Black box anti-attack method based on proxy function optimization and feature probability diffusion

Abstract

The invention belongs to the technical field of black-box confrontation attacks, discloses a black-box confrontation attack method based on proxy function optimization and feature probability diffusion, and aims to solve the problems that traditional evading attacks cannot disturb a network intrusion detection system based on machine learning and the number of black-box confrontation sample attack query times is large. In order to solve the problems of large calculation overhead, universality of adversarial samples and the like, a method for generating the adversarial samples by combining the adversarial samples, reinforcement learning and a diffusion model is designed, an indirect optimization framework is realized, and a trainable neural network is introduced for generating adversarial disturbance. Through back propagation of the proxy loss function J, parameters of the neural network can be indirectly updated. According to the mechanism, an unguidable black box optimization problem is ingeniously converted into a trainable and end-to-end neural network optimization problem, so that indirect optimization against disturbance is realized.

Description

Technical Field

[0001] This invention belongs to the field of black-box adversarial attack technology, and particularly relates to a black-box adversarial attack method based on proxy function optimization and feature probability diffusion. Background Technology

[0002] In recent years, Artificial Intelligence (AI) has developed rapidly and has become an important pillar of the digital economy. With increasing integration and automation, more and more companies are adopting AI tools to improve work efficiency. Despite its many benefits, deep learning suffers from inherent limitations such as difficulty in interpretability and unpredictability in its algorithms or models. Therefore, security vulnerabilities arising from these inherent flaws in AI systems—such as adversarial attacks, model backdoor attacks, and data poisoning attacks—can pose a serious threat to AI systems.

[0003] In the era of network communication, network traffic is a crucial means of communication. Attackers can exploit malicious traffic to access hosts, conduct malicious activities, and cause significant economic losses. Currently, traditional malicious traffic attacks involve carefully crafting data packets to bypass intrusion detectors by exploiting code vulnerabilities. This attack method is known as evasion attack; however, traditional evasion attack methods are largely ineffective against today's deep learning-based intrusion detection systems.

[0004] Adversarial attacks against machine learning-based network intrusion detection systems have become a new focus of cybersecurity. Currently, the mainstream attack methods are categorized into three types: feature space-based attacks, packet space-based attacks, and flow space-based attacks. While packet and flow space-based attacks can directly modify the content of network traffic packets, these attacks cannot guarantee the communication and malicious functions of the modified packets. Furthermore, because flow- or packet-based intrusion detection systems handle millions of packets and terabytes of data streams, they suffer from high overhead and low detection efficiency. Therefore, most commercially available systems on the market today are feature space-based intrusion detection systems.

[0005] Adversarial attacks are categorized into white-box and black-box attacks based on the attack environment. White-box attacks require all knowledge of the target classifier, lacking practicality and only suitable for theoretical research. Black-box attack algorithms are divided into transfer learning-based attacks and query-based attacks. Transfer learning-based attacks rely on constructing a substitute model with similar decision boundaries to the target model. Adversarial attacks are then performed on the substitute model, leveraging the transferability of adversarial examples to attack the target model. This type of attack depends on the similarity between models, cannot solve the challenge of cross-architecture transfer, and requires identically distributed training data, which is difficult to obtain. Query-based black-box attack algorithms involve numerous queries, high computational complexity, and reliance on gradient estimation. With a low number of queries, their convergence speed is slow, even slower than transfer learning attacks.

[0006] Based on the above analysis, the problems and shortcomings of the existing technology are as follows: (1) In actual projects, most intrusion detection systems are based on feature space. Traditional attack avoidance is inefficient and easily detected.

[0007] (2) Adversarial attacks based on data packets and data streams require processing large amounts of data. Most commercially available detection systems are now feature-space-based intrusion detection systems. Attacks targeting data packets and data streams are essentially similar to traditional evasion attacks and are easily identified by feature-space-based intrusion detection systems.

[0008] (3) Adversarial attacks based on transfer learning rely on the construction of alternative models, which requires obtaining training data with the same distribution. Query-based black-box attacks involve too many queries, and the high computational complexity and slow convergence speed are mostly due to gradient estimation algorithms. Summary of the Invention

[0009] To address the problems existing in the prior art, this invention provides a black-box adversarial attack method based on proxy function optimization and feature probability diffusion.

[0010] This invention is implemented as follows: a black-box adversarial attack method based on proxy function optimization and feature probability diffusion includes: Step 1: Initialize traffic features to obtain the processed traffic feature dataset; Step 2: Remove duplicate data and highly relevant features, and perform manual dimensionality reduction; Step 3: Initialize the black-box attack environment using the training dataset and the trained classifier; Step 4: Establish the black-box adversarial attack target function and set the optimization target based on the proxy function; Step 5: Establish a reinforcement learning algorithm model based on the black-box attack environment, and initialize the policy network, value network, and perturbation generation function for adversarial attacks; Step 6: Based on the training algorithm and the proxy loss function, train the reinforcement learning algorithm model using a black-box attack environment; Step 7: Adjust the model parameters and perform batch training and testing; Step 8: Use metrics to evaluate the model and compare its merits with those of previous algorithms.

[0011] Furthermore, in step three, the method for initializing the black-box environment mainly includes: Define the state space and action space; Map the original sample to the initial state of the adversarial sample. .

[0012] Furthermore, in step four, the black-box adversarial attack objective function is established by setting confidence and similarity constraints on adversarial samples to obtain a basic objective function G. To reduce the number of queries, a time variable T is introduced, and the objective function G is optimized using a self-updating method to obtain the objective function R. After obtaining the objective function R, a proxy loss function J is introduced to transform the feedback of the objective function R into an optimizable gradient signal, thereby updating the parameters of the perturbation generation function and achieving indirect optimization of the adversarial perturbation.

[0013] Furthermore, in step five, the value network and policy network are initialized based on the state space S and action space A; the policy network receives adversarial examples output by the environment and generates parameters that conform to the perturbation distribution; then, the perturbation generation function samples the corresponding perturbation based on the distribution of these two parameters. The perturbation is input into the state transition function of the black-box environment, along with adversarial examples. Obtain the adversarial sample for the next time step ; In a reinforcement learning agent, a state buffer stores the state tuples for each state, up to the final state. When a state sequence reaches its final state, the agent updates the parameters of the value network and policy network through gradient descent of the surrogate loss function J, thereby indirectly realizing the perturbation vector. Iterative updates; A Gaussian distribution is used to model the perturbation vector in the perturbation generation function; the policy network takes the state s as input, and after passing through the front-end encoder, outputs two parameters with the same dimension as the perturbation space: the mean vector. and standard deviation vector The two parameters correspond to the expectation and variance of a Gaussian distribution, respectively, thus modeling an independent probability distribution for each feature dimension; then, the distribution is reparameterized and sampled to obtain the perturbation. .

[0014] Furthermore, the agent loss function J, policy network, and value network are all set as parameters of the PPO algorithm.

[0015] Furthermore, a general perturbation based on feature probability diffusion is constructed, wherein the general perturbation based on feature probability diffusion includes: Based on the generated perturbation dataset, embedding time, noise, and conditions, a denoising neural network is trained using a feature probability diffusion model to predict the noise at t time steps; Inputting normally distributed noise, the system uses a feature probability diffusion model to output a general adversarial perturbation that integrates various perturbation features from the perturbation dataset. Through the forward process of the diffusion model, the adversarial sample dataset is subjected to T rounds of noise addition to generate noise samples that conform to a standard normal distribution. In the reverse process, a denoising neural network is trained to predict noise. The inverse operation of adding noise follows a normal distribution, and the noise at time t can be obtained by training the neural network to predict the mean and variance. Embedding conditions in the denoising neural network enables the deception rate of the general perturbation generated based on the feature probability diffusion model sampling to meet the requirements; Input adversarial examples into the black-box model If the misclassification rate of the general perturbation does not meet the requirements, the conditions in step eight are updated to increase the degree of constraint and guide the denoising neural network to approximate a stronger black-box adversarial attack general perturbation.

[0016] Another objective of this invention is to provide a black-box adversarial attack system based on proxy function optimization and feature probability diffusion, comprising: The feature initialization module is used to initialize traffic features and obtain the processed traffic feature dataset. The deduplication module is used to remove duplicate data and highly relevant features, performing manual dimensionality reduction. The environment initialization module is used to initialize the black-box attack environment using the training dataset and the trained classifier. A module is established to create a black-box attack target function and a proxy loss function to indirectly optimize the target function. The generator function module is used to build reinforcement learning algorithm models based on black-box attack environments and initialize policy networks, value networks, and perturbation generator functions. The training module is used to train reinforcement learning algorithm models in a black-box attack environment based on the training algorithm and the proxy loss function. The testing module is used to adjust model parameters and perform batch training and testing. The comparison module is used to evaluate the model using metrics and compare the merits of this black-box adversarial attack system with those of previous algorithms.

[0017] Another object of the present invention is to provide a computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the black-box adversarial attack method based on proxy function optimization and feature probability diffusion.

[0018] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the black-box adversarial attack method based on proxy function optimization and feature probability diffusion.

[0019] Another objective of this invention is to provide an information data processing terminal for implementing the black-box adversarial attack system based on proxy function optimization and feature probability diffusion.

[0020] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows: This invention addresses the limitations of traditional evasion attacks in bypassing machine learning-based network intrusion detection systems, as well as the problems of high query counts, computational overhead, and generalizability of existing black-box adversarial attacks. It proposes a method to generate adversarial examples by combining adversarial examples, reinforcement learning, and a diffusion model, implementing an indirect optimization framework. This framework introduces a trainable neural network to generate adversarial perturbations. To transform the feedback from the black-box objective function R into a differentiable optimization signal, a proxy loss function J is used. Specifically, after the adversarial example is input into the objective function R, its output evaluation result is received by the proxy loss function J. The proxy loss function J is designed to be differentiable and aims to maximize the "negative feedback" from R. Backpropagation is performed using the proxy loss function J, and the updated neural network generates adversarial perturbations. This mechanism cleverly transforms a non-differentiable black-box optimization problem into a trainable, end-to-end neural network optimization problem, thereby achieving indirect optimization of the objective function for the adversarial perturbations. Furthermore, the diffusion model essentially adds noise and then removes it, while the small perturbations added in adversarial attacks are essentially a special type of noise; therefore, the two share similar characteristics. This diffusion model conforms to the rules of adversarial attacks, enabling the fusion of different types of adversarial perturbation characteristics to generate a universal perturbation. The idea behind generating a universal perturbation based on the diffusion model is to combine several sets of local perturbations obtained for different samples or different attack methods. Treating the observed noise samples as examples, the diffusion model learns a perturbation distribution in the perturbation space that covers the statistical characteristics of the intersection region through alternating diffusion and anti-diffusion processes. From a probabilistic modeling perspective, the diffusion model approximates the target perturbation distribution through maximum likelihood or variational optimization. Thus, the perturbations generated on the sample batch. It can retain the important features of misclassification caused by the original local perturbation and has a certain generalization ability, so that the same general perturbation can produce a high probability of misclassification for different samples.

[0021] This invention significantly reduces the number of queries during the attack process, avoids gradient estimation, and lowers computational overhead. Feature space-based adversarial attacks save resources and are suitable for practical engineering applications.

[0022] The technical solution of this invention fills a technological gap in the industry both domestically and internationally: (black box query attack on traffic). (1) This invention fills the technical gap in black-box query attacks and dynamic interaction attacks based on traffic. Due to the relatively continuous and regular feature spaces of images and text, image-based adversarial attack methods only need to consider the constraints of the feature space. However, traffic data has stronger structure, protocol semantic constraints, and semantic coupling. In order to speed up the detection, feature-based NIDS has been designed. The feature extractor operates on data packets in units of traffic flow to extract the basic five-tuples of the entire traffic, as well as temporal and spatial features. These features form discrete data features that are input into NIDS for training. The advantage of this detection method is its extremely fast speed and cost savings per unit of traffic. In the era of big data, traffic data packets are getting larger and larger. Network traffic analysis based on data packets is inefficient and slow in detection speed. Therefore, network traffic analysis systems based on traffic feature space are very popular. However, there is an irreversible problem with the features of traffic and the traffic data packets themselves. The statistical features of traffic are different from those of images, which can be freely transformed in the feature space. Traffic data has its own structure, while statistical features are calculated based on mathematical formulas in the feature extractor. Therefore, for attackers, it is necessary to restrict the legitimacy of the input space. Adversarial attacks must construct perturbations that conform to network protocol specifications, and their feature values ​​must remain within a reasonable range in a real network environment; otherwise, they are easily filtered out by traffic collectors or feature extraction modules. Furthermore, the attack semantics must remain consistent throughout the perturbation process, meaning the key characteristics of the attack behavior cannot be altered. In summary, adversarial attacks targeting NIDS have numerous limitations.

[0023] To meet these constraints, adversarial attack techniques targeting NIDS are mostly white-box attacks. While black-box attacks also exist, they are primarily migration attacks. The technical solution of this invention uses constraint functions to limit the magnitude of traffic perturbations, thus satisfying the malice and availability constraints of traffic while ensuring the credibility and stealth of the perturbations. Furthermore, traffic data is discrete, resulting in discrete feedback values ​​from query-based black-box attacks, which can fluctuate significantly. Using mathematical estimation to obtain gradient values ​​and then backpropagating these gradient values ​​to optimize the perturbations leads to unstable attack effects. This invention uses a surrogate function J to update the neural network, thereby generating perturbations and indirectly optimizing the objective function R for the perturbations. In the surrogate function J and the perturbation generation function, this invention uses a ratio-optimized update method to ensure that the exploration of unknown regions utilizes good parameters, achieving a balance between exploration and utilization. Simultaneously, the perturbation vector is modeled using a Gaussian distribution by the neural network, and a perturbation value is obtained through reparameterization sampling. This utilization method enables exploration-balanced utilization in a discrete action space. If perturbations are generated directly by the network, the model may get stuck in local optima and struggle to fully explore complex, high-dimensional spaces. However, by sampling from a parameterized distribution, the neural network strategy can maintain the distribution center. While approaching the optimal solution, utilize variance Random exploration within the neighborhood improves the robustness and generalization of neural network strategies in black-box optimization and adversarial example generation tasks.

[0024] Previous query-based black-box attacks mostly relied on mathematical estimation. However, as mentioned above, due to the discrete nature of traffic data, attacks applicable to continuous features like images and text cannot be easily transferred to traffic data. This leads to unstable attack effects and a high number of queries on feature-based NIDS, which is inconsistent with real-world black-box environments. The dynamic interactive attack method used in this invention emphasizes dynamic perturbation or online updates of traffic in a real-time environment, achieving a flexible and efficient attack strategy. This attack method can achieve highly efficient adversarial attacks with minimal query counts.

[0025] This invention establishes a novel optimization relationship. Existing adversarial attacks generally satisfy a direct binary optimization relationship: an objective function and a perturbation. In this paradigm, perturbation data is treated as an optimizable parameter, input into the objective function for evaluation, and the objective function uses gradients or gradient estimation methods to iteratively update the perturbation data. However, this invention proposes a novel paradigm that inputs the feedback value of the objective function R into a surrogate loss function J, using the surrogate loss function J to update the neural network parameters in the direction of maximizing the feedback value of the objective function, thereby dynamically generating perturbations and realizing a quaternary indirect optimization framework.

[0026] (2) Whether the technical solution of the present invention solves the technical problem that people have been eager to solve but have never been able to succeed in, and solves the strategy of reducing the number of queries by mathematically estimating the gradient and statically initializing the perturbation.

[0027] Most existing algorithms focus on optimizing the objective function, with limited research on generating perturbation values. Traditional initialization methods typically set the perturbation value to all zeros, a minimum value, or use random noise. These static initialization strategies can lead to slow convergence or getting stuck in local optima, thus limiting the efficiency and robustness of attacks. Inspired by this, this invention uses a neural network to dynamically generate adversarial perturbations. Because adversarial perturbations are generated using a neural network, the trained neural network can be used directly online. Other black-box attack algorithms require gradient estimation for each attack and use the gradient value for the attack. This approach results in high computational cost and complexity when there are many samples and large amounts of data, making it unsuitable for the real-time requirements of high throughput.

[0028] This invention does not directly generate adversarial perturbations, but instead utilizes a neural network to model the perturbations using a Gaussian distribution. This invention observes that other adversarial attack algorithms statically initialize a perturbation value and then optimize the perturbations in batches through matrix operations. In this invention, a parameterized Gaussian distribution is used to model the perturbation values ​​in the discrete action space. Specifically, the neural network input state... After passing through the front-end encoder, it outputs two parameters that correspond to the dimensions of the perturbation space: the mean vector. and standard deviation vector These two parameters correspond to Gaussian distributions. The expected value and variance are used to define an independent probability distribution for each feature dimension.

[0029] During the sampling process, firstly by and Construct a distribution, and then obtain the perturbation from this distribution through reparameterized sampling. The disturbance then passed through The scaling factor is constrained within a certain range to ensure its amplitude is controllable. Since the perturbation strictly corresponds to the dimension of the sample, meaning each input feature value corresponds to a perturbation component, the generated... and The shape and size of the perturbation are consistent with the input sample. This means that for each dimension of the input feature, the policy network can provide an adaptive probability distribution, thereby ensuring that the perturbation matches the sample shape.

[0030] Unlike deterministic perturbations directly output by a neural network, modeling using a Gaussian distribution offers the advantage of achieving an exploration-exploitation balance in a continuous action space. If perturbations are generated directly by the network, the model may get trapped in local optima, making it difficult to fully explore complex, high-dimensional spaces. By sampling from a parameterized distribution, the policy can maintain the distribution center. While approaching the optimal solution, utilize variance Random exploration within the neighborhood improves the robustness and generalization of the strategy in black-box optimization and adversarial example generation tasks.

[0031] This invention defines a framework for indirectly optimizing perturbations. Research has found that most binary optimization paradigms are unsuitable for updating discrete data like traffic flow because mathematical estimation relies heavily on hyperparameter settings and is prone to getting stuck in local optima or slow convergence. The volatility of discrete data also easily leads to poor attack performance. The indirect optimization perturbation framework proposed in this invention dynamically generates perturbations by inputting the feedback value of the objective function R into a proxy loss function J. This proxy loss function J updates the neural network parameters in the direction that maximizes the feedback value of the objective function. The ratio update of the proxy loss function and the probability distribution modeling method of the neural network both ensure that the perturbations can achieve exploration and balance in a discrete high-dimensional feature space. To further ensure the stability of neural network training, this invention restricts the ratio update of the proxy loss function J to a fixed region using a clip function, ensuring that the state distributions of the old and new perturbations are very similar. This ensures that the perturbations can monotonically increase attack performance while satisfying the update conditions of function J. In summary, the indirect update framework proposed in this invention not only ensures the stability of neural network training but also guarantees the monotonically increasing attack performance during perturbation updates, thus avoiding the instability of using mathematical estimation methods.

[0032] (3) Whether the technical solution of the present invention overcomes technical bias: This invention proposes a universal perturbation generation method based on feature probability diffusion, overcoming the problems of computational complexity and limited number of generated universal perturbations. This method also utilizes a trained neural network to generate universal perturbations. This technique breaks away from the inherent limitations of previous universal perturbation generation methods, which always iterate using white-box or black-box algorithms until the generated perturbations meet the conditions for universal perturbations. These methods require multiple runs of the attack algorithm each time a universal perturbation is generated until the conditions are met, and multiple perturbation samples can only yield one universal perturbation. To obtain multiple universal perturbations, the universal perturbation generation algorithm needs to be executed multiple times, increasing time and space complexity. Firstly, from a principle perspective, the universal perturbation generation method based on feature probability diffusion proposed in this invention utilizes probability diffusion, through alternating iterative diffusion and de-diffusion processes, to learn a perturbation distribution in the perturbation space that covers the statistical characteristics of the intersection region. In this process, key features causing misclassification due to multiple local perturbations are retained and integrated into the general perturbation, giving them a certain generalization ability. Technically, this method generates the general perturbation by sampling noise from a normal distribution and then using a trained neural network to denoise it, thus obtaining the general adversarial perturbation (UAP). Existing methods, however, can only obtain UAP through iterative attacks, which is inefficient. Furthermore, the method proposed in this invention only requires sampling noise from a normal distribution to obtain multiple general perturbations. Attached Figure Description

[0033] Figure 1 This is a flowchart of a black-box adversarial attack method based on proxy function optimization and feature probability diffusion provided in an embodiment of the present invention.

[0034] Figure 2 This is a block diagram of a black-box adversarial attack system based on proxy function optimization and feature probability diffusion provided in an embodiment of the present invention.

[0035] Figure 3 This is a schematic diagram of the black-box adversarial attack method based on proxy function optimization provided in this embodiment of the invention.

[0036] Figure 4 This is a schematic diagram of the feature probability diffusion principle based on the diffusion model provided in the embodiments of the present invention.

[0037] Figure 5 It is based on the CIC-IDS2017 dataset provided in this embodiment of the invention. Attack success rate (ASR) chart at different distances.

[0038] Figure 6 It is based on the CIC-IDS2017 dataset provided in this embodiment of the invention. Attack success rate (ASR) chart at different distances.

[0039] Figure 7 This is the attack success rate (ASR) graph at L2 distance on the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention.

[0040] Figure 8 It is based on the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention. Attack success rate (ASR) chart at different distances.

[0041] Figure 9 It is based on the CIC-IDS2017 dataset provided in this embodiment of the invention. Success Rate (ASR) chart for various types of malicious traffic attacks based on distance.

[0042] Figure 10 It is based on the CIC-IDS2017 dataset provided in this embodiment of the invention. Success Rate (ASR) chart for various types of malicious traffic attacks based on distance.

[0043] Figure 11 It is based on the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention. Success Rate (ASR) chart for various types of malicious traffic attacks based on distance.

[0044] Figure 12 It is based on the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention. Success Rate (ASR) chart for various types of malicious traffic attacks based on distance.

[0045] Figure 13 It is based on the CIC-IDS2017 dataset provided in this embodiment of the invention. Traffic at different distances is classified using a confidence plot of BENIGN.

[0046] Figure 14 It is based on the CIC-IDS2017 dataset provided in this embodiment of the invention. Traffic at different distances is classified using a confidence plot of BENIGN.

[0047] Figure 15 It is based on the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention. Traffic at different distances is classified using a confidence plot of BENIGN.

[0048] Figure 16 It is based on the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention. Traffic at different distances is classified using a confidence plot of BENIGN.

[0049] Figure 17 It is based on the CIC-IDS2017 dataset provided in this embodiment of the invention. Query count graph based on distance.

[0050] Figure 18 It is based on the CIC-IDS2017 dataset provided in this embodiment of the invention. Query count graph based on distance.

[0051] Figure 19 It is based on the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention. Query count graph based on distance.

[0052] Figure 20 It is based on the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention. Query count graph based on distance.

[0053] Figure 21 It is based on the CIC-IDS2017 dataset and the CSE-CIC-IDS2018 dataset provided in this embodiment of the invention. and Success rate chart for general perturbation attacks at different distances. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0055] like Figure 1 As shown, the black-box adversarial attack method based on proxy function optimization and feature probability diffusion provided by this embodiment of the invention includes the following steps: S101, Initialize traffic features to obtain the processed traffic feature dataset; S102, remove duplicate data and highly relevant features, and perform manual dimensionality reduction; S103, Initialize the black-box attack environment using the training dataset and the trained classifier; S104, Establish the black-box attack target function; S105, Establish a reinforcement learning algorithm model based on the black-box attack environment, and initialize the policy network, value network and perturbation generation function; S106, Based on the training algorithm and the proxy loss function J, train the reinforcement learning algorithm model using a black-box attack environment; S107, adjust model parameters, perform batch training and testing; S108 uses an index evaluation model to compare the merits and demerits of algorithms proposed by predecessors.

[0056] Another object of the present invention is to provide a method for generating universal adversarial perturbations, wherein the universal perturbation generation method based on a diffusion model includes: Based on the generated perturbation dataset, embedding time, noise, and conditions, a denoising neural network is trained using a diffusion model to predict the noise at t time steps; Inputting normally distributed noise, a denoising neural network is used to output a general adversarial perturbation that integrates various perturbation features of the perturbation dataset.

[0057] The black-box adversarial attack method proposed in this invention, based on surrogate function optimization and feature probability diffusion, transforms the discrete feedback of the black-box model into a continuous optimizable signal by constructing a learnable surrogate optimization mechanism, under the premise that the internal structure and parameter information of the attacked model cannot be obtained. Furthermore, it combines probabilistic modeling and diffusion generation mechanism to achieve efficient, stable and generalizable adversarial perturbation generation.

[0058] In the black-box adversarial attack phase, the original traffic features are first initialized, deduplicated, and subjected to correlation constraints to ensure the input feature space meets the basic requirements of controllable adversarial perturbation and semantic consistency. Based on this, a black-box attack environment is constructed using the training dataset and a pre-trained classifier. This environment only feeds back classification results and confidence information to the attacker, without exposing any internal gradient information. Addressing the issue of non-differentiability of black-box attacks, this invention establishes an attack objective function that includes classification confidence constraints and sample similarity constraints, clarifying the optimization direction of the adversarial attack. By introducing a time variable to self-update the objective function, the attack process initially leans towards exploring misclassifications, gradually converging to a low-perturbation region in the later stages, thereby effectively reducing the number of queries.

[0059] To enable stable training of reinforcement learning algorithms in a black-box environment, this invention introduces a surrogate loss function, mapping the discrete feedback output of the black-box model to a continuous, differentiable optimization signal. The policy network outputs perturbation distribution parameters based on the current adversarial example state. The perturbation generation function generates a perturbation vector through probabilistic sampling and applies it to the current state to form new adversarial examples. The value network evaluates the state sequence. Under the unified constraint of the surrogate loss function, the policy network and value network are updated collaboratively, thereby indirectly optimizing the perturbation generation process.

[0060] In the general adversarial perturbation generation stage, this invention further introduces a feature probability diffusion mechanism based on a diffusion model. By adding noise to the generated perturbation samples in multiple steps, the perturbation features are gradually mapped to the standard normal distribution space. Then, a denoising neural network is used to gradually recover the perturbation features during the back-diffusion process, thereby achieving probabilistic fusion of multiple perturbation modes. By embedding attack condition constraints during the denoising process, the generated general perturbation has stable misclassification capabilities under different samples and different input scenarios, realizing the transfer and generalization of adversarial attack effects.

[0061] like Figure 2 As shown, an embodiment of the present invention provides a black-box adversarial attack system based on proxy function optimization and feature probability diffusion, comprising: The feature initialization module is used to initialize traffic features and obtain the processed traffic feature dataset. The deduplication module is used to remove duplicate data and highly relevant features, performing manual dimensionality reduction. The environment initialization module is used to initialize the black-box attack environment using the training dataset and the trained classifier. Create a module to build the target function for black-box attacks; The generator function module is used to build reinforcement learning algorithm models based on black-box attack environments and initialize policy networks, value networks, and perturbation generator functions. The training module is used to train reinforcement learning algorithm models in a black-box attack environment based on the training algorithm and the proxy loss function. The testing module is used to adjust model parameters and perform batch training and testing. The comparison module is used to evaluate the model using metrics and compare its merits with those of previous algorithms.

[0062] The black-box adversarial attack system based on proxy function optimization and feature probability diffusion provided in this invention works on the following principle: the black-box adversarial attack process is decomposed into multiple functional units such as feature processing, attack environment construction, proxy optimization training, and performance evaluation through a modular architecture, and the efficient generation and generalization of adversarial perturbations are achieved without obtaining the internal structure and parameter information of the attacked model.

[0063] During system operation, the feature initialization module first performs feature parsing and standardization on the raw traffic data to form a traffic feature dataset with consistent structure and controllable values, providing the basic input for subsequent adversarial perturbation generation. The deduplication module filters out and compresses duplicate samples and highly correlated features in the dataset, reducing feature redundancy and making the adversarial perturbation more effective and stable within a limited feature space.

[0064] The environment initialization module constructs a black-box attack environment based on the processed feature dataset and the trained classifier. This environment only returns classification results and corresponding confidence information to the system, without exposing the model's internal parameters or gradient information, thus realistically simulating a black-box attack scenario. The setup module then constructs the black-box attack objective function based on this environment. By jointly setting misclassification constraints and sample similarity constraints, it clarifies the optimization direction of the adversarial attack and provides an evaluation basis for subsequent proxy optimization.

[0065] The generation function module establishes a reinforcement learning algorithm model based on the black-box attack environment and initializes the policy network, value network, and perturbation generation function. The policy network outputs perturbation distribution parameters based on the current adversarial example state. The perturbation generation function generates perturbation vectors through probability sampling and applies them to the samples, forming new adversarial states. The training module uses a surrogate loss function to map the discrete feedback returned from the black-box environment into continuous optimization signals, guiding the policy network and value network to iteratively update, thereby achieving adaptive optimization of the perturbation generation function without relying on real gradient information.

[0066] The testing module performs batch training and testing on the system by adjusting model parameters to verify the stability of perturbation generation and attack success rate; the comparison module performs performance comparison analysis between the method of this invention and existing adversarial attack algorithms based on preset evaluation indicators, thereby objectively evaluating the system effect.

[0067] At the implementation level, this invention also carries out the above-mentioned system through computer equipment, computer-readable storage medium, and information data processing terminal. When the processor in the computer equipment executes program instructions stored in the memory, it sequentially calls each functional module to complete the black-box anti-attack process; the computer-readable storage medium is used to store the program code implementing the method; and the information data processing terminal serves as the system's operating carrier, realizing the overall functional deployment and application of the black-box anti-attack system of this invention.

[0068] like Figure 3 , Figure 4 As shown, the technical solution of the present invention includes: Step 1: Initialize traffic features to obtain the processed traffic feature dataset.

[0069] Step 2: Remove duplicate data and highly correlated features, and manually reduce dimensionality.

[0070] Step 3: Initialize the black-box attack environment using the training dataset and classifier. Initializing the black-box attack environment mainly includes: defining the state space and action space based on the training dataset, and mapping the original samples to the initial states of the adversarial samples. A state transition function is established based on the classifier, and confidence and L-norm are set as rewards. Specifically, let the original samples... Define the disturbance amplitude Define the state space Define the state space as Mapping the original sample to the initial state of the adversarial sample. And utilize the perturbation vector of the perturbation generation function. Adversarial examples are obtained from the input state transition function. The initial state is obtained by projecting the original sample x from the dataset onto the state space. , The action space is represented as a perturbation vector. The magnitude of the perturbation vector is constrained to Between. Then, according to the pre-defined state space. Action space and initial state Set the state transition function. ,in The state transition function receives perturbations from the agent's output. plus the current state And projected into the state space A new state is obtained .

[0071] Step 4: Establish the black-box attack target function R. Classifier model F input samples. Output the confidence scores for m categories. .in, m represents For example, the categories include, Where sample x belongs to label c2, which is a common category in m. This is a specified class in m other than c2. The targeted attack, as shown in the formula, aims to cause the classifier model to output an incorrect prediction, that is, to classify a common class c2 as the specified class. Non-targeted attacks, on the other hand, classify samples into categories other than the original category. .

[0072]

[0073] Then, by applying the two fundamental constraints of adversarial examples—confidence constraint and similarity constraint—the constraint function is obtained. As shown in the following formula:

[0074] Where D represents the original sample x and the adversarial sample x. The distance function between them, where F represents the classification model function. This represents the perturbation vector. The constraint function represents the function to make the classifier F accept adversarial examples. Classified as target category This requires satisfying the original sample x and the adversarial sample x. The constraint that minimizes the distance between them.

[0075] The conditions for a successful attack are further defined as follows:

[0076] in The adversarial example representing the input can also be represented as The conditions for a successful attack are Then, simplify the difference part in the above formula and let... condition function Combining constraint functions The objective function R is obtained by introducing the time step variable, as shown in the formula:

[0077] Step 5: Establish a reinforcement learning algorithm model based on the black-box attack environment, and initialize the policy network, value network, and perturbation generation function. Specifically, initialize an agent. Within the agent, based on the state space... and action space Initialize the value network and policy network. The policy network receives adversarial examples output by the environment. This generates parameters that conform to the perturbation distribution. Then, the perturbation generation function samples the corresponding perturbation based on the distribution of these two parameters. Then, the state transition function input perturbation In the state transition function, the perturbation Add current adversarial examples And project it into the state space to obtain the adversarial example for the next time step. Repeat the above steps until the final state. In the agent, a sample represents the starting point of a state sequence, each sample occupies a separate sequence, and a state buffer stores the state tuple for each state: {Adversarial Examples} Perturbation vector New adversarial examples Let r be the reward and r be the final state, where the final state is a Boolean variable representing the state when the adversarial example exceeds the maximum time step limit or achieves the attack objective. When a state sequence reaches its final state, the agent updates the parameters of the value network and policy network using gradient descent of the agent loss function J. This indirectly implements the perturbation vector through the policy network. The value network learns a value function through interaction with data via the policy network. This function is used to judge the quality of perturbations in the current state and helps the policy network update.

[0078] The benefits of using a Gaussian distribution to model the perturbation vector in step 5 above are as follows: other adversarial attack algorithms statically initialize a perturbation value and then optimize the perturbation in batches through matrix operations. In the implementation of this invention, the policy network uses a parameterized Gaussian distribution to model the perturbation values ​​in the continuous action space. Specifically, the policy network input state... After passing through the front-end encoder, it outputs two parameters that correspond to the dimensions of the perturbation space: the mean vector. and standard deviation vector These two parameters correspond to Gaussian distributions. The expected value and variance are used to define an independent probability distribution for each feature dimension.

[0079] During the sampling process, firstly by and Construct a distribution, and then obtain the perturbation from this distribution through reparameterized sampling. The disturbance then passed through The scaling factor is constrained within a certain range to ensure its amplitude is controllable. Since the perturbation strictly corresponds to the dimension of the sample, meaning each input feature value corresponds to a perturbation component, the generated... and The shape and size of the perturbation are consistent with the input sample. This means that for each dimension of the input feature, the policy network can provide an adaptive probability distribution, thereby ensuring that the perturbation matches the sample shape.

[0080] Unlike deterministic perturbations directly output by a neural network, modeling using a Gaussian distribution offers the advantage of achieving an exploration-exploitation balance in a continuous action space. If perturbations are generated directly by the network, the model may get trapped in local optima, making it difficult to fully explore complex, high-dimensional spaces. By sampling from a parameterized distribution, the policy can maintain the distribution center. While approaching the optimal solution, utilize variance Random exploration within the neighborhood improves the robustness and generalization of the strategy in black-box optimization and adversarial example generation tasks.

[0081] Step 6: Select the PPO algorithm as the proxy loss function J to maximize the reward R. Use the black-box attack environment and the proxy loss function J to update the parameters of the two neural networks, the policy network and the value network, to achieve indirect optimization of the objective function.

[0082] Step 7: Adjust model parameters and perform batch training and testing; Step 8: Evaluate the model using metrics, comparing its performance with previous algorithms. Specifically, use metrics such as Attack Success Rate (ASR), L-norm distance, and Query Count (QR) to evaluate the proposed algorithm against other adversarial attack algorithms.

[0083] Example 2 The design of a general perturbation generation algorithm includes: Time, noise, and conditions are embedded into the generated perturbation data. A denoising neural network is trained using a diffusion model to predict the noise at time steps t. Specifically, in the forward propagation, the forward propagation formula is used... Find the noise values ​​at T time points. It is a constant value. , from arrive Linear growth. The larger, The smaller, The rate at which it approaches zero increases rapidly. Finally, when... When it is almost 0, substitute , It then becomes noise that follows a standard normal distribution.

[0084] During forward propagation, this embodiment trains a conditional Unet to fit the noise. Conditional Unet input samples. Each sample is embedded with a corresponding time step t and condition c. Based on the current neural network parameters, the noise prediction value for the current time step t is output, and then the Unet is iteratively updated using gradient descent of the mean squared error function. After forward propagation and training of the conditional Unet are completed, the example utilizes backpropagation to extract noise... The universal perturbation uap is sampled from the input noise. First, the input noise is randomly sampled from a standard normal distribution. This operation ensures that different perturbations are generated each time. Next, the reverse process of the diffusion model is performed. First, let time start from... Up to 1, using the trained Unet, the noise is predicted. ,in This represents the parameters of Unet. Then, the mean of the denoising operation at this moment is calculated. With variance and sampled Until time 0, we obtained... .

[0085] Inputting normally distributed noise, a denoising neural network outputs a general adversarial perturbation that integrates various perturbation features from the perturbation dataset. Specifically, this is achieved by inputting... Where x contains all the data in the dataset, and the judgment is based on the output of the black-box model. Does it conform to general disturbance? The standard is that the misclassification rate reaches 80%. If it does, then save. If not, repeat the above steps. Also, update the conditions. The constraints are gradually increased to guide Unet to approximate stronger perturbations, and then Unet training continues. In this embodiment, Set it to 0.05.

[0086] The effectiveness of the generated general adversarial perturbation was tested using different classifiers and datasets, and the merits of the proposed general perturbation generation method were evaluated using metrics such as attack success rate, precision, recall, and F1 score.

[0087] This invention addresses the problems of traditional evasion attacks failing to bypass machine learning-based network intrusion detection systems and the high computational complexity, high computational cost, and numerous queries of existing black-box adversarial attack methods. It designs a method that combines machine learning, reinforcement learning, and a diffusion model to perform adversarial attacks and generate general perturbations. This method inputs the reward of the objective function R into a proxy loss function J, updates the parameters of the policy network and value network through gradient descent, and then uses these two networks to generate parameters conforming to the perturbation distribution. Adversarial perturbations are dynamically generated based on reparameterized sampling, preserving the space for exploration and exploitation. Furthermore, the perturbation is indirectly optimized through the proxy loss function J, thus achieving black-box adversarial attacks. The second method of this invention addresses the deficiency of adversarial attack algorithms requiring multiple runs on different classifiers and datasets. It implements a probabilistic diffusion s-attack model based on a diffusion model and a conditional denoising neural network, embedding noise and time steps T. The conditional denoising neural network is trained during the forward pass, and general perturbations are sampled during the backward pass.

[0088] Experiments were conducted in this embodiment of the invention, and the following is the experimental section: This invention used two datasets, CIC-IDS2017 and CSE-CIC-IDS2018, and selected three classifiers from simple to complex: MLP, DBN, and CNNBiLSTM. The 2017 dataset contains 3,119,345 records, each containing 83 statistical features. The 2018 dataset contains 15,616,016 records, each containing 83 statistical features. Both datasets were provided by the Canadian Cyber ​​Security Institute and contain 15 attack types, mainly including categories such as: HTTP flooding attacks, UDP flooding attacks, SYN flooding attacks, SSH / FTP password brute-force attacks, XSS, SQL injection, web page brute-force attacks, malware attacks, botnet attacks, and port scanning attacks. The data was divided 50 / 50, with 50% of the data used for training and 50% for testing the agent.

[0089] This invention relates to the fields of cyberspace security and artificial intelligence security technology, specifically to a deep learning-based adversarial example generation and defense technology. The method proposed in this invention has broad industrial application prospects and is particularly suitable for the following specific application areas and related products.

[0090] Robustness assessment and testing platform for Network Intrusion Detection Systems (NIDS): This is the most direct application scenario of this invention. Because this invention proposes an optimization scheme based on the Surrogate Function to address the problem of "high query counts in black-box attacks," it can be integrated into automated network security testing tools or red team / blue team exercise platforms. As a core module of third-party security assessment software, it is used to efficiently test the NIDS's detection capabilities against covert attacks by simulating adversarial samples of malicious network traffic, without knowing the target NIDS's internal model structure (i.e., black-box state). Utilizing the indirect optimization framework established in this invention, testing tools can evaluate the security of firewalls or traffic analysis probes with extremely low query costs, significantly reducing the time cost and computational resource consumption of security audits.

[0091] Network Range and Attack / Defense Simulation System: The "General Perturbation Generation Method Based on Feature Probability Diffusion" mentioned in this invention utilizes a diffusion model and conditional Unet to generate perturbations that generalize to different classifiers. This characteristic is highly suitable for large-scale network ranges (CyberRange). As an advanced attack generator in the range's attack simulation library, the system can automatically generate massive amounts of diverse attack traffic samples that are effective across models using the diffusion algorithm in this invention. This can be used to train cybersecurity personnel in identifying Advanced Persistent Threats (APTs) or to verify the overall defense effectiveness of multi-source heterogeneous security devices in complex network architectures.

[0092] Artificial Intelligence Model Security Audit and Risk Management Service: For enterprises providing AI security services, this invention can be transformed into a SaaS (Security as a Service) model health check service. Utilizing the multi-dimensional evaluation metrics proposed in this invention (including Attack Success Rate (ASR), Distance Paradigm L-dist, Query Count (QR), and Deception Rate (FR), a standardized AI model security scoring system is constructed. Users only need to provide the model's API interface (black box), and the system can quickly generate an evaluation report using the proxy loss function J and backpropagation mechanism, quantifying the model's vulnerability to malicious samples and providing visualized risk analysis.

[0093] To verify the effectiveness of the proposed SOA method against adversarial attacks, we conducted comparative experiments on two intrusion detection datasets, CICIDS2017 and CICIDS2018, targeting three typical deep learning models: DBN, MLP, and CNNBiLSTM. ZOO and SPSA were selected as benchmark comparison methods. and Attack success rate (ASR) was statistically analyzed under two distance norm constraints, and the experimental results are shown in Table 1.

[0094] 1. In Advantages of attack performance under norm constraints: Experimental data shows that existing ZOO methods generally have low attack success rates on both datasets (mostly between 19% and 49%), making effective attacks difficult. While the SPSA method shows improvement on some models, its performance is unstable, especially on the CICIDS2018 dataset's CNNBiLSTM model, where it only achieves 50.20%. In contrast, the SOA method proposed in this invention demonstrates significant advantages in all test scenarios, with an attack success rate exceeding 98% in most cases, reaching 99.99% on the CICIDS2017 CNNBiLSTM model, validating the effectiveness of this invention. It exhibits extremely high attack efficiency under constraints.

[0095] 2. In Applicability and robustness under norm constraints: The comparison method ZOO only supports Attacks are not applicable Norm scenarios. In Under constraints, the SPSA method's attack performance drops drastically on the CICIDS2018 dataset, with a success rate as low as 17.61% against the DBN model. In stark contrast, the SOA method of this invention exhibits extremely strong robustness across all datasets. The attack success rate remained above 87% in all tests, and reached 100% in many tests (such as the MLP model in CICIDS2017).

[0096] in conclusion: like Figure 5-8 As shown above, regardless of the different distance metrics ( Regardless of the dataset or target model, the SOA method of this invention achieves a significantly higher attack success rate and wider applicability compared to existing technologies such as ZOO and SPSA.

[0097] Table 1. Normal Detection Accuracy and Attack Success Rate

[0098] Further explanation of the examples: Comparison of attack effects against different types of malicious traffic.

[0099] To verify the universality of this invention in the face of diverse network threats, we further refined the experiments, conducting in-depth analysis of five specific malicious traffic types: Botnet, BruteForce, DoS / DDoS, PortScan, and WebAttack. The results (see attached figures in the specification) demonstrate that this invention (SOA) maintains extremely high stability under various specific attack scenarios, overcoming the shortcomings of existing technologies that fail with specific traffic types.

[0100] 1. Advantage of full category coverage on the CIC-IDS2017 dataset: like Figure 9 , Figure 10 Experimental results show that the method of the present invention is effective in... and Under both distance constraints, the average attack success rate for all five attack types remained stable at over 99%, achieving almost "indiscriminate strikes" against all types of malicious traffic.

[0101] Comparison of differences: Existing technologies exhibit significant volatility. For example, in During the attack, the ZOO method, when targeting the CNNBiLSTM model with PortScan traffic, saw its success rate plummet to an extremely low 0.81%, almost completely failing. Meanwhile, the SPSA method also proved inadequate in handling WebAttack type traffic. Under constraints, the success rate for the CNNBiLSTM model is only 36.70%.

[0102] Technical effect: In comparison, the method of the present invention maintains a success rate of over 99.9% under the same conditions, proving that the present invention has significant technical advantages in processing long sequences or complex characteristic traffic (such as PortScan and WebAttack).

[0103] 2. Robustness verification on the CSE-CIC-IDS2018 dataset: Compared to CIC-IDS2017, the CSE-CIC-IDS2018 dataset simulates a larger-scale network environment with more complex topologies, resulting in higher feature dimensions and a sparser distribution of attack traffic. Furthermore, this dataset subdivides attack categories (e.g., separating DoS from DDoS and adding highly stealthy infiltration attacks), posing a severe challenge to the feature extraction capabilities and generalization of adversarial attack algorithms. Experiments show that existing techniques (ZOO / SPSA) exhibit more severe performance issues on this dataset, while our invention (SOA) maintains extremely high robustness. The dataset scenario is more complex, further degrading the performance of the comparison methods, while our invention still maintains a high level of attack effectiveness.

[0104] Compare the differences: Advantages of using norms in extreme scenarios: like Figure 11 As shown, in the CSE-CIC-IDS2018 dataset In constraint testing, the average success rate of this invention (SOA) against all attack types (Botnet, BruteForce, DDoS, DoS, Infilteration, WebAttack) remained stable at over 95%, demonstrating extremely strong adaptability.

[0105] Existing methods suffer severe performance degradation when faced with complex traffic. For example, the ZOO algorithm has a success rate of only 9.35% when attacking the DBN model with botnet traffic; its success rate against PortScan is also as low as 15.12%. The SPSA algorithm also performs poorly, with its success rate against the DBN model dropping to 5.47% in DoS / DDoS attack scenarios.

[0106] This invention successfully overcomes the problem of sparse traffic features in the 2018 dataset by using a proxy function optimization strategy. Even in the Botnet and DoS / DDoS scenarios where the aforementioned competitors failed, the success rate of SOA attacks against the DBN model is still as high as 99.90% and 99.25%, respectively, demonstrating the superior performance of this invention in handling complex heterogeneous network traffic.

[0107] 3. In Full class coverage under norm (especially infiltration attacks): like Figure 12 exist Under constraints, we introduced the Infiltration attack category, which is unique to the 2018 dataset, for testing.

[0108] The SPSA algorithm almost completely fails when faced with highly covert attacks like infiltration, achieving a success rate of only 6.42% against CNNBiLSTM models and a mere 16.34% against MLP models. This indicates that gradient-based stochastic estimation methods (SPSA) struggle to capture the subtle feature perturbations in infiltration attacks.

[0109] Conversely, this invention (SOA) still maintained an average success rate of 96.67% for the Infiltration attack category, and even reached 97.59% for the DBN model. This strongly demonstrates that, with the assistance of the feature probability diffusion mechanism, this invention can accurately locate and perturb those key deep features, thereby achieving efficient "no dead ends" coverage in all attack categories (including the most difficult penetration attacks).

[0110] Even in extreme scenarios where the aforementioned comparison methods are almost ineffective (such as against Botnets and DoS / DDoS attacks), this invention (SOA) still maintains an attack success rate of over 90%, even approaching 100%. This strongly demonstrates that the optimization strategy adopted in this invention can effectively extract the deep vulnerability characteristics of various malicious traffic types, eliminate detection blind spots for specific attack types, and possesses extremely strong practical value.

[0111] In summary, compared to the "cliff-like" performance drop of the ZOO and SPSA methods when facing certain attack types, this invention demonstrates high consistency and excellent attack effectiveness across all tested attack categories.

[0112] To further evaluate the quality and stealth of adversarial examples, we statistically analyzed the prediction confidence when the target model misclassified the malicious adversarial examples generated by our invention (SOA) as "benign." Higher confidence indicates stronger certainty in the defense model regarding this erroneous judgment, making the attack more difficult to detect by anomaly detection mechanisms based on uncertainty.

[0113] 1. In Significant confidence advantage under norm constraints: Experimental data show that, Under distance constraints, the adversarial examples generated by this invention can deceive the target model with a confidence level significantly higher than that of the comparison method.

[0114] like Figure 13 As shown, the present invention (SOA) achieves an average misclassification confidence level of 63.90% across the three models, while the comparative method ZOO achieves only 18.92%. Particularly for the structurally complex CNNBiLSTM model, the confidence level of the present invention reaches 79.68%, more than double that of the ZOO method (35.52%) and nearly double that of the SPSA method (41.77%). This indicates that the present invention can deeply optimize features, making the model "convinced" that the malicious traffic is legitimate business.

[0115] 2. In High confidence maintenance under norm and breakthroughs in complex models: exist Under constraints, the adversarial examples generated by this invention generally achieved extremely high false positive confidence, further verifying the strong attack capability of the algorithm.

[0116] like Figure 14 As shown, the average confidence level of this invention is as high as 85.27%, with a false positive confidence level of 88.76% for the MLP model. This means that the defense system allowed the malicious attack traffic generated by this invention to pass through with almost "complete certainty".

[0117] In summary, unlike existing methods such as ZOO and SPSA that produce "barely successful misclassifications" (low confidence, easily intercepted), this invention (SOA) not only significantly improves the attack success rate, but more importantly, greatly enhances the confidence level of misclassifications. This "high-confidence deception" characteristic makes the adversarial examples of this invention extremely difficult to be identified by existing defense strategies based on confidence thresholds, resulting in deeper technical effects and application value.

[0118] like Figure 15 As shown, on the more complex 2018 dataset, the advantages of this invention remain significant, with an average confidence level of 64.25%, far exceeding the 44.32% of the SPSA method. For the CNNBiLSTM model, this invention increases the confidence level to 79.77%, which proves that even in complex network environments with sparse features, this invention can still generate high-quality "high-confidence" adversarial examples.

[0119] like Figure 16 As shown, when facing the most challenging CNNBiLSTM model, this invention still demonstrates superiority, achieving a high confidence level of 84.64%, which is better than the SPSA method's 80.07%. This indicates that when dealing with deep learning detection models with temporal memory capabilities, the feature probability diffusion mechanism of this invention can more effectively simulate the temporal patterns of benign traffic, thereby obtaining higher deception weights.

[0120] Query efficiency and overhead analysis under black-box attack environment In real-world black-box attack scenarios, attackers cannot access the target model's internal parameters and can only adjust their attack strategies by sending queries to the target model and observing the output. The number of queries directly determines the attack's time cost and the risk of being detected by the defense system (i.e., stealth). To verify the superiority of this invention in a black-box environment, we calculated the average number of queries required to generate a single successful adversarial example on the CIC-IDS2017 and CSE-CIC-IDS2018 datasets and compared it with the ZOO and SPSA methods.

[0121] 1. Analysis of the order-of-magnitude advantage in query cost: Combining the experimental results of the two datasets (e.g.) Figure 17 As shown, the present invention (SOA) demonstrates an order-of-magnitude advantage in query efficiency.

[0122] Existing methods like ZOO and SPSA are both algorithms based on zero-order optimization. Among them, the ZOO method... Generating an adversarial example under constraints requires an average of 3301 queries; while the SPSA method, due to the need for extensive random sampling to estimate gradient directions, has an even higher query overhead of 5121 queries, maintaining this high level across both datasets and different distance metrics. Such high-frequency accesses, numbering in the thousands, easily trigger abnormal traffic alerts in intrusion detection systems, leading to the blocking of attacking IPs.

[0123] Technical advantages of this invention: In comparison, this invention (SOA) keeps the average number of queries below 50 across all test scenarios. For example, in the CSE-CIC-IDS2018 dataset... During the attack, SOA performed only 26 to 50 queries on different models on average; The number of attacks was as low as 24. Compared to SPSA, the query efficiency of this invention is improved by approximately 100 times.

[0124] To verify the effectiveness and transferability of the proposed Universal Perturbation Approach (UAP) generation method based on feature probability diffusion, cross-model attack experiments were conducted on the IDS2017 and IDS2018 datasets. Five representative classifiers (DBN, MLP, cnnBiLSTM, RF, and XGB) were selected as attack targets. UAPs were generated on one of the classifiers and then transferred to other classifiers to test their Fooling Rate (FR). Experimental results are as follows: Figure 18 As shown.

[0125] The algorithm demonstrates high attack success rate and broad applicability. Test results across four subgraphs show that the general perturbations generated by the algorithm exhibit extremely high attack success rates in most cross-model attack scenarios. On both datasets, the transfer attack misclassification rate for most models exceeded 80%, with some scenarios (such as against ensemble learning models like RF and XGB) even achieving 100% complete misclassification. This indicates that the diffusion-based generation method can approximate the target conditions through maximum likelihood distribution, successfully extracting the core features that can render classifier decisions ineffective.

[0126] The method demonstrates exceptional cross-architecture transferability, with experimental results revealing its strong generalization ability across different classifier architectures. Traditional iterative algorithms (such as those proposed by Moosavi-Dezfooli et al.) often struggle to achieve a balance between neural networks and decision tree models with varying structures due to their reliance on single-sample stacking. This study, however, utilizes iterative diffusion and de-diffusion processes to fuse the local perturbation characteristics of different samples. Even UAPs generated on deep learning models (such as CNNBiLSTM) maintain extremely high attack efficiency when transferred to machine learning models (such as RF). This verifies that feature probability diffusion can learn the "common intersection region" of samples from different classes distributed in a high-dimensional space.

[0127] Experimental data further support the theoretical superiority of the diffusion model in UAP generation. The experimental results demonstrate the feature fusion capability. By simulating a "noise addition-denoising" process in the perturbation space, the diffusion model fuses important features of multiple local perturbations into a universal vector, enabling a single perturbation to produce misclassification of a batch of samples.

[0128] With low overhead and high generalization, compared to high-overhead black-box iterative attacks, this method avoids the process of frequently calling the target classifier by learning the perturbation distribution characteristics. The widespread distribution of dark areas in the heatmap proves that the perturbations generated by this method not only retain the aggressiveness of the original perturbations, but also have the ability to solve the AE transferability problem.

[0129] In summary, the general perturbation generation method based on feature probability diffusion performs excellently in IDS network intrusion detection scenarios. It not only significantly improves the success rate of adversarial examples transferring between different classifiers, but also demonstrates strong robustness and generalization ability.

[0130] 2. Advantages of the generative mechanism principle: like Figures 2-4 The fundamental reason for these huge differences lies in the different technological approaches: The drawbacks of traditional methods: ZOO and SPSA methods must simulate gradient descent by performing tedious numerical estimations outside the black box using difference methods, through thousands of tiny perturbations and queries on each input sample. This "trial and error" approach is not only computationally expensive, but also requires starting the search from scratch for each new sample.

[0131] The innovation of this invention lies in its abandonment of inefficient online gradient estimation and the adoption of a generative architecture based on deep learning. By pre-training a surrogate model and a generative network, this invention can directly learn the mapping relationship between input features and adversarial perturbations. During the attack phase, high-quality adversarial perturbations can be generated with only one forward propagation, requiring only a minimal number of queries for final fine-tuning.

[0132] Experimental data demonstrates that this invention, by replacing "online numerical estimation" with "trained neural network generation," successfully overcomes the technical bottleneck of excessive query overhead in black-box attacks. The extremely low number of queries (<50) not only significantly reduces the time cost of generating adversarial examples but also makes the attack behavior difficult to detect by defense mechanisms based on traffic frequency analysis, thus significantly improving the usability and stealth of this method in real-world black-box network environments.

[0133] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0134] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A black-box adversarial attack method based on surrogate function optimization and feature probability diffusion, characterized in that, This method, through the synergy of a reinforcement learning perturbation generation mechanism driven by a proxy loss function and a feature probability diffusion constraint mechanism, achieves low-query optimization generation of adversarial perturbations without obtaining the internal parameters of the attacked model. The method includes the following steps: Construct an attack environment based solely on black-box output feedback, mapping the original sample to the initial adversarial state; In the black-box attack environment, an attack target function that includes both confidence constraints and sample similarity constraints is constructed, and a time variable is introduced to self-update the target function in order to reduce the number of queries required per unit perturbation; By introducing a proxy loss function, the non-gradient feedback of the black-box attack target function is transformed into an optimizable gradient signal; Driven by the surrogate loss function, the perturbation generation process is iteratively updated through a reinforcement learning algorithm, so that the perturbation vector gradually approaches the misclassification boundary under the condition of satisfying the similarity constraint, thereby completing the black-box adversarial attack.

2. The black-box adversarial attack method as described in claim 1, characterized in that, The attack environment is constructed by defining a state space and an action space, wherein the state space is represented by the current adversarial sample, the action space is represented by the perturbation parameters output by the perturbation generation function, and the initial state is the adversarial initial state obtained by mapping the original sample.

3. The black-box adversarial attack method as described in claim 1, characterized in that, The attack objective function is constructed by combining the classification confidence constraint of adversarial examples with the similarity constraint of input samples. The weights of the objective function are dynamically adjusted by introducing a time variable, so that the early optimization stage focuses on exploring misclassifications and the later optimization stage focuses on perturbation convergence.

4. The black-box counter-attack method as described in claim 1, characterized in that, The surrogate loss function is used to map the changes in the classification results of the black-box model into a continuously differentiable optimization signal, and serves as a unified optimization basis for the policy network and value network in the reinforcement learning algorithm.

5. A perturbation generation method for black-box adversarial attacks, characterized in that, Iterative optimization of the perturbation vector is achieved through a policy update mechanism guided by a probability-based perturbation generation function and a proxy loss function, including: Initialize the policy network and value network based on the state space and action space; The policy network encodes the current adversarial state and outputs the probability parameters of the perturbation distribution; The perturbation vector is sampled according to the probability parameters, and the sampled perturbation is applied to the current adversarial state to obtain the next state; After the state sequence reaches the final state, the parameters of the policy network and the value network are updated based on the surrogate loss function, thereby achieving adaptive optimization of the perturbation generation function without relying on the gradient of the attacked model.

6. The disturbance generation method as described in claim 5, characterized in that, The perturbation generation function models the perturbation vector using a probability distribution. The policy network outputs a mean vector and a standard deviation vector consistent with the perturbation dimension, and constructs mutually independent probability distributions on each feature dimension.

7. The disturbance generation method as described in claim 5, characterized in that, The policy network and value network are jointly optimized using the same proxy loss function, so that the perturbation sampling distribution gradually diffuses towards the region with high misclassification probability as the black box feedback proceeds.

8. A general adversarial perturbation generation method based on feature probability diffusion, characterized in that, By jointly learning the feature distributions of multiple perturbation samples through a conditional diffusion modeling mechanism, transferable general adversarial perturbations are generated, including: Construct a perturbation sample dataset and introduce time and noise variables into the diffusion model; The perturbation sample is subjected to multi-step noise addition through a forward diffusion process, so that its distribution gradually approximates the standard normal distribution. A denoising neural network is trained during the backdiffusion process to progressively predict and eliminate noise, thereby recovering a general perturbation that integrates multiple perturbation features. During the denoising process, attack condition constraints are embedded to ensure that the generated general perturbation meets the preset misclassification requirements on the black-box model.

9. The general anti-perturbation generation method as described in claim 8, characterized in that, The attack conditions are used to constrain the misclassification rate of the general perturbation on the black-box model, and when the misclassification rate does not meet the preset requirements, the denoising neural network is guided to converge towards a stronger perturbation by increasing the strength of the condition constraints.

10. The general adversarial perturbation generation method as described in claim 8, characterized in that, The generated general perturbation is superimposed on the original sample to form adversarial samples, and the classification result of the black box model is used as a conditional feedback signal to achieve closed-loop optimization of the general perturbation generation process.

Images