| With the development of technology and the arrival of the Internet of Things era,smart devices and sensors have generated a large amount of time series data with mining value.However,due to the characteristics of low robustness and poor interpretability,the neural network model is extremely vulnerable to the attack of adversarial examples,which poses a potential security threat to the intelligent system based on time series data.The research of adversarial attack and defense is of great significance to discover the defects of neural network,improve the robustness of model and promote the practical application of artificial intelligence system.Aiming at the neural network of time series classification task,this paper employs the local nature of time series data and its adversarial examples to conduct research on adversarial attack and defense methods.The main contents are as follows:(1)In order to solve the problems that the adversarial examples generated by time series adversarial attack methods are easily perceived by human eyes,and the attack success rate is low,and the model parameters are difficult to obtain,a time series black box adversarial attack method based on local perturbation is proposed.Time series shapelets,as the most discriminative subsequences of time series,can provide effective local perturbation intervals.Different from the methods with global perturbation,this method only needs to add perturbation on the shapelet interval to attack.So the generated adversarial examples just have small perturbations on the local interval,which are not easily perceived by human eyes.This method describes the attack as a constrained optimization problem by constraining the norm of the perturbation vector.In order to solve the problem that the parameters of the target model cannot be obtained in the real situation and avoid the use of alternative models,the method uses the differential evolution algorithm to perform black-box optimization on the problem and generate adversarial examples.(2)In order to improve the robustness of time series classification models,this paper proposes an adversarial example defense method based on local detection and data augmentation.The method consists of local detector and data augmentation algorithm.Local detector makes use of the frequent numerical fluctuations on the local perturbation interval of time series adversarial examples.The detector traverses the normal samples in the dataset and records the mean and standard deviation of the slope between adjacent points at each location.Then,in the locally inference stage,the local detector calculates the relevant indicators of the input sample.And the local detector compares it with the normal value to determine whether the sample is an abnormal sample.At the same time,the detector merges and updates the next local perturbed interval.Second,the data augmentation method takes advantage of the property that time series can be converted between time domain and frequency domain.The method converts time series into Fourier coefficients through discrete Fourier transform.Then the method groups and randomly combines coefficients of similar samples to generate new sample.This data augmentation algorithm can not only introduce unseen features into the dataset,but also ensure clear classification boundaries.This paper verifies the proposed method through parameter analysis,comparative experiment and visual analysis.The experimental results show that the attack method proposed in this paper can significantly improve the imperceptibility of adversarial samples and maintain a high attack success rate compared with the benchmark methods.Compared with the baseline algorithms,the defense method proposed in this paper can significantly improve the defense performance. |
