Deep Network Attack On Radar High Resolution Range Profiles Target Recognition

Since radar high-resolution range profiles(HRRP)data is easy to obtain and process,it has become a commonly used data form in the field of radar automatic target recognition(RATR).In recent years,due to the rise of deep learning,radar target recognition methods based on deep network models have emerged endlessly.However,the latest research shows that deep networks are vulnerable to adversarial examples,and just adding extremely small noise to the original samples can cause the deep networks misclassification.The importance of security for radar target recognition is self-evident,so this paper will focus on the deep network attack on radar high-resolution range profiles recognition.The main work of the thesis includes the following three parts:The first part discusses the basic concepts of radar high-resolution range image based on the assumption of the scattering point model.The sensitivity of HRRP data was introduced and we give the corresponding preprocessing methods to solve them.Then the basic knowledge of radar target recognition based on deep networks are introduced,including the deep forword network and convolutional neural network.Finally we give the concept of adversarial examples whose principles and common types are discussed.The second part is about the deep network attack on radar target recognition task.First,the principles of classical deep network attack methods including FGSM,BIM,CW,and DF are explained,and it is verified that these methods are still effective on HRRP target recognition tasks based on deep networks.However,since the classical attack methods are all based on gradient optimization,complex optimization operations are required for each sample to obtain adversarial examples,which may not meet the real-time requirements in practical applications.To solve this problem,a fast attack method based on residual autoencoder model is proposed.The reason why it is called fast attack method is that once the autoencoder model is trained,it only needs to run the autoencoder model forward to get the adversarial examples.The use of adversarial loss and similarity loss promote the autoencoder model to generate adversarial examples which can cause model misclassification.Experimental results show that the fast attack method performs well on multiple performance indicators such as attack success rate,noise level,and real-time performance.At the same time,it is verified that the noise generated by the fast attack method can be transfered with different target networks.That is black box attacks can be implemented.The third part is about robust attack on radar target recognition.The common characteristic of all the attack methods in the second part is that the noise against different samples is different,that is,the noise is a function of the input samples.The robust attack method is different.Noise is applicable to all training samples and test samples.The advantages of robust attack include: after the training is completed,no additional calculation is required during the test phase,which reduces time consumption and makes it easier to implement real-time attacks;all samples share the same noise,which makes attacks easier to implement.Considering that HRRP has a target area,an attack using masks to limit the length of noise is proposed,which is more in line with the actual situation.Aiming at the problem that real networks do not make full use of HRRP complex information,a robust attack method based on complex networks is proposed.In order to implement black box attacks,a black box attack method based on network distillation is proposed.Finally,a large number of experiments have verified the effectiveness of robust attacks on white box attacks,complex attacks,and black box attacks.