神经网络中基于数据完整性抽样审计算法的中毒攻击检测方案  

Poisoning attack detection scheme based on data integrity sampling audit algorithm in neural network

作　　者：赵宁宁 蒋睿 Zhao Ningning;Jiang Rui(School of Cyber Science and Engineering,Southeast University,Nanjing 210096,China)

机构地区：[1]东南大学网络空间安全学院,南京210096

出　　处：《Journal of Southeast University(English Edition)》2023年第3期314-322,共9页东南大学学报（英文版）

基　　金：The National Natural Science Foundation of China(No.61372103);the Natural Science Foundation of Jiangsu Province(No.BK20201265);the Project of the National Engineering Research Center of Classified Protection and Safeguard Technology for Cyber Security(No.C21640-2)。

摘　　要：为了解决大多数现有的检测和防御方法只能检测已知的中毒攻击,而不能防御其他类型中毒攻击的问题,提出了一种带数据恢复的中毒攻击检测方案(PAD-DR),以有效地检测中毒攻击并恢复神经网络中中毒的数据.首先,该方案可以检测各种中毒攻击.将数据采样检测算法与神经网络中输入层节点的实时数据检测方法相结合,使系统能够确保训练数据的完整性和可用性,避免被更改或损坏.其次,该方案可以恢复中毒攻击中损坏或中毒的训练数据.将柯西-里德-所罗门(CRS)码技术应用于编码训练数据,并将其单独存储,一旦检测到中毒攻击并且导致数据受损,系统就可以从所有n个存储中的任何k个节点获取数据,以恢复原始的训练数据.最后,给出了PAD-DR方案的形式化证明,证明了该方案能够抵御中毒攻击、抵御临时伪造和篡改攻击,以及准确恢复数据.To address the issue that most existing detection and defense methods can only detect known poisoning attacks but cannot defend against other types of poisoning attacks,a poisoning attack detecting scheme with data recovery(PAD-DR)is proposed to effectively detect the poisoning attack and recover the poisoned data in a neural network.First,the PAD-DR scheme can detect all types of poisoning attacks.The data sampling detection algorithm is combined with a real-time data detection method for input layer nodes using a neural network so that the system can ensure the integrity and availability of the training data to avoid being changed or corrupted.Second,the PAD-DR scheme can recover corrupted or poisoned training data from poisoning attacks.Cauchy Reed-Solomon(CRS)code technology can encode training data and store them separately.Once the poisoning attack is detected,the original training data is recovered,and the system may get data from any k nodes from all n stores to recover the original training data.Finally,the security objectives of the PAD-DR scheme to withstand poisoning attacks,resist forgery and tampering attacks,and recover the data accurately are formally proved.

关 键 词：投毒攻击 神经网络 深度学习 数据完整性审计 

分 类 号：TP339[自动化与计算机技术—计算机系统结构]