An attack sample generation method and device based on a generative adversarial network

Abstract

The embodiment of the application relates to an attack sample generation method and device based on a generative adversarial network, wherein the method comprises the following steps: separating and constructing a fraud seed set from a pre-acquired training set of credit card transaction data; randomly sampling multiple noise vector inputs to an initial generator to generate multiple fake samples; selecting the same number of fraud samples as the fake samples from the fraud seed set as target reference samples to input a pre-trained integrated detector to obtain a detection result; calculating multiple losses of the initial generator based on the detection result and a pre-defined loss function, summing the total loss to update the parameters of the initial generator to obtain an updated generator; using the updated generator to generate new fake samples to input the integrated detector for cyclic confrontation until a target generator is obtained, and using the fake samples generated by the target generator as attack samples. The scheme can generate high-quality attack samples to provide reliable basis for fraud detection system optimization.

Description

Technical Field

[0001] This invention relates to the field of computer vision technology, and in particular to a method and apparatus for generating attack samples based on generative adversarial networks. Background Technology

[0002] Early fraud detection primarily relied on rule-based systems, using expert experience to set thresholds to identify abnormal transactions. With the development of machine learning, methods such as logistic regression, random forests, and support vector machines were widely used. The rise of deep learning further improved detection capabilities with architectures like CNNs, RNNs, and LSTMs, but the problem of class imbalance still persists, meaning that fraudulent transactions typically account for only 0.1%-0.2%, causing models to favor the normal class.

[0003] To alleviate class imbalance, researchers have proposed SMOTE (Synthetic Minority Oversampling Technique) and its variants, which generate synthetic samples by linear interpolation between minority class samples. However, the samples generated by these methods are too simple to capture the complex distribution of high-dimensional fraudulent data, and are prone to overfitting.

[0004] In other words, in current data-driven security defense systems, the vulnerability of detection models often stems from over-reliance on samples with specific distributions. Generative adversarial networks (GANs), due to their ability to learn from real sample distributions and synthesize realistic forged samples, provide a feasible technical path for generating attack samples. However, existing generation methods often generate single or low-quality adversarial samples due to a lack of in-depth modeling of the detector's internal decision-making mechanisms, making it difficult to effectively reveal potential vulnerabilities in the detection system. Summary of the Invention

[0005] The purpose of this invention is to provide an attack sample generation method and apparatus based on generative adversarial networks. By constructing a multi-objective optimized generative adversarial network, it actively generates novel attack samples that can effectively evade existing detection systems, providing a reliable basis for targeted optimization of detection systems.

[0006] To address the aforementioned problems, in a first aspect, embodiments of the present invention provide a method for generating attack samples based on generative adversarial networks, comprising: Normal samples and fraudulent samples are separated from the training set of pre-acquired credit card transaction data. A fraud seed set is constructed based on the separated fraudulent samples. Multiple noise vectors are randomly sampled and input into an initial generator to generate multiple fake samples. The number of fake samples in the fraud seed set is the same as the number of fake samples as the target reference samples. The fake samples and the target reference samples are input into a pre-trained ensemble detector to obtain the detection results of the ensemble detector for each sample. Based on the detection results and a predefined multinomial loss function, the multinomial loss of the initial generator is calculated. The multinomial losses are combined and summed according to preset weights to obtain the total loss. The parameters of the initial generator are updated using the total loss to obtain an updated generator. New fake samples are generated using the updated generator and input into the ensemble detector for cyclic adversarial processing until a preset convergence condition is met to obtain the target generator. The fake samples generated by the target generator are used as attack samples.

[0007] Another embodiment of the present invention provides an attack sample generation device based on generative adversarial networks, comprising: The data acquisition module is used to separate normal samples and fraudulent samples from the training set of pre-acquired credit card transaction data, and construct a fraud seed set based on the separated fraudulent samples. The sample forgery module is used to randomly sample multiple noise vectors and input them into an initial generator to generate multiple forged samples. The number of fraudulent samples selected from the fraud seed set is the same as the number of forged samples, which are then used as target reference samples. The forged samples and the target reference samples are input into a pre-trained ensemble detector to obtain the detection results of the ensemble detector for each sample. The generator update module is used to calculate the multivariate loss of the initial generator based on the detection results and a predefined multivariate loss function. The multivariate losses are combined and summed according to preset weights to obtain the total loss. The parameters of the initial generator are updated using the total loss to obtain an updated generator. The recurrent adversarial module is used to generate new forged samples using the updated generator and input them into the ensemble detector for recurrent adversarial testing until a preset convergence condition is met to obtain a target generator. The forged samples generated by the target generator are used as attack samples.

[0008] This invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the attack sample generation method based on generative adversarial networks as described above.

[0009] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the attack sample generation method based on generative adversarial networks as described above.

[0010] In some embodiments, the step of pre-acquiring the training set as described above includes: acquiring credit card transaction sample data containing real fraud data, performing missing value imputation on each sample data; performing max-min normalization on the imputed sample data to obtain a normalized original feature dataset, and dividing the original feature dataset into the training set and the test set according to a preset ratio.

[0011] In some embodiments, the step of obtaining the pre-trained integrated detector as described above includes: constructing a plurality of heterogeneous detectors, wherein the plurality of heterogeneous detectors include at least: a multilayer perceptron, a one-dimensional convolutional neural network, and a lightweight convolutional neural network; independently training each of the heterogeneous detectors on the training set using a cross-entropy loss function until a preset training stopping condition is met, thereby obtaining each of the trained heterogeneous detectors; and integrating the trained heterogeneous detectors to obtain the integrated detector.

[0012] In some embodiments, the initial generator described above employs a multilayer perceptron, and the detection result includes: a result label and label confidence level for determining whether the input sample is a normal sample or a fraudulent sample; the multiple loss includes at least two or any combination of high-confidence avoidance loss, hierarchical feature matching loss, multi-target loss, and hard boundary loss; the step of calculating the multiple loss of the initial generator based on the detection result and a predefined multiple loss function includes: calculating the high-confidence avoidance loss using a preset high-confidence loss function based on the result label and label confidence level corresponding to the fraudulent sample, wherein the high-confidence avoidance loss is used to constrain the generator to update in the direction of generating the fraudulent sample that is determined to be a normal sample with a preset high confidence level.

[0013] In some embodiments, the detection results described above further include: target feature vectors extracted from each neural network layer of the ensemble detector for the input forged sample, and reference feature vectors extracted from each neural network layer of the ensemble detector for the input fraud sample; the calculation of the multinomial loss of the initial generator based on the detection results and a predefined multinomial loss function includes: calculating the hierarchical feature matching loss using a preset feature matching loss function based on the target feature vectors corresponding to the forged sample in each neural network layer and the reference target feature vectors corresponding to the fraud sample in each neural network layer; the hierarchical feature matching loss is used to constrain the generator to update in the direction of generating forged samples whose internal feature similarity to the fraud sample is greater than a similarity threshold.

[0014] In some embodiments, the method described above further includes: randomly selecting a preset number of normal samples in the training set and extracting normal feature vectors from the normal samples; the step of calculating the multi-objective loss of the initial generator based on the detection result and a predefined multi-objective loss function includes: calculating the multi-objective loss using a preset multi-objective loss function based on the target feature vector, the reference target feature vector, and the normal feature vector; the multi-objective loss is used to constrain the distance between each of the fake samples generated by the generator and between the fake samples and the normal samples in the feature space.

[0015] In some embodiments, the method described above further includes: calculating the feature centers of a preset number of normal samples as first feature centers, and calculating the feature centers of the fraud samples in the fraud seed set as second feature centers; the step of calculating the multinomial loss of the initial generator based on the detection result and a predefined multinomial loss function further includes: calculating the hard boundary loss based on the target feature vector, the first feature center and the second feature center using a preset hard boundary loss function, wherein the hard boundary loss is used to constrain the fake samples generated by the generator to update in a direction that moves away from the first feature center and closer to the second feature center in the feature space.

[0016] In some embodiments, the method described above further includes: after a preset number of rounds of cyclical adversarial testing, obtaining multiple forged samples generated by the current generator; inputting the multiple forged samples into the integrated detector to obtain the current detection result, filtering target forged samples with an avoidance rate greater than the avoidance threshold based on the current detection result; and adding the target forged samples to the fraud seed set.

[0017] In some embodiments, the method described above further includes: using a trained one-dimensional convolutional neural network detector to calculate the probability of each original feature outputting as a normal class for its corresponding sample, performing attribution calculation, taking the average absolute attribution value of all samples and arranging them in descending order, and outputting a ranking of key original features that induce misjudgment; inputting the attack sample into the one-dimensional convolutional neural network detector, returning the pooled attention weight matrix, calculating the average attention weight of each dimension on all samples, and outputting a preset number of pooled feature indices with the highest weights; selecting successful evasion samples that are judged as normal by the one-dimensional convolutional neural network detector from the attack samples; performing attribution calculation on the successful evasion samples, and outputting a first number of key features in descending order; selecting representative samples from the successful evasion samples, determining the target key features whose attribution value is greater than the attribution threshold corresponding to the representative samples, and performing attribution direction analysis based on the key original features, the pooled feature indices, and the target key features.

[0018] This embodiment provides multi-dimensional supervision signals through an integrated detector. By fusing loss functions with multiple constraints, the generator continuously evolves in a preset direction to generate higher quality and more realistic attack samples. The entire generation process requires no manual design and is entirely data-driven, exhibiting good adaptability and generalization ability. It can be widely applied to the security assessment and iterative optimization of fraud detection systems for various credit transaction anti-fraud purposes, thereby improving the reliability of fraud detection systems. Attached Figure Description

[0019] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0020] Figure 1 This is a flowchart illustrating the attack sample generation method based on generative adversarial networks according to the first embodiment of the present invention. Figure 2 This is a flowchart illustrating the training ensemble detector according to the second embodiment of the present invention. Figure 3 This is a flowchart illustrating the attack sample generation method based on generative adversarial networks according to the fourth embodiment of the present invention. Figure 4 This is a flowchart illustrating the attack sample generation method based on generative adversarial networks according to the fifth embodiment of the present invention. Figure 5 This is a schematic diagram of the attack sample generation device based on generative adversarial networks according to the sixth embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of the electronic device according to the seventh embodiment of the present invention. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions of this disclosure, and to fully understand and implement the process of how this disclosure applies technical means to solve technical problems and achieve corresponding technical effects, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, not all embodiments. The embodiments of this disclosure and the various features within them can be combined with each other without conflict, and the resulting technical solutions are all within the protection scope of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort should fall within the protection scope of this disclosure.

[0022] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0023] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0024] Based on the aforementioned novel backdoor, the first embodiment of this invention relates to a method for generating attack samples based on generative adversarial networks, such as... Figure 1 As shown, the method in this embodiment includes the following steps: Step 101: Separate normal samples and fraud samples from the training set of pre-acquired credit card transaction data, and construct a fraud seed set based on the separated fraud samples.

[0025] Specifically, within the framework of Generative Adversarial Networks (GANs), the generator needs a clear learning objective to effectively synthesize forged samples with fraudulent characteristics. However, directly learning sparse fraud patterns from massive amounts of data can easily lead to pattern collapse or unstable training. Therefore, this embodiment constructs a seed set by pre-acquired, pre-processed, real and labeled fraudulent samples selected from the training set, providing a realistic prototype for the subsequent generation process. The fraud seed set is equivalent to the prior knowledge base acquired by the generator in the early stages of training, and its size can be controlled based on computing resources and sample representativeness. This embodiment does not impose a specific limit on the number. In the specific implementation, the training set typically includes user identifiers, transaction behavior features, and category labels. After data loading is completed, this step scales each feature to a uniform numerical range according to the standardized operations in the data preprocessing flow, and separates the corresponding original features and labels from the training set. Then, based on the label values, the samples are divided into normal and fraud sets, and some or all samples are extracted from the fraud set to construct the fraud seed set.

[0026] Step 102: Randomly sample multiple noise vectors and input them into the initial generator to generate multiple fake samples. Select the same number of fake samples as the target reference samples from the fake seed set. Input the fake samples and the target reference samples into the pre-trained ensemble detector to obtain the detection results of the ensemble detector for each sample.

[0027] Specifically, the basic paradigm of Generative Adversarial Networks (GANs) is to drive the generator's continuous optimization through an adversarial game between the generator and the discriminator. However, in traditional GANs, the discriminator only outputs the binary classification probability of a sample's authenticity, failing to provide the generator with multi-dimensional improvement directions. Therefore, this embodiment uses a pre-trained ensemble detector to replace the traditional discriminator. This ensemble detector contains multiple base detectors with different structures, capable of discriminating input samples from different receptive fields and feature abstraction levels, simulating the real-world environment where multiple detection mechanisms coexist in actual detection systems. In this step, the ensemble detector has already completed supervised binary classification training on the same training set before the generator begins training, and its parameters remain frozen during the generator training process.

[0028] In each iteration of generator training, the generator receives a set of noise vectors randomly sampled from a standard normal or uniform distribution. These are then transformed into fake samples with the same feature dimensions as real samples through multiple nonlinear mappings. Simultaneously, a set of real fraud samples, the same number as the current fake samples, is randomly drawn from the fraud seed set as a target reference for feature alignment. These samples are then fed into a pre-trained ensemble detector. Each detector within the ensemble performs forward propagation, generating predicted probabilities for the normal class at the output layer and intermediate feature representations at the hidden layers. These outputs collectively constitute the detection result.

[0029] Step 103: Calculate the multivariate loss of the initial generator based on the detection results and the predefined multivariate loss function. Combine the multivariate losses according to the preset weights and sum them to obtain the total loss. Use the total loss to update the parameters of the initial generator to obtain the updated generator.

[0030] Specifically, in adversarial example generation, if only the final output probability of the detector is used as the loss criterion, the generator can easily fall into speculative behavior. That is, although the generated fake samples may be misjudged as normal at the output level, their intrinsic feature distribution is far from that of real fraud samples. In this case, the low-quality adversarial samples generated by the generator cannot provide an effective reference for strengthening the defense of the fraud detection system. To this end, this embodiment introduces multiple loss functions from multiple dimensions to impose constraints on the generator. Each loss function corresponds to a different optimization objective. This embodiment does not impose restrictions on the specific loss functions. After calculating each loss according to the loss function, the losses are weighted and summed according to preset weights to obtain the total loss. Then, the partial derivatives of the total loss with respect to each weight parameter of the generator are calculated one by one through backpropagation. Finally, the Adam optimizer fine-tunes the generator parameters based on these gradient values, so that the generator can synthesize fake samples that better meet the constraint objectives in the next iteration. The optimizer can use an adaptive moment estimation optimization algorithm, and its learning rate can be dynamically adjusted according to the training process to balance convergence speed and stability. This embodiment does not impose specific restrictions on the specific learning rate, optimization algorithm, etc.

[0031] Step 104: Use an updated generator to generate new fake samples and input them into the integrated detector for cyclic adversarial testing until the preset convergence condition is met to obtain the target generator. Use the fake samples generated by the target generator as attack samples.

[0032] Specifically, since the training of a generative adversarial network is essentially a continuous game process, the generator's output distribution changes after each parameter update. Therefore, the updated generator needs to be re-introduced into the next iteration to generate fake samples again and undergo testing by the ensemble detector. This process is repeated until the generator gradually converges to a stable state under the joint supervision of multiple loss functions. The preset convergence condition can be any one or more combinations of the following: the total loss value drops below a preset threshold, the change in loss over multiple consecutive rounds is less than a preset tolerance, the avoidance rate of fake samples reaches a preset target, or the number of training rounds reaches a preset upper limit. This embodiment does not limit the specific preset convergence condition.

[0033] When the cyclical adversarial process reaches the preset convergence condition, the current generator is identified as the target generator. At this point, the generator has the ability to synthesize attack samples with high avoidance rate, high realism, and sufficient diversity. Subsequently, it only needs to be input with randomly sampled noise vectors to output high-quality attack samples in batches. The attack samples it generates can be used to strengthen the defense of fraud detection systems.

[0034] Compared with related technologies, this embodiment provides multi-dimensional supervision signals by integrating detectors. By fusing loss functions with multiple constraints, the generator continuously evolves in a preset direction to generate higher quality and more realistic attack samples. The entire generation process does not require manual design and is completely data-driven, with good adaptability and generalization ability. It can be widely used in the security assessment and iterative optimization of fraud detection systems for various credit transaction anti-fraud, thereby improving the reliability of fraud detection systems.

[0035] The second embodiment of this application relates to a method for generating attack samples based on generative adversarial networks. This embodiment is a supplement to the foregoing embodiments and specifically includes the following contents.

[0036] In one example, the steps for pre-acquiring the training set include: Obtain sample data of credit card transactions containing real fraud data, and fill in missing values ​​for each sample data; The filled sample data is subjected to max-min normalization to obtain the normalized original feature dataset. The original feature dataset is then divided into training set and test set according to a preset ratio.

[0037] Specifically, data preparation is required before starting adversarial training. In this embodiment, sample data of credit card transactions containing real fraud labels are obtained in advance. This sample data usually comes from the historical transaction logs of banks or payment institutions. Each sample corresponds to an independent transaction behavior and includes raw fields such as transaction time, amount, merchant type, transaction channel, user historical behavior statistics, and category labels that indicate whether the transaction belongs to a fraud event.

[0038] Furthermore, considering that the raw data collected in actual business systems inevitably has problems such as missing fields and significant differences in numerical units, this embodiment performs missing value imputation for each sample data obtained. Specifically, for continuous feature columns in the samples, the central tendency statistic of the column in all samples can be calculated as the imputation basis, such as using the column mean or column median. For discrete categorical features, the column mode can be used. For some cases where the missing business logic cannot be reasonably imputed by statistics, a specific constant value can be preset according to the domain of the feature for imputation. After the missing value imputation is completed, the imputed sample data needs to be subjected to max-min normalization. The essence of this normalization method is to perform an independent linear transformation for each feature dimension. Based on the relative positional relationship between the original feature value and the observed maximum and minimum values ​​on the feature dimension, the values ​​of each feature are mapped to a unified interval of [-1, 1], thereby eliminating the impact of differences in magnitude between different features such as transaction amount and behavior frequency on model training. After normalization, the standardized original feature dataset is obtained. Finally, the original feature dataset is divided into a training set and a test set according to a preset ratio. This preset ratio can be flexibly set according to the actual amount of data, such as 7:3, 8:2, etc. This embodiment does not impose specific restrictions on this.

[0039] In another example, such as Figure 2 As shown, the steps to obtain a pre-trained ensemble detector include: Step 201: Construct multiple heterogeneous detectors, which include at least: multilayer perceptron, one-dimensional convolutional neural network and lightweight convolutional neural network.

[0040] Specifically, to simulate the real-world scenario of multiple detection mechanisms coexisting in anti-fraud cases of credit transactions, this invention constructs several heterogeneous detectors with different structures. These heterogeneous detectors include at least a Multilayer Perceptron (MLP), a 1D Convolutional Neural Network (1D-CNN), and a Light-Convolutional Neural Network (Light-CNN). The reason for using heterogeneous structures instead of a single detector is that different types of neural networks have complementary advantages at the feature extraction level. Among them, the multilayer perceptron network design includes two hidden layers (128-dimensional and 64-dimensional), ReLU activation, and Dropout regularization (dropout rate 0.3). It learns the global nonlinear combination relationship between input features through fully connected layers, and can capture cross-dimensional feature interactions. The one-dimensional convolutional neural network design consists of three convolutional layers (32, 64, and 128 channels), batch normalization, ReLU activation, global average pooling, and an attention mechanism based on a fully connected layer. It enhances key features through adaptive weighting and captures the local temporal patterns of behavioral fingerprints. The lightweight one-dimensional convolutional neural network (Light-CNN) design adopts a single-layer convolution (64 output channels, 5 convolutional kernels), batch normalization, ReLU activation, and global max pooling to achieve fast feature extraction with a simple and efficient structure.

[0041] Step 202: Train each heterogeneous detector independently on the training set using the cross-entropy loss function until the preset training stopping condition is met, and obtain each trained heterogeneous detector.

[0042] Specifically, all three detectors employ a binary classification architecture. Their output layers uniformly represent the probability that an input sample is classified as fraud. The difference between this probability and the true label is used as the basis for training optimization. On the training set, each detector undergoes independent supervised training. The forward propagation process for each detector is independent, and the backpropagation process only updates the weight parameters within its own network, without interference. The loss function used for training is cross-entropy loss. This loss function is essentially a negative log-likelihood measure of the difference between the predicted probability and the true label. When the predicted probability matches the true label and the confidence level is high, the loss approaches zero; conversely, the loss increases significantly, thus providing a clear direction for optimizing the detector parameters. The specific formula for the cross-entropy loss function is as follows: Where N is the batch size, For real labels, This represents the class probabilities predicted by the model.

[0043] During training, the training set can be further divided into a training subset and a validation subset. After each iteration, the loss value or evaluation metric of the model on the validation subset is calculated. If the validation metric no longer improves or even decreases after several consecutive iterations, training is terminated early to prevent overfitting. Alternatively, a fixed upper limit for the number of training iterations can be set, and optimization stops once this upper limit is reached. This embodiment does not impose restrictions on specific training termination conditions. After each detector has been trained independently, its parameters have converged to a stable state. At this point, the trained heterogeneous detectors are integrated to obtain an integrated detector.

[0044] Step 203: Integrate the trained heterogeneous detectors to obtain an integrated detector.

[0045] Specifically, the integration method can be a simple integration at the output level, such as taking the arithmetic average or weighted average of the probability values ​​output by each detector as the basis for the final decision, or a voting mechanism can be used, that is, each detector first gives a binary classification hard decision result independently, and then the integrated output is determined by taking the average of the majority vote. This embodiment does not limit the specific integration and output form.

[0046] It should be noted that in the subsequent adversarial training phase of this application, the parameters of each base detector in the ensemble detector are frozen and no longer updated with the training of the generator. Their function is to serve as a fixed supervision model to provide the generator with a constant optimization objective.

[0047] Compared with related technologies, the integrated detector obtained by the above method in this embodiment integrates multiple discriminative perspectives, and its decision boundary is more complex and stable than that of a single detector. This provides a more multi-dimensional supervisory environment for the adversarial training of the generator, forcing the generator to seek a balance among multiple constraints, and finally synthesizing high-quality attack samples with cross-model attack capabilities.

[0048] The third embodiment of the present invention relates to an attack sample generation method based on generative adversarial networks. This embodiment is a supplement to the foregoing embodiments, and the supplement is that step 103 is refined, specifically including the following contents.

[0049] In one example, the initial generator uses a multilayer perceptron, and the detection results include: the result label and label confidence level for determining whether the input sample is a normal sample or a fraudulent sample; the multiple losses include at least two or any combination of the following: high confidence avoidance loss, hierarchical feature matching loss, multi-target loss and hard boundary loss; The initial generator employs a multilayer perceptron structure. Its input is a noise vector randomly sampled from a preset probability distribution. After nonlinear transformation through multiple fully connected hidden layers, the output layer generates a fake sample with the same feature dimensions as the real transaction sample. The initial generator uses LeakyReLU as its activation function, and the output layer uses Tanh to constrain the values ​​within [...]. The interval is [1, 1].

[0050] The network layer dimensions of the initial generator include: Hidden layer 1:

[0051] Hidden layer 2:

[0052] Output layer: ,in , These are the weight matrix and bias vector of the i-th layer, respectively.

[0053] In each round of adversarial training, after the fake samples and real fraud samples selected from the fraud seed set are input into the ensemble detector, each base detector performs forward propagation and outputs the detection results. These results include at least the detector's classification label for the input sample (whether it belongs to the normal or fraud category) and the corresponding label confidence level. The classification label is obtained by thresholding the detector's output probability, while the label confidence level directly reflects the detector's certainty about its own classification result. For example, when the detector outputs a probability of 0.95 for the normal category, it means that the detector is 95% confident that the input sample is normal.

[0054] Meanwhile, this invention predefines several loss functions to constrain the generator's optimization direction. These losses include at least two of the following: high-confidence avoidance loss, hierarchical feature matching loss, multi-objective loss, and hard boundary loss. The high-confidence avoidance loss ensures that the forged sample is misclassified as normal by the ensemble detector, and that the prediction confidence for the normal class is as high as possible, thus guaranteeing the effectiveness of the attack. The hierarchical feature matching loss aligns the intermediate feature statistics extracted by the forged sample from each layer of the ensemble detector with the real fraud sample, ensuring the authenticity of the forged sample in the feature space and avoiding the generation of meaningless outliers. The multi-objective loss maintains sufficient feature distance between multiple forged samples generated in the same batch, while also keeping the forged samples away from the normal sample distribution and moderately dispersed around the real fraud sample, ensuring the diversity of forged samples and preventing the generator from outputting only a few highly similar samples, resulting in a single attack sample pattern. The hard boundary loss imposes geometric constraints on the position of the forged sample in the feature space relative to the normal class center and the fraud class center, forcing it to fall within the clearly defined fraud region boundary, thus ensuring that the malicious attributes of the forged sample are not diluted. In practical applications, any combination can be selected for weighted summation based on the specific application scenario and attack target.

[0055] Based on this, step 103, which involves calculating the multinomial loss of the initial generator based on the detection results and a predefined multinomial loss function, includes: Based on the result labels and label confidence levels corresponding to the forged samples, a high-confidence avoidance loss is calculated using a preset high-confidence loss function. The high-confidence avoidance loss is used to constrain the generator to update in the direction of generating forged samples that are judged as normal samples by a preset high-confidence level.

[0056] Specifically, the high-confidence avoidance loss is used to train the generator, enabling the generated samples to successfully evade identification by multiple detectors, i.e., be classified as "normal" (label 0) by the detectors. Simultaneously, to improve the determinism of the attack, it is not only required that the sample be classified as normal, but also that the detector's prediction confidence for the normal category be as close as possible to a preset high threshold (e.g., 0.99). By introducing a confidence enhancement term, the forged sample can be made to more stably fall within the normal region in the detector output space. The high-confidence loss function in this embodiment is as follows: ; in, To avoid losses with high confidence, It is the number of detectors. For training batches, The probability that the i-th sample is predicted as the normal class by the k-th detector. =10⁻⁸ is a very small constant to prevent the logarithm from being zero. It is the weight of the confidence enhancement term. =99 is the target confidence level.

[0057] In another example, the detection results also include: target feature vectors extracted from each neural network layer of the ensemble detector for the input forged sample, and reference feature vectors extracted from each neural network layer of the ensemble detector for the input fraudulent sample.

[0058] Specifically, to ensure that the forged samples synthesized by the generator can not only deceive the ensemble detector at the output level but also approximate the intrinsic distribution of real fraud samples at the feature space level, this embodiment introduces hierarchical feature matching loss within the multi-loss function framework. Since the ensemble detector comprises multiple base detectors with varying structures, each base detector consists of multiple stacked neural network layers, including an input layer, several hidden layers, and an output layer, each hidden layer generates intermediate feature representations of the corresponding input samples during forward propagation. These intermediate features reflect the detector's encoding results of the input samples at different levels of abstraction. During adversarial training, after the forged samples and real fraud samples selected from the fraud seed set are input into the ensemble detector, each base detector performs layer-by-layer forward propagation on each input sample and extracts corresponding feature vectors at several preset neural network layers. The feature vector extracted for the forged samples is called the target feature vector, and the feature vector extracted for the real fraud samples is called the reference feature vector.

[0059] At this point, step 103, which involves calculating the multinomial loss of the initial generator based on the detection results and a predefined multinomial loss function, may further include: Based on the target feature vectors corresponding to the fake samples in each neural network layer and the reference target feature vectors corresponding to the fraudulent samples in each neural network layer, a pre-defined feature matching loss function is used to calculate the hierarchical feature matching loss. The hierarchical feature matching loss is used to constrain the generator to update in the direction of generating fake samples with an internal feature similarity greater than a similarity threshold with the fraudulent samples.

[0060] Specifically, the hierarchical feature matching loss is calculated based on the difference between the target feature vector of the forged sample at each neural network layer and the reference feature vector of the fraudulent sample at each neural network layer, using a preset feature matching loss function. The significance of this loss function lies in the fact that, relying solely on the classification loss at the output level, the generator might evade detection by creating outliers near the decision boundary that are close to the normal region but whose intrinsic feature structure differs significantly from the real fraudulent sample. These outliers are considered normal in the detector's output space, but their intermediate layer features differ significantly from both real normal and real fraudulent samples, making them easily exposed when facing an unknown detection model. Therefore, the feature matching loss, by aligning the feature statistics of the forged sample to those of the real fraudulent sample, forces the generator to learn the distribution structure of the real fraudulent sample in the feature space, making the statistical characteristics of the synthesized sample, such as the mean and variance, in each intermediate layer as close as possible to the statistical characteristics of the real fraudulent sample. Considering this, this embodiment introduces the feature matching loss to force the forged sample to approach the real fraudulent sample in the feature space by aligning the feature statistics of the detector's intermediate layers, thereby generating more realistic and more difficult-to-detect adversarial samples. In this embodiment, the specific calculation formula for the feature matching loss function is as follows: ; Where K is the number of detectors, and L is the number of intermediate layers extracted by each detector. It is the feature of layer l. Sample size Number of fraud samples, n = min( Individual paired samples are real samples randomly selected from the index set, Var(.) is the feature dimension and variance. and These represent the j-th dimension of the i-th detected sample in the l-th layer of the k-th detector; It is a set of indices randomly selected from real samples; The feature matching loss function above consists of mean matching loss, individual sample distribution loss, and variance matching loss: Wherein, the mean matching loss is used to represent the mean matching loss of the k-th detector at the l-th layer, and is calculated by the following formula: ; The individual sample distribution loss, used to represent the individual matching loss of the k-th detector at layer l, is calculated using the following formula: ; Variance matching loss is used to represent the variance matching loss of the k-th detector at the l-th layer, and is calculated using the following formula: ; In generative adversarial training, using only the final classification loss may result in generated samples that merely deceive the detector output, while their internal features differ significantly from real fraudulent samples. The feature matching loss described above, by aligning the feature statistics of the detector's intermediate layers, forces the generated samples to converge towards real fraudulent samples in the feature space, thereby generating more realistic adversarial samples that are more difficult to detect by subsequent defenses.

[0061] In another example, the method of this embodiment further includes: randomly selecting a preset number of normal samples in the training set and extracting the normal feature vectors of the normal samples.

[0062] At this point, step 103, which involves calculating the multinomial loss of the initial generator based on the detection results and a predefined multinomial loss function, may further include: Based on the target feature vector, the reference target feature vector, and the normal feature vector, a pre-defined multi-objective loss function is used to calculate the multi-objective loss. The multi-objective loss is used to constrain the distance between each fake sample generated by the generator and between the fake sample and the normal sample in the feature space.

[0063] Specifically, to avoid the generator falling into pattern collapse during adversarial training—that is, all forged samples becoming highly clustered or even identical in the feature space, resulting in a lack of diversity in the generated attack samples and an inability to effectively cover multiple attack variants—this embodiment further introduces multi-objective loss within the multi-loss function framework. High-confidence avoidance loss drives forged samples to converge towards the output space of the normal category, while hierarchical feature matching loss drives the internal features of forged samples to align with the statistical distribution of real fraud samples. However, if only these two losses are used as constraints, the generator can easily find a shortcut: all forged samples converge to a narrow intersection region in the feature space between the normal and fraud categories. Forged samples within this region satisfy both the requirement of being misjudged as normal and the requirement of feature statistics approaching those of real fraud samples, but the similarity between batches of samples is extremely high, resulting in a single attack pattern. Such homogenized attack samples have limited value in actual adversarial evaluation. Therefore, the design goal of the multi-target loss function is to impose diversity constraints on forged samples at the geometric distribution level of the feature space. Specifically, this constraint is used to encourage forged samples within the same batch to move away from each other to increase individual differences, and to encourage forged samples as a whole to move away from the feature distribution of normal samples to prevent confusion with normal samples. Since the greater the distance between forged samples and normal samples in the feature space, the more difficult it is for the detector to misclassify them as normal, this constraint, conversely, forces the generator to achieve evasion by using diverse camouflage strategies rather than migrating entirely to the normal region while maintaining a high avoidance rate. This forces the generator to explore multiple different attack paths in the feature space. In this embodiment, the multi-target loss function is as follows: ; Where n represents the number of batches. The feature vector of the i-th fake sample The feature vector of the i-th sample is randomly extracted from the normal samples. The feature vector of the j-th fraud sample, where d is the feature dimension, Var( ) represents the variance of sample i in the k-dimensional vector. =10-8, =1.2.

[0064] The above loss is used to force the fake samples to maintain diversity in the feature space during generative adversarial training, preventing fake samples from falling into pattern collapse (i.e., all samples are highly similar). In the above formula, the first addend constrains intra-class dispersion, causing fake samples to move away from each other and increasing individual differences; the second addend constrains inter-class dispersion, causing fake samples as a whole to move away from the distribution of normal samples, preventing confusion with normal samples; the third addend constrains dispersion from fraudulent samples, preventing fake samples from excessively clustering around real fraudulent samples and covering a wider feature region; the fourth addend covers the feature space, encouraging the distribution of fake samples to have greater variance, thereby exploring a wider feature space.

[0065] In another example, the method of this embodiment further includes: calculating the feature centers of a preset number of normal samples as first feature centers, and calculating the feature centers of fraud samples in the fraud seed set as second feature centers; At this point, step 103, which involves calculating the multinomial loss of the initial generator based on the detection results and a predefined multinomial loss function, may further include: Based on the target feature vector, the first feature center, and the second feature center, a preset hard boundary loss function is used to calculate the hard boundary loss. The hard boundary loss is used to constrain the fake samples generated by the generator to update in the direction that moves away from the first feature center and closer to the second feature center in the feature space.

[0066] Specifically, to ensure that the forged samples synthesized by the generator possess clear malicious attributes rather than wandering in the ambiguous boundary region between the normal and fraud categories, this embodiment further introduces a hard boundary loss within the multi-loss function framework. As explained above, the high-confidence avoidance loss drives the forged samples to be classified as normal by the ensemble detector with high confidence. While this constraint ensures the effectiveness of the attack, its essence is to guide the generated samples toward the output space of the normal category. Without the checks and balances of other constraints, the generator may push the forged samples to the edge of the normal category in the feature space or even intrude into the normal category. As a result, although the generated adversarial samples can evade detection under the current detector, their intrinsic characteristics are far removed from the real fraud samples, or even highly confused with normal samples. Such marginalized attack samples have limited value in actual business scenarios. Therefore, the hard boundary loss, starting from the geometric structure of the feature space, sets strict regional constraints for the generated samples, forcing them to be clearly located within the preset boundary on the side of the fraud category in the feature space, and not to cross or approach the area where the normal category is located. The purpose of this loss is to ensure that even if the generated sample is judged as normal at the output level of the detector, its intrinsic features should still retain a clear fraud attribute label in the feature space. That is, it should be close enough to the representation center of the fraud category and far enough away from the representation center of the normal category, so as to ensure that the generated sample has both attack avoidance and malicious certainty.

[0067] The specific formula for the hard boundary loss function is as follows: ; Where n is the batch number, The feature vector of the i-th fake sample It is the first feature center corresponding to the normal sample. It is the second feature center corresponding to the fake sample. =1.2 is the minimum distance ratio threshold. =10-8.

[0068] In this embodiment, the hard boundary loss provides strict geometric constraints, forcing that the distance ratio of all generated samples must be greater than a preset threshold. This ensures that each generated sample is explicitly located near the fraud center, rather than near the normal center. This strong constraint helps generate highly "malicious" samples.

[0069] Compared with related technologies, this embodiment, through the introduction of the above four types of losses, can simultaneously achieve the following objectives: generating samples that are misjudged as normal malicious targets by the detector with high confidence; generating samples that approximate real fraudulent samples in the detector's internal feature space; generating samples that are far removed from each other and from normal samples, covering diverse attack patterns; and improving the robustness of the model and stabilizing generator training by forcibly constraining the distance of samples to the decision boundary, achieving more accurate distribution alignment at the boundary. By seeking a balance among these four objectives through multi-objective joint optimization, it generates attack samples that can effectively evade detection, possess fraudulent semantic features, and cover a wide range of attacks.

[0070] The fourth embodiment of the present invention relates to a method for generating attack samples based on generative adversarial networks. This embodiment is a supplement to the foregoing embodiments and specifically includes the following: To further enhance the generator's continuous evolutionary capability and avoid optimization bottlenecks caused by the solidification of reference targets in the later stages of training, this embodiment introduces a dynamic seed pool update mechanism during the recurrent adversarial process. The initial fraud seed set consists of real historical fraud samples in the early stages of generator training, providing the generator with initial targets to imitate. However, as the generator parameters are continuously iterated and optimized, the synthesized forgeries gradually improve in terms of evasion ability and feature fidelity; some forgeries may even possess attack effects superior to the original fraud samples. At this point, if the reference samples in the seed pool remain unchanged, the alignment target of the hierarchical feature matching loss will gradually lag behind the generator's current actual capability, causing the generator to only approach a relatively outdated target and making it difficult to break through its performance ceiling. Considering this, this embodiment evaluates and filters the current generator output after a preset number of recurrent adversarial rounds, adding the best-performing forgeries to the seed pool. This allows the composition of the seed pool to dynamically evolve with the generator, thereby ensuring that the generator's learning target always remains synchronized with the current optimal attack level.

[0071] like Figure 3 As shown, in the cyclical adversarial process, the method of this embodiment further includes: Step 301: After the preset number of rounds of cyclical adversarial training is completed, obtain multiple fake samples generated by the current generator.

[0072] Step 302: Input multiple fake samples into the integrated detector to obtain the current detection results, and filter the target fake samples with an avoidance rate greater than the avoidance threshold based on the current detection results.

[0073] Step 303: Add the target fake sample to the fraud seed set.

[0074] Specifically, the training process of the recurrent adversarial training triggers a seed pool update operation at a preset interval. This preset interval can be flexibly set based on the total number of training rounds and computational resources. For example, an update evaluation can be performed after a fixed number of training rounds; this embodiment does not impose specific limitations on this. Whenever an update is triggered, multiple forged samples synthesized by the current generator under several sets of random noise inputs are first acquired. These forged samples are then input into the ensemble detector in batches. Each heterogeneous detector performs forward propagation and outputs a discrimination result for each forged sample, including the probability value or hard decision label of each detector classifying it as a normal category. Based on this, the avoidance rate of each forged sample is calculated according to the output results of each base detector. This avoidance rate quantifies the degree to which the sample successfully avoids detection by the current ensemble detector. Its calculation can employ various metrics, such as statistically analyzing the proportion of samples consistently classified as normal by all base detectors, or calculating the average of the output probabilities of each base detector as the overall confidence level. Alternatively, a weighted summation method can be used to assign different weights to the judgments of different base detectors; this embodiment does not impose any limitations on this.

[0075] After obtaining the avoidance rate of each forgery sample, it is compared with a preset avoidance threshold, and forgery samples with an avoidance rate greater than the threshold are selected as target forgery samples. Subsequently, these target forgery samples are added to the fraud seed set, so that the hierarchical feature matching loss in subsequent rounds can use these newly added high-quality forgery samples as one of the reference targets when calculating, thereby guiding the generator to continue to optimize towards a better feature distribution.

[0076] It should be noted that in practical implementations, since the capacity of the fraud seed set is usually capped, when the addition of new samples causes the seed set to exceed the preset capacity limit, a replacement strategy must be implemented simultaneously to maintain the seed set size within a controllable range. The replacement strategy can be based on the cumulative contribution of each sample or the avoidance rate at the most recent evaluation, prioritizing the retention of samples with high avoidance rates. Through this dynamic update mechanism, the generator can not only learn basic patterns from the initial real fraud samples, but also continuously absorb high-quality samples it produces during training, forming a positive feedback loop. This effectively alleviates the problem of the static seed set's supervision signal degradation in the later stages of training, allowing the generator's performance to continuously improve with the training process.

[0077] The fifth embodiment of this application relates to an attack sample generation method based on generative adversarial networks. This embodiment is a supplement to the foregoing embodiments. The supplement is that, after obtaining the attack sample, in order to reveal the intrinsic mechanism by which the attack sample synthesized by the generator successfully evades the integrated detector, and to clarify which feature dimensions in the original feature space play a decisive role in inducing the detector to make a misjudgment, this invention further introduces an attribution analysis process after completing the generation of adversarial samples.

[0078] like Figure 4 As shown, this embodiment includes the following steps 401-404.

[0079] Step 401: Use the trained one-dimensional convolutional neural network detector to calculate the probability of each original feature being classified as normal for its corresponding sample. Perform attribution calculation, take the average absolute attribution value of all samples and sort them in descending order, and output the ranking of key original features that induce misjudgment.

[0080] Specifically, a trained one-dimensional convolutional neural network detector is used to perform integrated gradient attribution calculations on all or sampled generated samples. This calculation method uses the zero vector as a baseline and accumulates the integral gradient along a straight path from the baseline to the target sample on the normal class probability output by the detector, thereby obtaining the contribution attribution value of each original feature to the final output probability. The formula for the attribution value of the i-th feature is as follows: ; in, The output probability of the detector for the normal class, for a single sample. baseline It is a zero vector.

[0081] For all selected generated samples, the attribution value for each feature dimension is calculated, and the absolute value is then averaged across the sample dimensions to obtain the mean absolute attribution value for each original feature. These values ​​are then sorted in descending order to output the ranking of key original features that induce misjudgments in the detector. This ranking directly reveals which transaction behavior features, such as transaction amount, transaction interval, and merchant category code, in the attack samples most drastically perturb the generator, and how these perturbations statistically contribute the most to the deception detector.

[0082] Step 402: Input the attack sample into the one-dimensional convolutional neural network detector, return the pooled attention weight matrix, calculate the average attention weight of each dimension on all samples, and output the preset number of pooled feature indices with the highest weight.

[0083] Specifically, this embodiment also performs an attention-driven interpretability analysis at the level of the detector's internal representation. The aforementioned attack samples are input into a one-dimensional convolutional neural network detector, and an attention weight matrix is ​​set during the forward propagation process after returning to the pooling layer. Each dimension of this matrix corresponds to the detector's attention intensity to different abstract patterns in the deep feature space. Since the feature dimensions output by the pooling layer are usually dimensionality-reduced, their number of dimensions is much smaller than the original feature dimensions. Therefore, the attention weight matrix reflects the detector's focus on the internal structure of the input samples at a higher semantic level. For all input attack samples, their respective attention weight matrices are extracted, and the average attention weight of each dimension across all samples is calculated. This results in the output of a preset number of pooling feature indices with the highest average weight. The internal representation channels corresponding to these indices represent the abstract patterns most relied upon by the detector during the discrimination process. By comparing the original feature attribution ranking with the pooling feature indices, a mapping relationship can be established between input perturbations and internal representation activation, i.e., clarifying which changes in the original features ultimately lead to misjudgments by the detector through which internal representation channels.

[0084] Step 403: Filter out the successful evasion samples that are judged as normal by the one-dimensional convolutional neural network detector from the attack samples; perform attribution calculation on the successful evasion samples and output the first number of key features in descending order.

[0085] Specifically, given that not all generated samples can successfully evade detector identification, including all generated samples in the attribution analysis would dilute the truly effective attack patterns due to a large number of unsuccessful evasion samples, leading to an averaged attribution result that fails to highlight core attack characteristics. Therefore, this embodiment further filters out samples from all attack samples that are actually classified as normal by the one-dimensional convolutional neural network detector—that is, samples that successfully evaded detection—and removes those correctly identified failed samples, allowing subsequent analysis to target the most threatening attack entities. For these successfully evaded samples, the aforementioned integrated gradient attribution calculation is re-executed, outputting the first number of key features in descending order. This result is more targeted than the attribution ranking of all samples, reflecting the unique characteristic impact of "effective attacks."

[0086] Step 404: Select representative samples from the successful avoidance samples, determine the target key features whose attribution values ​​are greater than the attribution threshold corresponding to the representative samples, and perform attribution direction analysis based on the key original features, pooled feature index and target key features.

[0087] Specifically, to further understand the specific impact of each feature at the individual sample level on the detection results, this embodiment selects one or more representative samples from the successfully evaded samples. Features with an absolute attribution value greater than a preset attribution threshold in these representative samples are identified as target key features. Subsequently, the attribution values ​​of these target key features are interpreted. A positive attribution value indicates that the feature's value in the current sample positively increases the probability that the detector classifies it as normal, meaning that perturbation in this feature dimension is the main driver of a successful attack. A negative attribution value indicates that the feature's value in the current sample suppresses the probability that the detector classifies it as normal, meaning that deception traces still remain in this feature dimension, representing a flaw that the attack sample failed to completely eliminate.

[0088] By integrating the aforementioned key original feature rankings, pooled feature indexes, and attribution direction analysis results, a complete interpretability report is ultimately generated. This report provides a transparent basis for security analysts to understand the generator's attack strategies and offers clear technical guidance for subsequent targeted defense and hardening measures.

[0089] The sixth embodiment of the present invention relates to an attack sample generation device based on generative adversarial networks, such as... Figure 5 As shown, it includes: The data acquisition module 501 is used to separate normal samples and fraud samples from the training set of pre-acquired credit card transaction data, and to construct a fraud seed set based on the separated fraud samples; The sample forgery module 502 is used to randomly sample multiple noise vectors and input them into the initial generator to generate multiple forged samples. It selects the same number of fraudulent samples as the target reference samples from the fraud seed set. It inputs the forged samples and the target reference samples into the pre-trained ensemble detector to obtain the detection results of the ensemble detector for each sample. The generator update module 503 is used to calculate the multiple losses of the initial generator based on the detection results and the predefined multiple loss function, combine the multiple losses according to the preset weights and sum them to obtain the total loss, and use the total loss to update the parameters of the initial generator to obtain the updated generator. The recurrent adversarial module 504 is used to generate new fake samples with an updated generator and input them into the integrated detector for recurrent adversarial processing until a preset convergence condition is met to obtain the target generator. The fake samples generated by the target generator are then used as attack samples.

[0090] The backdoor risk detection system in this embodiment also includes: a fraud seed update module, which is used to obtain multiple fake samples generated by the current generator after a preset number of rounds of cyclical anti-countermeasures; input the multiple fake samples into the integrated detector to obtain the current detection result; filter the target fake samples with an avoidance rate greater than the avoidance threshold according to the current detection result; and add the target fake samples to the fraud seed set.

[0091] The backdoor risk detection system in this embodiment also includes: an attribution analysis module, used to calculate the probability of each original feature being classified as normal for its corresponding sample output using a trained one-dimensional convolutional neural network detector, perform attribution calculation on all samples, take the average absolute attribution value and sort them in descending order, and output the ranking of key original features that induce misjudgment; input attack samples into the one-dimensional convolutional neural network detector, return the pooled attention weight matrix, calculate the average attention weight of each dimension on all samples, and output the preset number of pooled feature indices with the highest weights; filter out successful evasion samples that are judged as normal by the one-dimensional convolutional neural network detector from the attack samples; perform attribution calculation on the successful evasion samples, and output the first number of key features in descending order; filter representative samples from the successful evasion samples, determine the target key features whose attribution value is greater than the attribution threshold corresponding to the representative samples, and perform attribution direction analysis based on the key original features, pooled feature indices and target key features.

[0092] It is not difficult to see that this embodiment is a system embodiment corresponding to the aforementioned method embodiments, used to implement the methods described in any of the above embodiments. The steps and implementation details described in the above method embodiments are still applicable in this embodiment, and will not be repeated here.

[0093] The seventh embodiment of the present invention relates to an electronic device, such as... Figure 6 As shown, it includes at least one processor 602; and a memory 601 communicatively connected to at least one processor 602; wherein the memory 601 stores instructions executable by at least one processor 602, the instructions being executed by at least one processor 602 to enable at least one processor 602 to perform any of the above method embodiments.

[0094] The memory 601 and processor 602 are connected via a bus, which may include any number of interconnecting buses and bridges. The bus connects various circuits of one or more processors 602 and memory 601 together. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. A bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 602 is transmitted over a wireless medium via an antenna, which further receives data and transmits it to processor 602.

[0095] Processor 602 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 601 can be used to store data used by processor 602 during operation.

[0096] The eighth embodiment of the present invention relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements any of the above-described method embodiments.

[0097] The ninth embodiment of the present invention relates to a computer program product, including computer instructions that, when executed by a processor, implement any of the above-described method embodiments.

[0098] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0099] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0100] While the embodiments disclosed herein are as described above, the foregoing content is merely for the purpose of facilitating understanding of this disclosure and is not intended to limit this disclosure. Any person skilled in the art to which this disclosure pertains may make any modifications and changes in form and detail of the implementation without departing from the spirit and scope disclosed herein; however, the scope of patent protection of this disclosure shall still be determined by the scope defined in the appended claims.

Claims

1. A method for generating attack samples based on generative adversarial networks, characterized in that, include: Normal samples and fraud samples are separated from the training set of pre-acquired credit card transaction data, and a fraud seed set is constructed based on the separated fraud samples; Multiple noise vectors are randomly sampled and input into an initial generator to generate multiple fake samples. The number of fake samples is the same as the number of fake samples selected from the fake seed set as target reference samples. The fake samples and the target reference samples are input into a pre-trained ensemble detector to obtain the detection results of the ensemble detector for each sample. Based on the detection results and a predefined multivariate loss function, the multivariate losses of the initial generator are calculated. The multivariate losses are combined and summed according to preset weights to obtain the total loss. The parameters of the initial generator are updated using the total loss to obtain the updated generator. A new forged sample is generated using an updated generator and input into the integrated detector for cyclical adversarial testing until a preset convergence condition is met, thus obtaining a target generator. The forged sample generated by the target generator is then used as an attack sample.

2. The method according to claim 1, characterized in that, The steps for pre-acquiring the training set include: Obtain sample data of credit card transactions containing real fraud data, and fill in missing values ​​for each of the sample data entries. The sample data after padding is subjected to max-min normalization to obtain the normalized original feature dataset. The original feature dataset is then divided into the training set and the test set according to a preset ratio.

3. The method according to claim 1, characterized in that, The steps to obtain the pre-trained ensemble detector include: Construct multiple heterogeneous detectors, wherein the multiple heterogeneous detectors include at least: a multilayer perceptron, a one-dimensional convolutional neural network, and a lightweight convolutional neural network; Each heterogeneous detector is trained independently on the training set using the cross-entropy loss function until a preset training stopping condition is met, thus obtaining each trained heterogeneous detector. The trained heterogeneous detectors are integrated to obtain the integrated detector.

4. The method according to claim 1, characterized in that, The initial generator employs a multilayer perceptron, and the detection results include: a result label determining whether the input sample is a normal sample or a fraudulent sample, and the label confidence level; the multiple losses include at least two or any combination of high-confidence avoidance loss, hierarchical feature matching loss, multi-target loss, and hard boundary loss. The step of calculating the multivariate loss of the initial generator based on the detection results and a predefined multivariate loss function includes: Based on the result label and label confidence level corresponding to the forged sample, the high confidence avoidance loss is calculated using a preset high confidence loss function. The high confidence avoidance loss is used to constrain the generator to update in the direction of generating the forged sample that is judged as a normal sample with a preset high confidence level.

5. The method according to claim 4, characterized in that, The detection results also include: target feature vectors extracted from each neural network layer of the integrated detector for the input forged sample, and reference feature vectors extracted from each neural network layer of the integrated detector for the input fraud sample; The calculation of the multivariate loss of the initial generator based on the detection results and a predefined multivariate loss function includes: Based on the target feature vector corresponding to the forged sample in each neural network layer and the reference target feature vector corresponding to the fraudulent sample in each neural network layer, the hierarchical feature matching loss is calculated using a preset feature matching loss function; the hierarchical feature matching loss is used to constrain the generator to update in the direction of generating forged samples with an internal feature similarity greater than a similarity threshold with the fraudulent sample.

6. The method according to claim 5, characterized in that, The method further includes: randomly selecting a preset number of normal samples in the training set and extracting normal feature vectors from the normal samples; The step of calculating the multivariate loss of the initial generator based on the detection results and a predefined multivariate loss function includes: Based on the target feature vector, the reference target feature vector, and the normal feature vector, the multi-target loss is calculated using a preset multi-target loss function; The multi-objective loss is used to ensure that the fake samples generated by the constraint generator are far apart from each other in the feature space, as well as between the fake samples and the normal samples.

7. The method according to claim 6, characterized in that, The method further includes: calculating the feature centers of a preset number of normal samples as first feature centers, and calculating the feature centers of the fraud samples in the fraud seed set as second feature centers; The step of calculating the multinomial loss of the initial generator based on the detection results and a predefined multinomial loss function further includes: Based on the target feature vector, the first feature center, and the second feature center, the hard boundary loss is calculated using a preset hard boundary loss function. The hard boundary loss is used to constrain the fake samples generated by the generator to update in a direction that moves away from the first feature center and closer to the second feature center in the feature space.

8. The method according to claim 1, characterized in that, The method further includes: After a preset number of rounds of cyclical adversarial training, multiple forged samples generated by the current generator are obtained. Multiple forged samples are input into the integrated detector to obtain the current detection result. Based on the current detection result, target forged samples with an avoidance rate greater than the avoidance threshold are selected. Add the target forged sample to the fraud seed set.

9. The method according to claim 1, characterized in that, The method further includes: A trained one-dimensional convolutional neural network detector is used to calculate the probability of each original feature outputting the normal class for its corresponding sample. The average absolute attribution value of all samples is taken and sorted in descending order to output the ranking of key original features that induce misjudgment. The attack sample is input into the one-dimensional convolutional neural network detector, which returns the pooled attention weight matrix, calculates the average attention weight of each dimension on all samples, and outputs the preset number of pooled feature indices with the highest weight. From the attack samples, select the successful evasion samples that are judged as normal by the one-dimensional convolutional neural network detector; perform attribution calculation on the successful evasion samples, and output the first number of key features in descending order; Representative samples are selected from the successful avoidance samples, and the target key features corresponding to the representative samples with attribution values ​​greater than the attribution threshold are determined. Attribution direction analysis is performed based on the key original features, the pooling feature index and the target key features.

10. An attack sample generation device based on generative adversarial networks, characterized in that, include: The data acquisition module is used to separate normal samples and fraud samples from the training set of pre-acquired credit card transaction data, and to construct a fraud seed set based on the separated fraud samples; The sample forgery module is used to randomly sample multiple noise vectors and input them into an initial generator to generate multiple forged samples. It selects the same number of fraudulent samples as the number of forged samples from the fraud seed set as target reference samples. It inputs the forged samples and the target reference samples into a pre-trained ensemble detector to obtain the detection results of the ensemble detector for each sample. The generator update module is used to calculate the multiple losses of the initial generator based on the detection results and the predefined multiple loss functions, combine and sum the multiple losses according to preset weights to obtain the total loss, and update the parameters of the initial generator using the total loss to obtain the updated generator; The cyclic adversarial module is used to generate new forged samples using an updated generator and input them into the integrated detector for cyclic adversarial processing until a preset convergence condition is met to obtain a target generator. The forged samples generated by the target generator are then used as attack samples.

11. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the attack sample generation method based on generative adversarial networks as described in any one of claims 1 to 9.

12. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the attack sample generation method based on generative adversarial networks as described in any one of claims 1 to 9.

Images