WO2022151579A1 - 边缘计算场景下后门攻击主动防御方法及装置 - Google Patents

边缘计算场景下后门攻击主动防御方法及装置 Download PDF

Info

Publication number
WO2022151579A1
WO2022151579A1 PCT/CN2021/081596 CN2021081596W WO2022151579A1 WO 2022151579 A1 WO2022151579 A1 WO 2022151579A1 CN 2021081596 W CN2021081596 W CN 2021081596W WO 2022151579 A1 WO2022151579 A1 WO 2022151579A1
Authority
WO
WIPO (PCT)
Prior art keywords
optional operation
optional
subset
model
backdoor
Prior art date
Application number
PCT/CN2021/081596
Other languages
English (en)
French (fr)
Inventor
徐恪
赵乙
姚苏
李子巍
Original Assignee
清华大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 清华大学 filed Critical 清华大学
Priority to US17/523,474 priority Critical patent/US20220222352A1/en
Publication of WO2022151579A1 publication Critical patent/WO2022151579A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/15—Correlation function computation including computation of convolution operations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis

Definitions

  • the present application relates to the technical field of Internet security, and in particular, to a method and device for active defense against backdoor attacks in an edge computing scenario.
  • edge computing networks In related technologies, thanks to the rapid development of mobile Internet and wireless communication technologies, the relevant theories and technologies of edge computing networks have matured, which further promotes the widespread popularity of edge computing networks. At the same time, there are a large number of abnormal network behaviors, such as abnormal traffic caused by SYN flooding attacks and other security incidents. In order to realize the defense against possible attacks from the edge network, thereby reducing the risk of the backbone network being attacked, many deep learning-based abnormal behavior detection models are deployed at the edge nodes of the edge network. However, compared with the cloud, the equipment resources of edge nodes are very limited, such as poor computing performance and low storage capacity, and it is difficult to meet the computing power and data requirements required for deep learning training.
  • edge nodes can contact the abnormal behavior samples that edge nodes can contact are limited, and the training data they possess may also contain private information that is inconvenient to disclose.
  • each edge node in the edge computing network can not only reduce the requirements for data volume and computing power, but also do not need to disclose their own training data.
  • Edge nodes only need to share the trained model with other edge nodes to obtain an intelligent model that can process all data samples (including training data owned by themselves and training data owned by other edge nodes), thus enjoying the training of other edge nodes Performance improvements from data.
  • each edge node in an edge computing network is independent, once attacked by a malicious attacker, other edge nodes cannot perceive it.
  • an attacker can implant a backdoor into the deep learning model by modifying the training data possessed by the attacked edge node, thereby realizing a backdoor attack.
  • the backdoor attack mentioned here refers to tampering with some features of the training data to form the trigger of the backdoor attack, and at the same time modifying the label of the training data to a specific wrong label. Subsequently, malicious attackers manipulate the attacked edge nodes and use the tampered data for model training.
  • the deep learning models of other edge nodes will also be embedded in the backdoor. Deep learning models work correctly when no samples containing triggers are encountered. However, when encountering samples containing triggers, the model will output false results specified by the attacker. Therefore, backdoor attacks for collaborative learning in edge computing scenarios are very difficult to detect.
  • the present application aims to solve one of the technical problems in the related art at least to a certain extent.
  • the first purpose of this application is to propose an active defense method for backdoor attacks in edge computing scenarios, which can effectively improve network security in edge computing scenarios, and has high stability and resistance to The feature of strong capability is more suitable for the deployment and application of real-world scenarios.
  • the second purpose of this application is to propose an active defense device for backdoor attacks in an edge computing scenario.
  • the third object of the present application is to propose an electronic device.
  • a fourth object of the present application is to propose a computer-readable storage medium.
  • an embodiment of the first aspect of the present application proposes an active defense method for backdoor attacks in an edge computing scenario, including the following steps: generating an initial optional operation set according to optional operations for improving the generalization capability of a model, and Construct a set of configuration parameters for each operation in the set; screen out the first optional set of configuration parameters of the optional operation and the accuracy curve of the model exhibiting a monotonically decreasing concave function characteristic from the initial set of optional operations Operation subset; screen out the second optional operation subset in which the curve of the configuration parameters of the optional operation and the success probability of the model being attacked by the backdoor presents monotonically decreasing convex function characteristics from the initial optional operation set; according to the preset formula For each optional operation in the intersection of the first optional operation subset and the second optional operation subset, construct a corresponding mutation characteristic set; For each optional operation in the intersection of the second optional operation subset, according to its corresponding mutation characteristic set, determine the final parameter setting value of the optional operation to actively defend against possible backdoor attacks.
  • the active defense method for backdoor attacks in an edge computing scenario can find qualified hyperparameters according to a specific formula to actively defend against a backdoor attack oriented to collaborative learning in an edge computing scenario without human intervention, and the method does not require other
  • the cooperation of edge nodes does not need to know which edge nodes are manipulated by attackers as malicious edge nodes.
  • this method has the characteristics of high stability and strong resistance, effectively improving network security in edge computing scenarios, and is more suitable for deployment and application in real-world scenarios.
  • the method for active defense against backdoor attacks in an edge computing scenario may also have the following additional technical features:
  • the initial optional operation set is generated according to the optional operation for improving the generalization capability of the model, and a configuration parameter set is constructed for each operation in the set, Including: constructing the initial set of optional operations related to the generalization capability of the model; constructing the set of configuration parameters for each optional operation.
  • the configuration parameters of the optional operations selected from the initial optional operation set and the accuracy curve of the model exhibit the first optional feature of a monotonically decreasing concave function.
  • Operation subsets including: constructing a two-tuple set of configuration parameters and model accuracy; screening optional operation subsets that meet the characteristics of a preset monotonically decreasing concave function.
  • the curve that selects the configuration parameters of the optional operations from the initial optional operation set and the success probability of the model being attacked by the backdoor presents a monotonically decreasing convex function characteristic.
  • Two optional operation subsets including: constructing a two-tuple set of configuration parameters and the success probability of a model being attacked by a backdoor; screening an optional operation subset that conforms to the characteristics of a preset monotonically decreasing convex function.
  • Constructing a corresponding set of mutation characteristics including: constructing a set of finally selected optional operations; for each operation in the set of finally selected optional operations, constructing a binary configuration parameter and an upper bound of the model generalization error A set of groups; for each operation in the finally selected set of optional operations, a corresponding set of the mutation characteristics is constructed.
  • the final parameter setting value of the optional operation including: a mutation characteristic set associated with each optional operation in the intersection of the first optional operation subset and the second optional operation subset , gradually increase according to the preset strategy, and when it is detected that it is greater than the preset threshold, the final parameter setting value is determined; for each collaborative learning edge node in the edge computing scenario, when training the model, each final parameter is set.
  • the parameter settings for the selected optional operation are the final parameter settings.
  • a second aspect embodiment of the present application proposes an active defense device for backdoor attacks in an edge computing scenario, including: a first building module, configured to generate an initial possible block according to an optional operation for improving the generalization capability of the model. select an operation set, and construct a configuration parameter set for each operation in the set; a first screening module is used to filter out the configuration parameters of the optional operation and the accuracy curve of the model from the initial optional operation set A first optional operation subset that presents a monotonically decreasing concave function characteristic; a second screening module, used to filter out the configuration parameters of the optional operation from the initial optional operation set and the curve presentation of the success probability of the model being attacked by the backdoor The second optional operation subset of the monotonically decreasing convex function characteristic; the second building module is used for, according to a preset formula, to perform the operation in the intersection of the first optional operation subset and the second optional operation subset according to the preset formula.
  • a corresponding mutation characteristic set is constructed; the defense module is used for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, According to its corresponding mutation characteristic set, the final parameter setting value of this optional operation is determined to actively defend against possible backdoor attacks.
  • the active defense device for backdoor attacks in the edge computing scenario of the embodiment of the present application can find qualified hyperparameters according to a specific formula to actively defend against the backdoor attack oriented to collaborative learning in the edge computing scenario without human intervention, and the device does not require other
  • the cooperation of edge nodes does not need to know which edge nodes are manipulated by attackers as malicious edge nodes.
  • this device has the characteristics of high stability and strong resistance, effectively improving network security in edge computing scenarios, and is more suitable for deployment and application in real-world scenarios.
  • the device for active defense against backdoor attacks in an edge computing scenario may also have the following additional technical features:
  • the defense module is specifically used for mutation associated with each optional operation in the intersection of the first optional operation subset and the second optional operation subset.
  • the feature set is gradually increased according to the preset strategy, and when it is detected that it is greater than the preset threshold, the final parameter setting value is determined; for each collaborative learning edge node in the edge computing scenario, when training the model, each The parameter settings for the final selected optional operation are the final parameter settings.
  • Embodiments of the third aspect of the present application provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores data that can be executed by the at least one processor
  • the instruction is configured to execute the method for active defense against backdoor attacks in an edge computing scenario as described in the foregoing embodiment.
  • Embodiments of the fourth aspect of the present application provide a computer-readable storage medium, where the computer-readable storage medium stores computer instructions, where the computer instructions are used to cause the computer to execute the backdoor in the edge computing scenario described in the foregoing embodiments Attack active defense method.
  • FIG. 1 is a flowchart of an active defense method for backdoor attacks in an edge computing scenario according to an embodiment of the present application
  • FIG. 2 is a schematic block diagram of a backdoor attack active defense device in an edge computing scenario according to an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • FIG. 1 is a flowchart of an active defense method for backdoor attacks in an edge computing scenario according to an embodiment of the present application.
  • the active defense method for backdoor attacks in this edge computing scenario includes the following steps:
  • step S101 an initial set of optional operations is generated according to the optional operations for improving the generalization capability of the model, and a set of configuration parameters is constructed for each operation in the set.
  • the embodiments of the present application are mainly used in a system in which multiple edge nodes realize network intelligence through cooperative learning in an edge computing scenario. Therefore, in the embodiment of the present application, in view of the status quo that the deep learning model has multiple optional operations to improve the generalization ability of the model, firstly, the selected optional operations for improving the generalization ability of the model are formed into an initial optional operation set , and builds a set of configuration parameters for each operation in the set.
  • an initial optional operation set is generated according to optional operations used to improve the generalization capability of the model, and a configuration parameter set is constructed for each operation in the set, including: constructing and The initial set of optional operations related to the generalization ability of the model; the set of configuration parameters for constructing each optional operation.
  • the embodiment of the present application uses different configuration parameters to train multiple models for each optional operation.
  • step S1 Considering that the deep learning model has multiple optional operations to improve the generalization ability of the model, and as the configuration parameters of the optional operations change, the generalization ability of the deep learning model will also change accordingly.
  • the optional operations used to improve the generalization ability of the model are formed into an initial optional operation set, and a set of configuration parameters is constructed for each operation in the set.
  • step S1 may include:
  • Step S11 Construct an initial set of optional operations related to the generalization capability of the model.
  • optional operations such as dropout (a certain proportion of the network structure is not updated during training), regularization, gradient clipping, etc.
  • Step S12 Construct a set of configuration parameters for each optional operation.
  • an optional parameter configuration range defined by said, of which is the smallest optional configuration parameter, is the largest optional configuration parameter.
  • K+2 parameters that is, the parameter interval can be expressed as s i , and the specific calculation method is as follows:
  • step S102 a first optional operation subset in which the configuration parameters of the optional operations and the accuracy curve of the model exhibit a monotonically decreasing concave function characteristic is selected from the initial optional operation set.
  • a first optional operation subset in which the configuration parameters of the optional operation and the accuracy curve of the model exhibiting a monotonically decreasing concave function characteristic are selected from the initial optional operation set, Including: constructing a two-tuple set of configuration parameters and model accuracy; filtering a subset of optional operations that conform to the characteristics of a preset monotonically decreasing concave function.
  • step S2 Screening out a subset of optional operations in which the configuration parameters of the optional operations and the accuracy curve of the model exhibit a monotonically decreasing concave function characteristic.
  • step S2 may include:
  • Step S21 Construct a 2-tuple set of configuration parameters and model accuracy. For each optional operation p i in the optional operation set P, use each element in the corresponding configuration parameter set E i to train the model. After the training is complete, test the model to get the accuracy of the model Thereby constructing the tuples of configuration parameters and model accuracy, namely Form a set of all the tuples of the optional operation pi, i.e.
  • Step S22 Screen the optional operation subsets that conform to the characteristic of the monotonically decreasing concave function. For each optional operation p i in the optional operation set P, use its two-tuple set F i to construct a curve between configuration parameters and model accuracy, and fit an approximate curve function f i . All the operations pi corresponding to the curve function f i that conform to the characteristics of the monotonically decreasing concave function form a specific subset, which is expressed as and f i (x 1 )>f i (x 2 ),and x 1 ⁇ x 2 ⁇ , where The x 1 and x 2 here are just to illustrate the monotonicity and concave-convexity of the function, and have no practical significance.
  • step S103 a second optional operation subset in which the curve of the configuration parameters of the optional operations and the success probability of the model being attacked by the backdoor presents a monotonically decreasing convex function characteristic is selected from the initial optional operation set.
  • a second optional operation in which the curve of the configuration parameters of the optional operation and the success probability of the model being attacked by the backdoor presents a monotonically decreasing convex function characteristic is selected from the initial optional operation set.
  • Subsets including: constructing a two-tuple set of configuration parameters and the success probability of a model being attacked by a backdoor; screening a subset of optional operations that meet the characteristics of a preset monotonically decreasing convex function.
  • step S3 Screen out a subset of optional operations in which the curve of the configuration parameters of the optional operations and the success probability of the model being attacked by the backdoor presents a monotonically decreasing convex function characteristic.
  • step S3 may include:
  • Step S31 Construct a set of 2-tuples of configuration parameters and the probability that the model is successfully attacked by the backdoor.
  • the success probability of a model being attacked by a backdoor here refers to the probability that the model incorrectly identifies a sample with a backdoor attack trigger.
  • For each optional operation p i in the optional operation set P use each element in the corresponding configuration parameter set E i to train the model. After the training is completed, use the samples with the backdoor attack trigger to test the model, and get the success probability of the model being attacked by the backdoor
  • a binary pair of configuration parameters and the probability of the model being attacked by a backdoor is constructed, that is, Form a set of all the tuples of the optional operation pi, i.e.
  • Step S32 Screen the optional operation subset that conforms to the characteristic of the monotonically decreasing convex function. For each optional operation pi in the optional operation set P, use its two-tuple set G i to construct a curve between the configuration parameters and the success probability of the model being attacked by the backdoor, and fit an approximate curve function g i .
  • step S104 a corresponding mutation characteristic set is constructed for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula.
  • a mutation characteristic set is constructed for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula, including: : Construct the final selected optional operation set; for each operation in the final selected optional operation set, construct a two-tuple set of configuration parameters and the upper bound of the model generalization error; for the final selected optional operation set For each operation in the operation set, construct the corresponding mutation characteristic set.
  • step S4 According to a specified formula, construct a mutation characteristic set for each optional operation in the intersection of the two subsets obtained in step S2 and step S3.
  • step S4 may include:
  • Step S42 For each operation p i ⁇ P' in the finally selected optional operation set, construct a two-tuple set of configuration parameters and the upper bound of the model generalization error.
  • the upper bound of the model generalization error here can express the generalization ability of the model.
  • a benign dataset D benign where all samples do not contain triggers for backdoor attacks.
  • a certain proportion of samples are optionally taken from D benign to form a benign subset D' benign , wherein For the benign subset D' benign , add backdoor attack triggers to all its samples, and tamper with the real labels, thus forming a backdoor attack subset D' backdoor .
  • Two models M 1 and M 2 are trained on the two datasets D 1 and D 2 , respectively.
  • the absolute value of the difference, that is The defined upper bound of the model generalization error can be expressed as ⁇ , and the specific calculation method is as follows:
  • Step S43 For each operation in the finally selected optional operation set, construct a corresponding mutation characteristic set. for each element in Vi The mutation property of this dyad is defined as The specific calculation method is as follows:
  • step S105 for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, determine the final parameter setting of the optional operation according to its corresponding mutation characteristic set value to proactively defend against possible backdoor attacks.
  • the embodiment of the present application is based on the upper bound of the model generalization error, which is each of the intersection of the first optional operation subset and the second optional operation subset (that is, the finally selected optional operation set).
  • Optional operation construct a corresponding mutation characteristic set, so as to select the final parameter setting value for each optional operation through the relationship between the elements in the mutation characteristic set and the preset threshold, so as to actively defend against possible backdoor attacks .
  • set threshold can be set by those skilled in the art according to the actual situation, which is not specifically limited here.
  • the cooperation of other edge nodes is not required, and it is not necessary to know whether other edge nodes have been attacked by backdoors, which can effectively improve network security in edge computing scenarios, and has far-reaching significance for practical deployment and application.
  • the The final parameter setting value of the optional operation includes: for the mutation characteristic set associated with each optional operation in the intersection of the first optional operation subset and the second optional operation subset, gradually according to the preset strategy. Increase, and when it is detected that it is greater than the preset threshold, the final parameter setting value is determined; for each collaborative learning edge node in the edge computing scenario, when training the model, the parameters of each finally selected optional operation are set. Set to the final parameter setting value.
  • step S5 According to the mutation characteristic set W i of each optional operation p i ⁇ P' finally selected in step S4, determine the final parameter setting value of the optional operation p i ⁇ P', so as to actively Defend against possible backdoor attacks.
  • step S5 may include:
  • Step S51 For each finally selected optional operation p i ⁇ P' associated mutation characteristic set W i , optionally start from 1 and gradually increase in units of 1 according to j, compare and the size of the artificially set threshold ⁇ . appearing for the first time , stop the comparison, and record this time the corresponding parameter value Optionally denote it as ⁇ i .
  • Step S52 For each collaborative learning edge node in the edge computing scenario, when training the model, set the parameter of each finally selected optional operation p i ⁇ P' to ⁇ i , so as to actively defend against possible occurrences. Backdoor attack.
  • the embodiment of the present application can perform stability analysis on the deep learning model in the edge computing scenario. Then, according to the result of the stability analysis, the embodiment of the present application can find the hyperparameter corresponding to the inflection point of the change of the generalization ability of the model according to the formula.
  • the inflection point mentioned here has the following characteristics.
  • the embodiment of the present application does not require the cooperation of other edge nodes, nor does it need to know which edge nodes are manipulated by attackers as malicious edge nodes.
  • the method and device have the characteristics of high stability and strong resistance in terms of actively defending against backdoor attacks against collaborative learning in edge computing scenarios, and are more suitable for deployment and application in real-world scenarios.
  • edge computing networks promotes the further development of collaborative learning among edge nodes.
  • each edge node cannot know whether the training data of other edge nodes has been tampered with by malicious attackers and evolved into samples with backdoor attack triggers.
  • the backdoor attack can be propagated by one or more edge nodes controlled by malicious attackers to other benign edge nodes, so that the deep learning models of all edge nodes participating in collaborative learning are embedded in the backdoor. This will cause the deep learning model to exhibit the wrong behavior expected by attackers when encountering samples with backdoor attack triggers, bringing potential security risks to edge nodes, edge computing networks where edge nodes are located, and related devices.
  • each edge node can independently use the present invention to actively defend against backdoor attacks against collaborative learning in edge computing scenarios, without requiring the edge nodes to cooperate with each other for joint defense, and without knowing whether any edge nodes have been attacked by malicious attackers. control.
  • this solution does not need to rely on human intervention.
  • the active defense method for backdoor attacks in edge computing scenarios without human intervention, qualified hyperparameters can be found according to specific formulas to actively defend backdoor attacks in edge computing scenarios, and the cooperation of other edge nodes is not required. There is no need to know which edge nodes are manipulated by attackers as malicious edge nodes. In terms of actively defending against backdoor attacks in edge computing scenarios, it has the characteristics of high stability and strong resistance, effectively improving network security in edge computing scenarios. It is more suitable for deployment and application in real-world scenarios.
  • FIG. 2 is a schematic block diagram of an active defense device for backdoor attacks in an edge computing scenario according to an embodiment of the present application.
  • the device 10 for active defense against backdoor attacks in this edge computing scenario includes: a first building module 100 , a first screening module 200 , a second screening module 300 , a second building module 400 and a defense module 500 .
  • the first construction module 100 is configured to generate an initial set of optional operations according to the optional operations for improving the generalization capability of the model, and to construct a set of configuration parameters for each operation in the set.
  • the first screening module 200 is configured to screen out a first optional operation subset in which the configuration parameters of the optional operation and the accuracy curve of the model exhibit a monotonically decreasing concave function characteristic from the initial optional operation set.
  • the second screening module 300 is configured to screen out a second optional operation subset in which the curve of the configuration parameters of the optional operations and the success probability of the model being attacked by the backdoor presents a monotonically decreasing convex function characteristic from the initial optional operation set.
  • the second construction module 400 is configured to construct a corresponding mutation characteristic set for each optional operation in the intersection of the first optional operation subset and the second optional operation subset according to a preset formula.
  • the defense module 500 is configured to, for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, determine the final parameter setting of the optional operation according to its corresponding mutation characteristic set. Set the value to actively defend against possible backdoor attacks.
  • the defense module 500 is specifically used for the mutation characteristic set associated with each optional operation in the intersection of the first optional operation subset and the second optional operation subset, Gradually increase according to the preset strategy, and when it is detected that it is greater than the preset threshold, the final parameter setting value is determined; for each collaborative learning edge node in the edge computing scenario, when training the model, each final selected Parameter settings for optional operations are the final parameter settings.
  • the active defense device for backdoor attacks in edge computing scenarios without human intervention, qualified hyperparameters can be found according to specific formulas to actively defend against backdoor attacks oriented to collaborative learning in edge computing scenarios, and the device does not require The cooperation of other edge nodes does not need to know which edge nodes are manipulated by attackers as malicious edge nodes.
  • the device In terms of actively defending against backdoor attacks facing collaborative learning in edge computing scenarios, the device has the characteristics of high stability and strong resistance, effectively improving network security in edge computing scenarios, and is more suitable for deployment and application in real-world scenarios.
  • FIG. 3 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the electronic device may include:
  • the electronic device also includes:
  • the communication interface 1203 is used for communication between the memory 1201 and the processor 1202 .
  • the memory 1201 is used to store computer programs that can be executed on the processor 1202 .
  • the memory 1201 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk memory.
  • the bus can be an Industry Standard Architecture (referred to as ISA) bus, a Peripheral Component (referred to as PCI) bus, or an Extended Industry Standard Architecture (referred to as EISA) bus or the like.
  • ISA Industry Standard Architecture
  • PCI Peripheral Component
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into address bus, data bus, control bus and so on. For ease of presentation, only one thick line is used in FIG. 3, but it does not mean that there is only one bus or one type of bus.
  • the memory 1201, the processor 1202 and the communication interface 1203 are integrated on one chip, the memory 1201, the processor 1202 and the communication interface 1203 can communicate with each other through an internal interface.
  • the processor 1202 may be a central processing unit (Central Processing Unit, referred to as CPU), or a specific integrated circuit (Application Specific Integrated Circuit, referred to as ASIC), or is configured to implement one or more of the embodiments of the present application integrated circuit.
  • CPU Central Processing Unit
  • ASIC Application Specific Integrated Circuit
  • This embodiment also provides a computer-readable storage medium on which a computer program is stored, characterized in that, when the program is executed by a processor, the above-mentioned active defense method for backdoor attacks in an edge computing scenario is implemented.
  • first and second are only used for descriptive purposes, and should not be construed as indicating or implying relative importance or implying the number of indicated technical features. Thus, a feature delimited with “first”, “second” may expressly or implicitly include at least one of that feature.
  • plurality means at least two, such as two, three, etc., unless expressly and specifically defined otherwise.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Pure & Applied Mathematics (AREA)
  • Software Systems (AREA)
  • Computational Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • General Engineering & Computer Science (AREA)
  • Algebra (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Probability & Statistics with Applications (AREA)
  • Operations Research (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种边缘计算场景下后门攻击主动防御方法及装置，其中，方法包括：根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为集合中的每一种操作构建配置参数集合；筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集；筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集，构建相应的突变特性集合；确定可选操作的最终参数设定值，以主动防御可能的后门攻击。本申请实施例的方法可以在边缘计算场景下，有效地提升边缘计算场景下的网络安全，具有稳定性高、抵御能力强的特点，更加适合现实场景的部署与应用。

Description

边缘计算场景下后门攻击主动防御方法及装置
相关申请的交叉引用
本申请要求清华大学于2021年01月13日提交的、发明名称为“一种边缘计算场景下后门攻击主动防御方法及装置”的、中国专利申请号“202110042127.X”的优先权。
技术领域
本申请涉及互联网安全技术领域，特别涉及一种边缘计算场景下后门攻击主动防御方法及装置。
背景技术
相关技术中，得益于移动互联网和无线通讯技术的快速发展，边缘计算网络的相关理论和技术已经成熟，进一步促使边缘计算网络的广泛普及。同时，目前存在大量的网络异常行为，如SYN Flooding攻击引发的流量异常等安全事件。为了实现从边缘网络防御可能的攻击，从而降低骨干网被攻击的风险，许多基于深度学习的异常行为检测模型被部署在边缘网络的边缘节点。然而，相比于云端，边缘节点的设备资源十分受限，如计算性能差、存储能力低，难以满足深度学习训练所需的计算能力和数据需求。而且，边缘节点所能够接触的异常行为样本有限，所拥有的训练数据也可能存在不便于公开的隐私信息。通过协作学习，边缘计算网络中的各个边缘节点不仅仅可以降低对数据量和计算能力的要求，而且无须公开自己的训练数据。边缘节点只需要与其它边缘节点共享训练好的模型，即可获得能够处理所有数据样本(包括自己拥有的训练数据以及其它边缘节点拥有的训练数据)的智能模型，从而享受到其它边缘节点的训练数据带来的性能提升。
然而，由于边缘计算网络中的每个边缘节点都是独立的，一旦被恶意的攻击者攻击，其它边缘节点无法感知。在其它边缘节点无任何感知的情况下，攻击者可以通过修改被攻击边缘节点所拥有的训练数据来向深度学习模型中植入后门，从而实现后门攻击。这里提及的后门攻击，指的是通过篡改训练数据的部分特征来形成后门攻击的触发器，同时将训练数据的标签修改为特定的错误标签。随后，恶意的攻击者操纵被攻击的边缘节点，利用篡改后的数据进行模型训练。被嵌入后门的模型同步至其它未被攻击的边缘节点后，其它边缘节点的深度学习模型也会被嵌入后门。在没有遇到包含触发器的样本时，深度学习模型能够正常工作。但是，在遇到包含触发器的样本时，模型将输出攻击者指定的错误结果。因此，在边缘计算场景下面向协作学习的后门攻击是非常难以检测的。
发明内容
本申请旨在至少在一定程度上解决相关技术中的技术问题之一。
为此，本申请的第一个目的在于提出一种边缘计算场景下后门攻击主动防御方法，该方法可以在边缘计算场景下，有效地提升边缘计算场景下的网络安全，具有稳定性高、抵御能力强的特点，更加适合现实场景的部署与应用。
本申请的第二个目的在于提出一种边缘计算场景下后门攻击主动防御装置。
本申请的第三个目的在于提出一种电子设备。
本申请的第四个目的在于提出一种计算机可读存储介质。
为达到上述目的，本申请第一方面实施例提出了一种边缘计算场景下后门攻击主动防御方法，包括以下步骤：根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为所述集合中的每一种操作构建配置参数集合；从所述初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集；从所述初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集；按照预设公式对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，构建相应的突变特性集合；对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，以主动防御可能的后门攻击。
本申请实施例的边缘计算场景下后门攻击主动防御方法，无须人为干预，即可依据特定公式找到符合条件的超参数来主动防御边缘计算场景下面向协作学习的后门攻击，且该方法不要求其它边缘节点的配合，也不需要知道哪些边缘节点被攻击者操纵为恶意的边缘节点。在主动防御边缘计算场景下面向协作学习的后门攻击方面，此方法具有稳定性高、抵御能力强的特点，有效地提升边缘计算场景下的网络安全，更加适合现实场景的部署与应用。
另外，根据本申请上述实施例的边缘计算场景下后门攻击主动防御方法还可以具有以下附加的技术特征：
可选地，在本申请的一个实施例中，所述根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为所述集合中的每一种操作构建配置参数集合，包括：构建与模型泛化能力相关的初始可选操作集合；构建每一种可选操作的配置参数集合。
可选地，在本申请的一个实施例中，所述从所述初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集，包括：构建配置参数与模型准确性的二元组集合；筛选符合预设单调递减凹函数特性的可选操作 子集。
可选地，在本申请的一个实施例中，所述从所述初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集，包括：构建配置参数与模型被后门攻击成功概率的二元组集合；筛选符合预设单调递减凸函数特性的可选操作子集。
可选地，在本申请的一个实施例中，所述按照预设公式对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，构建相应的突变特性集合，包括：构建最终选定的可选操作集合；针对所述最终选定的可选操作集合中的每一种操作，构建配置参数与模型泛化误差上界的二元组集合；针对所述最终选定的可选操作集合中的每一种操作，构建相应的所述突变特性集合。
可选地，在本申请的一个实施例中，所述对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，包括：对于第一可选操作子集与第二可选操作子集的交集中的每一种可选操作相关联的突变特性集合，按照预设策略逐渐增加，且在检测到大于预设阈值时，确定所述最终参数设定值；对于边缘计算场景下每个协作学习的边缘节点，在训练模型时，将每一种最终选定的可选操作的参数设置为所述最终参数设定值。
为达到上述目的，本申请第二方面实施例提出了一种边缘计算场景下后门攻击主动防御装置，包括：第一构建模块，用于根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为所述集合中的每一种操作构建配置参数集合；第一筛选模块，用于从所述初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集；第二筛选模块，用于从所述初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集；第二构建模块，用于按照预设公式对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，构建相应的突变特性集合；防御模块，用于对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，以主动防御可能的后门攻击。
本申请实施例的边缘计算场景下后门攻击主动防御装置，无须人为干预，即可依据特定公式找到符合条件的超参数来主动防御边缘计算场景下面向协作学习的后门攻击，且该装置不要求其它边缘节点的配合，也不需要知道哪些边缘节点被攻击者操纵为恶意的边缘节点。在主动防御边缘计算场景下面向协作学习的后门攻击方面，此装置具有稳定性高、抵御能力强的特点，有效地提升边缘计算场景下的网络安全，更加适合现实场景的部署与应用。
另外，根据本申请上述实施例的边缘计算场景下后门攻击主动防御装置还可以具有以下附加的技术特征：
可选地，在本申请的一个实施例中，所述防御模块具体用于对于第一可选操作子集与第二可选操作子集的交集中的每一种可选操作相关联的突变特性集合，按照预设策略逐渐增加，且在检测到大于预设阈值时，确定所述最终参数设定值；对于边缘计算场景下每个协作学习的边缘节点，在训练模型时，将每一种最终选定的可选操作的参数设置为所述最终参数设定值。
本申请第三方面实施例提供一种电子设备，包括：至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被设置为用于执行如上述实施例所述的边缘计算场景下后门攻击主动防御方法。
本申请第四方面实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储计算机指令，所述计算机指令用于使所述计算机执行如上述实施例所述的边缘计算场景下后门攻击主动防御方法。
本申请附加的方面和优点将在下面的描述中部分给出，部分将从下面的描述中变得明显，或通过本申请的实践了解到。
附图说明
本申请上述的和/或附加的方面和优点从下面结合附图对实施例的描述中将变得明显和容易理解，其中：
图1为根据本申请实施例的边缘计算场景下后门攻击主动防御方法的流程图；
图2为根据本申请实施例的边缘计算场景下后门攻击主动防御装置的方框示意图；
图3为本申请实施例提供的电子设备的结构示意图。
具体实施方式
下面详细描述本申请的实施例，所述实施例的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的元件或具有相同或类似功能的元件。下面通过参考附图描述的实施例是示例性的，旨在用于解释本申请，而不能理解为对本申请的限制。
下面参照附图描述根据本申请实施例提出的边缘计算场景下后门攻击主动防御方法及装置，首先将参照附图描述根据本申请实施例提出的边缘计算场景下后门攻击主动防御方法。
图1是本申请一个实施例的边缘计算场景下后门攻击主动防御方法的流程图。
如图1所示，该边缘计算场景下后门攻击主动防御方法包括以下步骤：
在步骤S101中，根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为集合中的每一种操作构建配置参数集合。
作为一种可能实现的方式，本申请实施例主要用于边缘计算场景下多个边缘节点通过协作学习来实现网络智能化的系统之中。由此，本申请实施例针对深度学习模型拥有多种可选择操作来提升模型的泛化能力的现状，首先将选定的用于提升模型泛化能力的可选操作构成一个初始可选操作集合，并且为集合中的每一种操作构建配置参数集合。
可选地，在本申请的一个实施例中，根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为集合中的每一种操作构建配置参数集合，包括：构建与模型泛化能力相关的初始可选操作集合；构建每一种可选操作的配置参数集合。随后，本申请实施例利用不同的配置参数，为每一种可选操作训练多个模型。
例如，步骤S1：考虑到深度学习模型存在多种可选操作来提升模型的泛化能力，并且随着可选操作的配置参数的改变，深度学习模型的泛化能力也会随之改变。可选地将用于提升模型泛化能力的可选操作构成一个初始可选操作集合，并且为集合中的每一种操作构建配置参数集合。
在实际执行过程中，步骤S1可以包括：
步骤S11：构建与模型泛化能力相关的初始可选操作集合。在训练深度学习模型时，存在大量的可选操作，如dropout(一定比例的网络结构在训练过程中不更新)、正则化、梯度裁剪等。可选地将与模型泛化能力相关的N种可选操作构成一个初始可选操作集合，由P＝{p 1,p 2,…,p N-1,p N}表示。
步骤S12：构建每一种可选操作的配置参数集合。对于P中的每一种可选操作p i,都存在一个可选的参数配置范围，由
Figure PCTCN2021081596-appb-000001
表示，其中
Figure PCTCN2021081596-appb-000002
为最小的可选配置参数，
Figure PCTCN2021081596-appb-000003
为最大的可选配置参数。在可选的参数配置范围内，均匀地选择K+2个参数(包含
Figure PCTCN2021081596-appb-000004
和
Figure PCTCN2021081596-appb-000005
)，即参数间隔可以表示为s i,具体计算方式如下：
Figure PCTCN2021081596-appb-000006
最后，每一种可选操作p i都会存在一个配置参数集合，表示为
Figure PCTCN2021081596-appb-000007
其中
Figure PCTCN2021081596-appb-000008
在步骤S102中，从初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集。
可以理解的是，在配置参数与模型的准确性方面，筛选符合单调递减凹函数特性的可选操作子集。
可选地，在本申请的一个实施例中，从初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集，包括：构建配置参数与模型准确性的二元组集合；筛选符合预设单调递减凹函数特性的可选操作子集。
例如，步骤S2：筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的可选操作子集。
在实际执行过程中，步骤S2可以包括：
步骤S21：构建配置参数与模型准确性的二元组集合。对于可选操作集合P中的每一种可选操作p i，分别用对应的配置参数集合E i中的每个元素
Figure PCTCN2021081596-appb-000009
来训练模型。在训练完成后，测试模型，得到模型的准确性
Figure PCTCN2021081596-appb-000010
从而构建配置参数与模型准确性的二元组，即
Figure PCTCN2021081596-appb-000011
将可选操作p i的所有二元组构成集合，即
Figure PCTCN2021081596-appb-000012
步骤S22：筛选符合单调递减凹函数特性的可选操作子集。对于可选操作集合P中的每一种可选操作p i，利用其二元组集合F i构建配置参数与模型准确性的曲线，并拟合出近似曲线函数f i。将所有的符合单调递减凹函数特性的曲线函数f i对应的操作p i构成特定的子集，表示为
Figure PCTCN2021081596-appb-000013
and f i(x 1)>f i(x 2),and x 1<x 2}，其中
Figure PCTCN2021081596-appb-000014
这里的x 1与x 2只是为了说明函数的单调性以及凹凸性，并无其实际意义。
在步骤S103中，从初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集。
可以理解的是，本申请实施例在配置参数与模型被后门攻击成功概率方面，筛选符合单调递减凸函数特性的可选操作子集。
可选地，在本申请的一个实施例中，从初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作 子集，包括：构建配置参数与模型被后门攻击成功概率的二元组集合；筛选符合预设单调递减凸函数特性的可选操作子集。
例如，步骤S3：筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的可选操作子集。
在实际执行过程中，步骤S3可以包括：
步骤S31：构建配置参数与模型被后门攻击成功概率的二元组集合。这里的模型被后门攻击成功概率指的是模型错误地将具有后门攻击触发器的样本识别错误的概率。对于可选操作集合P中的每一种可选操作p i，分别用对应的配置参数集合E i中的每个元素
Figure PCTCN2021081596-appb-000015
来训练模型。在训练完成后，利用带有后门攻击触发器的样本来测试模型，得到模型被后门攻击成功概率
Figure PCTCN2021081596-appb-000016
从而构建配置参数与模型被后门攻击成功概率的二元组，即
Figure PCTCN2021081596-appb-000017
将可选操作p i的所有二元组构成集合，即
Figure PCTCN2021081596-appb-000018
步骤S32：筛选符合单调递减凸函数特性的可选操作子集。对于可选操作集合P中的每一种可选操作p i，利用其二元组集合G i构建配置参数与模型被后门攻击成功概率的曲线，并拟合出近似曲线函数g i。将所有的符合单调递减凸函数特性的曲线函数g i对应的操作p i构成特定的子集，表示为
Figure PCTCN2021081596-appb-000019
and g i(x 1)>g i(x 2),and x 1<x 2}，其中
Figure PCTCN2021081596-appb-000020
需要说明的是，这里的x 1与x 2只是为了说明函数的单调性以及凹凸性，并无其实际意义。
在步骤S104中，按照预设公式对第一可选操作子集与第二可选操作子集的交集内的每一种可选操作，构建相应的突变特性集合。
即言，本申请实施例将上述两个子集取交集后，构成一个新的用于主动防御可能的后门攻击的最终选定的可选操作集合。
可选地，在本申请的一个实施例中，按照预设公式对第一可选操作子集与第二可选操作子集的交集内的每一种可选操作，构建突变特性集合，包括：构建最终选定的可选操作集合；针对最终选定的可选操作集合中的每一种操作，构建配置参数与模型泛化误差上界的二元组集合；针对最终选定的可选操作集合中的每一种操作，构建相应的突变特性集合。
例如，步骤S4：按照指定公式，对步骤S2与步骤S3获得的两个子集的交集内的每一种可选操作，构建突变特性集合。
在实际执行过程中，步骤S4可以包括：
步骤S41：构建最终选定的可选操作集合。在完成步骤S2与步骤S3之后，将两个步骤中获得的可选操作子集取并集，即P'＝P A∩P B。
步骤S42：针对最终选定的可选操作集合中的每一种操作p i∈P'，构建配置参数与模型泛化误差上界的二元组集合。这里的模型泛化误差上界，能够表达模型的泛化能力。具体来说，可选地存在一个良性的数据集D benign，所有样本都不包含后门攻击的触发器。可选地从D benign取出一定比例的样本，构成一个良性的子集D' benign，其中
Figure PCTCN2021081596-appb-000021
对于良性的子集D' benign，将其所有的样本都增加后门攻击触发器，并且篡改真实的标签，从而构成一个后门攻击的子集D' backdoor。构造两个用于训练的数据集D 1＝D benign\D' benign和D 2＝(D benign\D' benign)∪D' backdoor。分别地在D 1和D 2两个数据集上训练两个模型M 1和M 2。对于数据集D 2中的每一个样本d∈D 2，分别地计算该样本在训练好的两个模型M 1和M 2上的损失值
Figure PCTCN2021081596-appb-000022
和
Figure PCTCN2021081596-appb-000023
的差的绝对值，即
Figure PCTCN2021081596-appb-000024
所定义的模型泛化误差上界即可表示为φ，具体的计算方式如下：
Figure PCTCN2021081596-appb-000025
where d∈D 2，
对于可选操作集合P'中的每一种可选操作p i∈P'，分别用对应的配置参数集合E i中的每个元素
Figure PCTCN2021081596-appb-000026
来计算模型泛化误差上界
Figure PCTCN2021081596-appb-000027
从而构建配置参数与模型泛化误差上界的二元组，即
Figure PCTCN2021081596-appb-000028
将可选操作p i∈P'的所有二元组构成集合，即
Figure PCTCN2021081596-appb-000029
步骤S43：针对最终选定的可选操作集合中的每一种操作，构建相应的突变特性集合。对于V i中的每一个元素
Figure PCTCN2021081596-appb-000030
定义该二元组的突变特性为
Figure PCTCN2021081596-appb-000031
具体的计算方式如下：
Figure PCTCN2021081596-appb-000032
其中，Δ是一个大于等于1的整数型超参数。于是，与V i相对应的可选操作p i∈P' 的突变特性集合
Figure PCTCN2021081596-appb-000033
将j从1开始逐渐变大。
在步骤S105中，对于第一可选操作子集与第二可选操作子集的交集中的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，以主动防御可能的后门攻击。
综上，本申请实施例基于模型泛化误差上界，为第一可选操作子集与第二可选操作子集的交集(也就是最终选定的可选操作集合)中的每一种可选操作，构建相应的突变特性集合，从而通过突变特性集合中的元素与预先设定阈值的关系，为每一种可选操选定最终的参数设定值，从而主动防御可能的后门攻击。
需要说明的是，设定阈值可以由本领域技术人员根据实际情况进行设置，在此不做具体限定。
在本申请的实施例中，不要求其它边缘节点的配合，也不需要知道其它边缘节点是否已经遭受后门攻击，能够有效地提升边缘计算场景下的网络安全，对于投入现实部署和应用意义深远。
可选地，在本申请的一个实施例中，对于第一可选操作子集与第二可选操作子集的交集中的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，包括：对于第一可选操作子集与第二可选操作子集的交集中的每一种可选操作相关联的突变特性集合，按照预设策略逐渐增加，且在检测到大于预设阈值时，确定最终参数设定值；对于边缘计算场景下每个协作学习的边缘节点，在训练模型时，将每一种最终选定的可选操作的参数设置为最终参数设定值。
例如，步骤S5：根据步骤S4中为每一种最终选定的可选操作p i∈P'的突变特性集合W i，确定可选操作p i∈P'的最终参数设定值，以主动防御可能的后门攻击。
在实际执行过程中，步骤S5可以包括：
步骤S51：对于每一种最终选定的可选操作p i∈P'相关联的突变特性集合W i，可选地按照j从1开始以1的单位逐渐增加，比较
Figure PCTCN2021081596-appb-000034
与人为设定阈值σ的大小。在首次出现
Figure PCTCN2021081596-appb-000035
时，停止比较，并记录此时
Figure PCTCN2021081596-appb-000036
所对应的参数值
Figure PCTCN2021081596-appb-000037
可选地将其表示为η i。
步骤S52：对于边缘计算场景下每个协作学习的边缘节点，在训练模型时，将每一种最终选定的可选操作p i∈P'的参数设置为η i，从而主动防御可能发生的后门攻击。
本领域技术人员应该理解到的是，考虑到深度学习模型的稳定性与后门攻击的成功概率存在关联，本申请实施例可以对边缘计算场景下的深度学习模型进行稳定性分 析。随后，根据稳定性分析的结果，本申请实施例可以依据公式找到模型泛化能力变化拐点所对应的超参数。这里所提及的拐点具有如下特性。当超参数的值小于拐点所对应的超参数时，随着超参数的增加，边缘计算场景下的深度学习模型的准确性缓慢降低，但是深度学习模型被嵌入有效后门的概率明显降低；当超参数的值大于拐点所对应的超参数时，随着超参数的增加，边缘计算场景下的深度学习模型的准确率明显降低，但是深度学习模型被嵌入有效后门的概率缓慢降低。该方法无须人为干预，即可依据特定公式找到符合条件的超参数来主动防御边缘计算场景下面向协作学习的后门攻击。而且，本申请实施例不要求其它边缘节点的配合，也不需要知道哪些边缘节点被攻击者操纵为恶意的边缘节点。总的来说，此方法及装置在主动防御边缘计算场景下面向协作学习的后门攻击方面，具有稳定性高、抵御能力强的特点，更加适合现实场景的部署与应用。
综上，边缘计算网络的广泛部署促进了边缘节点之间协作学习的进一步发展。然而，各个边缘节点无法获知其它边缘节点的训练数据是否被恶意攻击者篡改而演化为具有后门攻击触发器的样本。在这样一个场景下，后门攻击能够由一个或者多个被恶意攻击者控制的边缘节点传播至其它良性边缘节点，让所有参与协作学习的边缘节点的深度学习模型都被嵌入后门。这将导致深度学习模型在遇到具有后门攻击触发器的样本时，表现出攻击者期望的错误行为，给边缘节点、边缘节点所在的边缘计算网络以及相关设备带来潜在的安全风险。特别是诸如网络异常(SYN Flooding攻击)检测的场景，一旦边缘节点被植入后门，将会造成巨大的经济损失，甚至危害国家安全。边缘计算场景下面向协作学习而发起的后门攻击具有难以发现的特点，仅在遇到特定的后门攻击触发器时，才会表现出恶意行为。为此，可选地提出了一种边缘计算场景下后门攻击主动防御方法及装置，有效地主动防御潜在的后门攻击。
本申请实施例解决了边缘计算场景下后门攻击难以被检测的问题。同时，各个边缘节点可以单独地按照本发明来主动防御边缘计算场景下面向协作学习的后门攻击，不要求边缘节点之间相互配合来共同防御，也不需要知道是否有边缘节点已经被恶意攻击者控制。另外，本方案不需要依赖人为干预，每个边缘节点在配置好本发明所需的超参数之后，完全按照本发明自动部署防御。
根据本申请实施例的边缘计算场景下后门攻击主动防御方法，无须人为干预，即可依据特定公式找到符合条件的超参数来主动防御边缘计算场景下后门攻击，而且不要求其它边缘节点的配合，也不需要知道哪些边缘节点被攻击者操纵为恶意的边缘节点，在主动防御边缘计算场景下后门攻击方面，具有稳定性高、抵御能力强的特点，有效地提升边缘计算场景下的网络安全，更加适合现实场景的部署与应用。
其次参照附图描述根据本申请实施例提出的边缘计算场景下后门攻击主动防御装置。
图2是本申请一个实施例的边缘计算场景下后门攻击主动防御装置的方框示意图。
如图2所示，该边缘计算场景下后门攻击主动防御装置10包括：第一构建模块100、第一筛选模块200、第二筛选模块300、第二构建模块400和防御模块500。
具体地，第一构建模块100，用于根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为集合中的每一种操作构建配置参数集合。
第一筛选模块200，用于从初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集。
第二筛选模块300，用于从初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集。
第二构建模块400，用于按照预设公式对第一可选操作子集与第二可选操作子集的交集内的每一种可选操作，构建相应的突变特性集合。
防御模块500，用于对第一可选操作子集与第二可选操作子集的交集内的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，以主动防御可能的后门攻击。
其中，在本申请的一个实施例中，防御模块500具体用于对于第一可选操作子集与第二可选操作子集的交集中的每一种可选操作相关联的突变特性集合，按照预设策略逐渐增加，且在检测到大于预设阈值时，确定最终参数设定值；对于边缘计算场景下每个协作学习的边缘节点，在训练模型时，将每一种最终选定的可选操作的参数设置为最终参数设定值。
需要说明的是，前述对边缘计算场景下后门攻击主动防御方法实施例的解释说明也适用于该实施例的边缘计算场景下后门攻击主动防御装置，此处不再赘述。
根据本申请实施例的边缘计算场景下后门攻击主动防御装置，无须人为干预，即可依据特定公式找到符合条件的超参数来主动防御边缘计算场景下面向协作学习的后门攻击，而且该装置不要求其它边缘节点的配合，也不需要知道哪些边缘节点被攻击者操纵为恶意的边缘节点。在主动防御边缘计算场景下面向协作学习的后门攻击方面，该装置具有稳定性高、抵御能力强的特点，有效地提升边缘计算场景下的网络安全，更加适合现实场景的部署与应用。
图3为本申请实施例提供的电子设备的结构示意图。该电子设备可以包括：
存储器1201、处理器1202及存储在存储器1201上并可在处理器1202上运行的计算机 程序。
处理器1202执行程序时实现上述实施例中提供的边缘计算场景下后门攻击主动防御方法。
进一步地，电子设备还包括：
通信接口1203，用于存储器1201和处理器1202之间的通信。
存储器1201，用于存放可在处理器1202上运行的计算机程序。
存储器1201可能包含高速RAM存储器，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。
如果存储器1201、处理器1202和通信接口1203独立实现，则通信接口1203、存储器1201和处理器1202可以通过总线相互连接并完成相互间的通信。总线可以是工业标准体系结构(Industry Standard Architecture，简称为ISA)总线、外部设备互连(Peripheral Component，简称为PCI)总线或扩展工业标准体系结构(Extended Industry Standard Architecture，简称为EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图3中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
可选的，在具体实现上，如果存储器1201、处理器1202及通信接口1203，集成在一块芯片上实现，则存储器1201、处理器1202及通信接口1203可以通过内部接口完成相互间的通信。
处理器1202可能是一个中央处理器(Central Processing Unit，简称为CPU)，或者是特定集成电路(Application Specific Integrated Circuit，简称为ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路。
本实施例还提供一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现如上的边缘计算场景下后门攻击主动防御方法。
此外，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括至少一个该特征。在本申请的描述中，“多个”的含义是至少两个，例如两个，三个等，除非另有明确具体的限定。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本申请的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不必须针对的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特 点可以在任一个或多个实施例或示例中以合适的方式结合。此外，在不相互矛盾的情况下，本领域的技术人员可以将本说明书中描述的不同实施例或示例以及不同实施例或示例的特征进行结合和组合。
尽管上面已经示出和描述了本申请的实施例，可以理解的是，上述实施例是示例性的，不能理解为对本申请的限制，本领域的普通技术人员在本申请的范围内可以对上述实施例进行变化、修改、替换和变型。

Claims (10)

  1. 一种边缘计算场景下后门攻击主动防御方法，其特征在于，包括以下步骤：
    根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为所述集合中的每一种操作构建配置参数集合；
    从所述初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集；
    从所述初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集；
    按照预设公式对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，构建相应的突变特性集合；
    对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，以主动防御可能的后门攻击。
  2. 根据权利要求1所述的方法，其特征在于，所述根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为所述集合中的每一种操作构建配置参数集合，包括：
    构建与模型泛化能力相关的初始可选操作集合；
    构建每一种可选操作的配置参数集合。
  3. 根据权利要求1所述的方法，其特征在于，所述从所述初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集，包括：
    构建配置参数与模型准确性的二元组集合；
    筛选符合预设单调递减凹函数特性的可选操作子集。
  4. 根据权利要求1所述的方法，其特征在于，所述从所述初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集，包括：
    构建配置参数与模型被后门攻击成功概率的二元组集合；
    筛选符合预设单调递减凸函数特性的可选操作子集。
  5. 根据权利要求1所述的方法，其特征在于，所述按照预设公式对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，构建相应的突变特性集合，包括：
    构建最终选定的可选操作集合；
    针对所述最终选定的可选操作集合中的每一种操作，构建配置参数与模型泛化误差上 界的二元组集合；
    针对所述最终选定的可选操作集合中的每一种操作，构建相应的所述突变特性集合。
  6. 根据权利要求1所述的方法，其特征在于，所述对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，包括：
    对于第一可选操作子集与第二可选操作子集的交集中的每一种可选操作相关联的突变特性集合，按照预设策略逐渐增加，且在检测到大于预设阈值时，确定所述最终参数设定值；
    对于边缘计算场景下每个协作学习的边缘节点，在训练模型时，将每一种最终选定的可选操作的参数设置为所述最终参数设定值。
  7. 一种边缘计算场景下后门攻击主动防御装置，其特征在于，包括：
    第一构建模块，用于根据用于提升模型泛化能力的可选操作生成初始可选操作集合，并且为所述集合中的每一种操作构建配置参数集合；
    第一筛选模块，用于从所述初始可选操作集合中筛选出可选操作的配置参数与模型的准确性曲线呈现单调递减的凹函数特性的第一可选操作子集；
    第二筛选模块，用于从所述初始可选操作集合中筛选出可选操作的配置参数与模型被后门攻击成功概率的曲线呈现单调递减的凸函数特性的第二可选操作子集；
    第二构建模块，用于按照预设公式对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，构建相应的突变特性集合；
    防御模块，用于对所述第一可选操作子集与所述第二可选操作子集的交集内的每一种可选操作，根据其相应的突变特性集合，确定该可选操作的最终参数设定值，以主动防御可能的后门攻击。
  8. 根据权利要求7所述的装置，其特征在于，所述防御模块具体用于对于第一可选操作子集与第二可选操作子集的交集中的每一种可选操作相关联的突变特性集合，按照预设策略逐渐增加，且在检测到大于预设阈值时，确定所述最终参数设定值；对于边缘计算场景下每个协作学习的边缘节点，在训练模型时，将每一种最终选定的可选操作的参数设置为所述最终参数设定值。
  9. 一种电子设备，其特征在于，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述处理器执行所述程序，以实现如权利要求1-6任一项所述的边缘计算场景下后门攻击主动防御方法。
  10. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行，以用于实现如权利要求1-6任一项所述的边缘计算场景下后门攻击主动防御方法。
PCT/CN2021/081596 2021-01-13 2021-03-18 边缘计算场景下后门攻击主动防御方法及装置 WO2022151579A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/523,474 US20220222352A1 (en) 2021-01-13 2021-11-10 Method and apparatus for actively defending against backdoor attacks under edge computing scenario

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110042127.XA CN112800421A (zh) 2021-01-13 2021-01-13 边缘计算场景下后门攻击主动防御方法及装置
CN202110042127.X 2021-01-13

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/523,474 Continuation US20220222352A1 (en) 2021-01-13 2021-11-10 Method and apparatus for actively defending against backdoor attacks under edge computing scenario

Publications (1)

Publication Number Publication Date
WO2022151579A1 true WO2022151579A1 (zh) 2022-07-21

Family

ID=75810451

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/081596 WO2022151579A1 (zh) 2021-01-13 2021-03-18 边缘计算场景下后门攻击主动防御方法及装置

Country Status (2)

Country Link
CN (1) CN112800421A (zh)
WO (1) WO2022151579A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116055413A (zh) * 2023-03-07 2023-05-02 云南省交通规划设计研究院有限公司 一种基于云边协同的隧道网络异常识别方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114826764B (zh) * 2022-05-17 2023-07-18 广西科技大学 一种基于集成学习的边缘计算网络攻击识别方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110049497A (zh) * 2019-04-11 2019-07-23 北京工业大学 移动雾计算中一种面向用户的智能攻击防御方法
US20200412743A1 (en) * 2019-06-25 2020-12-31 International Business Machines Corporation Detection of an adversarial backdoor attack on a trained model at inference time
US20200410098A1 (en) * 2019-06-26 2020-12-31 Hrl Laboratories, Llc System and method for detecting backdoor attacks in convolutional neural networks
CN112199189A (zh) * 2019-07-08 2021-01-08 国际商业机器公司 深度学习模型对资源受限边缘设备的适应

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110049497A (zh) * 2019-04-11 2019-07-23 北京工业大学 移动雾计算中一种面向用户的智能攻击防御方法
US20200412743A1 (en) * 2019-06-25 2020-12-31 International Business Machines Corporation Detection of an adversarial backdoor attack on a trained model at inference time
US20200410098A1 (en) * 2019-06-26 2020-12-31 Hrl Laboratories, Llc System and method for detecting backdoor attacks in convolutional neural networks
CN112199189A (zh) * 2019-07-08 2021-01-08 国际商业机器公司 深度学习模型对资源受限边缘设备的适应

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZHAO YI; XU KE; WANG HAIYANG; LI BO; JIA RUOXI: "Stability-Based Analysis and Defense against Backdoor Attacks on Edge Computing Services", IEEE NETWORK., IEEE SERVICE CENTER, NEW YORK, NY., US, vol. 35, no. 1, 16 February 2021 (2021-02-16), US , pages 163 - 169, XP011838013, ISSN: 0890-8044, DOI: 10.1109/MNET.011.2000265 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116055413A (zh) * 2023-03-07 2023-05-02 云南省交通规划设计研究院有限公司 一种基于云边协同的隧道网络异常识别方法
CN116055413B (zh) * 2023-03-07 2023-08-15 云南省交通规划设计研究院有限公司 一种基于云边协同的隧道网络异常识别方法

Also Published As

Publication number Publication date
CN112800421A (zh) 2021-05-14

Similar Documents

Publication Publication Date Title
US11526745B2 (en) Methods and apparatus for federated training of a neural network using trusted edge devices
WO2022151579A1 (zh) 边缘计算场景下后门攻击主动防御方法及装置
CN110505241B (zh) 一种网络攻击面检测方法及系统
CN113364752B (zh) 一种流量异常检测方法、检测设备及计算机可读存储介质
AU2017254815A1 (en) Anomaly detection to identify coordinated group attacks in computer networks
Qin et al. Federated learning-based network intrusion detection with a feature selection approach
CN110059747B (zh) 一种网络流量分类方法
CN109818964B (zh) 一种DDoS攻击检测方法、装置、设备以及存储介质
CN111625820A (zh) 一种基于面向AIoT安全的联邦防御方法
CN113094707B (zh) 一种基于异质图网络的横向移动攻击检测方法及系统
US20230053182A1 (en) Network access anomaly detection via graph embedding
CN111464501A (zh) 一种面向数据服务的自适应入侵响应博弈方法及其系统
Huang et al. Markov differential game for network defense decision-making method
Liu et al. A novel dynamic model for web malware spreading over scale-free networks
CN115378733B (zh) 一种基于动态图嵌入的多步攻击场景构建方法及系统
CN112883377A (zh) 一种基于特征对抗的联邦学习中毒检测方法和装置
CN110336806B (zh) 一种结合会话行为和通信关系的隐蔽通信检测方法
CN111131199A (zh) 业务攻击流量清洗控制方法、装置、服务器及存储介质
CN112215300A (zh) 一种基于网络结构增强的图卷积模型防御方法、装置和系统
CN109510805B (zh) 一种基于安全基线模型的网络数据安全检测方法及系统
Bhuyan et al. Towards an unsupervised method for network anomaly detection in large datasets
Tang et al. A novel LDoS attack detection method based on reconstruction anomaly
CN114679291B (zh) 一种用于工业网络入侵监测的系统
CN112969180B (zh) 模糊环境下无线传感器网络攻击防御方法及系统
WO2022252039A1 (en) Method and apparatus for adversarial attacking in deep reinforcement learning

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21918778

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21918778

Country of ref document: EP

Kind code of ref document: A1