WO2020168874A1 - 分类器鲁棒性的测试方法、装置、终端及存储介质 - Google Patents

分类器鲁棒性的测试方法、装置、终端及存储介质 Download PDF

Info

Publication number
WO2020168874A1
WO2020168874A1 PCT/CN2020/072339 CN2020072339W WO2020168874A1 WO 2020168874 A1 WO2020168874 A1 WO 2020168874A1 CN 2020072339 W CN2020072339 W CN 2020072339W WO 2020168874 A1 WO2020168874 A1 WO 2020168874A1
Authority
WO
WIPO (PCT)
Prior art keywords
classifier
evasion
sample
test
variant
Prior art date
Application number
PCT/CN2020/072339
Other languages
English (en)
French (fr)
Inventor
闫巧
王明德
罗旭鹏
黄文耀
Original Assignee
深圳大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳大学 filed Critical 深圳大学
Publication of WO2020168874A1 publication Critical patent/WO2020168874A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/217—Validation; Performance evaluation; Active pattern learning techniques
    • G06F18/2193—Validation; Performance evaluation; Active pattern learning techniques based on specific statistical tests
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/285—Selection of pattern recognition techniques, e.g. of classifiers in a multi-classifier system

Definitions

  • This application belongs to the technical field of classifier testing, and in particular relates to a method, device, terminal and storage medium for testing the robustness of a classifier.
  • Machine learning algorithms can learn data adaptively. It analyzes the data and has achieved good classification performance in many security applications, such as spam filtering, intrusion detection, and malware detection systems. Therefore, people generally obtain classifications through machine learning To quickly and effectively process these complex data.
  • the purpose of this application is to provide a method, device, terminal, and storage medium for testing the robustness of the classifier, which aims to solve the problem that the prior art cannot provide an effective classifier test method, which causes the existing classifier to test the classification.
  • the robustness of the device the test effect is not ideal and the test efficiency is not high.
  • this application provides a method for testing the robustness of a classifier.
  • the method includes the following steps:
  • the robustness of the target test classifier is output according to the classification result after the attack.
  • this application provides a test device for classifier robustness, the device includes:
  • the sample acquisition unit is configured to input the preset test sample into the target test classifier for classification, and obtain the malicious sample and the normal sample in the test sample;
  • the feature value obtaining unit is configured to input random noise into a preset perceptron network, and obtain the reference feature value of the malicious sample through the perceptron network to generate a reference sample;
  • the feature value modification unit is configured to modify the feature value of the malicious sample according to the reference feature value of the reference sample to generate an evasive variant of the malicious sample;
  • An attack classification unit configured to input the escape variant to the target test classifier for classification, and obtain a classification result of the target test classifier after being attacked by the escape variant
  • the performance output unit is configured to output the robustness of the target test classifier according to the classification result after the attack.
  • the present application also provides a test terminal, including a memory, a processor, and a computer program stored in the memory and running on the processor.
  • the processor implements the computer program when the computer program is executed. The steps of the above-mentioned classifier robustness test method.
  • the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the above-mentioned classifier robustness test method. step.
  • FIG. 1 is an implementation flowchart of a method for testing the robustness of a classifier provided by Embodiment 1 of the present application;
  • FIG. 2 is an implementation flowchart of a method for testing the robustness of a classifier provided in the second embodiment of the present application;
  • FIG. 3 is a schematic structural diagram of a test device for classifier robustness provided in Embodiment 3 of the present application;
  • Fig. 4 is a schematic structural diagram of a test device for classifier robustness provided in the fourth embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a test terminal improved in Embodiment 5 of the present application.
  • FIG. 1 shows the implementation process of the method for testing the robustness of the classifier provided in the first embodiment of the present application.
  • FIG. 1 shows the implementation process of the method for testing the robustness of the classifier provided in the first embodiment of the present application.
  • the details are as follows:
  • step S101 a preset test sample is input to the target test classifier for classification, and malicious samples and normal samples in the test samples are obtained.
  • the embodiments of the present application are applicable to a test terminal, which can test the performance of the classifier, for example, robustness.
  • the test sample is composed of a sample with no malicious features and a sample with malicious features that have been classified by a discriminator in advance, and the discriminator can correctly process the samples with no malicious features and the samples with malicious features.
  • Classification the malicious sample is the sample that can be correctly detected by the target test classifier to have malicious attack characteristics in the test sample.
  • the tested classifier is called the target test classifier.
  • the preset test sample is input into the target test classifier
  • the classification is performed to obtain malicious samples and normal samples that can be correctly classified by the target test classifier in the test samples, in which the accuracy of the malicious attack characteristics detected by the malicious samples is ensured.
  • step S102 random noise is input to a preset perceptron network, and the reference characteristic value of the malicious sample is obtained through the perceptron network to generate a reference sample.
  • the preset perceptron network is a preset multilayer perceptron network, so that the distribution of samples generated by the multilayer perceptron network can be the same as the distribution of the preset test samples, and random noise is input
  • the sample feature value is obtained through the multi-layer perceptron network, and the sample is generated according to the sample feature value, thereby improving the aggressiveness of subsequent evasion variants.
  • this sample is called reference
  • the characteristic value of the sample is called the reference characteristic value, which is used as a reference for subsequent modification of the characteristic value of the malicious sample.
  • step S103 the characteristic value of the malicious sample is modified according to the reference characteristic value of the reference sample to generate an escape variant of the malicious sample.
  • the characteristic value of the malicious sample separated by the test sample is modified according to the reference characteristic value of the reference sample, thereby generating a malicious sample, that is, an escape variant .
  • the evasion variant retains some of the features that can make the evasion variant attack the classifier, and the remaining features that are irrelevant to aggressiveness are modified.
  • step S104 the escape variant is input to the target test classifier for classification, and the classification result of the target test classifier after being attacked by the escape variant is obtained.
  • the evasion variant is input to the target test classifier for classification test, and the classification result of the target test classifier after being attacked by the evasion variant is obtained, thereby obtaining the malicious sample correctly classified by the target test classifier After modifying some features, can it be classified correctly by the target test classifier?
  • step S105 the robustness of the target test classifier is output according to the classification result after the attack.
  • the preset test samples are first input into the target test classifier for classification, the malicious samples in the test samples are obtained, random noise is input into the preset perceptron network, and the malicious samples are obtained through the perceptron network.
  • the feature value to generate a reference sample and then modify the feature value of the malicious sample according to the reference feature value of the reference sample to generate an evasion variant of the malicious sample, and then input the evasion variant into the target test classifier for classification to obtain
  • the classification result of the target test classifier after being attacked by the evasion variant, and finally the robustness of the target test classifier is output according to the classification result after the attack, so as to test the robustness of the classifier by generating the evasion variant, thereby improving the classifier Robust test effect and test efficiency.
  • Fig. 2 shows the implementation process of the method for testing the robustness of the classifier provided in the first embodiment of the present application.
  • Fig. 2 shows the implementation process of the method for testing the robustness of the classifier provided in the first embodiment of the present application.
  • the details are as follows:
  • step S201 a preset test sample is input to the target test classifier for classification, and malicious samples in the test sample are obtained.
  • the embodiments of the present application are applicable to a test terminal, which can test the performance of the classifier, for example, robustness.
  • the test sample is composed of a sample with no malicious features and a sample with malicious features that have been classified by a discriminator in advance, and the discriminator can correctly process the samples with no malicious features and the samples with malicious features.
  • Classification the malicious sample is the sample that can be correctly detected by the target test classifier to have malicious attack characteristics in the test sample.
  • the tested classifier is called the target test classifier.
  • the preset test sample is input into the target test classifier
  • the classification is performed to obtain malicious samples and normal samples that can be correctly classified by the target test classifier in the test samples, in which the accuracy of the malicious attack characteristics detected by the malicious samples is ensured.
  • step S202 random noise is input to a preset perceptron network, and the reference characteristic value of the malicious sample is obtained through the perceptron network to generate a reference sample.
  • the preset perceptron network is a preset multilayer perceptron network, so that the distribution of samples generated by the multilayer perceptron network can be the same as the distribution of the preset test samples, and random noise is input
  • the sample feature value is obtained through the multi-layer perceptron network, and the sample is generated according to the sample feature value, thereby improving the aggressiveness of subsequent evasion variants.
  • this sample is called reference
  • the characteristic value of the sample is called the reference characteristic value, which is used as a reference for subsequent modification of the characteristic value of the malicious sample.
  • step S203 the characteristic value of the malicious sample is modified according to the reference characteristic value of the reference sample to generate an escape variant of the malicious sample.
  • the characteristic value of the malicious sample separated by the test sample is modified according to the reference characteristic value of the reference sample, thereby generating a malicious sample, that is, an escape variant .
  • the evasion variant retains some of the features that can make the evasion variant attack the classifier, and the remaining features that are irrelevant to aggressiveness are modified.
  • step S204 the escape variant is input to the target test classifier for classification, and the classification result of the target test classifier after being attacked by the escape variant is obtained.
  • the evasion variant is input to the target test classifier for classification test, and the classification result of the target test classifier after being attacked by the evasion variant is obtained, thereby obtaining the malicious sample correctly classified by the target test classifier After modifying some features, can it be classified correctly by the target test classifier?
  • step S205 the evasion ratio of the evasion variants that are incorrectly classified by the target test classifier is obtained according to the classification result after the attack.
  • the target test classifier classifies the evasion variants
  • the proportions of the evasion variants that can be incorrectly classified and correctly classified by the target test classifier can be obtained by comparison.
  • the ratio of variants is called the escape ratio.
  • step S206 when the escape ratio reaches the preset ratio threshold, the second parameter of the target test classifier is adjusted.
  • the parameter of the target test classifier is called the second parameter.
  • the escape ratio reaches the preset ratio threshold, it may be because the parameters of the target test classifier are not optimized to the maximum. Good, the parameters of the target test classifier need to be adjusted to reduce the evasion ratio.
  • the evasion ratio still reaches the preset ratio threshold, indicating the robustness of the target test classifier If the robustness is unqualified, skip to step S209, and output the test result of the robustness of the target test classifier.
  • the preset ratio threshold can be set to 25%.
  • the target test classifier adjustment index As the target test classifier adjustment index, the larger the adjustment index, it indicates that the classification performance of the target test classifier has been optimized, thereby improving the accuracy of testing the target test classifier while improving the classification performance of the target test classifier ,
  • x n represents a normal sample
  • x M represents a malicious sample number
  • M represents a malicious sample number
  • z represents random noise
  • G(z) represents a reference sample generated by random noise
  • D(x n ) represents The classification result of the sample x n by the target test classifier, Represents a random sample under the distribution of x n , x M , and G(z), Represents the target test classifier against the sample C(G(z), x M ) represents the evasion sample generated by the reference sample G(z) and the malicious sample x M
  • D(C(G(z), x M )) represents the target test classifier pair Escape the classification result
  • step S207 when the escape ratio is less than the preset ratio threshold, the first parameter of the sensor network is adjusted.
  • the parameters of the perceptron network are adjusted to expand the coverage of the reference features generated by the perceptron network, thereby further improving the accuracy of testing the target test classifier.
  • the parameter for adjusting the perceptron network is called the first parameter.
  • the As an adjustment index of the adjustment perceptron network the smaller the adjustment index, the greater the attack intensity of the evasion variant attack target test classifier, thereby further improving the accuracy of testing the target test classifier.
  • the Adam optimization algorithm is used to perform stochastic gradient descent adjustment of the first parameter or the second parameter, thereby reducing the optimization time of the first parameter or the second parameter, thereby increasing the target Test the test efficiency of the classifier.
  • step S208 the Wassertein distance between the distribution of the escape variant and the normal sample distribution in the test sample is obtained to determine whether to continue testing the target classifier according to the Wassertein distance.
  • the Wassertein distance is the distance moved by the earth, and the Earth-Mover distance (EM distance) is used to measure the distance between two distributions.
  • EM distance Earth-Mover distance
  • the Wassertein distance The smaller the value, the more difficult it is to distinguish the evasion variant from the normal sample, and the higher the attack intensity of the evasion sample on the target test classifier.
  • the Wassertein distance converges, you can jump to step S209 to output the robustness of the target test classifier Otherwise, you can continue to adjust the first parameter of the perceptron network to continue to strengthen the attack intensity of the evasion variant.
  • step S209 the robustness of the target test classifier is output according to the classification result after the attack.
  • the evasion ratio reaches the preset evasion threshold, it can be obtained whether the robustness of the target test classifier meets the standard.
  • first obtain the malicious sample in the test sample obtain the reference characteristic value of the malicious sample through the perceptron network, generate the reference sample, and then modify the characteristic value of the malicious sample according to the reference characteristic value of the reference sample to generate Evasion variants, and then input the evasion variants into the target test classifier for classification, and obtain the classification results after being attacked by the evasion variants.
  • the evasion ratio of the target test classifier's misclassification evasion variants adjusts the parameters of the target test classifier and the perceptron network, and finally outputs the robustness of the target test classifier according to the classification results after the attack, so as to test the robustness of the classifier by generating evasion variants, thereby improving the classification The robustness of the test results and test efficiency.
  • Fig. 3 shows the structure of the test device for classifier robustness provided in the third embodiment of the present application.
  • Fig. 3 shows the structure of the test device for classifier robustness provided in the third embodiment of the present application.
  • parts related to the embodiment of the present application are shown, including:
  • the sample obtaining unit 31 is configured to input preset test samples into the target test classifier for classification, and obtain malicious samples and normal samples in the test samples;
  • the feature value obtaining unit 32 is configured to input random noise into a preset perceptron network, and obtain the reference feature value of the malicious sample through the perceptron network to generate a reference sample;
  • the feature value modification unit 33 is configured to modify the feature value of the malicious sample according to the reference feature value of the reference sample to generate an evasive variant of the malicious sample;
  • the attack classification unit 34 is configured to input the escape variant into the target test classifier for classification, and obtain the classification result of the target test classifier after being attacked by the escape variant;
  • the performance output unit 35 is configured to output the robustness of the target test classifier according to the classification result after the attack.
  • the preset test samples are first input into the target test classifier for classification, the malicious samples in the test samples are obtained, random noise is input into the preset perceptron network, and the malicious samples are obtained through the perceptron network.
  • the feature value to generate a reference sample and then modify the feature value of the malicious sample according to the reference feature value of the reference sample to generate an evasion variant of the malicious sample, and then input the evasion variant into the target test classifier for classification to obtain
  • the classification result of the target test classifier after being attacked by the evasion variant, and finally the robustness of the target test classifier is output according to the classification result after the attack, so as to test the robustness of the classifier by generating the evasion variant, thereby improving the classifier Robust test effect and test efficiency.
  • each unit of the test device for classifier robustness can be implemented by a corresponding hardware or software unit.
  • Each unit can be an independent software and hardware unit, or can be integrated into a software and hardware unit. Not to limit this application.
  • For the specific implementation of each unit please refer to the description of Embodiment 1, which will not be repeated here.
  • Fig. 4 shows the structure of the test device for classifier robustness provided in the fourth embodiment of the present application.
  • Fig. 4 shows the structure of the test device for classifier robustness provided in the fourth embodiment of the present application.
  • parts related to the embodiment of the present application are shown, including:
  • the sample obtaining unit 41 is configured to input preset test samples into the target test classifier for classification, and obtain malicious samples and normal samples in the test samples;
  • the feature value obtaining unit 42 is configured to input random noise into a preset perceptron network, and obtain the reference feature value of the malicious sample through the perceptron network to generate a reference sample;
  • the feature value modification unit 43 is configured to modify the feature value of the malicious sample according to the reference feature value of the reference sample to generate an evasion variant of the malicious sample;
  • the attack classification unit 44 is configured to input the escape variant to the target test classifier for classification, and obtain the classification result of the target test classifier after being attacked by the escape variant;
  • the ratio obtaining unit 45 is configured to obtain the evasion ratio of the wrong classification evasion variant of the target test classifier according to the classification result after the attack;
  • the second adjustment unit 46 is configured to adjust the second parameter of the target test classifier when the escape ratio reaches the preset ratio threshold;
  • the first adjustment unit 47 is configured to adjust the first parameter of the sensor network when the escape ratio is less than the preset ratio threshold
  • the distance acquiring unit 48 is configured to acquire the Wassertein distance between the distribution of the escape variant and the normal sample distribution in the test sample, so as to determine whether to continue testing the target classifier according to the Wassertein distance;
  • the performance output unit 49 is configured to output the robustness of the target test classifier according to the classification result after the attack.
  • first obtain the malicious sample in the test sample obtain the reference characteristic value of the malicious sample through the perceptron network, generate the reference sample, and then modify the characteristic value of the malicious sample according to the reference characteristic value of the reference sample to generate Evasion variants, and then input the evasion variants into the target test classifier for classification, and obtain the classification results after being attacked by the evasion variants.
  • the evasion ratio of the target test classifier's misclassification evasion variants adjusts the parameters of the target test classifier and the perceptron network, and finally outputs the robustness of the target test classifier according to the classification results after the attack, so as to test the robustness of the classifier by generating evasion variants, thereby improving the classification The robustness of the test results and test efficiency.
  • each unit of the test device for classifier robustness can be implemented by a corresponding hardware or software unit.
  • Each unit can be an independent software and hardware unit, or can be integrated into a software and hardware unit. Not to limit this application.
  • For the specific implementation of each unit please refer to the description of the second embodiment, which will not be repeated here.
  • Fig. 5 shows the structure of the test terminal provided in the fifth embodiment of the present application.
  • Fig. 5 shows the structure of the test terminal provided in the fifth embodiment of the present application.
  • parts related to the embodiment of the present application including:
  • the computing terminal 5 in the embodiment of the present application includes a processor 51, a memory 52, and a computer program 53 stored in the memory 52 and running on the processor 51.
  • the processor 51 executes the computer program 53
  • the steps in the above-mentioned method for testing the robustness of each classifier are implemented, for example, steps S101 to S105 shown in FIG. 1 and steps S201 to S209 shown in FIG.
  • the processor 51 executes the computer program 53
  • the functions of the units in the above-mentioned test device for the robustness of the classifiers are implemented, for example, the functions of the units 31 to 35 shown in FIG. 3 and the units 41 to 49 shown in FIG. .
  • the processor when the processor executes the computer program, it first obtains the malicious sample in the test sample, obtains the reference characteristic value of the malicious sample through the perceptron network, generates the reference sample, and then compares the malicious sample according to the reference characteristic value of the reference sample.
  • the evasion ratio of the evasion variant adjust the parameters of the target test classifier and the perceptron network according to the evasion ratio, and finally output the robustness of the target test classifier according to the classification result after the attack, so as to generate the evasion variant to be robust to the classifier Robustness is tested, thereby improving the robustness test effect and test efficiency of the classifier.
  • Embodiment 6 is a diagrammatic representation of Embodiment 6
  • a computer-readable storage medium stores a computer program.
  • the robustness of each classifier is tested in the embodiment The steps of, for example, steps S101 to S105 shown in FIG. 1 and steps S201 to S209 shown in FIG. 2.
  • the functions of the units in the above-mentioned test device for the robustness of the classifiers are realized, for example, the functions of the units 31 to 35 shown in FIG. 3 and the units 41 to 49 shown in FIG. 4 .
  • the malicious sample in the test sample is first obtained, the reference characteristic value of the malicious sample is obtained through the sensor network, the reference sample is generated, and then the reference characteristic value pair of the reference sample
  • the characteristic value of the malicious sample is modified to generate the evasion variant, and then the evasion variant is input to the target test classifier for classification, and the classification result after the attack by the evasion variant is obtained, and the target test classifier error is obtained according to the classification result after the attack Classify the evasion ratio of the evasion variant, adjust the parameters of the target test classifier and the perceptron network according to the evasion ratio, and finally output the robustness of the target test classifier according to the classification results after the attack, so as to generate the evasion variant to the classifier Robustness is tested, thereby improving the robustness test effect and test efficiency of the classifier.
  • the computer-readable storage medium in the embodiment of the present application may include any entity or device or storage medium capable of carrying computer program code, such as ROM/RAM, magnetic disk, optical disk, flash memory and other memories.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Biology (AREA)
  • Evolutionary Computation (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请适用分类器测试技术领域，提供了一种分类器鲁棒性的测试方法、装置、终端及存储介质，该方法包括：将预设的测试样本输入到目标测试分类器进行分类，获取测试样本中的恶意样本，将随机噪声输入预设的感知器网络，通过感知器网络获取恶意样本的参考特征值，以生成参考样本，然后根据参考样本的参考特征值对恶意样本的特征值进行修改，以生成恶意样本的逃避变体，再将逃避变体输入到目标测试分类器进行分类，获取目标测试分类器被逃避变体攻击后的分类结果，最后根据攻击后的分类结果输出目标测试分类器的鲁棒性。

Description

分类器鲁棒性的测试方法、装置、终端及存储介质
本申请要求于2019年2月20日提交中国专利局、申请号为201910126943.1、申请名称为“分类器鲁棒性的测试方法、装置、终端及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请属于分类器测试技术领域，尤其涉及一种分类器鲁棒性的测试方法、装置、终端及存储介质。
背景技术
随着社会的进步与发展，人们所需要收集、处理的数据越来越多，如何选择一个快速有效的工具或者方式来处理这些数据成了人们关注的焦点，机器学习算法能自适应地学习数据的特性并对数据进行分析，在许多安全类应用中取得了较好的分类性能，比如说在垃圾邮件过滤、入侵检测和恶意软件检测系统等应用中，因此，人们一般通过机器学习得到的分类器来对这些繁杂的数据进行快速有效地处理。
但是，在上述分类器的应用中，可能存在一些攻击者通过修改一些恶意数据样本来误导分类器做出错误的决策，或者试探分类器的漏洞，从而便于恶意者通过分类器的漏洞来达到他们的非法目的。因此，在人们使用分类器处理数据之前，需要分类器进行测试，测试该分类器在有恶意数据攻击的情况下，对数据进行分类的正确率是否能达到人们预期的水平，即测试该分类器的鲁棒性。
一般地，人们在测试分类器的鲁棒性时，采用模拟攻击法或者遗传算法，但是前者的攻击性能不强，难以达到预期的测试效果，后者的攻击效果相对较好，耗时却比较长，例如，利用遗传算法测试分类器的鲁棒性时，需要2-5天才可使500个恶意PDF文件生成可行的变体(躲避分类器的检测，用以对分类 器进行攻击)，因此，现有的测试分类器鲁棒性的测试效果、测试效率都有待提高。
发明内容
本申请的目的在于提供一种分类器鲁棒性的测试方法、装置、终端以及存储介质，旨在解决由于现有技术无法提供一种有效的分类器测试方法，导致现有分类器在测试分类器的鲁棒性时，测试效果不理想、测试效率不高的问题。
一方面，本申请提供了一种分类器鲁棒性的测试方法，所述方法包括下述步骤：
将预设的测试样本输入到目标测试分类器进行分类，获取所述测试样本中的恶意样本和正常样本；
将随机噪声输入预设的感知器网络，通过所述感知器网络获取所述恶意样本的参考特征值，以生成参考样本；
根据所述参考样本的参考特征值对所述恶意样本的特征值进行修改，以生成所述恶意样本的逃避变体；
将所述逃避变体输入到所述目标测试分类器进行分类，获取所述目标测试分类器被所述逃避变体攻击后的分类结果；
根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性。
另一方面，本申请提供了一种分类器鲁棒性的测试装置，所述装置包括：
样本获取单元，用于将预设的测试样本输入到目标测试分类器进行分类，获取所述测试样本中的恶意样本和正常样本；
特征值获取单元，用于将随机噪声输入预设的感知器网络，通过所述感知器网络获取所述恶意样本的参考特征值，以生成参考样本；
特征值修改单元，用于根据所述参考样本的参考特征值对所述恶意样本的特征值进行修改，以生成所述恶意样本的逃避变体；
攻击分类单元，用于将所述逃避变体输入到所述目标测试分类器进行分类， 获取所述目标测试分类器被所述逃避变体攻击后的分类结果；以及
性能输出单元，用于根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性。
另一方面，本申请还提供了一种测试终端，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如上述分类器鲁棒性的测试方法的步骤。
另一方面，本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时实现如上述分类器鲁棒性的测试方法的步骤。
附图说明
图1是本申请实施例一提供的一种分类器鲁棒性的测试方法的实现流程图；
图2是本申请实施例二提供的一种分类器鲁棒性的测试方法的实现流程图；
图3是本申请实施例三提供的一种分类器鲁棒性的测试装置的结构示意图；
图4是本申请实施例四提供的一种分类器鲁棒性的测试装置的结构示意图；以及
图5是本申请实施例五提高的一种测试终端的结构示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
以下结合具体实施例对本申请的具体实现进行详细描述：
实施例一：
图1示出了本申请实施例一提供的分类器鲁棒性的测试方法的实现流程，为了便于说明，仅示出了与本申请实施例相关的部分，详述如下：
在步骤S101中，将预设的测试样本输入到目标测试分类器进行分类，获取测试样本中的恶意样本和正常样本。
本申请实施例适用于测试终端，该测试终端可测试分类器的性能，例如，鲁棒性等。在本申请实施例中，测试样本为预先设置的经过判别器分类好的无恶意特征的样本和有恶意特征的样本组成，该判别器可以正确将无恶意特征的样本和有恶意特征的样本进行分类，恶意样本为测试样本中能被目标测试分类器正确检测出有恶意攻击特征的样本，将被测试的分类器称为目标测试分类器，先将预先设置的测试样本输入到目标测试分类器进行分类，获取测试样本中该目标测试分类器可以正确分类出来的恶意样本和正常样本，其中，以确保恶意样本被检测出恶意攻击特征的准确度。
在步骤S102中，将随机噪声输入预设的感知器网络，通过感知器网络获取恶意样本的参考特征值，以生成参考样本。
在本申请实施例中，预设的感知器网络为预先设置的多层感知器网络，可使该多层感知器网络生成的样本的分布与预设的测试样本的分布相同，将随机噪声输入到该多层感知器网络后，通过该多层感知器网络得到样本特征值，根据样本特征值生成样本，从而提高了后续逃避变体的攻击性，为了便于后续描述，将该样本称为参考样本，其特征值称为参考特征值，用于后续给恶意样本作特征值修改的参照。
在步骤S103中，根据参考样本的参考特征值对恶意样本的特征值进行修改，以生成恶意样本的逃避变体。
在本申请实施例中，在得到与测试样本分布相同的参考样本之后，根据参考样本的参考特征值对测试样本分离出的恶意样本的特征值进行修改，从而生成了恶意样本，即逃避变体，该逃避变体保留了可使逃避变体攻击分类器的部 分特征，其余无关攻击性的部分特征被修改。
在步骤S104中，将逃避变体输入到目标测试分类器进行分类，获取目标测试分类器被逃避变体攻击后的分类结果。
在本申请实施例中，将逃避变体输入到目标测试分类器进行分类测试，获取目标测试分类器被该逃避变体攻击后的分类结果，从而得到被目标测试分类器正确分类后的恶意样本在修改了部分特征之后，是否还能正确被该目标测试分类器进行分类。
在步骤S105中，根据攻击后的分类结果输出目标测试分类器的鲁棒性。
在本申请实施例中，根据目标测试分类器被攻击后的分类结果，可以得到目标测试分类器的鲁棒性是否达标。
在本申请实施例中，先将预设的测试样本输入到目标测试分类器进行分类，获取测试样本中的恶意样本，将随机噪声输入预设的感知器网络，通过感知器网络获取恶意样本的参考特征值，以生成参考样本，然后根据参考样本的参考特征值对恶意样本的特征值进行修改，以生成恶意样本的逃避变体，再将逃避变体输入到目标测试分类器进行分类，获取目标测试分类器被逃避变体攻击后的分类结果，最后根据攻击后的分类结果输出目标测试分类器的鲁棒性，从而通过生成逃避变体对分类器鲁棒性进行测试，进而提高分类器鲁棒性的测试效果和测试效率。
实施例二：
图2示出了本申请实施例一提供的分类器鲁棒性的测试方法的实现流程，为了便于说明，仅示出了与本申请实施例相关的部分，详述如下：
在步骤S201中，将预设的测试样本输入到目标测试分类器进行分类，获取测试样本中的恶意样本。
本申请实施例适用于测试终端，该测试终端可测试分类器的性能，例如，鲁棒性等。在本申请实施例中，测试样本为预先设置的经过判别器分类好的无恶意特征的样本和有恶意特征的样本组成，该判别器可以正确将无恶意特征的 样本和有恶意特征的样本进行分类，恶意样本为测试样本中能被目标测试分类器正确检测出有恶意攻击特征的样本，将被测试的分类器称为目标测试分类器，先将预先设置的测试样本输入到目标测试分类器进行分类，获取测试样本中该目标测试分类器可以正确分类出来的恶意样本和正常样本，其中，以确保恶意样本被检测出恶意攻击特征的准确度。
在步骤S202中，将随机噪声输入预设的感知器网络，通过感知器网络获取恶意样本的参考特征值，以生成参考样本。
在本申请实施例中，预设的感知器网络为预先设置的多层感知器网络，可使该多层感知器网络生成的样本的分布与预设的测试样本的分布相同，将随机噪声输入到该多层感知器网络后，通过该多层感知器网络得到样本特征值，根据样本特征值生成样本，从而提高了后续逃避变体的攻击性，为了便于后续描述，将该样本称为参考样本，其特征值称为参考特征值，用于后续给恶意样本作特征值修改的参照。
在步骤S203中，根据参考样本的参考特征值对恶意样本的特征值进行修改，以生成恶意样本的逃避变体。
在本申请实施例中，在得到与测试样本分布相同的参考样本之后，根据参考样本的参考特征值对测试样本分离出的恶意样本的特征值进行修改，从而生成了恶意样本，即逃避变体，该逃避变体保留了可使逃避变体攻击分类器的部分特征，其余无关攻击性的部分特征被修改。
在步骤S204中，将逃避变体输入到目标测试分类器进行分类，获取目标测试分类器被逃避变体攻击后的分类结果。
在本申请实施例中，将逃避变体输入到目标测试分类器进行分类测试，获取目标测试分类器被该逃避变体攻击后的分类结果，从而得到被目标测试分类器正确分类后的恶意样本在修改了部分特征之后，是否还能正确被该目标测试分类器进行分类。
在步骤S205中，根据攻击后的分类结果获取目标测试分类器错误分类逃避 变体的逃避比例。
在本申请实施例中，在目标测试分类器对逃避变体进行分类之后，可通过比较分别得到能被目标测试分类器错误、正确分类逃避变体的比例，为了便于后续描述，将错误分类逃避变体的比例称为逃避比例。
在步骤S206中，当逃避比例达到预设比例阈值时，调整目标测试分类器的第二参数。
在本申请实施例中，为了便于后续描述，将该目标测试分类器的参数称为第二参数，当逃避比例达到预设比例阈值时，可能是由于该目标测试分类器的参数未优化至最佳，需要对目标测试分类器的参数进行调整，以降低逃避比例，当该目标测试分类器的参数优化至最佳后，逃避比例仍然达到了预设比例阈值，表明该目标测试分类器的鲁棒性不合格，则跳转至步骤S209，输出目标测试分类器的鲁棒性的测试结果，该预设比例阈值可设置为25％。
优选地，在调整该目标测试分类器的第二参数时，将
Figure PCTCN2020072339-appb-000001
作为目标测试分类器调整指标，该调整指标越大，表明该目标测试分类器的分类性能被优化了，从而在提高目标测试分类器的分类性能的同时，提高测试该目标测试分类器的准确度，其中，x n表示正常样本，n表示正常样本序号，x M表示恶意样本，M表示恶意样本序号，z表示随机噪声，G(z)表示随机噪声生成的参考样本，D(x n)表示目标测试分类器对样本x n的分类结果，
Figure PCTCN2020072339-appb-000002
表示x n、x M、G(z)分布下的随机样本，
Figure PCTCN2020072339-appb-000003
表示目标测试分类器对样本
Figure PCTCN2020072339-appb-000004
的分类结果，C(G(z)，x M)表示参考样本G(z)和恶意样本x M生成的逃避样本，D(C(G(z)，x M))表示目标测试分类器对逃避样本C(G(z)，x D)的分类结果，
Figure PCTCN2020072339-appb-000005
表示
Figure PCTCN2020072339-appb-000006
在
Figure PCTCN2020072339-appb-000007
的梯度，P mal(x)表示恶意样本的分布，P normal(x)表示正常样本的分布，P z(z)表示随机噪声样本的分布，
Figure PCTCN2020072339-appb-000008
表示D(x n)在正常样本分布下的期望值，
Figure PCTCN2020072339-appb-000009
表示D(C(G(z)，x M))在随机噪声分布和恶意样本分布下的期望值，
Figure PCTCN2020072339-appb-000010
表示
Figure PCTCN2020072339-appb-000011
在随机样本分布下的期望，λ是常数参数。
在步骤S207中，当逃避比例小于预设比例阈值时，调整感知器网络的第一参数。
在本申请实施例中，当逃避比例小于预设比例阈值时，调整感知器网络的参数，扩大该感知器网络生成的参考特征的覆盖范围，从而进一步提高测试该目标测试分类器的准确度，为了便于后续描述将该调整感知器网络的参数称为第一参数。
优选地，在调整该调整感知器网络的参数称为第一参数时，将
Figure PCTCN2020072339-appb-000012
作为该调整感知器网络的调整指标，该调整指标越小，表明逃避变体攻击目标测试分类器的攻击强度越大，从而进一步提高测试该目标测试分类器的准确度。
进一步地，在调整第一参数或者第二参数时，采用Adam优化算法对第一参数或者第二参数进行随机梯度下降调节，从而减少了第一参数或者第二参数的优化时间，进而提高了目标测试分类器的测试效率。
在步骤S208中，获取逃避变体的分布与测试样本中正常样本分布的Wassertein距离，以根据Wassertein距离判断是否继续对目标分类器进行测试。
在本申请实施例中，Wassertein距离为地球移动距离，Earth-Mover距离(EM距离)，用于衡量两个分布之间的距离，当逃避变体的分布与测试样本中正常样本分布的Wassertein距离越小时，表明逃避变体与正常样本越难以区分，逃避样本对目标测试分类器的攻击强度越高，当该Wassertein距离收敛时，即可跳转至步骤S209输出目标测试分类器的鲁棒性，否则，可继续调整感知器网络的第一参数，以继续加强逃避变体的攻击强度。
在步骤S209中，根据攻击后的分类结果输出目标测试分类器的鲁棒性。
在本申请实施例中，根据目标测试分类器被攻击后的分类结果，若逃避比例达到了预设逃避阈值，可以得到目标测试分类器的鲁棒性是否达标。
在本申请实施例中，先获取测试样本中的恶意样本，通过感知器网络获取恶意样本的参考特征值，生成参考样本，然后根据参考样本的参考特征值对恶意样本的特征值进行修改，生成逃避变体，再将逃避变体输入到目标测试分类器进行分类，获取被逃避变体攻击后的分类结果，根据攻击后的分类结果获取目标测试分类器错误分类逃避变体的逃避比例，根据该逃避比例调整目标测试分类器和感知器网络的参数，最后根据攻击后的分类结果输出目标测试分类器的鲁棒性，从而通过生成逃避变体对分类器鲁棒性进行测试，进而提高分类器鲁棒性的测试效果和测试效率。
实施例三：
图3示出了本申请实施例三提供的分类器鲁棒性的测试装置的结构，为了便于说明，仅示出了与本申请实施例相关的部分，其中包括：
样本获取单元31，用于将预设的测试样本输入到目标测试分类器进行分类，获取测试样本中的恶意样本和正常样本；
特征值获取单元32，用于将随机噪声输入预设的感知器网络，通过感知器网络获取恶意样本的参考特征值，以生成参考样本；
特征值修改单元33，用于根据参考样本的参考特征值对恶意样本的特征值进行修改，以生成恶意样本的逃避变体；
攻击分类单元34，用于将逃避变体输入到目标测试分类器进行分类，获取目标测试分类器被逃避变体攻击后的分类结果；以及
性能输出单元35，用于根据攻击后的分类结果输出目标测试分类器的鲁棒性。
在本申请实施例中，先将预设的测试样本输入到目标测试分类器进行分类，获取测试样本中的恶意样本，将随机噪声输入预设的感知器网络，通过感知器网络获取恶意样本的参考特征值，以生成参考样本，然后根据参考样本的参考 特征值对恶意样本的特征值进行修改，以生成恶意样本的逃避变体，再将逃避变体输入到目标测试分类器进行分类，获取目标测试分类器被逃避变体攻击后的分类结果，最后根据攻击后的分类结果输出目标测试分类器的鲁棒性，从而通过生成逃避变体对分类器鲁棒性进行测试，进而提高分类器鲁棒性的测试效果和测试效率。
在本申请实施例中，分类器鲁棒性的测试装置的各单元可由相应的硬件或软件单元实现，各单元可以为独立的软、硬件单元，也可以集成为一个软、硬件单元，在此不用以限制本申请。各单元的具体实施方式可参考实施例一的描述，在此不再赘述。
实施例四：
图4示出了本申请实施例四提供的分类器鲁棒性的测试装置的结构，为了便于说明，仅示出了与本申请实施例相关的部分，其中包括：
样本获取单元41，用于将预设的测试样本输入到目标测试分类器进行分类，获取测试样本中的恶意样本和正常样本；
特征值获取单元42，用于将随机噪声输入预设的感知器网络，通过感知器网络获取恶意样本的参考特征值，以生成参考样本；
特征值修改单元43，用于根据参考样本的参考特征值对恶意样本的特征值进行修改，以生成恶意样本的逃避变体；
攻击分类单元44，用于将逃避变体输入到目标测试分类器进行分类，获取目标测试分类器被逃避变体攻击后的分类结果；
比例获取单元45，用于根据攻击后的分类结果获取目标测试分类器错误分类逃避变体的逃避比例；
第二调整单元46，用于当逃避比例达到预设比例阈值时，调整目标测试分类器的第二参数；
第一调整单元47，用于当逃避比例小于预设比例阈值时，调整感知器网络的第一参数；
距离获取单元48，用于获取逃避变体的分布与测试样本中正常样本分布的Wassertein距离，以根据Wassertein距离判断是否继续对目标分类器进行测试；以及
性能输出单元49，用于根据攻击后的分类结果输出目标测试分类器的鲁棒性。
在本申请实施例中，先获取测试样本中的恶意样本，通过感知器网络获取恶意样本的参考特征值，生成参考样本，然后根据参考样本的参考特征值对恶意样本的特征值进行修改，生成逃避变体，再将逃避变体输入到目标测试分类器进行分类，获取被逃避变体攻击后的分类结果，根据攻击后的分类结果获取目标测试分类器错误分类逃避变体的逃避比例，根据该逃避比例调整目标测试分类器和感知器网络的参数，最后根据攻击后的分类结果输出目标测试分类器的鲁棒性，从而通过生成逃避变体对分类器鲁棒性进行测试，进而提高分类器鲁棒性的测试效果和测试效率。
在本申请实施例中，分类器鲁棒性的测试装置的各单元可由相应的硬件或软件单元实现，各单元可以为独立的软、硬件单元，也可以集成为一个软、硬件单元，在此不用以限制本申请。各单元的具体实施方式可参考实施例二的描述，在此不再赘述。
实施例五：
图5示出了本申请实施例五提供的测试终端的结构，为了便于说明，仅示出了与本申请实施例相关的部分，其中包括：
本申请实施例的计算终端5包括处理器51、存储器52以及存储在存储器52中并可在处理器51上运行的计算机程序53。该处理器51执行计算机程序53时实现上述各个分类器鲁棒性的测试方法实施例中的步骤，例如，图1所示的步骤S101至S105以及图2所示的步骤S201至S209。或者，处理器51执行计算机程序53时实现上述各个分类器鲁棒性的测试装置实施例中各单元的功能，例如，图3所示单元31至35以及图4所示单元41至49的功能。
在本申请实施例中，该处理器执行计算机程序时，先获取测试样本中的恶意样本，通过感知器网络获取恶意样本的参考特征值，生成参考样本，然后根据参考样本的参考特征值对恶意样本的特征值进行修改，生成逃避变体，再将逃避变体输入到目标测试分类器进行分类，获取被逃避变体攻击后的分类结果，根据攻击后的分类结果获取目标测试分类器错误分类逃避变体的逃避比例，根据该逃避比例调整目标测试分类器和感知器网络的参数，最后根据攻击后的分类结果输出目标测试分类器的鲁棒性，从而通过生成逃避变体对分类器鲁棒性进行测试，进而提高分类器鲁棒性的测试效果和测试效率。
该处理器执行计算机程序时实现上述分类器鲁棒性的测试方法实施例中的步骤可参考实施例一和实施例二的描述，在此不再赘述。
实施例六：
在本申请实施例中，提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，该计算机程序被处理器执行时实现上述各个分类器鲁棒性的测试方法实施例中的步骤，例如，图1所示的步骤S101至S105以及图2所示的步骤S201至S209。或者，该计算机程序被处理器执行时实现上述各个分类器鲁棒性的测试装置实施例中各单元的功能，例如，图3所示单元31至35以及图4所示单元41至49的功能。
在本申请实施例中，在计算机程序被处理器执行后，先获取测试样本中的恶意样本，通过感知器网络获取恶意样本的参考特征值，生成参考样本，然后根据参考样本的参考特征值对恶意样本的特征值进行修改，生成逃避变体，再将逃避变体输入到目标测试分类器进行分类，获取被逃避变体攻击后的分类结果，根据攻击后的分类结果获取目标测试分类器错误分类逃避变体的逃避比例，根据该逃避比例调整目标测试分类器和感知器网络的参数，最后根据攻击后的分类结果输出目标测试分类器的鲁棒性，从而通过生成逃避变体对分类器鲁棒性进行测试，进而提高分类器鲁棒性的测试效果和测试效率。
该计算机程序被处理器执行时实现上述分类器鲁棒性的测试方法实施例中 的步骤可参考实施例一和实施例二的描述，在此不再赘述。
本申请实施例的计算机可读存储介质可以包括能够携带计算机程序代码的任何实体或装置、存储介质，例如，ROM/RAM、磁盘、光盘、闪存等存储器。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本申请的保护范围之内。

Claims (20)

  1. 一种分类器鲁棒性的测试方法，所述方法包括下述步骤：
    将预设的测试样本输入到目标测试分类器进行分类，获取所述测试样本中的恶意样本和正常样本；
    将随机噪声输入预设的感知器网络，通过所述感知器网络获取所述恶意样本的参考特征值，以生成参考样本；
    根据所述参考样本的参考特征值对所述恶意样本的特征值进行修改，以生成所述恶意样本的逃避变体；
    将所述逃避变体输入到所述目标测试分类器进行分类，获取所述目标测试分类器被所述逃避变体攻击后的分类结果；
    根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性。
  2. 如权利要求1所述的分类器鲁棒性的测试方法，其中，所述获取所述目标测试分类器被所述逃避变体攻击后的分类结果的步骤之后，根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性的步骤之前，还包括：
    根据攻击后的所述分类结果获取所述目标测试分类器错误分类所述逃避变体的逃避比例；
    当所述逃避比例小于预设比例阈值时，调整所述感知器网络的第一参数直到所述逃避比例达到所述预设比例阈值。
  3. 如权利要2所述的分类器鲁棒性的测试方法，其中，所述根据攻击后的所述分类结果获取所述目标测试分类器错误分类所述逃避变体的逃避比例的步骤之后，所述调整所述感知器网络的第一参数直到所述逃避比例达到所述预设比例阈值的步骤之前，还包括：
    当所述逃避比例达到预设比例阈值时，调整所述目标测试分类器的第二参数直到所述逃避比例小于所述预设比例阈值。
  4. 如权利要求2所述的分类器鲁棒性的测试方法，其中，所述获取所述目标测试分类器被所述逃避变体攻击后的分类结果的步骤之后，所述根据攻击后 的所述分类结果输出所述目标测试分类器的鲁棒性的步骤之前，还包括：
    获取所述逃避变体的分布与所述测试样本中正常样本分布的Wassertein距离，以根据所述Wassertein距离判断是否继续对所述目标分类器进行测试。
  5. 如权利要求3所述的分类器鲁棒性的测试方法，其中，所述获取所述目标测试分类器被所述逃避变体攻击后的分类结果的步骤之后，所述根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性的步骤之前，还包括：
    获取所述逃避变体的分布与所述测试样本中正常样本分布的Wassertein距离，以根据所述Wassertein距离判断是否继续对所述目标分类器进行测试。
  6. 如权利要求1所述的分类器鲁棒性的测试方法，其中，所述测试样本为预先设置的经过判别器分类好的无恶意特征的样本和有恶意特征的样本组成。
  7. 一种分类器鲁棒性的测试装置，其中，包括：
    样本获取单元，用于将预设的测试样本输入到目标测试分类器进行分类，获取所述测试样本中的恶意样本和正常样本；
    特征值获取单元，用于将随机噪声输入预设的感知器网络，通过所述感知器网络获取所述恶意样本的参考特征值，以生成参考样本；
    特征值修改单元，用于根据所述参考样本的参考特征值对所述恶意样本的特征值进行修改，以生成所述恶意样本的逃避变体；
    攻击分类单元，用于将所述逃避变体输入到所述目标测试分类器进行分类，获取所述目标测试分类器被所述逃避变体攻击后的分类结果；以及
    性能输出单元，用于根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性。
  8. 如权利要求5所述的分类器鲁棒性的测试装置，其中，还包括：
    比例获取单元，用于根据攻击后的所述分类结果获取所述目标测试分类器错误分类所述逃避变体的逃避比例；以及
    第一调整单元，用于当所述逃避比例小于预设比例阈值时，调整所述感知器网络的第一参数直到所述逃避比例达到所述预设比例阈值。
  9. 如权利要求6所述的分类器鲁棒性的测试装置，其中，还包括：
    第二调整单元，用于当所述逃避比例达到预设比例阈值时，调整所述目标测试分类器的第二参数直到所述逃避比例小于所述预设比例阈值。
  10. 如权利要求7所述的分类器鲁棒性的测试装置，其中，还包括：
    距离获取单元，用于获取所述逃避变体的分布与所述测试样本中正常样本分布的Wassertein距离，以根据所述Wassertein距离判断是否继续对所述目标分类器进行测试。
  11. 一种测试终端，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现以下步骤：
    将预设的测试样本输入到目标测试分类器进行分类，获取所述测试样本中的恶意样本和正常样本；
    将随机噪声输入预设的感知器网络，通过所述感知器网络获取所述恶意样本的参考特征值，以生成参考样本；
    根据所述参考样本的参考特征值对所述恶意样本的特征值进行修改，以生成所述恶意样本的逃避变体；
    将所述逃避变体输入到所述目标测试分类器进行分类，获取所述目标测试分类器被所述逃避变体攻击后的分类结果；
    根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性。
  12. 如权利要求11所述的测试终端，其中，所述获取所述目标测试分类器被所述逃避变体攻击后的分类结果的步骤之后，根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性的步骤之前，还包括：
    根据攻击后的所述分类结果获取所述目标测试分类器错误分类所述逃避变体的逃避比例；
    当所述逃避比例小于预设比例阈值时，调整所述感知器网络的第一参数直到所述逃避比例达到所述预设比例阈值。
  13. 如权利要求12所述的测试终端，其中，所述根据攻击后的所述分类结果获取所述目标测试分类器错误分类所述逃避变体的逃避比例的步骤之后，所述调整所述感知器网络的第一参数直到所述逃避比例达到所述预设比例阈值的步骤之前，还包括：
    当所述逃避比例达到预设比例阈值时，调整所述目标测试分类器的第二参数直到所述逃避比例小于所述预设比例阈值。
  14. 如权利要求12所述的测试终端，其中，所述获取所述目标测试分类器被所述逃避变体攻击后的分类结果的步骤之后，所述根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性的步骤之前，还包括：
    获取所述逃避变体的分布与所述测试样本中正常样本分布的Wassertein距离，以根据所述Wassertein距离判断是否继续对所述目标分类器进行测试。
  15. 如权利要求13所述的测试终端，其中，所述获取所述目标测试分类器被所述逃避变体攻击后的分类结果的步骤之后，所述根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性的步骤之前，还包括：
    获取所述逃避变体的分布与所述测试样本中正常样本分布的Wassertein距离，以根据所述Wassertein距离判断是否继续对所述目标分类器进行测试。
  16. 如权利要求11所述的测试终端，其中，所述测试样本为预先设置的经过判别器分类好的无恶意特征的样本和有恶意特征的样本组成。
  17. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其中，所述计算机程序被处理器执行时实现以下操作：
    将预设的测试样本输入到目标测试分类器进行分类，获取所述测试样本中的恶意样本和正常样本；
    将随机噪声输入预设的感知器网络，通过所述感知器网络获取所述恶意样本的参考特征值，以生成参考样本；
    根据所述参考样本的参考特征值对所述恶意样本的特征值进行修改，以生成所述恶意样本的逃避变体；
    将所述逃避变体输入到所述目标测试分类器进行分类，获取所述目标测试分类器被所述逃避变体攻击后的分类结果；
    根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性。
  18. 如权利要求17所述的计算机可读存储介质，其中，所述获取所述目标测试分类器被所述逃避变体攻击后的分类结果的步骤之后，根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性的步骤之前，还包括：
    根据攻击后的所述分类结果获取所述目标测试分类器错误分类所述逃避变体的逃避比例；
    当所述逃避比例小于预设比例阈值时，调整所述感知器网络的第一参数直到所述逃避比例达到所述预设比例阈值。
  19. 如权利要求18所述的计算机可读存储介质，其中，所述根据攻击后的所述分类结果获取所述目标测试分类器错误分类所述逃避变体的逃避比例的步骤之后，所述调整所述感知器网络的第一参数直到所述逃避比例达到所述预设比例阈值的步骤之前，还包括：
    当所述逃避比例达到预设比例阈值时，调整所述目标测试分类器的第二参数直到所述逃避比例小于所述预设比例阈值。
  20. 如权利要求18所述的计算机可读存储介质，其中，所述获取所述目标测试分类器被所述逃避变体攻击后的分类结果的步骤之后，所述根据攻击后的所述分类结果输出所述目标测试分类器的鲁棒性的步骤之前，还包括：
    获取所述逃避变体的分布与所述测试样本中正常样本分布的Wassertein距离，以根据所述Wassertein距离判断是否继续对所述目标分类器进行测试。
PCT/CN2020/072339 2019-02-20 2020-01-16 分类器鲁棒性的测试方法、装置、终端及存储介质 WO2020168874A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910126943.1 2019-02-20
CN201910126943.1A CN110008987B (zh) 2019-02-20 2019-02-20 分类器鲁棒性的测试方法、装置、终端及存储介质

Publications (1)

Publication Number Publication Date
WO2020168874A1 true WO2020168874A1 (zh) 2020-08-27

Family

ID=67165913

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2019/108799 WO2020168718A1 (zh) 2019-02-20 2019-09-28 分类器鲁棒性的测试方法、装置、终端及存储介质
PCT/CN2020/072339 WO2020168874A1 (zh) 2019-02-20 2020-01-16 分类器鲁棒性的测试方法、装置、终端及存储介质

Family Applications Before (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/108799 WO2020168718A1 (zh) 2019-02-20 2019-09-28 分类器鲁棒性的测试方法、装置、终端及存储介质

Country Status (2)

Country Link
CN (1) CN110008987B (zh)
WO (2) WO2020168718A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112381150A (zh) * 2020-11-17 2021-02-19 上海科技大学 一种基于样本鲁棒性差异的对抗样本检测方法

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110008987B (zh) * 2019-02-20 2022-02-22 深圳大学 分类器鲁棒性的测试方法、装置、终端及存储介质
CN111582359B (zh) * 2020-04-28 2023-04-07 新疆维吾尔自治区烟草公司 一种图像识别方法、装置、电子设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104792530A (zh) * 2015-04-15 2015-07-22 北京航空航天大学 一种基于SDA和Softmax回归的深度学习滚动轴承故障诊断方法
CN109120652A (zh) * 2018-11-09 2019-01-01 重庆邮电大学 基于差分wgan网络安全态势预测
CN109359815A (zh) * 2018-09-10 2019-02-19 华北电力大学 基于生成对抗网络的智能电网深度学习训练样本生成方法
CN110008987A (zh) * 2019-02-20 2019-07-12 深圳大学 分类器鲁棒性的测试方法、装置、终端及存储介质

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050033200A1 (en) * 2003-08-05 2005-02-10 Soehren Wayne A. Human motion identification and measurement system and method
US20050259820A1 (en) * 2004-05-24 2005-11-24 Eastman Kodak Company Temporally distributed watermarking for image sequences
CN103021406B (zh) * 2012-12-18 2014-10-22 台州学院 基于压缩感知的鲁棒性语音情感识别方法
US10404745B2 (en) * 2013-08-30 2019-09-03 Rakesh Verma Automatic phishing email detection based on natural language processing techniques
US20150067833A1 (en) * 2013-08-30 2015-03-05 Narasimha Shashidhar Automatic phishing email detection based on natural language processing techniques
CN105488413A (zh) * 2015-06-19 2016-04-13 哈尔滨安天科技股份有限公司 一种基于信息增益的恶意代码检测方法及系统
CN105975857A (zh) * 2015-11-17 2016-09-28 武汉安天信息技术有限责任公司 基于深度学习方法推断恶意代码规则的方法及系统
CN105740771A (zh) * 2016-01-22 2016-07-06 张健敏 一种具有目标识别功能的推土装置
CN106529293B (zh) * 2016-11-09 2019-11-05 东巽科技（北京）有限公司 一种用于恶意软件检测的样本类别判定方法
CN107276805B (zh) * 2017-06-19 2020-06-05 北京邮电大学 一种基于入侵检测模型的样本预测方法、装置及电子设备
CN107241350A (zh) * 2017-07-13 2017-10-10 北京紫光恒越网络科技有限公司 网络安全防御方法、装置及电子设备
CN107463951A (zh) * 2017-07-19 2017-12-12 清华大学 一种提高深度学习模型鲁棒性的方法及装置
CN107688829A (zh) * 2017-08-29 2018-02-13 湖南财政经济学院 一种基于支持向量机的识别系统及识别方法
CN107862270B (zh) * 2017-10-31 2020-07-21 深圳云天励飞技术有限公司 人脸分类器训练方法、人脸检测方法及装置、电子设备
CN107749859B (zh) * 2017-11-08 2020-03-31 南京邮电大学 一种面向网络加密流量的恶意移动应用检测方法
CN108108769B (zh) * 2017-12-29 2020-08-25 咪咕文化科技有限公司 一种数据的分类方法、装置及存储介质
CN108491837B (zh) * 2018-03-07 2021-12-17 浙江工业大学 一种提高车牌攻击鲁棒性的对抗攻击方法
CN108615071B (zh) * 2018-05-10 2020-11-24 创新先进技术有限公司 模型测试的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104792530A (zh) * 2015-04-15 2015-07-22 北京航空航天大学 一种基于SDA和Softmax回归的深度学习滚动轴承故障诊断方法
CN109359815A (zh) * 2018-09-10 2019-02-19 华北电力大学 基于生成对抗网络的智能电网深度学习训练样本生成方法
CN109120652A (zh) * 2018-11-09 2019-01-01 重庆邮电大学 基于差分wgan网络安全态势预测
CN110008987A (zh) * 2019-02-20 2019-07-12 深圳大学 分类器鲁棒性的测试方法、装置、终端及存储介质

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HE, ZHIMIN: "Robust Machine Learning in an Adversarial Environment and its Applications", DOCTORAL DISSERTATION, 15 January 2016 (2016-01-15), CN, pages 1 - 123, XP055730297 *
WEIWEI HU; YING TAN: "Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN", ARXIV.ORG, 20 February 2017 (2017-02-20), pages 1 - 7, XP080747762, Retrieved from the Internet <URL:https://arxiv.org/abs/1702.05983> *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112381150A (zh) * 2020-11-17 2021-02-19 上海科技大学 一种基于样本鲁棒性差异的对抗样本检测方法

Also Published As

Publication number Publication date
CN110008987A (zh) 2019-07-12
CN110008987B (zh) 2022-02-22
WO2020168718A1 (zh) 2020-08-27

Similar Documents

Publication Publication Date Title
WO2020168874A1 (zh) 分类器鲁棒性的测试方法、装置、终端及存储介质
Lee et al. Machine learning based file entropy analysis for ransomware detection in backup systems
US10084822B2 (en) Intrusion detection and prevention system and method for generating detection rules and taking countermeasures
CN111382430A (zh) 用于对计算机系统的对象进行分类的系统和方法
US11501206B2 (en) Method and machine learning system for detecting adversarial examples
RU2708356C1 (ru) Система и способ двухэтапной классификации файлов
CN111382434A (zh) 用于检测恶意文件的系统和方法
WO2021027831A1 (zh) 一种恶意文件检测方法和装置、电子设备及存储介质
US11379581B2 (en) System and method for detection of malicious files
WO2017152877A1 (zh) 网络威胁事件评估方法及装置
CN109840413B (zh) 一种钓鱼网站检测方法及装置
WO2022199185A1 (zh) 用户操作检测方法及程序产品
CN110445766B (zh) DDoS攻击态势评估方法及装置
Naik et al. Augmented YARA rules fused with fuzzy hashing in ransomware triaging
CN113660196A (zh) 一种基于深度学习的网络流量入侵检测方法及装置
US11563654B2 (en) Detection device and detection method
Elmasri et al. Evaluation of CICIDS2017 with qualitative comparison of Machine Learning algorithm
Zhu et al. Effective phishing website detection based on improved BP neural network and dual feature evaluation
EP3798885A1 (en) System and method for detection of malicious files
JP7223372B2 (ja) 学習装置、学習方法及び学習プログラム
CN113839963B (zh) 基于人工智能与大数据的网络安全漏洞智能检测方法
Riyad et al. An ensemble classification approach for intrusion detection
Mol et al. Classification of Network Intrusion Attacks Using Machine Learning and Deep Learning^
Kang et al. Resilience against Adversarial Examples: Data-Augmentation Exploiting Generative Adversarial Networks.
Siraj et al. Analyzing ANOVA F-test and Sequential Feature Selection for Intrusion Detection Systems.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20759390

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 12.10.2021)

122 Ep: pct application non-entry in european phase

Ref document number: 20759390

Country of ref document: EP

Kind code of ref document: A1