基于Logits向量的JSMA对抗样本攻击改进算法

doi:10.3969/j.issn.1671-1122.2022.03.007

信息网络安全 ›› 2022, Vol. 22 ›› Issue (3): 62-69.doi: 10.3969/j.issn.1671-1122.2022.03.007

基于Logits向量的JSMA对抗样本攻击改进算法

胡卫, 赵文龙, 陈璐(), 付伟

海军工程大学信息安全系,武汉 430000

收稿日期:2021-09-29 出版日期:2022-03-10 发布日期:2022-03-28
通讯作者: 陈璐 E-mail:553235208@qq.com
作者简介:胡卫（1979—）,男,湖北,副教授,硕士,主要研究方向为密码学和网络空间安全|赵文龙（1993—）,男,河北,硕士研究生,主要研究方向为网络空间安全|陈璐（1979—）,女,广东,副教授,博士,主要研究方向为信息安全与可信计算|付伟（1978—）,男,湖北,副教授,博士,主要研究方向为信息安全与可信计算
基金资助:
国家自然科学基金(61672531)

An Improved JSMA Algorithm against Sample Attack Based on Logits Vector

HU Wei, ZHAO Wenlong, CHEN Lu(), FU Wei

Department of Information Security, Naval University of Engineering, Wuhan 430000, China

Received:2021-09-29 Online:2022-03-10 Published:2022-03-28
Contact: CHEN Lu E-mail:553235208@qq.com

摘要/Abstract

摘要：

文章针对目前典型基于显著图的对抗样本攻击算法JSMA开展研究,提出基于Logits向量的JSMA对抗样本攻击改进算法L-JSMA。该算法在MNIST数据集和CIFAR-10数据集上证明了攻击效果与Logits排序成正相关。为进一步验证该理论,在Alexnet模型和Inception-v3模型上对攻击目标根据Logits排序进行攻击,结论支持该理论。通过实验分析,攻击能力越强的JSMA衍生算法越能够充分利用神经网络的线性特性,在实验结果中表现出的线性相关性越强。由于神经网络同时具有线性特征和非线性特征,攻击效果并不是与Logits排序严格的正相关。文章通过对白盒攻击的神经网络性质探讨,有利于理解神经网络的本质特征,并对黑盒攻击的研究具有借鉴意义。

关键词: 神经网络, 对抗样本攻击, JSMA, Logits

Abstract:

This paper studied the current typical JSMA against sample attack algorithm based on saliency graph, and proposes an improved JSMA against sample attack algorithm L-JSMA based on Logits vector. The algorithm proves that the attack effect is positively correlated with Logits ranking on MNIST data set and CIFAR-10 data set. In order to further verify the theory, attack the targets according to Logits on the Alexnet model and Inception-v3 model, and the conclusion is further proved. Through experimental analysis, it is found that the stronger the attack ability of JSMA derivative algorithm, the more it can make full use of the linear characteristics of neural network, and the stronger the linear correlation in the experimental results. Because neural networks have both linear and nonlinear characteristics, the attack effect is not strictly positively correlated with Logits. By discussing the nature of neural network of white box attack, it is helpful to understand the essential characteristics of neural network, and also referential for black box attack.

Key words: neural network, resist sample attack, JSMA, Logits

中图分类号:

TP309

胡卫, 赵文龙, 陈璐, 付伟. 基于Logits向量的JSMA对抗样本攻击改进算法[J]. 信息网络安全, 2022, 22(3): 62-69.

HU Wei, ZHAO Wenlong, CHEN Lu, FU Wei. An Improved JSMA Algorithm against Sample Attack Based on Logits Vector[J]. Netinfo Security, 2022, 22(3): 62-69.

图/表 11

图1

图2

图3

图4

图5

图6

图7

图8

图9

图10

图11

参考文献 18

[1]	ZHANG Shun, GONG Yihong, WANG Jinjun. The Development of Convolutional Neural Network and its Applications in Computer Vision[J]. Journal of Computer Science, 2019, 42(3):453-482.
	张顺, 龚怡宏, 王进军. 深度卷积神经网络的发展及其在计算机视觉领域的应用[J]. 计算机学报, 2019, 42(3):453-482.
[2]	JAWAD H A. Handwritten Arabic Digit Recognition Using Convolutional Neural Network[J]. International Journal of Communication Networks and Information Security, 2020, 12(3):411-416.
[3]	TAIGMAN Y, MING Y, RANZATO M, et al. DeepFace: Closing the Gap to Human-level Performance in Face Verification [C]//IEEE. IEEE Conference on Computer Vision & Pattern Recognition, June 23-28, 2014, Columbus, OH, USA. New York: IEEE, 2014: 1701-1708.
[4]	XI Xuefeng, ZHOU Guodong. Research on Deep Learning for Natural Language Processing[J] Journal of Aautomation, 2016, 42(10):1445-1465
	奚雪峰, 周国栋. 面向自然语言处理的深度学习研究[J]. 自动化学报, 2016, 42(10):1445-1465.
[5]	WANG Xiaoguo, YI Zhichao, WU Hao. Research and Improvement of Internet Financial Anti-fraud Rules Based on Information Gain and Support[J]. Journal of Physics: Conference Series, 2018 (1):1-7.
[6]	GEORG C, FALKO D, RICHARD A, et al. Network Attack Detection and Defense-manifesto of the Dagstuhl Perspective Workshop[J]. Computer Science Research and Development, 2009, 23(1):15-25. doi: 10.1007/s00450-009-0055-y URL
[7]	WANG Jinqiang, HUANG Hang, ZHI Peng, et al. Review of Development and Key Ttechnologies in Aautomatic Ariving[J]. Application of Electronic Technology, 2019, 45(6):28-36.
	王金强, 黄航, 郅朋, 等. 自动驾驶发展与关键技术综述[J]. 电子技术应用, 2019, 45(6):28-36.
[8]	ZHANG Sisi, ZUO Xin, LIU Jianwei. Confrontation Sample Problem in Deep Learning[J]. Journal of Computer Science, 2019, 42(8):1886-1904.
	张思思, 左信, 刘建伟. 深度学习中的对抗样本问题[J]. 计算机学报, 2019, 42(8):1886-1904.
[9]	WANG Shuwei, ZHOU Gang, JU Xinghai, et al. Overview of Malware Countermeasure Sample Generation Based on Network[J] Journal of University of Information Engineering, 2019, 20(5):616-621.
	王树伟, 周刚, 巨星海, 等. 基于生成对抗网络的恶意软件对抗样本生成综述[J]. 信息工程大学学报, 2019, 20(5):616-621.
[10]	LIU Hui, ZHAO Bo, GUO Jiabao, et al. Overview of Counter Attack against Deep Learning[J] Journal of Cryptography, 2021, 8(2):202-214.
	刘会, 赵波, 郭嘉宝, 等. 针对深度学习的对抗攻击综述[J]. 密码学报, 2021, 8(2):202-214.
[11]	IAN J, JONATHON S, CHRISTIAN S. Explaining and Harnessing Adversarial Examples[EB/OL]. http://arxiv.org/abs/1412.6572, 2021-08-02.
[12]	CHRISTIAN S, WOJCIECH Z, ILYA S, et al. Intriguing Properties of Neural Networks[EB/OL]. http://arxiv.org/abs/1312.6199, 2021-08-02.
[13]	MOOSAVIDEZFOOLI S, FAWZI A, FROSSARD P, et al. DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks [C]// IEEE. 2016 IEEE Conference on Computer Vision and Pattern Recognition, June 27-30, 2016, Las Vegas, NV, USA. New York: IEEE, 2016: 2574-2582.
[14]	PAPERNOT N, MCDANIEL P, JHA S, et al. The limitations of Deep Learning in Adversarial Settings [C]//IEEE. 2016 IEEE European Symposium on Security and Privacy, March 21-24, 2016, Saarbruecken, Germany. New York: IEEE, 2016: 372-387.
[15]	CARLINI N, WAGNER D. Towards Evaluating the Robustness of Neural Networks[C]//IEEE. 2017 IEEE Symposium on Security and Privacy, May 22-26, 2017, San Jose, CA, US. New York: IEEE, 2017: 39-57.
[16]	WIYATNO R, XU A. Maximal Jacobian-based Saliency Map Attack[EB/OL]. http://arxiv.org/abs/1808.07945, 2021-08-16.
[17]	COMBEY T, LOISON A, FAUCHER M, et al. Probabilistic Jacobian-based Saliency Maps Attacks[EB/OL]. https://arxiv.org/abs/2007.06032, 2021-08-18.
[18]	SU Jiawei, VARGAS D V, SAKURAI K. One Pixel Attack for Fooling Deep Neural Networks[J]. IEEE Transactions on Evolutionary Computation, 2019, 23(5):828-841. doi: 10.1109/TEVC.4235 URL

基于Logits向量的JSMA对抗样本攻击改进算法

An Improved JSMA Algorithm against Sample Attack Based on Logits Vector

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献 18

相关文章 15

编辑推荐

Metrics

本文评价

[1]	张玉健, 刘代富, 童飞. 基于局部图匹配的智能合约重入漏洞检测方法[J]. 信息网络安全, 2022, 22(8): 1-7.
[2]	刘光杰, 段锟, 翟江涛, 秦佳禹. 基于多特征融合的移动流量应用识别[J]. 信息网络安全, 2022, 22(7): 18-26.
[3]	王浩洋, 李伟, 彭思维, 秦元庆. 一种基于集成学习的列车控制系统入侵检测方法[J]. 信息网络安全, 2022, 22(5): 46-53.
[4]	刘峰, 杨成意, 於欣澄, 齐佳音. 面向去中心化双重差分隐私的谱图卷积神经网络[J]. 信息网络安全, 2022, 22(2): 39-46.
[5]	林发鑫, 张健. 虚拟化平台异常行为检测系统的设计与实现[J]. 信息网络安全, 2022, 22(11): 62-67.
[6]	仝鑫, 金波, 王靖亚, 杨莹. 一种面向Android恶意软件的多视角多任务学习检测方法[J]. 信息网络安全, 2022, 22(10): 1-7.
[7]	张郅, 李欣, 叶乃夫, 胡凯茜. 融合多重风格迁移和对抗样本技术的验证码安全性增强方法[J]. 信息网络安全, 2022, 22(10): 129-135.
[8]	高昌锋, 肖延辉, 田华伟. 基于多阶段渐进式神经网络的图像相机指纹提取算法[J]. 信息网络安全, 2022, 22(10): 15-23.
[9]	刘家银, 李馥娟, 马卓, 夏玲玲. 基于多尺度卷积神经网络的恶意代码分类方法[J]. 信息网络安全, 2022, 22(10): 31-38.
[10]	朱丽娜, 马铭芮, 朱东昭. 基于图神经网络和通用漏洞分析框架的C类语言漏洞检测方法[J]. 信息网络安全, 2022, 22(10): 59-68.
[11]	蒋首志, 曹金璇, 殷浩展, 芦天亮. 基于MHA与SDAE的Tor网站指纹识别模型[J]. 信息网络安全, 2022, 22(10): 8-14.
[12]	弋晓洋, 张健. 基于图像的网络钓鱼邮件检测方法研究[J]. 信息网络安全, 2021, 21(9): 52-58.
[13]	李彦霖, 蔡满春, 芦天亮, 席荣康. 遗传算法优化CNN的网站指纹攻击方法[J]. 信息网络安全, 2021, 21(9): 59-66.
[14]	秦中元, 胡宁, 方兰婷. 基于免疫仿生机理和图神经网络的网络异常检测方法[J]. 信息网络安全, 2021, 21(8): 10-16.
[15]	徐洪平, 马泽文, 易航, 张龙飞. 基于卷积循环神经网络的网络流量异常检测技术[J]. 信息网络安全, 2021, 21(7): 54-62.