Improved ADS-B time series data adversarial sample generation method of WGAN-GP

Abstract

The present application relates to the technical field of aviation safety and artificial intelligence, in particular to an ADS-B time series data adversarial sample generation method based on improved WGAN-GP, comprising the following steps: obtaining ADS-B historical flight data, extracting the longitude, latitude, height, speed and heading five-dimensional features to construct a time series data set; building an adversarial sample generation model based on an improved Wasserstein distance generative adversarial network, and configuring a multi-objective composite loss function for the generator; the present application builds a generator and a discriminator based on LSTM, designs a composite loss function that integrates adversarial loss, concealment loss and time series smoothness loss, adopts gradient penalty and asymmetric update strategy to train the model, and the generated adversarial sample has high concealment and physical consistency, can effectively avoid various unsupervised anomaly detection models, the model training is stable, and technical support is provided for building a safer air traffic control defense mechanism.

Description

Technical Field

[0001] This invention relates to the interdisciplinary field of aviation safety and artificial intelligence, specifically to an improved method for generating adversarial examples from ADS-B time-series data in WGAN-GP. Background Technology

[0002] Automatic Dependent Surveillance-Broadcast (ADS-B) technology is one of the cornerstone technologies of the global air traffic management (ATM) system. Aircraft determine their position using satellite navigation and periodically broadcast information such as position, altitude, speed, heading, and identification code. However, the ADS-B protocol was designed with interoperability in mind, broadcasting messages in unencrypted plaintext and lacking an effective authentication mechanism. Malicious attackers can use devices such as Software-Defined Radio (SDR) to eavesdrop, tamper with, or inject false messages to carry out deception attacks, seriously threatening airspace security.

[0003] To address this threat, data-driven unsupervised anomaly detection techniques have become the mainstream defense method. Due to the scarcity of real anomaly data, researchers use deep learning models such as Long Short-Term Memory (LSTM), Variational Autoencoder (VAE), and Transformer to learn the temporal characteristics and distribution patterns of normal flight trajectories, identify anomalous data that deviates from the norm, and form an important line of defense for ADS-B security.

[0004] However, deep learning-based detection models are seriously vulnerable to "adversarial examples." Adversarial examples are samples in which tiny, imperceptible perturbations are added to the original data, causing the neural network to output incorrect results with high confidence. Attackers can use these to generate highly covert false tracks to evade the monitoring of anomaly detection systems.

[0005] Current research on adversarial examples mainly focuses on the field of computer vision. Classic attack algorithms include the Fast Gradient Sign Method (FGSM) in white-box attacks and the Zero-Order Optimization Algorithm (ZOO) in black-box attacks. However, when these methods are directly transferred to the domain of ADS-B time series data, a serious "domain mismatch" problem exists, as detailed below:

[0006] Ignoring temporal correlation and physical constraints: Image domain attacks focus on pixel spatial perturbations, while ADS-B data has strict flight dynamics physical constraints and temporal coherence. Directly applying FGSM or ZOO to generate discrete abrupt changes in perturbations can lead to physically impossible drastic changes in the trajectory, which are easily detected by time-dependent detection models.

[0007] The perturbation strategy is crude and has poor concealment: traditional methods have difficulty in accurately controlling the distribution of perturbation amplitude, the generated adversarial examples have discrete abnormal scores, and a large perturbation amplitude is required to achieve the attack, which easily exposes the attack behavior;

[0008] Lack of generation mechanism for time series data: Existing GANs are prone to pattern collapse and training instability when processing long sequence data, and the generated time series data lacks diversity and is difficult to cover complex real flight scenarios.

[0009] In summary, the lack of a method for generating adversarial examples for ADS-B time-series data that balances "deception effectiveness," "distribution concealment," and "temporal smoothness" in existing technologies has become a pressing technical challenge in the field of aviation data security. Summary of the Invention

[0010] The purpose of this invention is to provide an improved method for generating adversarial examples from ADS-B time series data in WGAN-GP, in order to solve the problems of neglecting the dynamic characteristics and physical constraints of ADS-B time series data, resulting in physical distortions such as abrupt position changes and discontinuous velocity in the generated adversarial examples, which are easily identified by time-dependent anomaly detection models, and the perturbation amplitude is difficult to control and has poor concealment.

[0011] To achieve the above objectives, the present invention provides the following technical solution: an improved method for generating adversarial examples from ADS-B time series data using WGAN-GP, comprising the following steps:

[0012] S1. Data Construction: Obtain historical ADS-B flight data, and after cleaning and denoising, extract features in five dimensions: longitude, latitude, altitude, speed, and heading. Normalize the data and construct a time series dataset using a sliding window.

[0013] S2. Model Construction: Build an adversarial sample generation model based on the improved Wasserstein distance generative adversarial network (WGAN-GP). The model includes a generator and a discriminator, both of which are multilayer long short-term memory networks (LSTM) as their core components.

[0014] S3. Composite Loss Function Design: Configure a multi-objective composite loss function for the generator in step S2. The composite loss function is composed of a weighted average of adversarial loss, concealment loss, and temporal smoothness loss.

[0015] S4. Adversarial Training: The model in step S2 is trained adversarially using the time series dataset from step S1. During training, a gradient penalty term is introduced into the discriminator loss function to stabilize the training, and an asymmetric update strategy is used to optimize the network parameters.

[0016] S5. Input the target ADS-B time series data into the trained generator to generate a perturbation sequence. Superimpose the perturbation sequence onto the original sequence to obtain the ADS-B adversarial sample.

[0017] Preferably, in step S1:

[0018] Data cleaning and denoising includes removing abrupt changes in velocity and location; for sequences with uneven time intervals, linear interpolation is used to resample them to a fixed time interval.

[0019] The normalization process uses the Min-Max normalization method to map all feature values ​​to the interval [0,1].

[0020] The time series dataset tensor constructed by the sliding window has the following shape: , The total number of samples, 5 represents the length of the sliding window and 5 represents the 5 feature dimensions.

[0021] Preferably, in step S2, the generator adopts a sequence-to-sequence (Seq-to-Seq) network structure, receives the original ADS-B sequence or its concatenation with Gaussian noise as input, captures the temporal dependencies through LSTM units, and outputs a perturbed sequence with the same size as the input sequence after mapping through a linear layer, specifically including:

[0022] The input layer receives normalized real ADS-B sequences, or spliced ​​data of Gaussian noise and original ADS-B data;

[0023] The hidden layer consists of two LSTM networks. The first LSTM layer has 64 hidden units and returns a complete sequence, while the second LSTM layer has 32 hidden units and returns a complete sequence.

[0024] The output layer is a fully connected layer that maps the 32-dimensional hidden state back to the 5-dimensional feature space and outputs a perturbation sequence.

[0025] Preferably, in step S2, the discriminator adopts a sequence-to-scalar network structure, receives real sample or adversarial sample sequences, extracts sequence feature summaries, and outputs a scalar score through a fully connected layer to evaluate the realism of the input sequence. Specifically, this includes:

[0026] The input layer receives real ADS-B samples or generated adversarial samples, and the input dimension is consistent with the dimension of the perturbation sequence output by the generator;

[0027] The hidden layer consists of two LSTM networks. The first LSTM layer has 64 hidden units and returns the complete sequence, while the second LSTM layer has 32 hidden units and only returns the hidden state of the last time step.

[0028] The output layer is a fully connected layer that maps the hidden states to 1-dimensional scalars and outputs real-valued scores to evaluate the authenticity of the input sequence.

[0029] Preferably, the expression for the multi-objective composite loss function in step S3 is:

[0030] ;

[0031] in, To combat the losses, For concealed losses, For time series smoothness loss, For hidden weights, This is the weight for time series smoothness.

[0032] Preferably, the resistance loss The expression is:

[0033] ;

[0034] in, Batch size, which is the number of samples input into the model for a single training iteration. For the discriminator to the first One generated sample The rating, To generate samples, the training objective of the generator is to minimize... .

[0035] Preferably, the loss of concealment The L2 norm is used to penalize excessively large disturbance amplitudes, expressed as follows:

[0036] ;

[0037] in, The length of the sliding window. It is the perturbation sequence generated by the generator for the input sequence. For the first The perturbation sequence corresponding to each sample Let be the perturbation value of the i-th sample in the k-th dimension at time step t. The magnitude of the perturbation is limited to ensure the stealth of the attack.

[0038] Preferably, the timing smoothness loss It is calculated by the difference between penalized perturbations at adjacent time points, and the expression is:

[0039] ;

[0040] in, and These represent the i-th sample at time step [i]. and The perturbation sequence is minimized to induce the generator to produce a gradually changing perturbation, thereby improving the physical credibility of the adversarial example.

[0041] Preferably, in step S4, the discriminator loss function Introducing a gradient penalty term, the expression is:

[0042] ;

[0043] in, To generate samples, To generate the sample distribution, For real data samples, For the true data distribution, The gradient penalty coefficient is... These are random interpolation points between real samples and generated samples;

[0044] To generate sample distribution Below, the mathematical expectation of the discriminator score;

[0045] For the true sample distribution Below, the mathematical expectation of the discriminator score;

[0046] For real samples With generated samples Random sampling points on the line, i.e. ,in ;

[0047] The gradient penalty term is used to satisfy the 1-Lipschitz constraint. By having the gradient norm of the constraint discriminator approach 1 for changes in the input, the vanishing and exploding gradient problems in traditional GAN ​​training are solved.

[0048] Preferably, the asymmetric update strategy in step S4 is as follows: in each round of training, the discriminator parameters are updated multiple times first, and then the generator parameters are updated once, and the number of discriminator updates is limited. Number of generator updates The ratio is 5:1, meaning that the generator parameters are updated once for every 5 updates to the discriminator parameters.

[0049] Compared with the prior art, the beneficial effects of the present invention are:

[0050] This invention introduces a temporal smoothness loss to penalize drastic changes in adjacent time steps of the perturbation sequence, forcing the generator to output smooth and continuous perturbations. This completely solves the physical distortion problems such as abrupt position changes and velocity discontinuities in samples generated by traditional methods, ensuring that adversarial examples strictly conform to flight dynamics and effectively circumventing anomaly detection models based on temporal dependencies. By precisely controlling the perturbation energy through a concealment loss, it avoids the shortcomings of excessive perturbation redundancy and discrete anomaly score distribution in traditional methods, making the generated perturbations both "effective" and "minimized," significantly improving attack concealment and preventing the exposure of attack behavior. An improved WGAN-GP framework is adopted, combined with a gradient penalty mechanism to satisfy 1-Lipschitz constraints, and an asymmetric update strategy for the discriminator and generator, effectively solving the problem of traditional GANs processing long sequences. To address the issues of pattern collapse and training instability during data processing, this method ensures rapid and smooth convergence of the generator and discriminator loss functions, while also enhancing the diversity of generated samples to cover complex flight scenarios. Through the collaborative design of a composite loss function with LSTM-based generators and discriminators, the generated samples possess deceptive effectiveness, low perturbation amplitude, and temporal smoothness, significantly improving attack adaptability to various mainstream unsupervised anomaly detection models and exhibiting strong transfer attack capabilities. Even against heterogeneous detection models not involved in training, it maintains high-efficiency attack performance, comprehensively solving the problem of insufficient attack effectiveness caused by "domain mismatch" in traditional methods. The resulting high-quality adversarial samples can be effectively used to evaluate the robustness of the ADS-B anomaly detection system, providing a key tool for building a safer air traffic control defense mechanism. Attached Figure Description

[0051] Figure 1 This is a schematic diagram of the overall process of the improved WGAN-GP ADS-B time series data adversarial example generation method of the present invention;

[0052] Figure 2 This is a detailed network architecture diagram of the generator and discriminator of the improved WGAN-GP ADS-B time-series adversarial example generation method of the present invention;

[0053] Figure 3 This is a graph showing the convergence curve of the loss function during the model training process of this invention;

[0054] Figure 4 This is a visual comparison chart of attack strategies against the LSTM anomaly detection model of this invention;

[0055] Figure 5 This is a visual comparison chart of the attack strategies against the VAE anomaly detection model of this invention. Detailed Implementation

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] Please see Figure 1-5 This invention provides a technical solution: an improved method for generating adversarial examples for ADS-B time series data using WGAN-GP, mainly relying on the hardware and software environment of a computer system. To verify the effectiveness of this invention, the following experimental environment was constructed in this embodiment:

[0058] Hardware requirements: The processor (CPU) should be an Intel Core i7-10700K or equivalent processor; the graphics processor (GPU) should be an NVIDIA GeForce RTX 3090 or higher performance graphics card with at least 24GB of video memory to accelerate the training and inference of deep learning models; and the memory (RAM) should be at least 32GB.

[0059] Software environment: Operating system is Ubuntu 20.04LTS or Windows 10 / 11; programming language is Python 3.8; deep learning framework is PyTorch 1.8.0 or TensorFlow 2.5; data processing libraries depend on NumPy, Pandas and Scikit-learn.

[0060] This embodiment uses publicly available real-world flight ADS-B datasets as the data source. The raw data typically includes fields such as timestamp, ICAO address, longitude, latitude, pressure altitude, ground speed, and heading.

[0061] This invention includes the following steps:

[0062] S1. Data Construction: Acquire historical ADS-B flight data. Due to the susceptibility of ADS-B signals to environmental noise interference during transmission, the raw data often contains missing values ​​or outliers. After cleaning and denoising, feature vectors are constructed by extracting the five most critical dimensions for describing the flight status. ,Right now In order to eliminate the numerical differences between different physical units (such as latitude and longitude degrees and altitude feet) and accelerate the convergence of neural networks, normalization processing is required, and a time series dataset is constructed by using a sliding window.

[0063] Data cleaning and denoising includes removing abrupt changes in velocity and positional jumps, and resampling sequences with uneven time intervals using linear interpolation to a fixed time interval (e.g., one point per second).

[0064] The normalization process uses the Min-Max normalization method, mapping all feature values ​​to the [0,1] interval. Specifically, for each feature dimension... ( Its normalization formula is:

[0065] ;

[0066] in, Indicates the first The sample at the th The original values ​​of each dimension, and These represent the minimum and maximum values ​​of the feature in the entire dataset, respectively. After normalization, all feature values ​​are distributed within the interval [0,1].

[0067] Constructing a time-series dataset using a sliding window is to adapt to the input requirements of the LSTM network, which requires converting continuous trajectory data into time-series samples. Specifically, the sliding window length is set to... Step size is For a length of The complete flight trajectory can be captured by a sliding window to construct a... The final time series dataset tensor has the following shape: [Number] sequence samples. ,in The total number of samples, 5 represents the length of the sliding window and 5 represents the 5 feature dimensions.

[0068] S2. Model Construction: An adversarial example generation model based on the improved Wasserstein distance generative adversarial network (WGAN-GP) is constructed. The model includes a generator and a discriminator, both of which are based on a multilayer long short-term memory (LSTM) network. The LSTM unit is the core component for handling temporal dependencies. For each time step... The calculation process inside the LSTM unit is as follows:

[0069] ForgetGate: Determines which information from the cell's previous state to discard;

[0070] ;

[0071] Input Gate: Determines which new information is updated into the cell state;

[0072] ;

[0073] ;

[0074] Cell State Update:

[0075] ;

[0076] Output gate: determines which information is output as a hidden state;

[0077] ;

[0078] ;

[0079] in, Represents the Sigmoid activation function. Represents the hyperbolic tangent activation function. and These represent the weight matrix and the bias term, respectively. Enter the current time. This is the hidden state from the previous moment;

[0080] The generator employs a sequence-to-sequence (Seq-to-Seq) network structure, aiming to generate a perturbed sequence with the same dimensions as the input sequence. The generator receives the original ADS-B sequence or its concatenation with Gaussian noise as input, captures temporal dependencies through LSTM units, and outputs a perturbed sequence with the same dimensions as the input sequence after linear layer mapping. Specifically, it includes:

[0081] The input layer receives normalized real ADS-B sequences, or concatenated data of Gaussian noise and original ADS-B data. ;

[0082] The hidden layer consists of two LSTM networks. The first LSTM layer has 64 hidden units and returns a complete sequence, while the second LSTM layer has 32 hidden units and returns a complete sequence.

[0083] The output layer is a fully connected layer that maps the 32-dimensional hidden state back to the 5-dimensional feature space, outputting a perturbation sequence. The generated adversarial examples are calculated as follows: ;

[0084] The discriminator employs a sequence-to-scalar (Seq-to-Scalar) network structure to evaluate the realism of sequences. It receives real or adversarial sample sequences, extracts sequence feature summaries, and outputs a scalar score through a fully connected layer to assess the realism of the input sequence. Specifically, this includes:

[0085] The input layer receives real ADS-B samples or generated adversarial samples. The input dimension is the same as the dimension of the perturbation sequence output by the generator, both being dimensional. ;

[0086] The hidden layer consists of two LSTM layers. The first LSTM layer has 64 hidden units and returns the complete sequence, while the second LSTM layer has 32 hidden units and returns only the hidden state of the last time step. ;

[0087] The output layer is a fully connected layer, which hides the state. The mapping is a 1-dimensional scalar, and the output is the CriticScore (real score), which is used to evaluate how realistic the input sequence is. The higher the score, the more the discriminator believes that the input is closer to the real data distribution.

[0088] S3. Composite Loss Function Design: To address the issues of "physical infeasibility" and "poor concealment" in existing adversarial examples, a multi-objective composite loss function is configured in step S2. The composite loss function is composed of a weighted average of adversarial loss, concealment loss, and temporal smoothness loss.

[0089] The expression for the multi-objective composite loss function is as follows:

[0090] ;

[0091] in, To combat the losses, For concealed losses, For time series smoothness loss, For hidden weights, For time series smoothness weights;

[0092] Combating losses Derived from the objective function of WGAN-GP, the generator aims to generate samples... Able to obtain high scores from the discriminator, thus mitigating losses. The expression is:

[0093] ;

[0094] in Batch size, which is the number of samples input to the model in a single training iteration. For the discriminator to the first One generated sample The rating, To generate samples, the training objective of the generator is to minimize... ;

[0095] This loss drives the generator to learn the statistical distribution characteristics of real data, ensuring that the generated samples can fool the discriminator;

[0096] To ensure the stealth of the attack, the energy of the disturbance must be limited, resulting in a loss of stealth. The L2 norm is used to penalize excessively large disturbance amplitudes, expressed as follows:

[0097] ;

[0098] in, The length of the sliding window. It is the perturbation sequence generated by the generator for the input sequence. For the first The perturbation sequence corresponding to each sample Let be the perturbation value of the i-th sample in the k-th dimension at time step t, and limit the magnitude of the perturbation to ensure the stealth of the attack;

[0099] This loss forces the generator to find the perturbation direction with the smallest amplitude while being able to deceive the discriminator. By minimizing this loss, the size of the perturbation is limited, preventing the attack from being detected by the human eye or simple threshold detection due to excessive perturbation. This solves the problem of coarse and redundant perturbations in traditional methods.

[0100] To prevent high-frequency jitter from disturbances, a timing smoothness loss is introduced. It is calculated by the difference between penalized perturbations at adjacent time points, and the expression is:

[0101] ;

[0102] in, and These represent the i-th sample at time step [i]. and The perturbation sequence is minimized to penalize drastic abrupt changes in the perturbation, forcing the generator to generate smoothly changing, continuous perturbations. This ensures that the generated flight trajectory conforms to flight dynamics in terms of position and velocity, resolving issues of physical inconsistency and temporal discontinuity, and improving the physical credibility of adversarial examples. In one embodiment, the concealment weight is used. Set to 10.0, timing smoothness weight. Set to 5.0.

[0103] S4. Adversarial Training: The model from step S2 is adversarially trained using the time-series dataset from step S1. To satisfy the 1-Lipschitz continuity condition of the Wasserstein distance and address the vanishing gradient problem during training, a gradient penalty (GP) term is introduced into the discriminator loss function to stabilize training. An asymmetric update strategy is used to optimize the network parameters. The discriminator loss function... Introducing a gradient penalty term, the expression is:

[0104] ;

[0105] in, To generate samples, To generate the sample distribution, For real data samples, For the true data distribution, This is the gradient penalty coefficient (default is 10). These are random interpolation points between real samples and generated samples;

[0106] To generate sample distribution Below, the mathematical expectation of the discriminator score;

[0107] For the true sample distribution Below, the mathematical expectation of the discriminator score;

[0108] For real samples With generated samples Random sampling points on the line, i.e. ,in ;

[0109] This constraint discriminator has a gradient norm close to 1 for changes in input, thus solving the gradient vanishing and exploding problems in traditional GAN ​​training;

[0110] The asymmetric update strategy is as follows: in each training round, the discriminator parameters are updated multiple times first, and then the generator parameters are updated once. The number of discriminator updates is [not specified]. Number of generator updates The ratio is 5:1, meaning that for every 5 updates to the discriminator parameters, the generator parameters are updated once, to ensure that the discriminator can provide accurate gradient guidance and achieve stable convergence of training.

[0111] In a specific implementation, adversarial training employs the following training steps:

[0112] Initialization: Randomly initialize the network parameters of the generator and discriminator.

[0113] Iterative training:

[0114] Step A (Update the discriminator):

[0115] (1) Sample a batch of real samples from the real dataset. ;

[0116] (2) The generator generates a batch of adversarial examples. ;

[0117] (3) Calculate random interpolation and its gradient;

[0118] (4) Calculate the total loss of the discriminator ;

[0119] (5) Update the discriminator parameters using the Adam optimizer;

[0120] (6) Repeat step A above for a total of Second-rate;

[0121] Step B (Update Generator):

[0122] (11) The generator generates a new batch of adversarial examples;

[0123] (12) Input the sample into the discriminator to obtain a score;

[0124] (13) Combination and Calculate the total loss of the generator ;

[0125] (14) Update generator parameters using the Adam optimizer;

[0126] (15) Perform step B above once;

[0127] Termination condition: Repeat the above iterations until the preset number of epochs is reached or the loss function converges.

[0128] S5. Input the target ADS-B time series data into the trained generator to generate a perturbation sequence. Superimpose the perturbation sequence onto the original sequence to obtain the ADS-B adversarial sample.

[0129] To verify the advanced nature of the method of the present invention, a detailed experimental evaluation was conducted.

[0130] 1. Definition of Evaluation Indicators

[0131] Attack Success Rate (ASR): The percentage of adversarial samples that are incorrectly identified as "normal" by anomaly detection models.

[0132] Concealment Score: Calculates the proportion of adversarial examples whose reconstruction error is below a normal threshold using an autoencoder trained only on normal data.

[0133] Diversity Score: Measures whether the distribution of generated samples covers the diversity patterns of the real data.

[0134] 2. Attack effectiveness against mainstream detection models

[0135] This embodiment selects five typical unsupervised anomaly detection models as attack targets, including LSTM-based prediction models, VAE reconstruction models, Transformer prediction models, OC-SVM, and LOF.

[0136] The experimental results show that:

[0137] For LSTM detection models: the ASR of the method of this invention reaches 99.5%, while that of the traditional FGSM is only 89.6%.

[0138] For VAE detection models: the ASR of the method of this invention reaches 96.2%, and the ASR of ZOO attack is 90.8%.

[0139] For the LOF (Local Outlier) model: This is the most difficult density-based model to attack. The success rate of traditional FGSM attacks is only 15.6%, while the method of this invention achieves 52.9%. This shows that the samples generated by this invention are extremely similar to real data in terms of local density features.

[0140] Average performance: Combining the five models, the adversarial examples generated by this invention achieve an average attack success rate (ASR) of 88.3% when facing various unsupervised anomaly detection models such as LSTM, VAE, Transformer, and OC-SVM, which is significantly better than the classic FGSM (73.24%) and ZOO (71.6%) attack methods.

[0141] 3. Sample quality and physical consistency analysis

[0142] The effect of the composite loss function was verified through ablation experiments:

[0143] Using only adversarial loss (V1 version): While the generated samples can fool the discriminator, the trajectories are jagged and contain many physically impossible sharp turns. Its stealth score is only 51.44%.

[0144] Increased concealment loss (V2 version): The perturbation amplitude is reduced, but the trajectory is still not smooth enough.

[0145] Full version (V3, this invention): Temporal smoothness loss introduced in this invention ( This effectively eliminates physical abrupt changes in the generated trajectory, making it conform to the dynamic characteristics of real flight; stealth loss ( This effectively controls the amplitude of perturbations. Experiments show that the "concealment score" and "diversity score" of the samples generated by this invention are as high as 95.88% and 92.15%, respectively, far exceeding existing technologies and making them extremely difficult for detection and defense mechanisms to identify.

[0146] 4. Visual analysis of attack strategies

[0147] By comparing the anomaly score distribution of adversarial examples (see Appendix) Figure 4 and attached Figure 5 ):

[0148] FGSM / ZOO strategy: The generated sample anomaly score distribution is very discrete. Although the anomaly scores of many samples are below the threshold, they are far from the threshold. This means that an unnecessary excessive perturbation has been applied, which is easily detected by the naked eye.

[0149] Visual analysis shows that the anomaly scores generated by this invention tend to cluster closely below the decision threshold of the detection model, creating a "flying close to the edge" attack effect. This strategy not only removes redundant perturbations but also exhibits strong transferability, meaning it maintains high-efficiency attack capabilities even when targeting heterogeneous models with unknown structures (such as transferring attacks from LSTM to VAEs).

[0150] The present invention Figure 1 The system demonstrates how it receives normal ADS-B sequences, generates perturbations through a generator, and simultaneously inputs real and generated data into a discriminator for evaluation. The entire process of using composite loss functions (adversarial loss, concealment loss, and temporal smoothness loss) to guide network parameter updates is also shown.

[0151] Figure 2 It demonstrates the sequence-to-sequence (Seq-to-Seq) LSTM structure used by the generator and its internal data flow, as well as the sequence-to-scalar (Seq-to-Scalar) LSTM structure used by the discriminator and how it outputs the authenticity score;

[0152] Figure 3 The red curve represents the generator loss, and the blue curve represents the discriminator loss. This shows that the loss value tends to stabilize as the training epochs increase, proving that the improved WGAN-GP model has good convergence and training stability.

[0153] Figure 4The distribution of outlier scores of the original samples, the samples generated by the method of this invention (V3), FGSM, and ZOO method were compared. The red dashed line represents the decision threshold. This figure visually shows that the scores of the samples generated by this invention are closely distributed below the threshold, and the perturbation redundancy is the lowest.

[0154] Figure 5 The invention demonstrates that even in heterogeneous model attack scenarios, the method of the present invention can still ensure that the generated sample scores cluster below the decision threshold of the VAE model, proving that the method of the present invention has excellent transfer attack capabilities.

[0155] The strategy of this invention is to generate sample anomaly scores that closely fit below the decision threshold. This indicates that the method of this invention can accurately calculate the minimum perturbation that "just" fools the model. This "edge-hugging attack" strategy not only has the highest concealment but also has extremely strong transferability—that is, it can still maintain efficient attack capabilities when targeting detection models with unknown structures (black-box attacks). This invention uses the WGAN-GP framework to replace the original GAN ​​and utilizes the Wasserstein distance and gradient penalty mechanism to effectively solve the problems of mode collapse and training instability, enabling the loss functions of the generator and discriminator to converge quickly and smoothly.

[0156] In summary, this invention, through a carefully designed composite objective function incorporating adversarial loss, concealment loss, and temporal smoothness loss, successfully solves the "domain mismatch" problem in existing methods for temporal data attacks. Experiments demonstrate that the samples generated by this method not only have a high attack success rate but also possess extremely high physical realism and concealment, making them an effective tool for evaluating and improving the security of air traffic control surveillance systems.

[0157] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0158] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An improved WGAN-GP method for generating adversarial examples from ADS-B time series data, characterized by: Includes the following steps: S1. Data Construction: Obtain historical ADS-B flight data, and after cleaning and denoising, extract features in five dimensions: longitude, latitude, altitude, speed, and heading. Normalize the data and construct a time series dataset using a sliding window. S2. Model Construction: An adversarial sample generation model based on an improved Wasserstein distance generative adversarial network is built. The model includes a generator and a discriminator, both of which are multilayer long short-term memory networks (LSTM) as their core components. S3. Composite Loss Function Design: Configure a multi-objective composite loss function for the generator in step S2. The composite loss function is composed of a weighted average of adversarial loss, concealment loss, and temporal smoothness loss. S4. Adversarial Training: Use the time series dataset from step S1 to perform adversarial training on the model from step S2. During training, a gradient penalty term is introduced into the discriminator loss function to stabilize training, and an asymmetric update strategy is used to optimize network parameters. S5. Input the target ADS-B time series data into the trained generator to generate a perturbation sequence. Superimpose the perturbation sequence onto the original sequence to obtain the ADS-B adversarial sample.

2. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 1, characterized in that: In step S1: Data cleaning and denoising includes removing abrupt changes in velocity and location; for sequences with uneven time intervals, linear interpolation is used to resample them to a fixed time interval. The normalization process uses the Min-Max normalization method to map all feature values ​​to the interval [0,1]. The time series dataset tensor constructed by the sliding window has the following shape: , The total number of samples, 5 represents the length of the sliding window and 5 represents the 5 feature dimensions.

3. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 2, characterized in that: In step S2, the generator employs a sequence-to-sequence network structure, receiving the original ADS-B sequence or its concatenation with Gaussian noise as input. It captures temporal dependencies through LSTM units and outputs a perturbed sequence with the same size as the input sequence after linear layer mapping. Specifically, this includes: The input layer receives normalized real ADS-B sequences, or spliced ​​data of Gaussian noise and original ADS-B data; The hidden layer consists of two LSTM networks. The first LSTM layer has 64 hidden units and returns a complete sequence, while the second LSTM layer has 32 hidden units and returns a complete sequence. The output layer is a fully connected layer that maps the 32-dimensional hidden state back to the 5-dimensional feature space and outputs a perturbation sequence.

4. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 3, characterized in that: In step S2, the discriminator employs a sequence-to-scalar network structure. It receives real or adversarial sample sequences, extracts sequence feature summaries, and outputs a scalar score through a fully connected layer to evaluate the realism of the input sequence. Specifically, this includes: The input layer receives real ADS-B samples or generated adversarial samples, and the input dimension is consistent with the dimension of the perturbation sequence output by the generator; The hidden layer consists of two LSTM networks. The first LSTM layer has 64 hidden units and returns the complete sequence, while the second LSTM layer has 32 hidden units and only returns the hidden state of the last time step. The output layer is a fully connected layer that maps the hidden states to 1-dimensional scalars and outputs real-valued scores to evaluate the authenticity of the input sequence.

5. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 4, characterized in that: The expression for the multi-objective composite loss function in step S3 is as follows: ； in, To combat the losses, For concealed losses, For time series smoothness loss, For hidden weights, This is the weight for time series smoothness.

6. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 5, characterized in that: The resistance loss The expression is: ； in, Batch size, which is the number of samples input into the model for a single training iteration. For the discriminator to the first One generated sample The rating, To generate samples, the training objective of the generator is to minimize... .

7. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 6, characterized in that: The hidden loss The L2 norm is used to penalize excessively large disturbance amplitudes, expressed as follows: ； in, The length of the sliding window. It is the perturbation sequence generated by the generator for the input sequence. For the first The perturbation sequence corresponding to each sample Let be the perturbation value of the i-th sample in the k-th dimension at time step t. The magnitude of the perturbation is limited to ensure the stealth of the attack.

8. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 7, characterized in that: The time-series smoothness loss It is calculated by the difference between penalized perturbations at adjacent time points, and the expression is: ； in, and These represent the i-th sample at time step [i]. and The perturbation sequence is minimized to induce the generator to produce a gradually changing perturbation, thereby improving the physical credibility of the adversarial example.

9. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 8, characterized in that: The discriminator loss function in step S4 Introducing a gradient penalty term, the expression is: ； in, To generate samples, To generate the sample distribution, For real data samples, For the true data distribution, The gradient penalty coefficient is... These are random interpolation points between real samples and generated samples; To generate sample distribution Below, the mathematical expectation of the discriminator score; For the true sample distribution Below, the mathematical expectation of the discriminator score; For real samples With generated samples Random sampling points on the line, i.e. ,in ; The gradient penalty term is used to satisfy the 1-Lipschitz constraint. By having the gradient norm of the constraint discriminator approach 1 for changes in the input, the vanishing and exploding gradient problems in traditional GAN ​​training are solved.

10. The improved WGAN-GP method for generating adversarial examples for ADS-B time series data according to claim 9, characterized in that: The asymmetric update strategy in step S4 is as follows: In each round of training, the discriminator parameters are updated multiple times first, and then the generator parameters are updated once. The number of discriminator updates is... Number of generator updates The ratio is 5:1, meaning that the generator parameters are updated once for every 5 updates to the discriminator parameters.

Images