertext Hamming distance between Exceeding the ECC recoverable threshold Then, perform discrete ECC secure projection: sort all executed replacements in descending order of comprehensive score, retain only the top t replacements, and cancel the remaining replacements, so that the final perturbation is strictly limited to the ECC error-correctable range, and obtain new adversarial examples.

[0099] The new adversarial examples generated through the perturbation generation mechanism described above This ensures that it is consistent with the encoded ciphertext. The Hamming distance is exactly This invention dynamically adjusts the perturbation based on the gradient, perturbation cost, and residual ECC error correction capability after each character replacement, and ensures that the final perturbation remains strictly within a recoverable range through discrete spatial projection when necessary. A constraint diagram is shown below. Figure 2 As shown, the perturbation sample x′ needs to perform a minor perturbation on the original sample x within an error correction radius not exceeding t, while simultaneously making it cross the decision boundary of the target encrypted text classification model, thereby achieving misclassification under the error-correctable constraint.

[0100] S7: Repeat S3 to S6 for iteration until the stopping condition is met, output the adversarial sample of the deception model, and use the adversarial sample of the deception model to verify at the receiving end. After the decoding is valid, the final adversarial sample is obtained.

[0101] In this embodiment of the application, new adversarial examples are generated. Then, the algorithm will determine whether the preset stopping conditions are met. The stopping conditions include:

[0102] Reaching the maximum number of iterations: Preventing infinite loops and ensuring the computational efficiency of the algorithm.

[0103] Attack successful: target ciphertext classification model New adversarial examples Prediction results It is no longer a real label y.

[0104] The disturbance has reached its limit: that is Furthermore, it is impossible to further increase the loss without exceeding t.

[0105] If the stopping condition is not met, then let k = k + 1, and add the new adversarial sample. As input for the next iteration, it is re-inputted into the target ciphertext classification model, and steps S3 to S6 above are repeated.

[0106] When adversarial examples successfully deceive the model When sent to a legitimate receiver, the receiver's system first invokes the pre-shared ECC decoder. .because and Hamming distance between , This will counter the disturbance It identifies noise generated during channel transmission and automatically corrects it using its error correction capabilities, perfectly recovering the original, undisturbed code. .

[0107] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for adversarial attacks on ciphertext classification models that incorporates error-correcting coding, characterized in that, Including the following steps: S1: Receive the original ciphertext data and the corresponding real encryption algorithm tag; S2: Select an ECC scheme and set its maximum error correction capability parameter. Use the ECC scheme to add redundant information to the original ciphertext data to obtain the encoded ciphertext, which is then used as the initial adversarial sample. S3: After forward propagating the current adversarial sample into the target ciphertext classification model, calculate the loss value between the model output and the real encryption algorithm label; S4: Solve the embedding gradient of the loss value with respect to the current adversarial sample through backpropagation to characterize the sensitivity of the target ciphertext classification model to characters at different positions; S5: Combine gradient benefits, costs and remaining ECC error correction quota to construct a comprehensive evaluation index, select the optimal character to replace and generate candidate adversarial samples; S6: Verify the perturbation amplitude of the candidate adversarial sample using Hamming distance. If the perturbation amplitude exceeds the maximum error correction capability of ECC, perform discrete ECC secure projection to constrain it and obtain a new adversarial sample. S7: Repeat S3 to S6 for iteration until the stopping condition is met, output the adversarial sample of the deception model, and use the adversarial sample of the deception model to verify at the receiving end. After the decoding is valid, the final adversarial sample is obtained.

2. The method for adversarial attacks on ciphertext classification models by introducing error correction coding as described in claim 1, characterized in that, The ECC scheme includes any one or more combinations of Hamming codes, BCH codes, Reed-Solomon codes, low-density parity-check codes, or Turbo codes.

3. The method for adversarial attacks on ciphertext classification models by introducing error correction coding according to claim 2, characterized in that, The target ciphertext classification model is any deep learning model based on gradient optimization.

4. The method for adversarial attacks on ciphertext classification models by introducing error-correcting coding according to any one of claims 1-3, characterized in that, The gradient-based deep learning model can be any one of the following: feedforward neural network, Naive Bayes, random forest, long short-term memory network, or Transformer model.

5. The method for adversarial attacks on ciphertext classification models by introducing error-correcting coding according to claim 4, characterized in that, The loss function used when calculating the loss value between the model output and the real encryption algorithm label includes one or more combinations of cross-entropy loss function, mean squared error, KL divergence, or Hinge.

6. The method for adversarial attacks on ciphertext classification models by introducing error correction coding according to claim 5, characterized in that, A comprehensive evaluation index is constructed by combining gradient benefits, costs, and the remaining ECC error correction capacity, including: S41: Select a set of candidate characters and calculate the gradient gain based on the embedding gradient of the loss value relative to the current adversarial sample; S42: Calculate the perturbation benefit-cost ratio based on gradient benefit; S43: Calculate the penalty factor for the remaining ECC error correction quota based on the current number of disturbances; S44: Calculate the overall score based on the ratio of the disturbance benefit cost ratio to the ECC remaining error correction quota penalty factor.

7. The method for adversarial attacks on ciphertext classification models by introducing error-correcting coding according to claim 6, characterized in that, Calculate the gradient gain, which includes calculating the loss improvement achieved by replacing the character at position i with the character at position j for all positions i and all candidate characters j in the current adversarial example, as a character pair. Corresponding gradient benefits: ； in, For character pairs The corresponding gradient benefit, Let j be the embedding vector of candidate character j. Let T be the embedding vector of the character at position i in the current adversarial sample, and let T denote the transpose. Gradient The i-th element.

8. The method for adversarial attacks on ciphertext classification models by introducing error correction coding according to claim 7, characterized in that, The perturbation benefit-cost ratio is calculated based on gradient benefit, including: Positional importance weights are determined by codeword field type and protocol / format sensitive fields. ; Calculate the replacement magnitude metric: When ECC is expressed in bits of error correction, the replacement magnitude metric is represented by binary Hamming distance. When ECC uses symbol correction as the unit, different symbols are substituted. Recorded as 1, with identical symbols replaced. Recorded as 0; Calculate the benefit-cost ratio of the disturbance: ； in, , which represents the cost of replacement.

9. The method for adversarial attacks on ciphertext classification models by introducing error correction coding as described in claim 8, characterized in that, The method for calculating the penalty factor of the remaining ECC error correction quota based on the current number of disturbances is as follows: ； in, This is the penalty factor for the remaining error correction quota. The penalty intensity adjustment parameter, To avoid the minimum value where the denominator is zero; This is the remaining error correction quota. This represents the current number of disturbances.

10. The method for adversarial attacks on ciphertext classification models by introducing error correction coding according to claim 9, characterized in that, The perturbation magnitude of candidate adversarial examples is verified using Hamming distance. If the perturbation magnitude exceeds the maximum error correction capability of ECC, discrete ECC secure projection is performed for constraint, resulting in new adversarial examples, including: S61: Calculate candidate adversarial examples With the encoded ciphertext Hamming distance between To characterize the resistance to disturbance; S62: Enforce the following constraints: If candidate adversarial examples With the encoded ciphertext Hamming distance between If the current character is not found, then the replacement will be accepted. If candidate adversarial examples With the encoded ciphertext Hamming distance between Then, perform discrete ECC secure projection: sort all executed replacements from high to low according to the comprehensive score, retain only the first t replacements, and cancel the remaining replacements to obtain new adversarial examples.

Images