Wireless communication signal countermeasure sample generation method and system based on dual-domain representation

Abstract

This invention discloses a method and system for generating adversarial examples for wireless communication signals based on dual-domain representation, belonging to the field of wireless communication security. It addresses the problems of existing methods that directly add perturbations to the IQ domain of the signal, resulting in significant damage to physical properties and poor cross-model transfer capabilities. This invention employs a two-stage perturbation strategy: First, in the amplitude domain stage, the signal amplitude and phase are extracted, and the model's gradient with respect to amplitude is calculated. Based on this, a relatively proportional energy perturbation is introduced to reconstruct the signal, interfering with energy-dependent network layers by altering the signal envelope characteristics. Second, in the IQ domain momentum iteration stage, a momentum mechanism is introduced, and the gradient is normalized using the L1 norm. Historical momentum is accumulated to smooth the update direction, and the perturbation is iteratively optimized on both the real and imaginary parts. This invention's dual-representation collaborative strategy effectively mitigates gradient oscillations while maintaining high signal waveform concealment, significantly improving the adversarial strength of adversarial examples and their transfer capability across heterogeneous multi-task models.

Description

Technical Field

[0001] This invention relates to the intersection of wireless communication security and deep learning, and in particular to a method and system for generating adversarial examples for wireless communication signals based on dual-domain representation. Background Technology

[0002] Deep learning has been widely applied in intelligent wireless communication and electronic warfare systems for tasks such as automatic modulation recognition, signal detection, and direction-of-arrival estimation. However, deep neural networks are vulnerable to adversarial attacks. Most existing mainstream adversarial attack methods (such as FGSM and PGD) directly superimpose perturbations on the IQ sample domain (real and imaginary parts) of the signal. Although these methods can reduce the classification performance of the model to some extent, they still have significant limitations:

[0003] First, the perturbation relies heavily on gradient information based on digital values, ignoring the inherent physical characteristics of the modulated signal (such as energy distribution and envelope structure).

[0004] Second, the perturbation is limited to the IQ numerical space for searching, which results in limited attack effectiveness of adversarial examples when transferring across models, especially exhibiting low stability under high perturbation intensity. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies and achieve the goal of maintaining signal physical characteristics and improving cross-mode transfer capability, the present invention adopts the following technical solution:

[0006] The method for generating adversarial examples for wireless communication signals based on dual-domain representation includes the following two stages:

[0007] Amplitude Domain Relative Perturbation Stage: Acquire the original complex baseband wireless communication signal, separate its in-phase I and quadrature Q components, and calculate the signal amplitude; while keeping the original signal phase unchanged, calculate the gradient of the target model loss function with respect to the signal amplitude, and introduce a relatively proportional perturbation to the signal amplitude along the gradient direction to reconstruct a first-stage perturbation signal; this step can finely change the energy distribution characteristics of the signal's underlying layer, causing the IQ signal to shift in power statistics, thereby effectively interfering with energy-dependent network models;

[0008] IQ Domain Momentum Iteration Perturbation Stage: Starting from the first-stage perturbation signal, a momentum iteration mechanism is introduced to calculate and normalize the gradient of the target model loss function relative to the current IQ domain signal. The normalized gradient is then weighted and summed with the historical accumulated momentum to update the accumulated gradient, thereby smoothing the update direction and alleviating gradient oscillations. The sign direction of the accumulated gradient is used to update the signal step size in the IQ domain. This process is iterated until a preset number of iterations is reached, generating the final adversarial sample for wireless communication signals.

[0009] Furthermore, the specific calculation process for the amplitude domain relative disturbance stage includes:

[0010] The original complex baseband wireless communication signal is represented in complex form. To calculate its amplitude ;

[0011] Calculate the target model loss function Relative to amplitude gradient ;

[0012] Based on amplitude and gradient This generates a new amplitude after introducing a relative perturbation:

[0013]

[0014] in, This represents the set relative disturbance intensity coefficient. Represents a symbolic function.

[0015] Furthermore, in the amplitude domain relative perturbation stage, the process of reconstructing the first-stage perturbation signal is achieved by extracting the phase of the original wireless communication signal. Combined with the new amplitude With the original phase Reconstructing the new in-phase component of the complex baseband signal and new orthogonal components and the new in-phase component and new orthogonal components The first-stage disturbance signal is obtained by splicing the signals together.

[0016] Furthermore, the new in-phase component is obtained by multiplying the new amplitude by the cosine of the original phase; the new quadrature component is obtained by multiplying the new amplitude by the sine of the original phase.

[0017]

[0018] .

[0019] Furthermore, in the IQ domain momentum iteration perturbation stage, a loss function is constructed based on the target model and the true label, the gradient of the loss function relative to the current step IQ domain signal is calculated, and the gradient is then... Norm normalization, the product of the set momentum factor and the cumulative gradient of the current step to be iterated, plus the ratio of the gradient to its normalized value, yields the cumulative gradient for the next step:

[0020]

[0021] in, This represents the set momentum factor. This represents the cumulative gradient from the previous iteration. The loss function is represented relative to the current i-th Wheel IQ domain signal gradient, This indicates that the gradient is being processed. Norm normalization, Represent the target model, This is a real label.

[0022] Furthermore, in the IQ domain momentum iterative perturbation stage, the signal step size update for each iteration is based on the accumulated gradient. Symbol and iteration update step size The product of the two, plus the IQ domain signal of the current step. To obtain the next step IQ domain signal The formula is:

[0023] .

[0024] Furthermore, the iterative update step size For the total preset disturbance budget The ratio of the total number of iterations T to the total number of iterations limits the signal projection to the original signal after each update. The total preset disturbance budget described by positive and negative values between .

[0025] Furthermore, the method is applied to adversarial robustness assessment. The final adversarial samples of wireless communication signals are input into the radio receiver or signal classification model to be evaluated, and the decrease in classification accuracy of the radio receiver or signal classification model when interfered with by adversarial samples is tested to assess its adversarial robustness.

[0026] The wireless communication signal adversarial sample generation system based on dual-domain representation includes an amplitude domain perturbation module and a momentum iteration perturbation module. The wireless communication signal adversarial sample generation method based on dual-domain representation is adopted, and the amplitude domain relative perturbation stage and the IQ domain momentum iteration perturbation stage are executed by the amplitude domain perturbation module and the momentum iteration perturbation module, respectively.

[0027] Furthermore, the system also includes an evaluation module, which acquires the final adversarial examples of wireless communication signals and inputs them into the radio receiver or signal classification model to be evaluated. The adversarial robustness is evaluated by testing the decrease in classification accuracy of the radio receiver or signal classification model when it is interfered with by adversarial examples.

[0028] The advantages and beneficial effects of this invention are as follows:

[0029] The relative perturbation in the amplitude domain of this invention focuses on disrupting the overall energy characteristics to weaken the global discriminative ability, while the momentum perturbation in the IQ domain misleads the discriminator at the symbol level. The synergistic effect of the two (dual representation mechanism) not only avoids gradient oscillations, but also greatly enhances the adversarial strength and cross-model transfer ability of adversarial examples while ensuring the time-frequency structure and waveform concealment (differences invisible to the human eye). Attached Figure Description

[0030] Figure 1 This is a flowchart of the method in an embodiment of the present invention.

[0031] Figure 2 This is a schematic diagram illustrating the principle of counter-attack and the change of decision boundary in an embodiment of the present invention.

[0032] Figure 3 This is a schematic diagram comparing the time-domain waveforms of the original sample and adversarial samples with different interference coefficients in an embodiment of the present invention.

[0033] Figure 4 This is an accuracy curve of the DOA teacher under different attacks in an embodiment of the present invention.

[0034] Figure 5 This is an accuracy curve of the DSSS teacher under different attacks in an embodiment of the present invention.

[0035] Figure 6 This is an accuracy curve of the MOD teacher under different attacks in an embodiment of the present invention. Detailed Implementation

[0036] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0037] This embodiment provides a method for generating adversarial examples for wireless communication signals based on dual-domain representation, comprising two mutually cooperating core stages: a relative perturbation stage in the amplitude domain and an iterative update stage in the IQ domain. For example... Figure 1 As shown, the specific steps are as follows:

[0038] Step S1: Acquire the original signal and perform amplitude-phase separation;

[0039] Given a primitive complex baseband wireless communication signal, decompose it into in-phase (I) and quadrature (Q) components. For the input signal in complex form... Its magnitude at the current moment Represented as:

[0040]

[0041] Its original phase Represented as:

[0042]

[0043] Step S2, First Stage: Amplitude Domain Relative Perturbation;

[0044] Unlike adding random perturbations independently to the I and Q channels, this step directly calculates the classification loss function of the target model. (in For the proxy model, (True label) relative to signal amplitude gradient Specific magnitude gradient The gradient can be obtained from the I / Q channel gradient using the chain rule:

[0045]

[0046] Based on the obtained gradient direction, a relative perturbation is applied in the amplitude domain to obtain a new amplitude after perturbation. :

[0047]

[0048] in, This is the relative disturbance intensity coefficient (e.g., set to 0.7%). This is the sign function. This step not only changes the amplitude distribution of the signal, but also forces statistical biases in the power characteristics of the IQ signal, specifically targeting and misleading model layers that rely on energy characteristics for perception.

[0049] Step S3: Reconstruct the first-stage disturbance signal based on the new amplitude;

[0050] New amplitude after perturbation Compared with the original phase extracted in step S1 Reconstructing the digital baseband signal:

[0051]

[0052]

[0053] Will and The segments are spliced ​​together to form a one-stage perturbation signal that includes amplitude and energy variations, denoted as... .

[0054] Step S4, Second Stage: IQ Domain Momentum Iteration Perturbation;

[0055] Based on the first-stage perturbation signal, a momentum iteration mechanism is introduced to further refine the search for efficient perturbation directions. The total number of iterations T (e.g., T=5) and the step size for each iteration are set. (Where epsilon is the total preset perturbation constraint limit). Initialize the accumulated gradient. .

[0056] In the Tth iteration (T=1 to T):

[0057] First, calculate the proxy model loss function with respect to the current adversarial example. The gradient, and utilize The norm is normalized.

[0058] Subsequently, the momentum factor was introduced. (For example Update cumulative gradients :

[0059]

[0060] Finally, the signal is adjusted directly on the real and imaginary parts along the sign direction of the updated accumulated gradient, and then projected back into the legal perturbation range:

[0061]

[0062] After T iterations, the final adversarial signal is output. Introducing a gradient accumulation term smoothly updates the direction, effectively mitigating the gradient oscillation problem that easily occurs during direct solution, thereby significantly improving the transfer capability of adversarial examples when crossing different model boundaries. After adversarial training, the model's decision boundary changes, as shown in the following effect. Figure 2 As shown.

[0063] Step S5: Evaluation of the effectiveness and stealth of counter-attacks.

[0064] In the effect verification of the embodiments of the present invention:

[0065] (1) Attack Success Rate: Under the same interference coefficient, compared with traditional FGSM, BIM, MIM and PGD methods, the DRMA algorithm proposed in this invention shows the highest attack success rate (the steepest decrease in model accuracy) in three tasks: DSSS detection, modulation identification (MOD) and direction of arrival (DOA) estimation. For example, in the DSSS task, when the interference coefficient is 0.02, the attack effect of DRMA is 6.73% higher than the strongest baseline method, MIM. The specific effect figure under the DOA task is shown in the figure below. Figure 4 As shown in the image, the specific effect of the DSSS task is as follows: Figure 5 As shown in the image, the specific effect of the MOD task is as follows: Figure 6 As shown.

[0066] (2) High stealth: By comparing the time-domain waveforms of the original modulation recognition signal sample and the adversarial sample generated by DRMA, the results show that the signal waveform after introducing the perturbation remains highly consistent with the original sample, possessing extremely high stealth. The signal comparison diagrams under different perturbations are shown below. Figure 3 As shown, within an acceptable range, the signal of the adversarial sample is not significantly different from the original signal in the time domain.

[0067] The present invention also proposes a wireless communication signal adversarial sample generation system based on dual-domain representation, including an amplitude domain perturbation module and a momentum iterative perturbation module.

[0068] Amplitude domain perturbation module: used to acquire the amplitude and phase of the original signal, calculate the gradient of the loss function with respect to the amplitude, generate a new amplitude by introducing a relatively proportional energy perturbation, and reconstruct a first-stage perturbation signal by combining it with the original phase;

[0069] Momentum Iteration Perturbation Module: This module receives the first-stage perturbation signal, calculates the gradient of the loss function with respect to the current IQ component and performs L1 norm normalization, updates the cumulative gradient by combining historical momentum, iteratively updates the signal in the IQ space along the sign direction of the cumulative gradient, and generates the final adversarial sample.

[0070] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating adversarial examples for wireless communication signals based on dual-domain representation, characterized in that: Amplitude domain relative perturbation stage: acquire the original complex baseband wireless communication signal, separate its in-phase I and quadrature Q components and calculate the signal amplitude; while keeping the original signal phase unchanged, calculate the gradient of the target model loss function with respect to the signal amplitude, and introduce a relatively proportional perturbation to the signal amplitude along the gradient direction to reconstruct a first-stage perturbation signal. IQ domain momentum iteration perturbation stage: Starting from the first stage perturbation signal, a momentum iteration mechanism is introduced to calculate and normalize the gradient of the target model loss function relative to the current IQ domain signal. The normalized gradient is weighted and summed with the historical cumulative momentum to update the cumulative gradient. The sign direction of the cumulative gradient is used to update the step size of the signal in the IQ domain. This process is repeated iteratively until a preset number of iterations are reached to generate the final adversarial sample of the wireless communication signal.

2. The method of claim 1, wherein the method is based on a dual-domain representation of the wireless communication signal. The specific calculation process for the relative disturbance stage in the amplitude domain includes: The original complex baseband wireless communication signal is represented in complex form to calculate its amplitude; Calculate the gradient of the target model loss function with respect to the magnitude; Based on the magnitude and gradient, a new magnitude is generated after introducing a relative perturbation.

3. The method of claim 1, wherein the method is based on a dual-domain representation of the wireless communication signal. In the amplitude domain relative disturbance stage, the process of reconstructing the first-stage disturbance signal is to extract the phase of the original wireless communication signal, combine the new amplitude with the original phase, reconstruct the new in-phase component and the new quadrature component of the complex baseband signal, and then splice the new in-phase component and the new quadrature component to obtain the first-stage disturbance signal.

4. The method for generating adversarial examples for wireless communication signals based on dual-domain representation according to claim 3, characterized in that: The new in-phase component is obtained by multiplying the new amplitude by the cosine of the original phase; the new quadrature component is obtained by multiplying the new amplitude by the sine of the original phase.

5. The method for generating adversarial examples for wireless communication signals based on dual-domain representation according to claim 1, characterized in that: In the IQ domain momentum iteration perturbation stage, a loss function is constructed based on the target model and the true label. The gradient of the loss function relative to the current step IQ domain signal is calculated, and the gradient is then... Norm normalization is achieved by multiplying the set momentum factor by the cumulative gradient of the current step to be iterated, and adding the ratio of the gradient to its normalized value to obtain the cumulative gradient of the next step.

6. The method for generating adversarial examples for wireless communication signals based on dual-domain representation according to claim 1, characterized in that: In the IQ domain momentum iterative perturbation stage, the signal step size update for each iteration is based on the product of the sign of the accumulated gradient and the iterative update step size, plus the current IQ domain signal, to obtain the next IQ domain signal.

7. The method for generating adversarial examples for wireless communication signals based on dual-domain representation according to claim 6, characterized in that: The iterative update step size is the ratio of the total preset perturbation budget to the total number of iterations. After each update, the signal projection is limited to the original signal between the positive and negative values ​​of the total preset perturbation budget.

8. The method for generating adversarial examples for wireless communication signals based on dual-domain representation according to any one of claims 1 to 7, applied to adversarial robustness evaluation, characterized in that: The resulting adversarial examples of wireless communication signals are input into the radio receiver or signal classification model to be evaluated. The classification accuracy of the radio receiver or signal classification model is tested when it is interfered with by the adversarial examples in order to evaluate its adversarial robustness.

9. A wireless communication signal adversarial example generation system based on dual-domain representation, comprising an amplitude domain perturbation module and a momentum iteration perturbation module, characterized in that: The wireless communication signal adversarial sample generation method based on dual-domain representation according to any one of claims 1 to 7 is adopted, wherein the amplitude domain relative perturbation stage and the IQ domain momentum iterative perturbation stage are executed by the amplitude domain perturbation module and the momentum iterative perturbation module, respectively.

10. The wireless communication signal adversarial sample generation system based on dual-domain representation according to claim 9, characterized in that: The system also includes an evaluation module, which acquires the final adversarial examples of wireless communication signals and inputs them into the radio receiver or signal classification model to be evaluated. The system evaluates the adversarial robustness by testing the decrease in classification accuracy of the radio receiver or signal classification model when it is interfered with by adversarial examples.

Images