When the Differences in Frequency Domain are Compensated: Understanding and Defeating Modulated Replay Attacks on Automatic Speech Recognition
When the Differences in Frequency Domain are Compensated: Understanding and Defeating Modulated Replay Attacks on Automatic Speech Recognition
复制标题
DOI：
10.1145/3372297.3417254
复制
发表时间：
2020-09
期刊：
影响因子：
--
通讯作者：
Shu Wang;Jiahao Cao;Xu He;Kun Sun;Qi Li
中科院分区：
文献类型：
--
作者：
Shu Wang;Jiahao Cao;Xu He;Kun Sun;Qi Li
自动语音识别（ASR）系统已广泛应用于现代智能设备中，以提供方便多样的语音控制服务。由于ASR系统很容易受到音频重放攻击，这些攻击可能会欺骗和误导ASR系统，因此已经提出了许多防御系统，以根据扬声器在频域的独特声学特征来识别重放的音频信号。本文揭示了一种新的重放攻击——调制重放攻击，它可以绕过现有的基于频域的防御系统。其基本思想是使用针对扬声器变换特性定制的逆滤波器来补偿给定电子扬声器的频率失真。我们在真实智能设备上的实验证实，调制重放攻击可以成功地逃避现有的依赖于识别频域可疑特征的检测机制。为了挫败调制重放攻击，我们设计并实现了一个名为DualGuard的对策。我们发现并正式证明，无论重放音频信号如何调制，重放攻击要么在时域留下振铃伪影，要么在频域造成频谱失真。因此，通过在频域和时域共同检测可疑特征，DualGuard可以成功检测各种重放攻击，包括调制重放攻击。我们在流行的语音交互平台ReSpeaker Core v2上实现了DualGuard~的原型。实验结果表明，DualGuard对调制重放攻击的检测准确率可达98%。
Automatic speech recognition (ASR) systems have been widely deployed in modern smart devices to provide convenient and diverse voice-controlled services. Since ASR systems are vulnerable to audio replay attacks that can spoof and mislead ASR systems, a number of defense systems have been proposed to identify replayed audio signals based on the speakers' unique acoustic features in the frequency domain. In this paper, we uncover a new type of replay attack called modulated replay attack, which can bypass the existing frequency domain based defense systems. The basic idea is to compensate for the frequency distortion of a given electronic speaker using an inverse filter that is customized to the speaker's transform characteristics. Our experiments on real smart devices confirm the modulated replay attacks can successfully escape the existing detection mechanisms that rely on identifying suspicious features in the frequency domain. To defeat modulated replay attacks, we design and implement a countermeasure named DualGuard. We discover and formally prove that no matter how the replay audio signals could be modulated, the replay attacks will either leave ringing artifacts in the time domain or cause spectrum distortion in the frequency domain. Therefore, by jointly checking suspicious features in both frequency and time domains, DualGuard~can successfully detect various replay attacks including the modulated replay attacks. We implement a prototype of DualGuard~on a popular voice interactive platform, ReSpeaker Core v2. The experimental results show DualGuard~can achieve 98% accuracy on detecting modulated replay attacks.