CN111860139A - A defense method and related device for an intelligent system - Google Patents

Abstract

The present application discloses a defense method for an intelligent system and a related device. The method includes: obtaining feature information corresponding to at least one sensor based on sensing data collected by at least one sensor; inputting the feature information of each sensor into a The attack judgment model of the corresponding sensor is used to judge whether the sensor is an attacked sensor, wherein the attack judgment model includes at least one of an autocorrelation judgment model and a cross-correlation judgment model; if so, the sensing data of the attacked sensor is repaired. Through the technical solution provided by the present application, the defense capability and security of the intelligent system can be better improved.

Description

A defense method and related device for an intelligent system

technical field

The present application relates to the technical field of intelligent system security, and in particular, to a defense method and related device for an intelligent system.

Background technique

The rapid development of information and communication technology has driven the development of intelligent system technology. With the goal of improving the safety and efficiency of intelligent systems, making intelligent systems intelligent and Internet-based has become an inevitable trend in the development of intelligent systems. Among them, the safety and reliability of the sensing system or sensing equipment in the intelligent system affects the safety and stability of the entire intelligent system. Once the sensing system or sensing equipment of the intelligent system is attacked, the information obtained by the sensor will be distorted, which will lead to wrong identification results, which will lead to the wrong strategy for the intelligent system, which will lead to the security of the intelligent system. ACCIDENT. Therefore, a technical solution that can stably defend against external attacks is required to solve the above-mentioned technical problems.

SUMMARY OF THE INVENTION

The main technical problem to be solved by the present application is to provide a defense method and related device for an intelligent system, which can improve the defense capability and security of the intelligent system.

In order to solve the above-mentioned technical problems, a technical solution adopted in the present application is to provide a defense method for an intelligent system, the method comprising:

Based on the sensing data collected by the at least one sensor, obtain feature information corresponding to the at least one sensor respectively;

The feature information of each of the sensors is respectively input into the attack judgment model of the corresponding sensor to judge whether the sensor is an attacked sensor, wherein the attack judgment model includes an autocorrelation judgment model, a cross-correlation judgment model at least one of the judgment models;

If so, repair the sensing data of the attacked sensor.

In order to solve the above technical problem, another technical solution adopted in the present application is to provide a defense device, the device includes a memory, a processor and a data acquisition port, the memory and the data acquisition port are respectively connected with the processor. coupled, where,

Under the control of the processor, the data acquisition port acquires sensing data fed back by at least one sensor, and outputs it to the processor;

the memory stores a computer program;

The processor is adapted to run the computer program to perform the method as described above.

In order to solve the above technical problem, another technical solution adopted in the present application is to provide an intelligent system, which includes at least one sensor and the above-mentioned defense device.

In order to solve the above technical problem, another technical solution adopted in the present application is to provide a storage medium, where the storage medium stores a computer program that can be run by a processor, and the computer program is used to realize the above-mentioned intelligentization System defense method.

The beneficial effects of the present application are: different from the situation in the prior art, the technical solution provided by the present application obtains the feature information corresponding to at least one sensor based on the sensing data collected by the at least one sensor, and then combines the features of each sensor The information is respectively input into the autocorrelation judgment model and/or the cross-correlation judgment model corresponding to each sensor, so as to quickly determine whether the sensor is an attacked sensor, that is, after each sensor feeds back the sensing data to the intelligent system, real-time Determine whether the corresponding sensor is attacked based on the autocorrelation and/or cross-correlation of the sensor data, and repair the sensor data corresponding to the attacked sensor when judging that the sensor is attacked, which better improves the defense of the intelligent system competence and completeness.

Description of drawings

FIG. 1 is a schematic structural diagram of an embodiment of a defense device of the present application;

2 is a schematic structural diagram of an embodiment of an intelligent system of the application;

3 is a schematic flowchart of an embodiment of a defense method for an intelligent system of the present application;

4 is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application;

5 is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application;

FIG. 6 is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application;

7 is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application;

FIG. 8 is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application;

FIG. 9 is a schematic structural diagram of an embodiment of a storage medium of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of this application.

In the description of the present application, "a plurality of" means at least two, such as two, three, etc., unless otherwise expressly and specifically defined. Furthermore, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes unlisted steps or units, or optionally also includes For other steps or units inherent to these processes, methods, products or devices.

Reference herein to an "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor a separate or alternative embodiment that is mutually exclusive of other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

With the development of intelligent technology, intelligent systems are widely used in all walks of life, especially in the field of unmanned driving, such as unmanned vehicles and drones. For example, when intelligent systems are applied in the field of unmanned driving, how to improve traffic safety and reliability, improve processing efficiency, intelligent and networked vehicles has become the development trend in the field of unmanned driving. Since unmanned driving technology is an important project in today's social development and cutting-edge science and technology, it is of immeasurable significance to many areas of society such as urban construction, transportation, economic development and national defense. Among them, the perception system in the unmanned driving technology affects the equipment safety and stability of the intelligent system. Once the perception system of the intelligent system is attacked, the information obtained by the perception system will be distorted, resulting in wrong recognition results, which will lead to Incorrect decision-making is very likely to cause safety accidents and cause serious loss of life and property. Therefore, countries and organizations are scrambling to launch relevant policies and new technologies.

At present, the security defense of intelligent systems at home and abroad is still in a relatively early stage, and the proposed scheme is applicable to a relatively single scenario. For example, when the intelligent system is applied to the field of unmanned driving, the intelligent system includes the visual perception part, and only a single defense can be performed on the visual perception part. Then there are two main ways to defend against visual attacks: the first is to continuously improve the robustness of the network by continuously inputting new types of adversarial samples and performing adversarial training. This method requires a lot of training data, however, Moosavi-Dezfooli pointed out that no matter how many adversarial samples are added, there are new adversarial attack samples that can fool the network again; the second is to deploy more sensors in a way that increases redundancy, etc. . The first method only reduces the impact of adversarial examples on sensor recognition to a certain extent, but there will always be new adversarial examples. The second approach significantly increases the cost of the production configuration.

In the prior art, the main defense measures for lidar sensors in unmanned driving are as follows: (1) Install fast photoelectric switches and filters in optical and photoelectric devices to prevent laser blindness. (2) Study anti-laser structures, such as sandwich structures, to prevent the damage of enemy laser energy to one's own equipment. (3) The technical parameters are strictly confidential, for example, the coding technology is adopted for the laser signal of one's own side to increase the difficulty of the enemy's interference. (4) Research and develop the shell of special high temperature resistant material, making it difficult to be burned and penetrated by laser weapons. After investigation and research, it is shown that these methods can only reduce the risk of being attacked to a certain extent, but cannot provide security countermeasures after the lidar sensor is attacked.

For the attack defense of position sensors, it is necessary to combine methods such as encryption, signal distortion detection, and direction of arrival (DOA) sensing to defend against attacks. Complete defense cannot be achieved with a single approach. The cost and cost of this method are extremely high, and there is also the possibility of being missed. Therefore, it can be seen from the above that the current defense methods of intelligent systems can only achieve defense against a single sensor, or reduce the impact of attacks to a certain extent, but a comprehensive attack detection and defense system has not yet been formed. The technical solution provided by the present application can better solve the above-mentioned technical problems.

In order to facilitate the understanding of the defense method of the intelligent system provided by the present application, the defense device and the intelligent system provided by the present application are first described here. First, please refer to FIG. 1. FIG. 1 is a schematic structural diagram of an embodiment of a defense device of the present application. In the current embodiment, the defense device 100 provided by the present application can execute any of the following FIGS. 3 to 8 and their corresponding The defense method of the intelligent system described in one embodiment. Specifically, the defense device 100 includes a memory 102 , a processor 101 and a data acquisition port 103 . The memory 102 and the data acquisition port 103 are respectively coupled to the processor 101 .

The data acquisition port 103, under the control of the processor 101, acquires sensor data fed back by at least one external sensor (not shown in the figure), and outputs it to the processor 101, so that the processor 101 determines whether the sensor is a sensor based on the sensor data. The attacked sensor, and when it is determined that the external sensor is the attacked sensor, the sensing data obtained by the attacked sensor is further repaired.

Wherein, the memory 102 includes local storage (not shown), and stores a computer program. When the computer program stored in the memory 102 is executed, it can realize the intelligent functions described in FIGS. 3 to 8 and any one of the corresponding embodiments. defensive methods of the system.

The processor 101 is coupled to the memory 102, and the processor 101 is used for running a computer program to execute the defense method for an intelligent system as described in any one of the above-mentioned FIG. 3 to FIG. 8 and their corresponding embodiments.

Please refer to FIG. 2 , which is a schematic structural diagram of an embodiment of an intelligent system of the present application. In the current embodiment, the intelligent system 200 provided by the present application includes at least one sensor 201 and a defense device 202, wherein the defense device 202 is the defense device described in FIG. 1 and any one of the corresponding embodiments. Among them, at least one sensor 201 is used to sense the external environment to collect sensor data of the acquired target, and feed back the acquired sensor data to the defense device 202, and the defense device 202 is used to execute FIG. 3 to FIG. 8 and its corresponding The defense method of the intelligent system described in any one of the embodiments.

The number and types of sensors 201 included in the intelligent system 200 are not limited here, and may be specifically set according to the actual application scenarios and actual functional requirements of the intelligent system 200 . For example, in an embodiment, when the intelligent system 200 is a system applied to an unmanned vehicle, the sensor 201 in the intelligent system 200 at least includes at least one of a position sensor, a lidar sensor, and an inertial measurement unit . In another embodiment, the sensor 201 includes other circuit units for acquiring external environmental parameters in addition to sensors in the traditional sense. For example, when the intelligent system 200 is a system used on a drone, the intelligent system The sensor 201 in 200 includes at least one of a distance sensor, a height sensor, a torque sensor, a balance sensor and an image acquisition unit.

It should be noted that, in other embodiments, the sensor 201 illustrated in FIG. 2 may also be directly integrated into the defense device 202 , which is not specifically limited herein.

Please refer to FIG. 3 , which is a schematic flowchart of an embodiment of a defense method for an intelligent system of the present application. In the current embodiment, the execution body of the defense method of the intelligent system is a defense device as described in FIG. 1 above. Specifically, the method provided by this application includes steps S310 to S330.

S310: Based on the sensing data collected by the at least one sensor, obtain feature information corresponding to the at least one sensor respectively.

When the sensors in the equipment applied by the intelligent system perceive the external environment and collect the sensor data, each sensor will feed back the collected sensor data to the defense device, and the defense device obtains the sensor data collected by at least one sensor, and After the sensing data is acquired, the sensing data is processed to obtain characteristic information corresponding to at least one sensor respectively.

Further, in an embodiment, at least one sensor includes at least one of a position sensor, a lidar sensor, and an inertial measurement unit, and in the current embodiment, the sampling period of each sensor is the shortest of the inertial measurement unit (IMU). The sampling period is set, and the cycle period of the method provided by the present application is set according to the sampling period of each sensor.

Furthermore, the feature information is a feature vector. Specifically, the feature vector corresponding to each sensor can be expressed in the form of a matrix.

Further, when at least one sensor feeds back the collected sensing data to the defense device according to the set sampling period, then step S310 is based on the sensing data collected by at least one sensor in the current sampling period, and The characteristic information corresponding to each sensor is obtained by processing the sensor data. Among them, when the intelligent system is a system applied to an unmanned vehicle, the sampling period of each sensor can be uniformly set as the shortest sampling period of the inertial measurement unit. In another embodiment, the sampling period of each sensor is not limited, but only the cycle period of the method provided in this application is limited. In the current embodiment, the shortest sampling period among all sensors can be defined as the method provided in this application. cycle period. Wherein, the above-mentioned cycle period refers to the time required for a complete cycle of steps S310 to S330.

Furthermore, when the sensing data acquired by the sensor can be used to directly reflect the characteristics of the target, the sensing data collected by the sensor can be directly output as the characteristic information corresponding to the sensor. On the contrary, the sensory data acquired by each sensor will be converted into the expression form, so as to acquire the feature information corresponding to each sensor.

S320: Input the feature information of each sensor into the attack judgment model of the corresponding sensor, to judge whether the sensor is an attacked sensor.

After the corresponding feature information of at least one sensor is obtained, the feature information of each sensor will be further input into the attack judgment model of the corresponding sensor to judge whether the sensing data obtained by the current sensor is abnormal, and then according to the judgment The results determine whether each sensor is under attack.

In another embodiment, when each sensor feeds back sensing data to the defense device according to a set period, in step S320, the feature information of each sensor in the current period is respectively input into the attack judgment model of the corresponding sensor, and then according to the attack The output result of the judgment model judges whether the sensor is an attacked sensor in the current cycle.

In the same intelligent system, since there will be overlap and redundancy of information between different sensors, and the relationship between the overlap and redundancy of information will not change with the change of the external environment, it can be judged by pre-constructing cross-correlation Model to judge or assist to judge whether the sensor is attacked. Correspondingly, for the sensor data collected by the same sensor in different time periods, there will also be time-invariant autocorrelation, so it can be judged or assisted by constructing the autocorrelation judgment model corresponding to each sensor. be attacked. Based on this, the above attack judgment model includes at least one of an autocorrelation judgment model and a cross-correlation judgment model. Specifically, the autocorrelation judgment model and the cross-correlation judgment model may be models established in advance based on empirical values. Among them, the autocorrelation judgment model is a judgment model established according to the autocorrelation between the same type of sensor data obtained by the same type of sensor or the feature information corresponding to the same type of sensor data, and the cross-correlation judgment model is A judgment model is established according to the cross-correlation between different types of sensory data acquired by different types of sensors, or the cross-correlation between the feature information corresponding to different types of sensory data. It should be noted that, in the same intelligent system, the autocorrelation between the sensing data (or the characteristic information corresponding to the sensing data) acquired by the sensor at different times is relatively invariable, and it has cross-correlation. The cross-correlation between the sensing data (or the characteristic information corresponding to the sensing data) acquired by different types of sensors in the same period also remains unchanged.

Specifically, the autocorrelation judgment model and the cross-correlation judgment model may be constructed through a mathematical modeling algorithm, or obtained through machine learning algorithm training. Therefore, further, in an embodiment, the method provided by the present application further includes constructing an attack judgment model through a mathematical modeling algorithm or a machine learning algorithm. It can be understood that the construction method of the attack judgment model is not limited, and other types of methods may also be used to construct the attack judgment model in other embodiments.

Further, in an embodiment, step S320 may be to input the feature information of each sensor into the corresponding autocorrelation judgment model or cross-correlation judgment model, and then determine whether each sensor is an attacked sensor. In another embodiment, in step S320, the characteristic information of each sensor may be input into the corresponding autocorrelation judgment model first, and then the characteristic information of each sensor is input into the corresponding cross-correlation judgment model, so as to Determine whether the sensor is an attacked sensor. In yet another embodiment, in step S320, the characteristic information of the sensor may also be input into the cross-correlation judgment model corresponding to the sensor, and the cross-correlation judgment model judges to obtain the relationship between the sensor and other sensors in the current cycle. If the cross-correlation between them changes, the sensor is judged to be a suspected attacked sensor in the current cycle, and the feature information of the suspected attacked sensor is further input into its corresponding autocorrelation judgment model to further judge whether the suspected attacked sensor is For the attacked sensor.

Further, when the intelligent system includes multiple types of sensors, some of the multiple types of sensors have cross-correlation, while some sensors do not have cross-correlation with other sensors, so step S320 is executed. When the current sensor is stored in the system, the type of the attack judgment model corresponding to the current sensor can be determined first, and then the characteristic information of the sensor is input into the type of the existing attack judgment model of the current sensor. For example, when it is determined that the current sensor only has an autocorrelation judgment model, in step S320, the autocorrelation judgment model is directly selected by default to judge whether the sensor is an attacked sensor.

Further, in yet another embodiment, in the technical solution provided by the present application, a plurality of judgment modes for judging whether the sensor is attacked can be set in the intelligent system at the same time for the user to select. For example, three modes can be set for the user to choose and execute according to the speed and accuracy of the entire judgment process. The first is to input the characteristic information of the sensor into the autocorrelation judgment model, and determine whether the sensor is a sensor according to the judgment result of the autocorrelation judgment model. The attacked sensor; the second is to input the characteristic information of the sensor into the corresponding cross-correlation judgment model of the sensor, so as to determine whether the sensor is the attacked sensor according to the judgment result of the cross-correlation judgment model; The feature information is input into the autocorrelation judgment model corresponding to the sensor, and then the feature information of the sensor is input into the cross-correlation judgment model corresponding to the sensor to combine the judgment result of the autocorrelation judgment model and the judgment result of the cross-correlation judgment model. , to determine whether the sensor is an attacked sensor.

Before step S310, the method provided by the present application further includes: acquiring sensing data collected based on at least one sensor. After acquiring the sensing data collected by the at least one sensor, the sensing data is further converted and processed to obtain feature information corresponding to the at least one sensor respectively.

S330: Repair the sensing data of the attacked sensor.

If the characteristic information of each sensor is input into the attack judgment model of the corresponding sensor and it is determined that the sensor is the attacked sensor, the sensing data of the attacked sensor will be further restored.

Further, if it is determined that the sensor in the current cycle is an attacked sensor, the sensor data in the current cycle of the sensor will be further repaired.

In the technical solution provided in the embodiment corresponding to FIG. 3 of the present application, the feature information corresponding to at least one sensor is obtained based on the sensing data collected by at least one sensor, and then the feature information of each sensor is input to the corresponding sensor data. The autocorrelation judgment model and/or the cross-correlation judgment model can be used to quickly judge whether the sensor is an attacked sensor. It can judge whether the corresponding sensor is attacked or not, and quickly repair the sensing data corresponding to the attacked sensor when judging that the sensor is attacked, which better improves the defense capability and completeness of the intelligent system.

Before describing the corresponding method flows in the following embodiments, the construction process of the attack judgment model is first described.

Specifically, the construction process of the attack judgment model is described by taking the intelligent system as an example that is applied to an autonomous vehicle and applies the method provided in the present application to perform security defense on the sensor of the visual perception part. Among them, the visual perception part includes two parts: target detection and positioning, wherein, the sensor used for target detection includes at least a lidar sensor and an image acquisition unit, and the sensor used for positioning includes at least a position sensor (such as GPS, Beidou navigation) and the above lidar sensor. Among them, the position sensor belongs to absolute positioning, and other types of positioning methods need to extract the feature vector of the corresponding environment in a structured environment. However, if the sensor is actively attacked by the outside world, the feature vector will be lost, which will make the positioning or target detection of the intelligent system fail. For example, when the image acquisition unit is attacked by strong light, if the positioning feature is not restored according to the sensing data collected by the lidar sensor in time, it will bring greater safety hazards to autonomous driving. After verification, it can be known that when the image acquisition unit is attacked by strong light, the technical solution provided by this application can be used to determine in real time that the image acquisition unit is the attacked sensor, and when it is determined that the image acquisition unit is the attacked sensor, Quickly recovering the sensor data or feature information of the image acquisition unit can better improve the security of the intelligent system.

Lidar sensors are used to collect and obtain laser point cloud information and build lidar maps. Among them, the lidar map includes a reflection value map and a height value map. Specifically, a lidar map can be constructed according to the feature quantities of the physical world such as laser reflection intensity and laser height, and then the relative pose of the carrier (vehicle body) of the lidar sensor can be calculated. The essence of matching and positioning using laser point cloud data is an optimization problem. As long as the loss function for positioning is pre-defined, then solving the minimum loss function is the process of positioning the carrier. Image alignment is to use the optimization method to solve the heading angle yaw, and use the optimization method of SSD-HF (SSD-Sum of Squared Difference Histogram Filter) to solve the coordinate points x and y of the carrier. (x,y) represents the plane coordinate point of the carrier in the lidar map. The height information z of the carrier is directly obtained from the laser point cloud data, and finally, the laser positioning algorithm is used to output the pose information X (x, y, z, yaw) of the carrier.

When the carrier equipped with the lidar sensor observes the point cloud L _m in one scan, the pose of L _m in the lidar coordinate system is recorded as Y _Lm , and the coordinate system of the lidar sensor carrier relative to the map is X(t ), then according to the observation principle of the lidar sensor, the lidar observation equation can be written:

Among them, ρ is the measurement distance, and α and β are the measurement angles of the laser pulses sent by the lidar sensor, respectively. H(t) represents the observation matrix of the lidar sensor, and v is the measurement noise.

If the number of point clouds scanned by the lidar sensor in one scan is k, the corresponding point feature vector observation equations of the current lidar sensor in one scan are:

在目标检测任务中，激光雷达传感器的特征向量可以表示为：

[X Y]^T表示检测到的目标相对激光雷达传感器的载体(即车体)坐标系[0 0]^T的位置，[h w]^T表示检测框的高度和宽度，θ为检测框内是检测目标的置信度。其中，置信度是目标检测算法判定对象类别的概率指示，用于标识当前检测的目标类型的概率，如当检测任务是车辆时，则置信度所检测到的目标为车辆的概率。In the localization task, the feature vector of the lidar sensor can be expressed as

In the target detection task, the feature vector of the lidar sensor can be expressed as:

[XY] ^T represents the position of the detected target relative to the lidar sensor’s carrier (ie vehicle body) coordinate system [0 0] ^T , [hw] ^T represents the height and width of the detection frame, θ is the detection target within the detection frame confidence. Among them, the confidence is the probability indication of the target detection algorithm to determine the object category, which is used to identify the probability of the currently detected target type.

来表示，

其中[yaw pitch roll]^T表示航向角、俯仰角和横滚角三姿态，[V_x V_y V_z]^T表示三轴速度，[a_x a_y a_z]^T表示三轴加速度，[w_x w_y w_z]^T表示三轴角速度。The eigenvectors of the inertial measurement unit (IMU) are used for

To represent,

Where [yaw pitch roll] ^T represents the three attitudes of heading angle, pitch angle and roll angle, [V _x V _y V _z ] ^T represents the three-axis velocity, [a _x a _y a _z ] ^T represents the three-axis acceleration, [w _x w _y w _z ] ^T represents the triaxial angular velocity.

x,y,z为车体的三维坐标。GPS feature vector

x, y, z are the three-dimensional coordinates of the vehicle body.

表示。其中[X_v Y_v]^T表示目标物体在图像坐标系上的坐标值，[hω]^T表示检测框的高度和宽度，v表示是利用深度卷积神经网络算法检测到的目标物体的类别编号，p表示目标物体的置信度。In the current embodiment, the image acquisition unit in the self-driving vehicle is an on-board camera, and the self-driving vehicle collects images around the vehicle through the on-board camera. The collected pictures are input into the target detection system in RGB format, and the intelligent system calls the deep convolutional neural network algorithm to extract the features of the RGB images. Finally, the features extracted from the RGB images can effectively describe the information of the target objects. vector

express. Where [X _v Y _v ] ^T represents the coordinate value of the target object on the image coordinate system, [hω] ^T represents the height and width of the detection frame, and v represents the category number of the target object detected by the deep convolutional neural network algorithm , p represents the confidence of the target object.

After the feature vector corresponding to the sensing data collected by each sensor is obtained, further according to the feature vector corresponding to the sensing data collected by each sensor, appropriate correlation and autocorrelation expression methods are selected respectively to establish each sensor. The constant cross-correlation judgment model between them, and the time-invariant autocorrelation judgment model of each sensor. In the current embodiment, Correlation_space() represents the mathematical function of the cross-correlation judgment model, Correlation_time() represents the mathematical function of the auto-correlation judgment model, the matrix S_constant represents the matrix representation of the inherent cross-correlation relationship between sensors, and C_i The matrix representing the autocorrelation of the sensor numbered i at different times, the matrix of the cross-correlation and the matrix of the autocorrelation are as follows:

表示的是编号为i的传感器的特征向量，c(t_i，t_i)表示该传感器在第i时刻和第j时刻的特征相关性。where s(a,b) represents the feature cross-correlation between sensor a and sensor b,

represents the feature vector of the sensor numbered i, and c(t _i , t _i ) represents the feature correlation of the sensor at the ith moment and the jth moment.

In the technical solution provided by the present application, firstly, the preset cross-correlation matrix and the preset auto-correlation matrix corresponding to each sensor are correspondingly set according to the characteristics of each sensor when it is not attacked. Calculate the feature correlation corresponding to the obtained sensor to obtain the corresponding target cross-correlation matrix, and obtain the autocorrelation corresponding to the sensor to obtain the corresponding target autocorrelation matrix, and then calculate the obtained target cross-correlation Compare the target cross-correlation matrix with the preset cross-correlation matrix to determine whether the target cross-correlation matrix is consistent with the preset cross-correlation matrix, and then determine whether the sensor is attacked; similarly, after obtaining the target auto-correlation matrix , compare the obtained target autocorrelation matrix with the preset autocorrelation matrix to determine whether the target autocorrelation matrix is consistent with the preset autocorrelation matrix, and then determine whether the sensor is attacked.

If the lidar sensor is attacked from a distance by the interference source of the high repetition frequency pulsed laser, each sensor feeds back the environmental information collected in real time to the defense device, and extracts the features of the sensing data respectively. The extracted features are subjected to correlation calculation to obtain the time-based target autocorrelation matrix C_1', C_2', C_3'...C_n' of each sensor, and the target cross-correlation matrix S' between different sensors; then the obtained The target autocorrelation matrix C_1', C_2', C_3'...C_n' is compared with the preset autocorrelation matrix C_1, C_2, C_3...C_n to judge whether the target autocorrelation matrix and the preset autocorrelation matrix are Consistent, if inconsistent, the current sensor is preliminarily judged to be attacked; similarly, if the target cross-correlation matrix S' is inconsistent with the preset cross-correlation matrix S after comparison, it is judged that there is an attacked sensor in the current sensor sensor.

In another embodiment, after judging that the target cross-correlation matrix is inconsistent with the preset cross-correlation matrix, the target auto-correlation matrix and the preset auto-correlation of each sensor in the cross-correlation matrix are compared respectively. Whether the matrix is consistent, if not, the sensor is judged to be the attacked sensor. Of course, in another embodiment, it is also possible to determine that the sensor is a suspected attacked sensor through the target autocorrelation matrix and the preset autocorrelation matrix, and then compare the corresponding target cross-correlation matrix with the corresponding preset cross-correlation matrix. The matrix is compared to further confirm whether the suspected attacked sensor is the attacked sensor. Wherein, taking the target cross-correlation matrix and the corresponding preset cross-correlation matrix as an example, the two matrices are subtracted, and it is judged whether each element in the matrix obtained by the subtraction of the two matrices is 0, and if so, then It is judged that the target cross-correlation matrix is consistent with the corresponding preset cross-correlation matrix. On the contrary, if there are elements other than zero in the matrix obtained by subtraction, such as the following S-S_constant, it is judged that the target cross-correlation matrix is consistent with the corresponding preset cross-correlation matrix. Assuming that the cross-correlation matrix is inconsistent, it can be determined that the current sensor is an attacked sensor or a suspected attacked sensor.

Please refer to FIG. 4 , which is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application. In the current embodiment, step S320 in the above FIG. 3 inputs the characteristic information of each sensor into the attack judgment model of the corresponding sensor respectively, so as to judge whether the sensor is an attacked sensor, and further includes steps S401 to S404.

S401: Take each sensor as a target sensor respectively.

Take each sensor as the target sensor, respectively. Among them, the target sensor refers to the sensor that is currently being judged whether it is attacked. The target sensor may be any sensor included in the intelligent system, which is not limited here.

S402: Input the feature information corresponding to the target sensor into the autocorrelation judgment model of the target sensor to judge whether the feature information of the target sensor does not conform to the preset autocorrelation.

After the characteristic information corresponding to at least one sensor is obtained and a certain sensor is determined as the target sensor, the characteristic information obtained based on the sensor data collected by the target sensor is further input into the autocorrelation judgment model of the target sensor, Then, it is judged whether the feature information of the target sensor does not conform to the preset autocorrelation.

S403: Further input the feature information corresponding to the target sensor into the cross-correlation judgment model corresponding to the target sensor, so as to determine whether the feature information of the target sensor does not conform to the preset cross-correlation.

If it is determined that the characteristic information of the target sensor does not conform to the preset autocorrelation, it means that the sensor of the characteristic information obtained by the current sensor is suspected to be attacked. Therefore, in the current embodiment, after it is determined that the characteristic information of the target sensor does not conform to the preset autocorrelation, the characteristic information corresponding to the target sensor will be further input into the cross-correlation judgment model corresponding to the target sensor to determine the target. Whether the characteristics of the sensor do not meet the preset cross-correlation, and then further confirm whether the target sensor is the attacked sensor.

Further, in one embodiment, the same sensor may have multiple cross-correlation judgment models, and in step S403, the feature information corresponding to the target sensor is input into the multiple cross-correlation judgment models corresponding to the target sensor respectively. , to determine whether the feature information of the target sensor does not conform to the preset cross-correlation. Among them, when the characteristic information of the target sensor determined by multiple cross-correlation judgment models all meet the preset cross-correlation, it is determined that the characteristic information of the target sensor is in line with the preset cross-correlation, otherwise, if there is at least one cross-correlation judgment If the model determines that the characteristic information of the target sensor does not conform to the preset cross-correlation, then it is determined that the characteristic information of the target sensor does not conform to the preset cross-correlation.

S404: Determine the target sensor as the attacked sensor.

If it is determined that the characteristic information of the target sensor does not conform to the preset cross-correlation, the current target sensor is determined to be the attacked sensor, and the sensing data of the target sensor is further repaired when it is determined that the target sensor is the attacked sensor. For the restoration process of the sensory data, refer to the content described in FIG. 8 and any one of the corresponding embodiments below.

In the embodiment corresponding to FIG. 4 , the feature information corresponding to the target sensor is input into the autocorrelation judgment model of the target sensor, and when it is determined that the feature information of the target sensor does not conform to the preset autocorrelation, the target sensor is further The feature information corresponding to the sensor is input into the cross-correlation judgment model corresponding to the target sensor to determine whether the feature information of the target sensor does not meet the preset cross-correlation, if the feature information of the target sensor does not meet the preset cross-correlation, then Determine the target sensor as the attacked sensor. That is, to judge whether a sensor is an attacked sensor based on autocorrelation and cross-correlation at the same time, it can achieve a more accurate judgment of whether the sensor is an attacked sensor, and further improve the accuracy of intelligent system defense.

Please refer to FIG. 5 , which is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application. First of all, it should be noted that due to the relatively stable characteristics of autocorrelation and cross-correlation, in the embodiment corresponding to FIG. 5 , it is also possible to determine whether the sensor is an attacked sensor based solely on the judgment result of the autocorrelation judgment model. . In the current embodiment, step S320 in FIG. 3 inputs the characteristic information of each sensor into the attack judgment model of the corresponding sensor respectively, so as to judge whether the sensor is an attacked sensor, and further includes steps S501 to S502.

S501: Take each sensor as a target sensor respectively.

Each sensor is used as a target sensor to judge whether each sensor is attacked.

S502: Input the feature information corresponding to the target sensor into the autocorrelation judgment model of the target sensor to judge whether the feature information of the target sensor does not conform to the preset autocorrelation, and if so, determine that the target sensor is an attacked sensor.

In the current embodiment, the feature information corresponding to the target sensor is input into the autocorrelation judgment model of the target sensor, and whether the target sensor is an attacked sensor is directly judged based on the judgment result of the autocorrelation judgment model. When the current feature information of the target sensor does not conform to the autocorrelation, it is determined that the current target sensor is the attacked sensor. Specifically, the target autocorrelation matrix of the target sensor can be calculated and obtained, the target autocorrelation matrix is compared with the preset autocorrelation matrix, and whether the current sensor is determined based on the judgment result of whether the two matrices are the same For the attacked sensor. If it is the same, it is judged that the current target sensor is normal; otherwise, it is judged that the current target sensor is the attacked sensor.

In another embodiment, step S320 may also include: taking each sensor as the target sensor, and inputting the feature information corresponding to the target sensor into the cross-correlation judgment model corresponding to the target sensor to determine whether the feature information of the target sensor is Does not meet the preset cross-correlation, if yes, then determine that the target sensor is the attacked sensor. Specifically, the target cross-correlation matrix between the target sensor and other sensors related to the target sensor can be calculated, and the target cross-correlation matrix is compared with the preset cross-correlation matrix, and based on the two The judgment result of whether the two matrices are the same determines whether the current sensor is the attacked sensor. If it is the same, it is judged that the current target sensor is normal; otherwise, it is judged that the current target sensor is the attacked sensor.

Please refer to FIG. 6 , which is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application. In the current embodiment, the above steps input the feature information corresponding to the target sensor into the autocorrelation judgment model of the target sensor to determine whether the feature information of the target sensor does not conform to the preset autocorrelation, and further includes steps S601 to S603.

S601: Obtain a target autocorrelation matrix of the target sensor based on the corresponding feature information of the target sensor.

After the characteristic information corresponding to the target sensor is obtained, the target autocorrelation matrix of the target sensor is obtained by conversion based on the characteristic information corresponding to the target sensor.

S602: Determine whether the target autocorrelation matrix is consistent with the preset autocorrelation matrix of the target sensor.

Since the autocorrelation of the sensing data acquired by the same sensor in different time periods will remain unchanged, the autocorrelation matrix corresponding to the feature information of the sensor will remain unchanged. After the correlation matrix is obtained, by comparing the target autocorrelation matrix with the preset autocorrelation matrix of the target sensor, it can be judged whether the obtained target autocorrelation matrix is consistent with the preset autocorrelation matrix of the target sensor.

S603: If no, determine that the feature information of the target sensor does not conform to the preset autocorrelation.

If it is found through comparison that the target autocorrelation matrix is inconsistent with the preset autocorrelation matrix of the target sensor, it is judged that the characteristic information of the target sensor does not conform to the preset autocorrelation; If the correlation matrix is consistent with the preset autocorrelation matrix of the target sensor, it is judged that the characteristic information of the target sensor conforms to the preset autocorrelation matrix. Specifically, in one embodiment, the target autocorrelation matrix can be determined by subtracting the target autocorrelation matrix from the preset autocorrelation matrix of the target sensor, and determining whether each element in the matrix obtained by the subtraction is zero. Whether it is consistent with the preset autocorrelation matrix. If each element in the matrix obtained by subtraction is 0, it is judged that the target autocorrelation matrix is consistent with the preset autocorrelation matrix. Otherwise, the target autocorrelation matrix is judged. Inconsistent with the preset autocorrelation matrix.

Please refer to FIG. 7 , which is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application. In the current embodiment, the above steps input the feature information corresponding to the target sensor into the cross-correlation judgment model corresponding to the target sensor to determine whether the feature information of the target sensor does not conform to the preset cross-correlation, and further includes steps S701 to Step S703.

S701: Obtain a target cross-correlation matrix of the target sensor based on the feature information corresponding to the target sensor and the feature information corresponding to at least one other sensor.

Among them, other sensors are sensors that have cross-correlation with the target sensor. Other sensors may be preset according to the cross-correlation between each sensor, which is not limited herein.

Therefore, based on the characteristic information corresponding to the target sensor and the characteristic information corresponding to at least one other sensor, the target cross-correlation matrix of the target sensor is obtained. Wherein, the number of other sensors is not limited here, and may be specifically set based on requirements and the cross-correlation between sensors.

Further, in another embodiment, when each sensor collects sensing data according to a set period, then step S701 is based on the characteristic information corresponding to the target sensor in the current period, and at least one other sensor is in the current period. The characteristic information in the period corresponding to the period of the target sensor is used to obtain the cross-correlation matrix of the target sensor in the current period.

In yet another embodiment, when the same sensor has different correlations with multiple different sensors, in step S701, multiple target cross-correlation matrices corresponding to the target sensor may be obtained.

S702: Acquire a preset cross-correlation matrix between the target sensor and at least one other sensor, and determine whether the target cross-correlation matrix and the preset cross-correlation matrix are consistent.

It should be noted that, in the technical solution provided by the present application, the preset cross-correlation matrix and the attribute identity information of each sensor are associated and stored. Therefore, based on the information of the target sensor, the preset cross-correlation matrix between the target sensor and at least one other sensor can be directly obtained, and the obtained target cross-correlation matrix of the target sensor in the current cycle can be compared with the preset cross-correlation matrix. The matrices are compared to determine whether the target cross-correlation matrix is consistent with the preset cross-correlation matrix.

S703: If no, determine that the feature information of the target sensor does not conform to the preset cross-correlation.

If it is judged that the target cross-correlation matrix is inconsistent with the preset cross-correlation matrix, it is judged that the characteristic information of the target sensor does not conform to the preset cross-correlation; on the contrary, if it is judged that the target cross-correlation matrix and the preset cross-correlation matrix are consistent, Then it is judged that the characteristic information of the target sensor conforms to the preset cross-correlation.

Further, repairing the sensing data of the attacked sensor in step S330 in FIG. 3 further includes: using a matrix decomposition modeling method to repair the sensing data of the attacked sensor. In the current embodiment, the matrix decomposition modeling method can be used to quickly repair the sensing data of the attacked sensor, which improves the execution efficiency of the algorithm. It can be understood that, in other embodiments, other methods can also be used to repair the sensing data of the attacked sensor, for example, a nuclear norm relaxation modeling method can also be used to repair the sensing data of the attacked sensor.

Please refer to FIG. 8 , which is a schematic flowchart of another embodiment of a defense method for an intelligent system of the present application. In the embodiment corresponding to FIG. 8 , the above-mentioned steps further include steps S801 to S804 to repair the sensing data of the attacked sensor by using the modeling method of matrix decomposition.

S801: Establish an original perception signal matrix based on the characteristic information of the attacked sensor and the characteristic information of other sensors.

Among them, other sensors are sensors that have cross-correlation with the attacked sensor.

S802: Use the original sensory signal matrix and the matrix to complete the mathematical model to construct a sensory signal matrix. Wherein, the matrix completion mathematical model is a preset model used to complete the matrix.

S803: Decompose the sensing signal matrix into at least two multiplied low-rank matrices.

In the current embodiment, the matrix decomposition is performed based on an existing matrix decomposition method, which is not limited herein.

S804: The sampling alternating direction multiplier method or the block coordinate descent algorithm respectively solves the sensing signal matrix, so as to obtain the restored sensing data.

Based on the repairing part of the sensing data corresponding to FIG. 8 , in an embodiment, when it is detected that a certain sensor is attacked, the original sensing signal matrix M is established based on the feature information of the current sensor and the feature information of other sensors. The set of feature information elements corresponding to the unattacked sensors included in the original perception signal matrix M may be called an index set, and the feature information of the attacked sensors included in the original perception signal matrix M may be called missing elements . According to the established original sensory signal matrix M, a matrix completion mathematical model is established to reconstruct the sensory signal matrix X.

In the current embodiment, the basic idea of the modeling method based on matrix decomposition is to decompose the original sensory signal matrix into the product of two low-rank matrices, thereby avoiding complex matrix singular value decomposition and accelerating the execution efficiency of the algorithm. Specifically, the matrix completion problem using matrix factorization is modeled as in Equation 1:

where k is the predicted matrix rank bound. The above model is solved by the block coordinate descent algorithm (commonly known as the alternating minimization algorithm). Specifically, the appropriate k value can be obtained in advance, and then the model can be used to obtain a high-precision solution with a small time complexity.

During the experiment, the experimental results on synthetic data and real data sets show that the above-mentioned matrix double factorization model based on the idea of matrix factorization can significantly improve both the completion accuracy and the convergence speed. Specifically, the model in Equation 1 above can be further simplified into Equation 2:

The model corresponding to Equation 2 can be solved by the alternating direction multiplier method. In addition, the literature has proved that for any matrix X∈Rn1×n2 of rank r, if k>r, the following equation as shown in Equation 3 holds:

In another embodiment, the standard matrix completion problem can also be directly modeled in the following form in Equation 4:

Among them, the model in formula 4 can be directly solved by the block coordinate descent algorithm. In one embodiment, since the problem is non-convex, in order to avoid the existence of non-globally optimal stagnation point solutions, a solution under relatively loose conditions as shown in Equation 5 below is obtained.

||P _Ω (M-LQ)||≤λ Equation 5

即为全局最优解，然后通过

中对应的值来填充原始感知信号矩阵M中缺失的部分。The solution to the above problem is obtained by solving

is the global optimal solution, and then by

to fill in the missing part in the original sensory signal matrix M.

For the method provided in the embodiment corresponding to FIG. 8 , it can be known that the method using matrix decomposition and matrix completion provided by the present application can be better Restores the sensed target that was missing from the attack. After verification, it can be seen that for the lidar data of about 50,000 point cloud data, the detection and recovery experiments only take seconds on a single-core CPU. However, if a multi-core CPU is used for processing, or the algorithm of the data repair part is further optimized in the later stage, the processing time can be further greatly reduced, and the defense technology of the intelligent system can be more real-time and efficient.

The technical solution provided by this application establishes a cross-correlation judgment model and/or an auto-correlation judgment model by studying the overlapping relationship and semantic correlation of information between different sensors, thereby realizing the cross-correlation based on sensor data. and/or the autocorrelation of the sensing data to determine whether the intelligent system is under attack in real time, and when it is judged that the intelligent system is under attack, the method of matrix decomposition modeling is used to analyze the sensor data distorted by the attack. Accuracy recovery realizes real-time attack defense and high-precision data recovery, and forms a complete set of attack defense solutions centered on detecting whether a sensor is an attacked sensor and data recovery algorithms.

Referring to FIG. 9, FIG. 9 is a schematic structural diagram of an embodiment of a storage medium of the present application. The storage medium 900 stores a computer program 901 that can be executed by the processor, and the computer program 901 is used to implement the defense method of the intelligent system as described in FIG. 3 to FIG. 8 and any one of the corresponding embodiments. Specifically, the above-mentioned storage medium 900 may be one of a memory, a personal computer, a server, a network device, or a USB flash drive, which is not specifically limited herein.

The above description is only an embodiment of the present application, and is not intended to limit the scope of the patent of the present application. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present application, or directly or indirectly applied to other related technologies Fields are similarly included within the scope of patent protection of this application.

Claims (12)

1. A method of defending an intelligent system, the method comprising:

acquiring characteristic information corresponding to at least one sensor based on sensing data acquired by the at least one sensor;

respectively inputting the characteristic information of each sensor into an attack judgment model of the corresponding sensor to judge whether the sensor is an attacked sensor, wherein the attack judgment model comprises at least one of an autocorrelation judgment model and a cross correlation judgment model;

And if so, repairing the sensing data of the attacked sensor.

2. The method of claim 1, wherein the characteristic information of each sensor is input to an attack determination model of the corresponding sensor to determine whether the sensor is an attacked sensor, further comprising:

respectively taking each sensor as a target sensor;

inputting the characteristic information corresponding to the target sensor into an autocorrelation judging model of the target sensor so as to judge whether the characteristic information of the target sensor does not accord with preset autocorrelation;

if so, further inputting the feature information corresponding to the target sensor into the cross-correlation judgment model corresponding to the target sensor to judge whether the feature information of the target sensor does not accord with preset cross-correlation;

and if the characteristic information of the target sensor does not accord with the preset cross correlation, determining that the target sensor is the attacked sensor.

3. The method of claim 1, wherein the characteristic information of each sensor is input to an attack determination model of the corresponding sensor to determine whether the sensor is an attacked sensor, further comprising:

Respectively taking each sensor as a target sensor;

inputting the characteristic information corresponding to the target sensor into an autocorrelation judging model of the target sensor to judge whether the characteristic information of the target sensor does not accord with preset autocorrelation, and if so, determining that the target sensor is the attacked sensor; or,

inputting the characteristic information corresponding to the target sensor into the cross-correlation judgment model corresponding to the target sensor to judge whether the characteristic information of the target sensor does not accord with preset cross-correlation, and if so, determining that the target sensor is the attacked sensor.

4. The method according to claim 2 or 3, wherein the inputting the feature information corresponding to the target sensor into the auto-correlation determination model of the target sensor to determine whether the feature information of the target sensor does not conform to the preset auto-correlation further comprises:

obtaining a target autocorrelation matrix of the target sensor based on the corresponding characteristic information of the target sensor;

judging whether the target autocorrelation matrix is consistent with a preset autocorrelation matrix of the target sensor;

If not, judging that the characteristic information of the target sensor does not accord with the preset autocorrelation.

5. The method according to claim 2 or 3, wherein the inputting the feature information corresponding to the target sensor into the cross-correlation determination model corresponding to the target sensor to determine whether the feature information of the target sensor does not conform to a preset cross-correlation further comprises:

obtaining a target cross-correlation matrix of the target sensor based on the characteristic information corresponding to the target sensor and the characteristic information corresponding to at least one other sensor; wherein the other sensor is the sensor having a cross-correlation with the target sensor;

acquiring a preset cross-correlation matrix between the target sensor and the at least one other sensor, and judging whether the target cross-correlation matrix is consistent with the preset cross-correlation matrix;

if not, judging that the characteristic information of the target sensor does not accord with the preset cross correlation.

6. The method of claim 1, wherein the at least one sensor comprises at least one of a position sensor, a lidar sensor, an inertial measurement unit; the sampling period of each sensor is the shortest sampling period of the inertia measurement unit;

And/or the characteristic information is a characteristic vector.

7. The method of claim 1, further comprising constructing the attack determination model by a mathematical modeling algorithm or a machine learning algorithm.

8. The method of claim 1, wherein the repairing the sensor data of the attacked sensor further comprises:

and repairing the sensing data of the attacked sensor by utilizing a modeling method of matrix decomposition.

9. The method of claim 8, wherein the repairing the sensor data of the attacked sensor using a modeling method of matrix factorization further comprises:

establishing a raw sensing signal matrix based on the characteristic information of the attacked sensor and the characteristic information of other sensors, wherein the other sensors are the sensors with cross correlation with the attacked sensor;

building a sensing signal matrix by using the original sensing signal matrix and a matrix completion mathematical model;

decomposing the perceptual signal matrix into at least two multiplied low rank matrices;

and respectively solving the sensing signal matrix by using an alternative direction multiplier method or a block coordinate descent algorithm to obtain the repaired sensing data.

10. A defensive device, the device comprising a memory, a processor and a data acquisition port, the memory and the data acquisition port being respectively coupled with the processor, wherein,

the data acquisition port acquires sensing data fed back by at least one sensor under the control of the processor and outputs the sensing data to the processor;

the memory stores a computer program;

the processor is configured to run the computer program to perform the method of any one of claims 1 to 9.

11. An intelligent system comprising at least one sensor and the defence apparatus of claim 10.

12. A storage medium, characterized in that it stores a computer program executable by a processor, the computer program being adapted to implement the method of any one of claims 1 to 9.

Images