• <tr id="yyy80"></tr>
  • <sup id="yyy80"></sup>
  • <tfoot id="yyy80"><noscript id="yyy80"></noscript></tfoot>
  • 99热精品在线国产_美女午夜性视频免费_国产精品国产高清国产av_av欧美777_自拍偷自拍亚洲精品老妇_亚洲熟女精品中文字幕_www日本黄色视频网_国产精品野战在线观看 ?

    Deep Image Restoration Model:A Defense Method Against Adversarial Attacks

    2022-08-24 03:26:16KazimAliAdnanQureshiAhmadAlauddinBinArifinMuhammadShahidBhattiAbidSohailandRohailHassan
    Computers Materials&Continua 2022年5期

    Kazim Ali,Adnan N.Qureshi,Ahmad Alauddin Bin Arifin,Muhammad Shahid Bhatti,Abid Sohail and Rohail Hassan

    1Department of Information Technology,University of Central Punjab,Lahore,54000,Pakistan

    2Department of Communication Technology and Network,F(xiàn)aculty of Computer Science and Information Technology,University Putra Malaysia,Salengor,43400,Malaysia

    3Department of Computer Science,Comsats University Islamabad,Lahore Campus,54000,Pakistan

    4Othman Yeop Abdullah Graduate School of Business,University Utara Malaysia,Kuala Lumpur,50300,Malaysia

    Abstract: These days, deep learning and computer vision are much-growing fields in this modern world of information technology.Deep learning algorithms and computer vision have achieved great success in different applications like image classification,speech recognition,self-driving vehicles,disease diagnostics, and many more.Despite success in various applications, it is found that these learning algorithms face severe threats due to adversarial attacks.Adversarial examples are inputs like images in the computer vision field,which are intentionally slightly changed or perturbed.These changes are humanly imperceptible.But are misclassified by a model with high probability and severely affects the performance or prediction.In this scenario,we present a deep image restoration model that restores adversarial examples so that the target model is classified correctly again.We proved that our defense method against adversarial attacks based on a deep image restoration model is simple and state-of-the-art by providing strong experimental results evidence.We have used MNIST and CIFAR10 datasets for experiments and analysis of our defense method.In the end,we have compared our method to other state-ofthe-art defense methods and proved that our results are better than other rival methods.

    Keywords: Computer vision; deep learning; convolutional neural networks;adversarial examples;adversarial attacks;adversarial defenses

    1 Introduction

    When Artificial Neural Networks(ANNs)consists of more than one hidden layer,then it is called deep learning.Deep learning(DL)is the subfield of Machine Learning(ML),and ML is the subfield of Artificial Intelligence(AI).These deep learning models have gained tremendous success in object recognition,object detection,speech recognition,and drug discovery.Convolutional Neural Networks(CNNs)are state-of-the-art models for doing different tasks in the computer vision domain[1].The CNN is a deep learning model used in image processing and the computer vision field to do various tasks.These tasks are image classification,segmentation,object detection,object tracking,video classification,text classification,speech recognition,language translation,autonomous vehicles,robotics,network security, safety-critical system, face recognition, medical science, mobile applications, and other utilities[2].

    The adversarial examples are input images imperceptible by the human visual system.A human eye recognizes or classifies correctly without any hesitation,but a deep learning model like CNN can misclassify with high probability or confidence [3].It is required to take necessary actions against adversarial example attacks because deep learning algorithms are not only limited to the laboratory but are much used in real-world fields[4]such as image recognition,speech recognition,and medical diagnostic,etc.It is possible to attack deep learning models deployed in the physical world,and a model can capture incorrect data through sensors[5].In the presence of an adversarial example,it raises a big question of the robustness of deep learning models[6].Recent research shows that DL algorithms cannot give correct results due to adversarial attack [7].The researcher has gained great success in modern deep learning algorithms but is less concentrated on a robust and security perspective [8].There are currently two active research areas on adversarial attacks.The first concentrates on creating adversarial example attacks,and the second is on developing defense methods against these attacks.There is a similarity between these two groups of researchers [9].Szegedy et al.[10] presented the concept of adversarial examples for the first time in 2014 in their paper titled“intriguing properties of neural networks”.The authors stated and proved that adversarial examples are a significant threat to deep learning algorithm security,especially in the computer vision domain[10].

    In this work, we will propose a defense method to restore adversarial examples to get back the correct prediction of a deep learning model in the computer vision field.The paper is structured as follows.Section 1 presents the introduction of the research area.Section 2 contains the related work,which provides well-known adversarial example attacks and defense methods against these attacks.Section 3 presents our proposed deep-image restoration model that reconstructs adversarial examples to restore a model’s performance.Section 4 contains our experiments and results to prove that our proposed method works effectively and performs better when compared with the other state-of-theart defense methods.Sections 5 and 6 present the discussion and conclusion of this research work.

    Our main contributions can be summarized as follows:

    ·We present a novel method that recovers adversarial examples from the different types of adversarial attacks.

    ·We propose a deep image restoration model that eliminates the perturbation from adversarial examples to restore in almost original examples,and restored samples are classified correctly.

    ·Our method does not require changing the internal structure of the model like hidden layers,activation functions,and output layers to remove adversarial noise.We only need the original input image and its adversarial version to get the correct pattern again for classification,unlike the existing methods.

    ·Our method does not need any detector method to detect adversarial noise or adversarial attack because our method will start its work after a successful adversarial attack.A successful attack means the target model misclassifies the test images.

    ·Our baseline technique is cGAN ((Conditional Generative Adversarial Network)) defense which uses the power of cGAN to destroy the adversarial noise from the adversarial examples.

    Our proposed method is inspired by this but consisted of a simple structure and gives good results.

    2 Related Works

    This section consists of two subsections.The first section describes some well-known adversarial attack methods,and the second section has consisted of defense methods.

    2.1 Adversarial Attacks

    There are two types of adversarial attacks that create adversarial examples; (1) gradient-based attacks, in these attacks.The attacker has complete knowledge and access to the model, including structure and parameters, and (2) decision-based attacks, in these types of attacks; the attacker has only observed the output or decision of the underlying model.We will describe these two types of attacks and restore adversarial examples created due to these two types of adversarial attacks in the experiments section to restore the prediction accuracy of deep learning models.

    Fast Gradient Sign Method(FGSM)(gradient-based attack)[11],the adversarial example can be created from the original image in a single step through the following Eq.(1):

    wherexis the original image,signΔx.L(x,y)represents the sign of the gradient of the loss with respect tox,εis a small constant which controls the adversarial perturbation andx′is the adversarial example.

    Basic Iterative Method(BIM)(gradient-based attack)[12]is a variant of FGSM[11].BIM creates an adversarial example through the following Eq.(2):

    Herenrepresents iterations,αshows step size,and the Clip(.)function has clipped the values of pixel intensities in the range 0-255 in case of an 8-bit image.

    Projected Gradient Descent Attack(PGD)(gradient-based attack)[13],which is also an iterative method that crafts adversarial samples by using FGSM[11]on clean examplex0iteratively,which is created by adding a random noise of quantityαin the original imagex.After this, the adversarial example is projected on applicable limits.The projection is searched for the nearest matching sample from the original images, away from the boundary of the original sample.It is explained by the following Eq.(3):

    wherexi+1is the perturbed input at iterationi+1 andSdenotes the set of feasible perturbations forx.

    Deep Fool Attack(DFA)(gradient-based attack)[14]is a non-targeted attack that is based onl2norms.The adversarial examples are produced by the following Eq.(4):

    such that f(x+r)≠f(x)where r is a minimum perturbation.

    Carlini and Wanger Attack(CWA)(gradient-based attack)[15]develops three types of adversarial attacks based on thel1,l2,and l∞norms.These three attacks especially failed the defensive distillation network,which is a defensive method to increase deep learning algorithms’robustness.

    The Spatial Attack (SPA) (decision-based-attack) [16], a classifier is easily fooled using simple image processing techniques like transformation and rotation,and the input image slightly rotate or transforms so that the human visual system classifies it correctly.However, a model misclassified it with high confidence.

    2.2 Defense Methods

    There are mainly three types of adversarial defense methods in the current literature.First involves the preprocessing of the input data during learning or testing by a model.Second,the defense changes the internal structure of the model by modifying or adding, or dropping any layer in the model’s structure.Third,the defenses in which external models are used to destroy adversarial noise.

    In adversarial training defensive techniques [11], a model’s robustness is increased by adding adversarial examples in the training data and then retrains the model.After retraining the model on the adversarial examples,it will correctly classify the adversarial example to increase the model’s robustness.The objective function is given as follows:

    whereL(I,y)is the objective function,I′is the adversarial example of the original input I andαare constant whose purpose is to balance the cost value between original and adversarial images,which has a constant value of 0.5.

    Ensemble Adversarial Training (EAT) [17] is called a new version of the old AE method [11].The classifier is retraining on adversarial samples which are created for other existing classifiers.The combination of classifier and training adversarial examples prevents over-fitting problems in the old method.EAT approximates inner maximization because of adversarial samples’universal property,among other models.

    The Defensive Distillation Method [18] consists of two networks.The first neural network is called the student network, and the second neural network is called a teacher network.The teacher network uses the predicted labels of the first network as inputs and then approximates the first network,increasing the network’s robustness.However,this method fails to defend against CWA-based attacks[15].

    Mag-Net [19] is a defense method to increase a model’s robustness, consisting of two autoencoders.One is called the detector, and the other is called the reformer.Both auto encoders reconstruct the original input image.The detector is used to detect adversarial perturbation,and the reformer is used to remove that perturbation to increase the robustness of the deep neural network model.

    The defense GAN method [20] also consists of a generative model trained on clean images to remove adversarial noise.The Defense GAN uses the GAN model with Wasserstein’s loss.The GAN defense method tries to reconstruct the adversarial examples into clean examples used as an add-on.The result of reconstruction is fed to the classifier and aims to reduce adversarial perturbation.

    The conditional GAN-Defense method[21]uses the power of the conditional generative adversarial network,which is a variant of the classic generative adversarial network.This method tries to minimize the adversarial perturbation from adversarial examples and then fed reconstructed examples to the target classifier, aiming to restore the predicted accuracy of the underlying model.It is also our baseline technique but our proposed method has simple layers structure to remove adversarial perturbation from adversarial images and gives better results.

    3 Proposed Defensive Method

    This section will present our proposed defense method,which improves the robustness of CNN models against adversarial attacks,which we have already discussed in the related work Section 2.1.The overall structure of our defense mechanism is shown in Fig.1.

    Our proposed defense method has five phases as follows:

    Phase I:We will use the CNN models,e.g.,Mobile-Net and Dense-Net,for the cifar10 dataset;M1 and M2 models for the MNIST dataset, their structures are described in Tab.3; these are used as target models.These models are under the threat of adversarial attacks because CNNs are much weaker under the threat of adversarial attacks.Adversarial attacks decrease the performance of these models.Therefore,we will work towards the robustness of the CNN models against adversarial attacks,so that performance of the model is not degraded on the adversarial images.

    Phase II:In this phase,we intentionally apply our adversarial attacks box to create different types of adversarial samples.Our adversarial attack engine creates adversarial examples by using FGSM,BIM,PGD,DFA,CWA,and SPA methods discussed in the related work Section 2.1.

    Phase III:We feed our adversarial examples to our target CNN models.The models predict the wrong label of an adversarial image,e.g.,the output(soft-max)layer of the model predicts the label or class of the adversarial example seven is three,which is the wrong label.Its mean attack is successful and spoils the correct prediction of the target model.

    Phase IV:Now in this important phase;we will feed the adversarial examples created in phase III;into our proposed deep image restoration model which will be already trained to remove adversarial perturbation.For example,we feed adversarial example seven to the proposed restoration model and as a result,we get a reconstructed image that is clean and adversarial-free.

    Phase V:In the end, we will feed restored adversarial examples to our target models, which are generated in phase IV by using our proposed deep image restoration models, and then checks their prediction and observed that prediction is correct to measure and evaluate the effectiveness of our method.

    The structures of our proposed deep image restoration model for the datasets MNIST and cifar10 are shown in Tabs.1 and 2 respectively.

    Tabs.1 and 2 present the structures of our proposed deep image restoration model for datasets MNIST and CIFAR-10,respectively.There is a slight difference between the two structures due to the different dimensions of images of the two datasets,but the concept is the same.Our image restoration model is specific to remove adversarial noise from adversarial examples which are created due to the adversarial attacks.Our proposed model consists of two parts:encoder and decoder but works as a single network.The encoder part reduces the dimensionality of the adversarial images by learning the necessary features.Thus, when we are fed adversarial or perturbed example/image into the encoder,it only learns the critical and necessary information of the perturbed image.Since the encoder learns only the important and necessary information to represent the image,it learns that adversarial noise or perturbation is unwanted information and removes the representations of adversarial noise or perturbation from the learned features.Encoder learns 2048 features from the MNIST dataset and 4096 features from the cifar10 dataset shown in Tabs.1 and 2.Thus,now we will have learned features of the encoder,that is,a representation of the image without any adversarial noise information.When this learned representation of the encoder,the features or intensities,is fed to the decoder.The decoder restores the adversarial image into the clean image from the encodings produced by the encoder.Since the encodings have no noise,the restored image will not contain any adversarial noise.

    Figure 1:The overall structure of our proposed defense method.It contains five main phases;(a)Apply CNN as an image classifier,(b)Adversarial attack box to create different types of adversarial images,(c)Feed adversarial image to CNN model,(d)A deep image restoration model to restore adversarial examples into clean examples again and (e) Feed the restored adversarial examples/images to CNN model again

    Table 1:The structure of the proposed deep image restoration model to restore adversarial examples into clean or original examples for the MNIST dataset

    Our proposed model is different from the traditional auto-encoder model because the autoencoder loses low-level information [21].Therefore they cannot restore images corrupted by the adversarial attack.The proposed model performs two operations which are encoding and decoding as a single network.This design has several advantages.First, we do not require two networks like traditional auto-encoder and adversarial generative network(GAN),which significantly improves the computational complexity.Second, we do not use the max-pooling layer for the encoding process because it does not maintain low-level information,extracts high-level information,and reduces the dimension,which does not help decode operation.It is also not a trainable layer.Third,we use only the convolution layer for extracting both low-level and high-level information, which decreases the dimension in the encoding process, and it is also trainable.Finally, we also use the convolutiontranspose layer instead of the up-sampling layer in the decoding process because the convolutiontranspose layer works well in the decoding or restoration process due to its trainability nature and effectiveness adversarial examples with perturbation free like the original image.The visual results of the proposed restoration model of adversarial examples are shown in Figs.2 and 3 for the MNIST and CIFAR10 datasets,respectively.

    Table 2:The structure of the proposed deep image restoration model for the restoration of adversarial examples into clean or original examples for the CIFAR10 dataset

    Table 3:The structure of the target models M1 and M2 for the MNIST dataset

    Table 4:Success rate(%)of the Defense system on the MNIST dataset

    Figure 2:The first row shows the original images of the MNIST dataset, the second row shows the adversarial examples, and the third row represents the restored adversarial examples into original images

    4 Experiments and Results

    The datasets used in our experiments and evaluations are given by.

    4.1 MNIST

    The MNIST [22] dataset consisted of 70,000 handwritten digits from 0 to 9 grayscale images,60,000 images are used for training and 10,000 images are used for testing the model.The dimension of each image is 28×28×1.It is a simple dataset and used as a benchmark in computer vision for many years.

    4.2 CIFAR-10

    CIFAR-10[23]is considered an alternative standard benchmark dataset for image classification in the computer vision and machine learning literature.CIFAR-10 consists of 60,000 32×32×3(RGB)images resulting in a feature vector dimensionality of 3072.As the name suggests,CIFAR-10 consists of 10 classes,including airplanes,automobiles,birds,cats,deer,dogs,frogs,horses,ships,and trucks.

    4.3 Evaluation Metrics

    The performance or evaluation of the proposed method is measured through the following evaluation metrics:

    Figure 3:The first row shows the original images of the CIFAR10 dataset, the second row shows the adversarial examples,and the third row represents the restored adversarial examples into original images

    Figure 4:The success rate(%)of the defense system for the MNIST dataset on the target models M1 and M2

    Figure 5:The success rate (%) of the defense system for the CIFAR10 dataset on the target model DenseNet and MobileNet

    Figure 6:The transferability of the defense system on the MNIST dataset for LeNet and AlexNet models

    Figure 7:The transferability of the defense system on the CIFAR10 dataset for VGG19 and ResNet models

    4.4 Training CNN Models

    We will train four target models for the above two datasets,the structure of target models trained on the MNIST dataset as shown in Tab.3.We named these two target models M1 and M2.

    M1 has an accuracy of 99%,and M2 has 97.4%on the MNIST dataset.We have used pre-trained models Dense-Net[24]and Mobil-Net[25]for the CIFAR-10 dataset,which has also attained good accuracy of above 80%.CIFAR10 is a complex dataset, so it is challenging to give accuracy more remarkable than a simple dataset like MNIST.We create adversarial examples by using five adversarial attacks,namely,the FGSM,BIM,PGD,DFA,CWA,and SPA,from test set images correctly classified by our target models.CWA and DFA attacks are more robust than other attacks.Attacks robustness means they need small perturbation to create an adversarial example.However,our defense mechanism is performed well on all the above six types of attacks.Our defense system gives a high success rate on the MNIST dataset than the CIFAR-10 dataset, a complex dataset, but we also get a better success rate on the cifar10 dataset.Tab.4 and Fig.4 present the results of the proposed method for dataset MNIST.The results for the CIFAR10 dataset are described in Tab.5 and Fig.5.

    4.5 Transferability of Defense Method

    The transferability of defense mechanism means the performance of the defense system trained for target models, now test on other models that have no defense system.Therefore, we check the transferability of our proposed defense method on LeNet[26]and AlexNet[27]models for the MNIST dataset.Alternatively CIFAR10 dataset, we check transferability on pre-trained ResNet [28] and VGG19 [29] models.The results of the transferability of the defense system for models LeNet and AlexNet are given in Tab.6 and Fig.6.Also,results for models ResNet and VGG19 are presented in Tab.7 and Fig.7.

    4.6 Comparison with Other Defense Methods

    This section will present the comparison of our proposed defense method with the other wellknown and state-of-the-art defense methods.The comparison results are given in Tabs.8 and 9 for MNIST and CIFAR10 datasets,respectively.

    Table 5:Success rate(%)of the defense system on the CIFAR10 dataset

    Table 6:Transferability(%)of the defense system on MNIST dataset

    4.7 Comparative Analysis

    We have compared our proposed method with the other state-of-the-art methods such as adversarial training[11],MagNet[19],Defense-GAN[20],and cGan-Defence[21].The adversarial training uses the adversarial examples as part of the training data to make a model robust.The MagNet uses two auto-encoders; one is called a detector to detect adversarial noise, and the other is called a reformer to remove adversarial noise.The Dense-GAN and cDefesce-GAN also use two networks called generator and discriminator to restore adversarial examples.The results of comparative analysis are shown in Tabs.7 and 8.Our proposed defense method is better than the above method;(i)it gives better results,(ii)it restores adversarial examples created by more attacks,(iii)this method is simple because it uses a single network to restore adversarial images into clean images(iv)it gives better results on two datasets MNIST and cifar10(v)our method can be used for different datasets and adversarial attacks by slightly changing or updating its layer structure.

    Table 7:Transferability(%)of defence system on CIFAR10 dataset

    Table 8:Comparisons of success rate(%)with the other adversarial defence techniques on the MNIST dataset

    Table 9:Comparisons of success rate (%) with the other adversarial defense techniques on the CIFAR10 dataset

    5 Discussions

    In general,our proposed deep image restoration model,which is used as a defense method against adversarial attacks, gives promising results.It performs reasonably well on the MNIST dataset and achieving outstanding results on the MNIST dataset than the CIFAR10 dataset.This remarkable achievement is due to the complexity of the CIFAR10 dataset but attaining many convincing results.The exact reasons for adversarial attacks are not yet confirmed because different researchers have given different reasons for attacks.However,the common thing is that all adversarial attacks decrease the performance of a model.In our experiments, we see that CWA and PGD attacks are the most robust.Attack’s robustness means it needs small perturbation and has a significant negative effect on decreasing the accuracy by almost 0%.However,our method gives a high success rate against CWA and PGD attacks.

    Our deep image restoration model works in two steps.First, get the low and high-level features and remove the adversarial perturbation by encoding the features layer by layer.Second,we restore the clean image without perturbation with the help of features that we get during the encoding part.Our approach is somewhat different from the traditional auto-encoder model because the auto-encoder loses low-level information.Therefore they cannot restore images that are corrupted by the adversarial attack.

    Our proposed model performs two operations which are encoding and decoding as a single network.We do not use two networks like traditional auto-encoder and adversarial generative network(GAN)[30].Furthermore,we do not use the max-pooling layer for the encoding process because it only extracts high-level information,reduces the dimension,and does not maintain low-level information,which is not helpful in decoding operation.It is also not a trainable layer.Our method only uses the convolution layer to extract low-level, high-level information.It has the benefit to decrease the dimension in the encoding process, and it is also trainable.Similarly, we also used the convolutiontranspose layer.Instead of the up-sampling layer in the decoding process because the convolutiontranspose layer works effectively in the decoding or restoration process due to its trainability nature and restores adversarial examples with perturbation free like the original image as demonstrated by our results on the MNIST and CIFAR10 datasets(Figs.2 and 3).

    6 Conclusions

    In this research paper,we have proposed an easy defense method against adversarial attacks.Our defense method consists of an image restoration model responsible for removing adversarial noise from adversarial examples created due to different adversarial attacks.Our method improves the robustness of CNNs models.We have validated our defense method on MNIST and CIFAR10 datasets and prove that it gives promising results.We have also validated the transferability of the deep image restoration model on other models and restored the adversarial examples into clean examples created on these models due to adversarial attacks and restored successfully.After this,we have evaluated our method to other well-known defense methods and proved that our results are better than other techniques.

    Funding Statement:This research study is funding by University Putra Malaysia, Salengor, 43400,Malaysia.

    Conflicts of Interest:The authors claim no conflict of interest to report the present study.

    亚洲欧美一区二区三区国产| 亚洲精品日韩av片在线观看| 国产精品三级大全| 色播亚洲综合网| 一级黄片播放器| 国产成人a区在线观看| 国产黄片美女视频| 久久国产乱子免费精品| 我要看日韩黄色一级片| 久久精品久久久久久久性| 99久久精品一区二区三区| 国产熟女欧美一区二区| 97超视频在线观看视频| 99久国产av精品国产电影| 久久精品国产鲁丝片午夜精品| 国产一区二区三区综合在线观看 | 免费av不卡在线播放| 蜜臀久久99精品久久宅男| 一级a做视频免费观看| 免费观看的影片在线观看| 亚洲不卡免费看| 成人高潮视频无遮挡免费网站| 2021天堂中文幕一二区在线观| 夫妻午夜视频| 久久久久性生活片| av在线亚洲专区| 亚洲av中文av极速乱| 床上黄色一级片| 日本一二三区视频观看| av黄色大香蕉| 日本-黄色视频高清免费观看| 日韩精品有码人妻一区| 91精品伊人久久大香线蕉| 如何舔出高潮| 成年版毛片免费区| 国产成人91sexporn| 亚洲国产精品成人综合色| 免费看日本二区| 日日摸夜夜添夜夜添av毛片| 国产亚洲5aaaaa淫片| 成人特级av手机在线观看| 简卡轻食公司| 天堂av国产一区二区熟女人妻| 三级国产精品欧美在线观看| 最近最新中文字幕免费大全7| 久久午夜福利片| 国产91av在线免费观看| 国产精品1区2区在线观看.| 26uuu在线亚洲综合色| 亚洲精品久久午夜乱码| 国产精品久久久久久久久免| 天天一区二区日本电影三级| 欧美bdsm另类| 最后的刺客免费高清国语| 久久精品国产亚洲av天美| 99久久九九国产精品国产免费| 久久国产乱子免费精品| av国产久精品久网站免费入址| 久久精品国产亚洲av天美| .国产精品久久| 日韩不卡一区二区三区视频在线| 亚洲综合精品二区| 最近最新中文字幕大全电影3| 国产av码专区亚洲av| 高清日韩中文字幕在线| 亚洲国产色片| 国产又色又爽无遮挡免| 亚洲精品乱码久久久久久按摩| 精品久久国产蜜桃| 51国产日韩欧美| 成人午夜精彩视频在线观看| 亚洲成人精品中文字幕电影| 亚洲精品久久午夜乱码| 在线观看人妻少妇| 欧美精品一区二区大全| 国产精品日韩av在线免费观看| 亚洲欧美中文字幕日韩二区| 中文字幕久久专区| 亚洲真实伦在线观看| 乱人视频在线观看| 午夜精品国产一区二区电影 | 国产免费福利视频在线观看| 综合色av麻豆| 麻豆乱淫一区二区| 少妇熟女aⅴ在线视频| 在线观看一区二区三区| 国产精品久久视频播放| 国产探花在线观看一区二区| 国产三级在线视频| 最近中文字幕高清免费大全6| 亚洲人成网站在线播| 白带黄色成豆腐渣| 中文精品一卡2卡3卡4更新| 国产人妻一区二区三区在| 天堂av国产一区二区熟女人妻| 日产精品乱码卡一卡2卡三| 中国国产av一级| 91精品国产九色| 少妇熟女aⅴ在线视频| 日韩精品有码人妻一区| 亚洲四区av| 成人一区二区视频在线观看| 亚洲自拍偷在线| 欧美激情在线99| 极品少妇高潮喷水抽搐| 我的老师免费观看完整版| 爱豆传媒免费全集在线观看| 毛片一级片免费看久久久久| 国产精品国产三级国产专区5o| 秋霞伦理黄片| 国产毛片a区久久久久| 久久精品人妻少妇| 我的女老师完整版在线观看| 深爱激情五月婷婷| 麻豆av噜噜一区二区三区| 搞女人的毛片| 日韩大片免费观看网站| 精品一区二区三区视频在线| 日韩在线高清观看一区二区三区| 国产不卡一卡二| 午夜福利在线观看吧| 乱码一卡2卡4卡精品| 亚洲欧美一区二区三区黑人 | 白带黄色成豆腐渣| 亚洲av福利一区| 国产成人aa在线观看| 日韩在线高清观看一区二区三区| 免费av毛片视频| 午夜精品在线福利| 亚洲性久久影院| 久久精品久久久久久噜噜老黄| 久久午夜福利片| 中文字幕久久专区| 欧美bdsm另类| 亚洲人与动物交配视频| 免费无遮挡裸体视频| 九九久久精品国产亚洲av麻豆| 日本一二三区视频观看| 特级一级黄色大片| 亚洲怡红院男人天堂| 日韩亚洲欧美综合| 天天一区二区日本电影三级| 亚洲av成人av| 特大巨黑吊av在线直播| 欧美精品一区二区大全| 久久精品久久精品一区二区三区| 亚洲国产精品国产精品| 国内精品美女久久久久久| 搡老乐熟女国产| 中文字幕免费在线视频6| 全区人妻精品视频| av一本久久久久| 婷婷色av中文字幕| 亚洲第一区二区三区不卡| 久久久久久久午夜电影| 特大巨黑吊av在线直播| 两个人的视频大全免费| 欧美性猛交╳xxx乱大交人| 久久久久久久大尺度免费视频| 欧美日韩综合久久久久久| 又粗又硬又长又爽又黄的视频| 国产中年淑女户外野战色| 十八禁网站网址无遮挡 | 久久久精品免费免费高清| 国产精品福利在线免费观看| 久久国内精品自在自线图片| 久久久久久久久久成人| 美女黄网站色视频| 免费看av在线观看网站| 九九在线视频观看精品| 青青草视频在线视频观看| 日本三级黄在线观看| 国产免费福利视频在线观看| 女人十人毛片免费观看3o分钟| 最近最新中文字幕大全电影3| 亚洲av中文av极速乱| 卡戴珊不雅视频在线播放| 青春草视频在线免费观看| 精品人妻视频免费看| 精品久久久精品久久久| 国产伦一二天堂av在线观看| 日韩三级伦理在线观看| 久久人人爽人人片av| 久久久久国产网址| 国产精品爽爽va在线观看网站| 中文字幕制服av| 欧美三级亚洲精品| or卡值多少钱| 午夜精品一区二区三区免费看| 久久99精品国语久久久| 国产亚洲av嫩草精品影院| 久久久欧美国产精品| 日韩伦理黄色片| 国产精品嫩草影院av在线观看| 国产伦一二天堂av在线观看| 床上黄色一级片| 中文字幕制服av| 国产免费一级a男人的天堂| 免费看美女性在线毛片视频| 国产精品一二三区在线看| 国产伦一二天堂av在线观看| 中文字幕av成人在线电影| 国产一级毛片在线| 亚洲精品一二三| 亚洲欧美成人综合另类久久久| 国产人妻一区二区三区在| 国产一区二区三区综合在线观看 | 日韩欧美精品v在线| 美女内射精品一级片tv| 高清视频免费观看一区二区 | 国产精品人妻久久久久久| 日韩不卡一区二区三区视频在线| 亚洲欧美一区二区三区国产| 亚洲电影在线观看av| 国产精品日韩av在线免费观看| 熟妇人妻不卡中文字幕| 国产精品一区二区性色av| 少妇裸体淫交视频免费看高清| 乱码一卡2卡4卡精品| 亚洲乱码一区二区免费版| 免费观看的影片在线观看| 熟妇人妻久久中文字幕3abv| 亚洲精品色激情综合| 青春草国产在线视频| 你懂的网址亚洲精品在线观看| 乱人视频在线观看| 国产一区有黄有色的免费视频 | 久久精品夜色国产| 亚洲av日韩在线播放| 日本av手机在线免费观看| 青春草视频在线免费观看| 国产一区二区在线观看日韩| 天堂俺去俺来也www色官网 | 午夜福利视频1000在线观看| 伊人久久精品亚洲午夜| 一本—道久久a久久精品蜜桃钙片 精品乱码久久久久久99久播 | 黄片无遮挡物在线观看| 日韩强制内射视频| 亚洲精品第二区| 国产一区二区三区综合在线观看 | 婷婷色综合大香蕉| 99re6热这里在线精品视频| 日韩av在线免费看完整版不卡| 丰满人妻一区二区三区视频av| 18禁在线无遮挡免费观看视频| 高清在线视频一区二区三区| 在线天堂最新版资源| 777米奇影视久久| 国产精品一区www在线观看| 赤兔流量卡办理| 国产精品福利在线免费观看| 亚洲aⅴ乱码一区二区在线播放| 丝瓜视频免费看黄片| 色网站视频免费| 色吧在线观看| 亚洲av免费高清在线观看| 青春草视频在线免费观看| 午夜日本视频在线| 综合色丁香网| 熟妇人妻不卡中文字幕| 免费观看a级毛片全部| 亚洲欧美中文字幕日韩二区| 天堂中文最新版在线下载 | 毛片女人毛片| 国产精品一区二区在线观看99 | 久久久精品免费免费高清| 我的女老师完整版在线观看| 久久精品国产亚洲av天美| 2021天堂中文幕一二区在线观| 在线 av 中文字幕| 日本免费在线观看一区| 欧美zozozo另类| 欧美高清成人免费视频www| 五月玫瑰六月丁香| 男女那种视频在线观看| 免费av毛片视频| 欧美日韩亚洲高清精品| 亚洲精品日韩av片在线观看| 国产中年淑女户外野战色| 成年女人看的毛片在线观看| 欧美成人一区二区免费高清观看| 精品酒店卫生间| 美女xxoo啪啪120秒动态图| 青春草视频在线免费观看| 亚洲综合色惰| 尤物成人国产欧美一区二区三区| 3wmmmm亚洲av在线观看| 超碰97精品在线观看| av网站免费在线观看视频 | 成人高潮视频无遮挡免费网站| 综合色av麻豆| 成年女人在线观看亚洲视频 | 女人十人毛片免费观看3o分钟| 亚洲在线观看片| 国产精品无大码| 深爱激情五月婷婷| 嘟嘟电影网在线观看| 美女脱内裤让男人舔精品视频| 一边亲一边摸免费视频| 麻豆精品久久久久久蜜桃| 精品少妇黑人巨大在线播放| 99热网站在线观看| 国产精品美女特级片免费视频播放器| 国产成人freesex在线| 一本—道久久a久久精品蜜桃钙片 精品乱码久久久久久99久播 | 国产黄片视频在线免费观看| 日本三级黄在线观看| 亚洲精品亚洲一区二区| 18禁在线无遮挡免费观看视频| 欧美变态另类bdsm刘玥| 亚洲美女视频黄频| 非洲黑人性xxxx精品又粗又长| 人妻制服诱惑在线中文字幕| 一级毛片 在线播放| 99热全是精品| 麻豆成人av视频| 最新中文字幕久久久久| 久久97久久精品| 亚洲人成网站在线播| 亚洲欧美一区二区三区黑人 | 一级毛片电影观看| 91精品国产九色| 亚洲欧美精品自产自拍| 我要看日韩黄色一级片| 亚洲精品乱码久久久v下载方式| 身体一侧抽搐| 国产黄色小视频在线观看| 尤物成人国产欧美一区二区三区| 日韩av不卡免费在线播放| 色哟哟·www| 日韩 亚洲 欧美在线| 亚洲无线观看免费| 中文欧美无线码| 色尼玛亚洲综合影院| av.在线天堂| 久久久精品欧美日韩精品| 内地一区二区视频在线| 永久网站在线| 久久综合国产亚洲精品| 又爽又黄a免费视频| 免费高清在线观看视频在线观看| 美女内射精品一级片tv| a级一级毛片免费在线观看| av国产免费在线观看| 99久国产av精品国产电影| 日本熟妇午夜| 亚洲国产av新网站| 国产人妻一区二区三区在| 波多野结衣巨乳人妻| 蜜臀久久99精品久久宅男| av国产久精品久网站免费入址| 亚洲人成网站在线观看播放| 91久久精品国产一区二区三区| 日韩一区二区视频免费看| 床上黄色一级片| 啦啦啦韩国在线观看视频| 又粗又硬又长又爽又黄的视频| 国产日韩欧美在线精品| 国产黄a三级三级三级人| 国产免费又黄又爽又色| 色综合亚洲欧美另类图片| 亚洲精品第二区| 国产成人freesex在线| 99久久精品热视频| 久久久久精品性色| 久久久久免费精品人妻一区二区| 国产精品精品国产色婷婷| 秋霞伦理黄片| 精品一区在线观看国产| 18+在线观看网站| 一级毛片电影观看| 91狼人影院| 听说在线观看完整版免费高清| 91精品一卡2卡3卡4卡| 国产精品爽爽va在线观看网站| 国产精品麻豆人妻色哟哟久久 | 好男人视频免费观看在线| 老师上课跳d突然被开到最大视频| 亚洲av国产av综合av卡| 日韩 亚洲 欧美在线| 亚洲激情五月婷婷啪啪| 三级国产精品片| 国产精品国产三级专区第一集| 青春草国产在线视频| 人人妻人人澡欧美一区二区| 欧美3d第一页| 亚洲精品成人久久久久久| 久热久热在线精品观看| 26uuu在线亚洲综合色| 国产乱来视频区| 欧美日韩一区二区视频在线观看视频在线 | 狠狠精品人妻久久久久久综合| 亚洲熟女精品中文字幕| 99热这里只有精品一区| av免费在线看不卡| 成人一区二区视频在线观看| 国产高清国产精品国产三级 | 免费观看精品视频网站| 精品久久国产蜜桃| 久久久久免费精品人妻一区二区| 亚洲熟妇中文字幕五十中出| 干丝袜人妻中文字幕| 肉色欧美久久久久久久蜜桃 | 卡戴珊不雅视频在线播放| 一个人看的www免费观看视频| videossex国产| 精品国产一区二区三区久久久樱花 | 精品人妻偷拍中文字幕| 建设人人有责人人尽责人人享有的 | 色综合站精品国产| 欧美极品一区二区三区四区| 午夜福利网站1000一区二区三区| 在线观看美女被高潮喷水网站| 丝袜喷水一区| 男女啪啪激烈高潮av片| 成人无遮挡网站| 久久久久久久久久成人| 中文精品一卡2卡3卡4更新| 国产乱人偷精品视频| av免费观看日本| 狂野欧美白嫩少妇大欣赏| 人人妻人人澡人人爽人人夜夜 | 国产69精品久久久久777片| 亚洲精品aⅴ在线观看| 亚洲婷婷狠狠爱综合网| 欧美激情国产日韩精品一区| 一边亲一边摸免费视频| videos熟女内射| 五月伊人婷婷丁香| 免费在线观看成人毛片| 日本免费在线观看一区| 我要看日韩黄色一级片| 免费黄网站久久成人精品| 男人舔奶头视频| 国产乱人视频| 成人无遮挡网站| 亚洲欧美日韩东京热| 国产av不卡久久| av线在线观看网站| 日日啪夜夜撸| 国产精品一区www在线观看| 午夜日本视频在线| 午夜福利成人在线免费观看| 亚洲综合色惰| 国产伦精品一区二区三区四那| 一级二级三级毛片免费看| 搞女人的毛片| 插阴视频在线观看视频| 国产乱人视频| 欧美日韩亚洲高清精品| 日韩欧美三级三区| 午夜免费男女啪啪视频观看| 色哟哟·www| 国产精品麻豆人妻色哟哟久久 | 狂野欧美白嫩少妇大欣赏| 你懂的网址亚洲精品在线观看| 精品久久久久久久末码| 两个人的视频大全免费| 又爽又黄无遮挡网站| 亚洲国产av新网站| av专区在线播放| 欧美日韩视频高清一区二区三区二| 看十八女毛片水多多多| 国产淫片久久久久久久久| 国产三级在线视频| 日日啪夜夜爽| 国国产精品蜜臀av免费| 黄色配什么色好看| 国产精品久久视频播放| 99久久九九国产精品国产免费| 国产精品爽爽va在线观看网站| 亚洲av成人精品一区久久| 久久精品国产自在天天线| 少妇熟女欧美另类| 亚洲自拍偷在线| 直男gayav资源| 日韩av免费高清视频| 伦精品一区二区三区| 18禁在线无遮挡免费观看视频| 1000部很黄的大片| 国产精品伦人一区二区| 亚洲一级一片aⅴ在线观看| 亚洲人成网站在线观看播放| 在线观看免费高清a一片| 国产免费福利视频在线观看| 成人鲁丝片一二三区免费| 国产三级在线视频| 免费黄色在线免费观看| 成人毛片60女人毛片免费| 97热精品久久久久久| 岛国毛片在线播放| 一个人免费在线观看电影| av在线亚洲专区| 99九九线精品视频在线观看视频| 成人欧美大片| 精品午夜福利在线看| 成人美女网站在线观看视频| 卡戴珊不雅视频在线播放| 国产伦在线观看视频一区| 有码 亚洲区| 99热这里只有是精品50| 高清日韩中文字幕在线| 老女人水多毛片| 亚洲精品国产成人久久av| 成年版毛片免费区| 水蜜桃什么品种好| 美女大奶头视频| 国产大屁股一区二区在线视频| 国产亚洲最大av| 一个人看的www免费观看视频| 成人av在线播放网站| 亚洲欧美日韩无卡精品| 99热这里只有是精品50| 一个人免费在线观看电影| 免费av不卡在线播放| videossex国产| 色网站视频免费| 六月丁香七月| 大香蕉久久网| av在线播放精品| 少妇高潮的动态图| 免费观看的影片在线观看| 日本与韩国留学比较| 国产综合懂色| 最近视频中文字幕2019在线8| 三级经典国产精品| 51国产日韩欧美| 日本wwww免费看| 亚洲人成网站在线观看播放| 午夜福利在线观看吧| 午夜日本视频在线| 精品人妻一区二区三区麻豆| 听说在线观看完整版免费高清| 精品国产一区二区三区久久久樱花 | 亚洲成人久久爱视频| 亚洲激情五月婷婷啪啪| 国产精品一二三区在线看| 七月丁香在线播放| 国产伦在线观看视频一区| 美女cb高潮喷水在线观看| 日韩欧美精品v在线| 免费少妇av软件| 日本av手机在线免费观看| 三级国产精品欧美在线观看| 亚洲国产成人一精品久久久| 国产精品三级大全| 免费av不卡在线播放| 免费在线观看成人毛片| 美女黄网站色视频| 日韩国内少妇激情av| 亚洲综合精品二区| 三级国产精品欧美在线观看| 精品欧美国产一区二区三| 国产免费福利视频在线观看| 大香蕉97超碰在线| 免费观看在线日韩| 久久久久精品性色| 日韩不卡一区二区三区视频在线| 久久久久久久久中文| 最后的刺客免费高清国语| 亚洲乱码一区二区免费版| 成人美女网站在线观看视频| 久久6这里有精品| 日韩av不卡免费在线播放| 日日啪夜夜爽| 国产综合精华液| 人妻夜夜爽99麻豆av| 精品久久久久久成人av| 国产视频首页在线观看| 夜夜看夜夜爽夜夜摸| 久热久热在线精品观看| 国产精品一及| 精品国内亚洲2022精品成人| 久久精品综合一区二区三区| 国产激情偷乱视频一区二区| 国产成人福利小说| 中文字幕av在线有码专区| 免费看美女性在线毛片视频| 国产一区二区三区综合在线观看 | 久久精品国产亚洲av涩爱| 久久午夜福利片| 纵有疾风起免费观看全集完整版 | 亚洲欧美一区二区三区黑人 | 免费观看无遮挡的男女| av天堂中文字幕网| 好男人在线观看高清免费视频| 亚洲精品自拍成人| 极品教师在线视频| 日韩制服骚丝袜av| 黄色欧美视频在线观看| 精品一区在线观看国产| 久久久久久久久久人人人人人人| 免费看av在线观看网站| 精品久久国产蜜桃| 色综合色国产| 国产亚洲av嫩草精品影院| 久久精品人妻少妇| 久久精品久久久久久久性| 五月伊人婷婷丁香| 亚洲不卡免费看| 亚洲精品乱久久久久久| 国产在线男女| 91久久精品国产一区二区成人| 汤姆久久久久久久影院中文字幕 | 亚洲av成人精品一二三区| 欧美高清成人免费视频www| 国产精品熟女久久久久浪| 久久这里只有精品中国| 高清视频免费观看一区二区 | 国产不卡一卡二| 日韩在线高清观看一区二区三区| 亚洲av免费高清在线观看| 久久这里只有精品中国| 国产精品99久久久久久久久| 亚洲av免费高清在线观看|