基于贝叶斯-斯坦科尔伯格博弈的DNN动态防御方法

DNN DYNAMIC DEFENSE METHOD BASED ON BAYESIAN STACKELBERG GAME

基于梯度攻击对图像进行修改,可造成基于神经网络的分类技术的精确度降低10%左右,针对这一问题,提出利用网络空间领域里移动目标防御思想来增加神经网络对抗该类攻击的鲁棒性。定义整体网络集的“区别免疫”概念,将网络中防御方和用户之间的交互模拟为一个重复贝叶斯-斯坦科尔伯格博弈过程。基于此从该组网络集中挑选出一个受训练的网络对输入图像进行分类。该防御方法能减少MNIST数据库中受干扰图像的分类错误,同时对于正常的测试图像保持较高的分类精度。该方法可以与现有的防御机制结合使用,确保神经网络安全性。

Gradient-based attack can reduce the accuracy of classification technology based on neural network by about 10%by modifying the image.To solve the problem,the idea of moving target defense in cyberspace is used to enhance the robustness of neural network against such attacks.The concept of“differential immunity”of the whole network set was defined,and the interaction between the defender and the user in the network was simulated as a repeated Bayesian Stackelberg games process.Based on this process,a trained network was selected from this set of networks to classify the input images.The defense method can reduce the classification errors of interfered images in MNIST database,and maintain high classification accuracy for normal test images.The method can also be combined with existing defense mechanism to ensure the security of neural networks.