Voice Assistant Defense Against Inaudible Dolphin Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current defense methods against 'Dolphin Attack' are ineffective, as hardware-based solutions are costly and impractical for existing devices, and software-based solutions are limited to specific voice commands and devices, failing to universally detect malicious inaudible voice commands.
Innovation Solution
A machine learning-based method using an SVM classifier is employed to differentiate between normal and malicious voice commands by preprocessing, feature calculation, normalization, and classification of voice data, allowing for detection and cancellation of malicious commands across various smart devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based defense methods are used to filter high-frequency sounds, then security against Dolphin Attack is improved, but device cost and complexity increase significantly
Solution Approach 1:
The patent replaces the hardware-based mechanical filtering system with a software-based machine learning system. Instead of modifying the microphone circuit to physically filter ultrasonic frequencies, the system uses an SVM classifier to analyze voice signal characteristics and identify malicious commands softwareually, thereby achieving the same security goal without hardware modifications.
Solution Approach 2:
The patent changes the approach from modifying physical hardware parameters (microphone frequency response) to analyzing and classifying signal parameters (voice command characteristics). By extracting features from the voice signal and using machine learning to classify malicious versus benign commands, the system achieves security without altering the hardware's physical properties.
2Adaptability or versatility
If software-based defense methods using machine learning are implemented, then device compatibility and ease of deployment are improved, but detection accuracy and reliability may be compromised
Solution Approach 1:
The patent implements a preliminary training phase where the SVM classifier is trained offline using labeled voice command data before deployment. This preliminary action allows the system to learn the characteristics of both benign and malicious commands in advance, ensuring high detection accuracy when the actual detection phase occurs on various devices without requiring real-time complex computations.
Solution Approach 2:
The patent creates a simplified copy of the voice command classification problem by extracting key features from the original voice signals and representing them in a reduced feature space. This copying approach allows the SVM classifier to work efficiently across different devices while maintaining detection accuracy, as the essential characteristics of malicious commands are preserved in the feature representation.
3Quantity of substance
If existing voice commands are used for training the classifier, then training data availability is improved, but the model may overfit to specific commands and fail to generalize to new commands
Solution Approach 1:
The patent transforms the classification problem from command-specific recognition to characteristic-based identification by changing the parameters from raw voice commands to extracted features. This allows the model to learn the underlying patterns and characteristics of malicious commands rather than memorizing specific command examples, enabling generalization to new and unseen commands while utilizing available training data effectively.
Data Source
AI summary
The present disclosure discloses a machine learning-based method for defending a voice assistant from being controlled by an inaudible command, including following steps: 1) collecting data of positive and negative samples, 2) performing data segmentation on data of the positive and negative samples; 3) selecting and normalizing sample features; 4) selecting a classifier to be trained and generate a detection model for a malicious voice command; 5) detecting a voice command to be detected by the detection model. The present disclosure selects an original feature selection method, and for smart devices of different types, it is necessary to obtain normal voice commands and malicious voice commands by means of a smart device of this type, and use them as the positive and negative samples to train a specific classifier for the device. Such a customized approach can well solve a problem that detection and defense between devices cannot work.