Journal of Computer Applications ›› 2025, Vol. 45 ›› Issue (5): 1573-1581.DOI: 10.11772/j.issn.1001-9081.2024050610

• Cyber security • Previous Articles    

Adversarial sample generation method for time-series data based on local augmentation

Xueying LI1, Kun YANG2, Guoqing TU1, Shubo LIU2()   

  1. 1.Key Laboratory of Aerospace Information Security and Trusted Computing,Ministry of Education,School of Cyber Science and Engineering,Wuhan University,Wuhan Hubei 430072,China
    2.School of Computer Science,Wuhan University,Wuhan Hubei 430072,China
  • Received:2024-05-14 Revised:2024-07-08 Accepted:2024-08-16 Online:2024-09-04 Published:2025-05-10
  • Contact: Shubo LIU
  • About author:LI Xueying, born in 2001, M. S. candidate. Her research interests include time series data, adversarial attack, machine learning, artificial intelligence security.
    YANG Kun, born in 1992, M. S. candidate. His research interests include embedded system, machine learning, cryptography, internet of things security, artificial intelligence security.
    TU Guoqing, born in 1974, Ph. D., associate professor. His research interests include embedded system, internet of things, information security, water conservancy informatization.
    LIU Shubo, born in 1970, Ph. D., professor. His research interests include embedded system, differential privacy, time series.
  • Supported by:
    National Natural Science Foundation of China(41971407)

基于局部增强的时序数据对抗样本生成方法

李雪莹1, 杨琨2, 涂国庆1, 刘树波2()   

  1. 1.空天信息安全与可信计算教育部重点实验室,武汉大学 国家网络安全学院,武汉 430072
    2.武汉大学 计算机学院,武汉 430072
  • 通讯作者: 刘树波
  • 作者简介:李雪莹(2001—),女,山东莘县人,硕士研究生,主要研究方向:时序数据、对抗攻击、机器学习、人工智能安全
    杨琨(1992—),男,安徽安庆人,硕士研究生,主要研究方向:嵌入式系统、机器学习、密码学、物联网安全、人工智能安全
    涂国庆(1974—),男,湖北罗田人,副教授,博士,主要研究方向:嵌入式系统、物联网、信息安全、水利信息化
    刘树波(1970—),男,黑龙江泰来人,教授,博士,主要研究方向:嵌入式系统、差分隐私、时间序列。
  • 基金资助:
    国家自然科学基金资助项目(41971407)

Abstract:

Deep Neural Networks (DNNs) are highly susceptible to adversarial attacks, causing security problems in time-series data classification tasks. Gradient-based attack methods can generate adversarial samples quickly but need continuous access to the model's internal information, while generation-based attack methods do not need this access after training but suffer from poor stealthiness and transferability. To address these problems, a semi-white box adversarial sample generation method for time-series data based on local augmentation was proposed using the generative attack method AdvGAN. The local augmentation strategy in this method injected information from other data categories into original samples and utilized enhanced data to execute semi-white-box attacks. The attack model leveraged both original sample information and distribution characteristics of other categories, thereby enhancing model's attack capability and transferability. Experimental results on UCR datasets demonstrate that the proposed method generates an adversarial example in 0.027 s on average; it outperforms Fast Gradient Sign Method (FGSM), AdvGAN, and GATN (Gradient Adversarial Transformation Network) methods in attack success rate on 18, 25, and 13 datasets of 27 datasets respectively. The generated adversarial examples exhibit significantly smaller Mean Squared Error (MSE) compared to AdvGAN and GATN methods on 20 and 27 datasets respectively. Its transfer success rates surpass AdvGAN and FGSM methods on 18 and 11 datasets respectively, with transfer attack success rates exceeding 25% on 9 datasets of 21 datasets. The results indicate that the proposed method maintains efficient adversarial example generation while improving stealthiness and preserving competitive attack performance.

Key words: time-series data, deep learning, adversarial sample, data augmentation, semi-white box attack

摘要:

深度神经网络(DNN)极易遭受对抗攻击,进而引起时序数据分类任务中的安全问题。基于梯度的攻击方法可以快速地生成对抗样本,但需要不断访问模型内部信息;基于生成的攻击方法在模型训练完成之后无须访问模型内部信息,但存在隐蔽性和迁移性较差等问题。针对以上问题,基于生成式攻击方法AdvGAN提出一种基于局部增强的时序数据对抗样本生成方法,其中的局部增强策略将其他类别数据的信息注入原样本中,并利用增强后的数据执行灰盒攻击;而攻击模型不仅可以利用原样本信息,还能利用其他类别样本的分布信息,进而提升模型的攻击能力和迁移能力。在UCR数据集上的实验结果表明,所提方法平均0.027 s即可生成一个对抗样本;在27个数据集中,它的攻击成功率分别在18、25和13个数据集上优于快速梯度符号法(FGSM)、AdvGAN和GATN(Gradient Adversarial Transformation Network)方法;它的生成对抗样本的均方误差(MSE)分别在20和27个数据集上明显小于AdvGAN和GATN方法;在21个数据集中,它的迁移成功率分别在18和11个数据集上优于AdvGAN和FGSM方法,且在9个数据集上的迁移攻击成功率达到25%以上。可见,所提方法在保证对抗样本生成速度的同时,提高了对抗样本的隐蔽性并保持有竞争力的攻击效果。

关键词: 时序数据, 深度学习, 对抗样本, 数据增强, 灰盒攻击

CLC Number: