• <tr id="yyy80"></tr>
  • <sup id="yyy80"></sup>
  • <tfoot id="yyy80"><noscript id="yyy80"></noscript></tfoot>
  • 99热精品在线国产_美女午夜性视频免费_国产精品国产高清国产av_av欧美777_自拍偷自拍亚洲精品老妇_亚洲熟女精品中文字幕_www日本黄色视频网_国产精品野战在线观看 ?

    Deep Image Restoration Model:A Defense Method Against Adversarial Attacks

    2022-08-24 03:26:16KazimAliAdnanQureshiAhmadAlauddinBinArifinMuhammadShahidBhattiAbidSohailandRohailHassan
    Computers Materials&Continua 2022年5期

    Kazim Ali,Adnan N.Qureshi,Ahmad Alauddin Bin Arifin,Muhammad Shahid Bhatti,Abid Sohail and Rohail Hassan

    1Department of Information Technology,University of Central Punjab,Lahore,54000,Pakistan

    2Department of Communication Technology and Network,F(xiàn)aculty of Computer Science and Information Technology,University Putra Malaysia,Salengor,43400,Malaysia

    3Department of Computer Science,Comsats University Islamabad,Lahore Campus,54000,Pakistan

    4Othman Yeop Abdullah Graduate School of Business,University Utara Malaysia,Kuala Lumpur,50300,Malaysia

    Abstract: These days, deep learning and computer vision are much-growing fields in this modern world of information technology.Deep learning algorithms and computer vision have achieved great success in different applications like image classification,speech recognition,self-driving vehicles,disease diagnostics, and many more.Despite success in various applications, it is found that these learning algorithms face severe threats due to adversarial attacks.Adversarial examples are inputs like images in the computer vision field,which are intentionally slightly changed or perturbed.These changes are humanly imperceptible.But are misclassified by a model with high probability and severely affects the performance or prediction.In this scenario,we present a deep image restoration model that restores adversarial examples so that the target model is classified correctly again.We proved that our defense method against adversarial attacks based on a deep image restoration model is simple and state-of-the-art by providing strong experimental results evidence.We have used MNIST and CIFAR10 datasets for experiments and analysis of our defense method.In the end,we have compared our method to other state-ofthe-art defense methods and proved that our results are better than other rival methods.

    Keywords: Computer vision; deep learning; convolutional neural networks;adversarial examples;adversarial attacks;adversarial defenses

    1 Introduction

    When Artificial Neural Networks(ANNs)consists of more than one hidden layer,then it is called deep learning.Deep learning(DL)is the subfield of Machine Learning(ML),and ML is the subfield of Artificial Intelligence(AI).These deep learning models have gained tremendous success in object recognition,object detection,speech recognition,and drug discovery.Convolutional Neural Networks(CNNs)are state-of-the-art models for doing different tasks in the computer vision domain[1].The CNN is a deep learning model used in image processing and the computer vision field to do various tasks.These tasks are image classification,segmentation,object detection,object tracking,video classification,text classification,speech recognition,language translation,autonomous vehicles,robotics,network security, safety-critical system, face recognition, medical science, mobile applications, and other utilities[2].

    The adversarial examples are input images imperceptible by the human visual system.A human eye recognizes or classifies correctly without any hesitation,but a deep learning model like CNN can misclassify with high probability or confidence [3].It is required to take necessary actions against adversarial example attacks because deep learning algorithms are not only limited to the laboratory but are much used in real-world fields[4]such as image recognition,speech recognition,and medical diagnostic,etc.It is possible to attack deep learning models deployed in the physical world,and a model can capture incorrect data through sensors[5].In the presence of an adversarial example,it raises a big question of the robustness of deep learning models[6].Recent research shows that DL algorithms cannot give correct results due to adversarial attack [7].The researcher has gained great success in modern deep learning algorithms but is less concentrated on a robust and security perspective [8].There are currently two active research areas on adversarial attacks.The first concentrates on creating adversarial example attacks,and the second is on developing defense methods against these attacks.There is a similarity between these two groups of researchers [9].Szegedy et al.[10] presented the concept of adversarial examples for the first time in 2014 in their paper titled“intriguing properties of neural networks”.The authors stated and proved that adversarial examples are a significant threat to deep learning algorithm security,especially in the computer vision domain[10].

    In this work, we will propose a defense method to restore adversarial examples to get back the correct prediction of a deep learning model in the computer vision field.The paper is structured as follows.Section 1 presents the introduction of the research area.Section 2 contains the related work,which provides well-known adversarial example attacks and defense methods against these attacks.Section 3 presents our proposed deep-image restoration model that reconstructs adversarial examples to restore a model’s performance.Section 4 contains our experiments and results to prove that our proposed method works effectively and performs better when compared with the other state-of-theart defense methods.Sections 5 and 6 present the discussion and conclusion of this research work.

    Our main contributions can be summarized as follows:

    ·We present a novel method that recovers adversarial examples from the different types of adversarial attacks.

    ·We propose a deep image restoration model that eliminates the perturbation from adversarial examples to restore in almost original examples,and restored samples are classified correctly.

    ·Our method does not require changing the internal structure of the model like hidden layers,activation functions,and output layers to remove adversarial noise.We only need the original input image and its adversarial version to get the correct pattern again for classification,unlike the existing methods.

    ·Our method does not need any detector method to detect adversarial noise or adversarial attack because our method will start its work after a successful adversarial attack.A successful attack means the target model misclassifies the test images.

    ·Our baseline technique is cGAN ((Conditional Generative Adversarial Network)) defense which uses the power of cGAN to destroy the adversarial noise from the adversarial examples.

    Our proposed method is inspired by this but consisted of a simple structure and gives good results.

    2 Related Works

    This section consists of two subsections.The first section describes some well-known adversarial attack methods,and the second section has consisted of defense methods.

    2.1 Adversarial Attacks

    There are two types of adversarial attacks that create adversarial examples; (1) gradient-based attacks, in these attacks.The attacker has complete knowledge and access to the model, including structure and parameters, and (2) decision-based attacks, in these types of attacks; the attacker has only observed the output or decision of the underlying model.We will describe these two types of attacks and restore adversarial examples created due to these two types of adversarial attacks in the experiments section to restore the prediction accuracy of deep learning models.

    Fast Gradient Sign Method(FGSM)(gradient-based attack)[11],the adversarial example can be created from the original image in a single step through the following Eq.(1):

    wherexis the original image,signΔx.L(x,y)represents the sign of the gradient of the loss with respect tox,εis a small constant which controls the adversarial perturbation andx′is the adversarial example.

    Basic Iterative Method(BIM)(gradient-based attack)[12]is a variant of FGSM[11].BIM creates an adversarial example through the following Eq.(2):

    Herenrepresents iterations,αshows step size,and the Clip(.)function has clipped the values of pixel intensities in the range 0-255 in case of an 8-bit image.

    Projected Gradient Descent Attack(PGD)(gradient-based attack)[13],which is also an iterative method that crafts adversarial samples by using FGSM[11]on clean examplex0iteratively,which is created by adding a random noise of quantityαin the original imagex.After this, the adversarial example is projected on applicable limits.The projection is searched for the nearest matching sample from the original images, away from the boundary of the original sample.It is explained by the following Eq.(3):

    wherexi+1is the perturbed input at iterationi+1 andSdenotes the set of feasible perturbations forx.

    Deep Fool Attack(DFA)(gradient-based attack)[14]is a non-targeted attack that is based onl2norms.The adversarial examples are produced by the following Eq.(4):

    such that f(x+r)≠f(x)where r is a minimum perturbation.

    Carlini and Wanger Attack(CWA)(gradient-based attack)[15]develops three types of adversarial attacks based on thel1,l2,and l∞norms.These three attacks especially failed the defensive distillation network,which is a defensive method to increase deep learning algorithms’robustness.

    The Spatial Attack (SPA) (decision-based-attack) [16], a classifier is easily fooled using simple image processing techniques like transformation and rotation,and the input image slightly rotate or transforms so that the human visual system classifies it correctly.However, a model misclassified it with high confidence.

    2.2 Defense Methods

    There are mainly three types of adversarial defense methods in the current literature.First involves the preprocessing of the input data during learning or testing by a model.Second,the defense changes the internal structure of the model by modifying or adding, or dropping any layer in the model’s structure.Third,the defenses in which external models are used to destroy adversarial noise.

    In adversarial training defensive techniques [11], a model’s robustness is increased by adding adversarial examples in the training data and then retrains the model.After retraining the model on the adversarial examples,it will correctly classify the adversarial example to increase the model’s robustness.The objective function is given as follows:

    whereL(I,y)is the objective function,I′is the adversarial example of the original input I andαare constant whose purpose is to balance the cost value between original and adversarial images,which has a constant value of 0.5.

    Ensemble Adversarial Training (EAT) [17] is called a new version of the old AE method [11].The classifier is retraining on adversarial samples which are created for other existing classifiers.The combination of classifier and training adversarial examples prevents over-fitting problems in the old method.EAT approximates inner maximization because of adversarial samples’universal property,among other models.

    The Defensive Distillation Method [18] consists of two networks.The first neural network is called the student network, and the second neural network is called a teacher network.The teacher network uses the predicted labels of the first network as inputs and then approximates the first network,increasing the network’s robustness.However,this method fails to defend against CWA-based attacks[15].

    Mag-Net [19] is a defense method to increase a model’s robustness, consisting of two autoencoders.One is called the detector, and the other is called the reformer.Both auto encoders reconstruct the original input image.The detector is used to detect adversarial perturbation,and the reformer is used to remove that perturbation to increase the robustness of the deep neural network model.

    The defense GAN method [20] also consists of a generative model trained on clean images to remove adversarial noise.The Defense GAN uses the GAN model with Wasserstein’s loss.The GAN defense method tries to reconstruct the adversarial examples into clean examples used as an add-on.The result of reconstruction is fed to the classifier and aims to reduce adversarial perturbation.

    The conditional GAN-Defense method[21]uses the power of the conditional generative adversarial network,which is a variant of the classic generative adversarial network.This method tries to minimize the adversarial perturbation from adversarial examples and then fed reconstructed examples to the target classifier, aiming to restore the predicted accuracy of the underlying model.It is also our baseline technique but our proposed method has simple layers structure to remove adversarial perturbation from adversarial images and gives better results.

    3 Proposed Defensive Method

    This section will present our proposed defense method,which improves the robustness of CNN models against adversarial attacks,which we have already discussed in the related work Section 2.1.The overall structure of our defense mechanism is shown in Fig.1.

    Our proposed defense method has five phases as follows:

    Phase I:We will use the CNN models,e.g.,Mobile-Net and Dense-Net,for the cifar10 dataset;M1 and M2 models for the MNIST dataset, their structures are described in Tab.3; these are used as target models.These models are under the threat of adversarial attacks because CNNs are much weaker under the threat of adversarial attacks.Adversarial attacks decrease the performance of these models.Therefore,we will work towards the robustness of the CNN models against adversarial attacks,so that performance of the model is not degraded on the adversarial images.

    Phase II:In this phase,we intentionally apply our adversarial attacks box to create different types of adversarial samples.Our adversarial attack engine creates adversarial examples by using FGSM,BIM,PGD,DFA,CWA,and SPA methods discussed in the related work Section 2.1.

    Phase III:We feed our adversarial examples to our target CNN models.The models predict the wrong label of an adversarial image,e.g.,the output(soft-max)layer of the model predicts the label or class of the adversarial example seven is three,which is the wrong label.Its mean attack is successful and spoils the correct prediction of the target model.

    Phase IV:Now in this important phase;we will feed the adversarial examples created in phase III;into our proposed deep image restoration model which will be already trained to remove adversarial perturbation.For example,we feed adversarial example seven to the proposed restoration model and as a result,we get a reconstructed image that is clean and adversarial-free.

    Phase V:In the end, we will feed restored adversarial examples to our target models, which are generated in phase IV by using our proposed deep image restoration models, and then checks their prediction and observed that prediction is correct to measure and evaluate the effectiveness of our method.

    The structures of our proposed deep image restoration model for the datasets MNIST and cifar10 are shown in Tabs.1 and 2 respectively.

    Tabs.1 and 2 present the structures of our proposed deep image restoration model for datasets MNIST and CIFAR-10,respectively.There is a slight difference between the two structures due to the different dimensions of images of the two datasets,but the concept is the same.Our image restoration model is specific to remove adversarial noise from adversarial examples which are created due to the adversarial attacks.Our proposed model consists of two parts:encoder and decoder but works as a single network.The encoder part reduces the dimensionality of the adversarial images by learning the necessary features.Thus, when we are fed adversarial or perturbed example/image into the encoder,it only learns the critical and necessary information of the perturbed image.Since the encoder learns only the important and necessary information to represent the image,it learns that adversarial noise or perturbation is unwanted information and removes the representations of adversarial noise or perturbation from the learned features.Encoder learns 2048 features from the MNIST dataset and 4096 features from the cifar10 dataset shown in Tabs.1 and 2.Thus,now we will have learned features of the encoder,that is,a representation of the image without any adversarial noise information.When this learned representation of the encoder,the features or intensities,is fed to the decoder.The decoder restores the adversarial image into the clean image from the encodings produced by the encoder.Since the encodings have no noise,the restored image will not contain any adversarial noise.

    Figure 1:The overall structure of our proposed defense method.It contains five main phases;(a)Apply CNN as an image classifier,(b)Adversarial attack box to create different types of adversarial images,(c)Feed adversarial image to CNN model,(d)A deep image restoration model to restore adversarial examples into clean examples again and (e) Feed the restored adversarial examples/images to CNN model again

    Table 1:The structure of the proposed deep image restoration model to restore adversarial examples into clean or original examples for the MNIST dataset

    Our proposed model is different from the traditional auto-encoder model because the autoencoder loses low-level information [21].Therefore they cannot restore images corrupted by the adversarial attack.The proposed model performs two operations which are encoding and decoding as a single network.This design has several advantages.First, we do not require two networks like traditional auto-encoder and adversarial generative network(GAN),which significantly improves the computational complexity.Second, we do not use the max-pooling layer for the encoding process because it does not maintain low-level information,extracts high-level information,and reduces the dimension,which does not help decode operation.It is also not a trainable layer.Third,we use only the convolution layer for extracting both low-level and high-level information, which decreases the dimension in the encoding process, and it is also trainable.Finally, we also use the convolutiontranspose layer instead of the up-sampling layer in the decoding process because the convolutiontranspose layer works well in the decoding or restoration process due to its trainability nature and effectiveness adversarial examples with perturbation free like the original image.The visual results of the proposed restoration model of adversarial examples are shown in Figs.2 and 3 for the MNIST and CIFAR10 datasets,respectively.

    Table 2:The structure of the proposed deep image restoration model for the restoration of adversarial examples into clean or original examples for the CIFAR10 dataset

    Table 3:The structure of the target models M1 and M2 for the MNIST dataset

    Table 4:Success rate(%)of the Defense system on the MNIST dataset

    Figure 2:The first row shows the original images of the MNIST dataset, the second row shows the adversarial examples, and the third row represents the restored adversarial examples into original images

    4 Experiments and Results

    The datasets used in our experiments and evaluations are given by.

    4.1 MNIST

    The MNIST [22] dataset consisted of 70,000 handwritten digits from 0 to 9 grayscale images,60,000 images are used for training and 10,000 images are used for testing the model.The dimension of each image is 28×28×1.It is a simple dataset and used as a benchmark in computer vision for many years.

    4.2 CIFAR-10

    CIFAR-10[23]is considered an alternative standard benchmark dataset for image classification in the computer vision and machine learning literature.CIFAR-10 consists of 60,000 32×32×3(RGB)images resulting in a feature vector dimensionality of 3072.As the name suggests,CIFAR-10 consists of 10 classes,including airplanes,automobiles,birds,cats,deer,dogs,frogs,horses,ships,and trucks.

    4.3 Evaluation Metrics

    The performance or evaluation of the proposed method is measured through the following evaluation metrics:

    Figure 3:The first row shows the original images of the CIFAR10 dataset, the second row shows the adversarial examples,and the third row represents the restored adversarial examples into original images

    Figure 4:The success rate(%)of the defense system for the MNIST dataset on the target models M1 and M2

    Figure 5:The success rate (%) of the defense system for the CIFAR10 dataset on the target model DenseNet and MobileNet

    Figure 6:The transferability of the defense system on the MNIST dataset for LeNet and AlexNet models

    Figure 7:The transferability of the defense system on the CIFAR10 dataset for VGG19 and ResNet models

    4.4 Training CNN Models

    We will train four target models for the above two datasets,the structure of target models trained on the MNIST dataset as shown in Tab.3.We named these two target models M1 and M2.

    M1 has an accuracy of 99%,and M2 has 97.4%on the MNIST dataset.We have used pre-trained models Dense-Net[24]and Mobil-Net[25]for the CIFAR-10 dataset,which has also attained good accuracy of above 80%.CIFAR10 is a complex dataset, so it is challenging to give accuracy more remarkable than a simple dataset like MNIST.We create adversarial examples by using five adversarial attacks,namely,the FGSM,BIM,PGD,DFA,CWA,and SPA,from test set images correctly classified by our target models.CWA and DFA attacks are more robust than other attacks.Attacks robustness means they need small perturbation to create an adversarial example.However,our defense mechanism is performed well on all the above six types of attacks.Our defense system gives a high success rate on the MNIST dataset than the CIFAR-10 dataset, a complex dataset, but we also get a better success rate on the cifar10 dataset.Tab.4 and Fig.4 present the results of the proposed method for dataset MNIST.The results for the CIFAR10 dataset are described in Tab.5 and Fig.5.

    4.5 Transferability of Defense Method

    The transferability of defense mechanism means the performance of the defense system trained for target models, now test on other models that have no defense system.Therefore, we check the transferability of our proposed defense method on LeNet[26]and AlexNet[27]models for the MNIST dataset.Alternatively CIFAR10 dataset, we check transferability on pre-trained ResNet [28] and VGG19 [29] models.The results of the transferability of the defense system for models LeNet and AlexNet are given in Tab.6 and Fig.6.Also,results for models ResNet and VGG19 are presented in Tab.7 and Fig.7.

    4.6 Comparison with Other Defense Methods

    This section will present the comparison of our proposed defense method with the other wellknown and state-of-the-art defense methods.The comparison results are given in Tabs.8 and 9 for MNIST and CIFAR10 datasets,respectively.

    Table 5:Success rate(%)of the defense system on the CIFAR10 dataset

    Table 6:Transferability(%)of the defense system on MNIST dataset

    4.7 Comparative Analysis

    We have compared our proposed method with the other state-of-the-art methods such as adversarial training[11],MagNet[19],Defense-GAN[20],and cGan-Defence[21].The adversarial training uses the adversarial examples as part of the training data to make a model robust.The MagNet uses two auto-encoders; one is called a detector to detect adversarial noise, and the other is called a reformer to remove adversarial noise.The Dense-GAN and cDefesce-GAN also use two networks called generator and discriminator to restore adversarial examples.The results of comparative analysis are shown in Tabs.7 and 8.Our proposed defense method is better than the above method;(i)it gives better results,(ii)it restores adversarial examples created by more attacks,(iii)this method is simple because it uses a single network to restore adversarial images into clean images(iv)it gives better results on two datasets MNIST and cifar10(v)our method can be used for different datasets and adversarial attacks by slightly changing or updating its layer structure.

    Table 7:Transferability(%)of defence system on CIFAR10 dataset

    Table 8:Comparisons of success rate(%)with the other adversarial defence techniques on the MNIST dataset

    Table 9:Comparisons of success rate (%) with the other adversarial defense techniques on the CIFAR10 dataset

    5 Discussions

    In general,our proposed deep image restoration model,which is used as a defense method against adversarial attacks, gives promising results.It performs reasonably well on the MNIST dataset and achieving outstanding results on the MNIST dataset than the CIFAR10 dataset.This remarkable achievement is due to the complexity of the CIFAR10 dataset but attaining many convincing results.The exact reasons for adversarial attacks are not yet confirmed because different researchers have given different reasons for attacks.However,the common thing is that all adversarial attacks decrease the performance of a model.In our experiments, we see that CWA and PGD attacks are the most robust.Attack’s robustness means it needs small perturbation and has a significant negative effect on decreasing the accuracy by almost 0%.However,our method gives a high success rate against CWA and PGD attacks.

    Our deep image restoration model works in two steps.First, get the low and high-level features and remove the adversarial perturbation by encoding the features layer by layer.Second,we restore the clean image without perturbation with the help of features that we get during the encoding part.Our approach is somewhat different from the traditional auto-encoder model because the auto-encoder loses low-level information.Therefore they cannot restore images that are corrupted by the adversarial attack.

    Our proposed model performs two operations which are encoding and decoding as a single network.We do not use two networks like traditional auto-encoder and adversarial generative network(GAN)[30].Furthermore,we do not use the max-pooling layer for the encoding process because it only extracts high-level information,reduces the dimension,and does not maintain low-level information,which is not helpful in decoding operation.It is also not a trainable layer.Our method only uses the convolution layer to extract low-level, high-level information.It has the benefit to decrease the dimension in the encoding process, and it is also trainable.Similarly, we also used the convolutiontranspose layer.Instead of the up-sampling layer in the decoding process because the convolutiontranspose layer works effectively in the decoding or restoration process due to its trainability nature and restores adversarial examples with perturbation free like the original image as demonstrated by our results on the MNIST and CIFAR10 datasets(Figs.2 and 3).

    6 Conclusions

    In this research paper,we have proposed an easy defense method against adversarial attacks.Our defense method consists of an image restoration model responsible for removing adversarial noise from adversarial examples created due to different adversarial attacks.Our method improves the robustness of CNNs models.We have validated our defense method on MNIST and CIFAR10 datasets and prove that it gives promising results.We have also validated the transferability of the deep image restoration model on other models and restored the adversarial examples into clean examples created on these models due to adversarial attacks and restored successfully.After this,we have evaluated our method to other well-known defense methods and proved that our results are better than other techniques.

    Funding Statement:This research study is funding by University Putra Malaysia, Salengor, 43400,Malaysia.

    Conflicts of Interest:The authors claim no conflict of interest to report the present study.

    少妇裸体淫交视频免费看高清 | av天堂久久9| 中文字幕高清在线视频| 丝袜在线中文字幕| 亚洲男人天堂网一区| 国产亚洲精品久久久久5区| 欧美日韩福利视频一区二区| 精品第一国产精品| 久热爱精品视频在线9| 欧美av亚洲av综合av国产av| 少妇裸体淫交视频免费看高清 | 国产一区二区激情短视频| 色播亚洲综合网| 国产成人一区二区三区免费视频网站| 热re99久久国产66热| 999久久久精品免费观看国产| 精品人妻在线不人妻| 一夜夜www| 一区在线观看完整版| 久久久久精品国产欧美久久久| 在线十欧美十亚洲十日本专区| 国产精品久久久久久亚洲av鲁大| 久久久精品欧美日韩精品| 久久香蕉激情| 免费在线观看日本一区| 国产午夜福利久久久久久| 国产欧美日韩一区二区三| 狠狠狠狠99中文字幕| 桃色一区二区三区在线观看| 无限看片的www在线观看| 韩国精品一区二区三区| 天天添夜夜摸| 亚洲成国产人片在线观看| 亚洲av片天天在线观看| 国产xxxxx性猛交| 91精品三级在线观看| 18美女黄网站色大片免费观看| 亚洲欧美精品综合久久99| 91在线观看av| 亚洲第一av免费看| 免费搜索国产男女视频| 一卡2卡三卡四卡精品乱码亚洲| 国产亚洲精品一区二区www| 嫩草影视91久久| 啦啦啦 在线观看视频| 成人手机av| 中文字幕最新亚洲高清| 在线观看www视频免费| 免费在线观看完整版高清| a在线观看视频网站| 色尼玛亚洲综合影院| 手机成人av网站| 日本欧美视频一区| 久久精品91无色码中文字幕| 9色porny在线观看| 每晚都被弄得嗷嗷叫到高潮| videosex国产| 老司机午夜福利在线观看视频| 精品久久久精品久久久| 免费少妇av软件| 中文字幕另类日韩欧美亚洲嫩草| 成熟少妇高潮喷水视频| 麻豆成人av在线观看| 国产主播在线观看一区二区| 18禁裸乳无遮挡免费网站照片 | 50天的宝宝边吃奶边哭怎么回事| 麻豆久久精品国产亚洲av| 美女高潮喷水抽搐中文字幕| av福利片在线| 91九色精品人成在线观看| 乱人伦中国视频| 午夜福利免费观看在线| 成年女人毛片免费观看观看9| 女人爽到高潮嗷嗷叫在线视频| 欧美日本亚洲视频在线播放| 一级,二级,三级黄色视频| 欧洲精品卡2卡3卡4卡5卡区| 亚洲电影在线观看av| 亚洲久久久国产精品| 男人的好看免费观看在线视频 | 午夜福利成人在线免费观看| 精品少妇一区二区三区视频日本电影| 91精品三级在线观看| 一级作爱视频免费观看| 无限看片的www在线观看| 欧美在线黄色| 久久精品成人免费网站| 免费在线观看日本一区| 波多野结衣av一区二区av| 午夜亚洲福利在线播放| 国产精品一区二区在线不卡| 午夜视频精品福利| 18禁美女被吸乳视频| aaaaa片日本免费| 国内精品久久久久精免费| 女性被躁到高潮视频| 日韩免费av在线播放| 久久天堂一区二区三区四区| 亚洲熟妇熟女久久| 国产精品精品国产色婷婷| 真人一进一出gif抽搐免费| 久久香蕉激情| 无人区码免费观看不卡| 女人精品久久久久毛片| 欧美日韩亚洲国产一区二区在线观看| www.熟女人妻精品国产| 久久人妻av系列| 一级毛片高清免费大全| 久久久久久久久免费视频了| 亚洲av片天天在线观看| 9热在线视频观看99| 久久久久久免费高清国产稀缺| 午夜两性在线视频| 99久久久亚洲精品蜜臀av| 国产av一区二区精品久久| 久久香蕉国产精品| 一夜夜www| 十八禁人妻一区二区| 精品国产一区二区久久| 久久久国产成人精品二区| 国产在线精品亚洲第一网站| 亚洲中文日韩欧美视频| 欧美绝顶高潮抽搐喷水| 亚洲精品中文字幕在线视频| 纯流量卡能插随身wifi吗| 99re在线观看精品视频| 欧美黄色片欧美黄色片| 色播亚洲综合网| 91大片在线观看| 亚洲电影在线观看av| 国产精品九九99| 国产国语露脸激情在线看| 校园春色视频在线观看| 亚洲精品中文字幕在线视频| 两个人视频免费观看高清| 成人18禁在线播放| 人人妻,人人澡人人爽秒播| 少妇裸体淫交视频免费看高清 | 18美女黄网站色大片免费观看| 亚洲欧美日韩高清在线视频| 欧美日本亚洲视频在线播放| 两性夫妻黄色片| 麻豆一二三区av精品| 国产精品久久久av美女十八| 亚洲国产欧美一区二区综合| 99国产精品99久久久久| 精品人妻在线不人妻| 国产av又大| 91在线观看av| 亚洲av美国av| 国产成人欧美在线观看| 侵犯人妻中文字幕一二三四区| 中文字幕人妻丝袜一区二区| 久久草成人影院| 在线观看舔阴道视频| 不卡一级毛片| 他把我摸到了高潮在线观看| 狠狠狠狠99中文字幕| 欧美大码av| 国产精品98久久久久久宅男小说| 午夜影院日韩av| 久久中文字幕人妻熟女| 久久热在线av| 国产成人系列免费观看| 久99久视频精品免费| 国产免费男女视频| 亚洲熟妇中文字幕五十中出| 桃色一区二区三区在线观看| 亚洲精品中文字幕在线视频| 免费搜索国产男女视频| 99久久99久久久精品蜜桃| 亚洲精品久久成人aⅴ小说| 国产成人影院久久av| 一级毛片精品| 亚洲国产精品sss在线观看| 嫩草影院精品99| 熟女少妇亚洲综合色aaa.| 亚洲国产高清在线一区二区三 | 天天添夜夜摸| 50天的宝宝边吃奶边哭怎么回事| av欧美777| 国产av又大| 女人爽到高潮嗷嗷叫在线视频| 婷婷六月久久综合丁香| 日本撒尿小便嘘嘘汇集6| 欧洲精品卡2卡3卡4卡5卡区| 国产1区2区3区精品| 亚洲精品在线美女| 日韩 欧美 亚洲 中文字幕| 99国产综合亚洲精品| 非洲黑人性xxxx精品又粗又长| 国产日韩一区二区三区精品不卡| 成人永久免费在线观看视频| 亚洲中文字幕一区二区三区有码在线看 | 日韩大尺度精品在线看网址 | 久久亚洲真实| 国产精品秋霞免费鲁丝片| 国产av一区在线观看免费| 久久精品亚洲熟妇少妇任你| 国产欧美日韩一区二区三区在线| 91精品三级在线观看| 国产亚洲av嫩草精品影院| 久久久久精品国产欧美久久久| 国语自产精品视频在线第100页| 美女免费视频网站| 国产亚洲精品久久久久5区| 色综合欧美亚洲国产小说| 国产精品1区2区在线观看.| 亚洲激情在线av| 在线观看免费日韩欧美大片| 国内精品久久久久精免费| 亚洲精品一区av在线观看| 国产精品av久久久久免费| aaaaa片日本免费| 欧美性长视频在线观看| 嫩草影视91久久| 一二三四社区在线视频社区8| av网站免费在线观看视频| 午夜久久久在线观看| 曰老女人黄片| 国产xxxxx性猛交| 欧美日韩乱码在线| 法律面前人人平等表现在哪些方面| 亚洲精品一卡2卡三卡4卡5卡| 搡老岳熟女国产| 狠狠狠狠99中文字幕| 很黄的视频免费| 国产1区2区3区精品| 老司机靠b影院| 两个人免费观看高清视频| 免费观看人在逋| 日本vs欧美在线观看视频| 国产成人免费无遮挡视频| 久久久久久人人人人人| 精品乱码久久久久久99久播| 男女下面插进去视频免费观看| 亚洲欧美精品综合久久99| 亚洲午夜精品一区,二区,三区| 免费少妇av软件| 日本 欧美在线| 久久国产亚洲av麻豆专区| 少妇被粗大的猛进出69影院| 欧美中文日本在线观看视频| 伊人久久大香线蕉亚洲五| 亚洲五月天丁香| 亚洲av片天天在线观看| 久久久水蜜桃国产精品网| 国产亚洲欧美精品永久| 男女午夜视频在线观看| 黄色片一级片一级黄色片| 国产精品1区2区在线观看.| 99国产综合亚洲精品| 欧美一级a爱片免费观看看 | 国产成人系列免费观看| 免费不卡黄色视频| 欧美一区二区精品小视频在线| 午夜福利在线观看吧| 欧美乱色亚洲激情| 色综合站精品国产| 日日夜夜操网爽| 一区二区日韩欧美中文字幕| 精品午夜福利视频在线观看一区| 伊人久久大香线蕉亚洲五| 在线观看免费日韩欧美大片| 亚洲欧美日韩另类电影网站| 日韩av在线大香蕉| 成人永久免费在线观看视频| 大陆偷拍与自拍| 精品第一国产精品| 91麻豆精品激情在线观看国产| 成年女人毛片免费观看观看9| 好男人电影高清在线观看| 一边摸一边抽搐一进一小说| 亚洲一区中文字幕在线| 亚洲欧美一区二区三区黑人| 久久精品国产综合久久久| 天堂动漫精品| 制服人妻中文乱码| 久久天堂一区二区三区四区| 亚洲国产中文字幕在线视频| 美女免费视频网站| 狂野欧美激情性xxxx| 亚洲 国产 在线| 亚洲成av人片免费观看| 女同久久另类99精品国产91| 麻豆av在线久日| 在线十欧美十亚洲十日本专区| 久久久精品欧美日韩精品| 日韩大尺度精品在线看网址 | 91精品国产国语对白视频| 久久中文看片网| 成人亚洲精品av一区二区| 国产男靠女视频免费网站| 如日韩欧美国产精品一区二区三区| 亚洲自偷自拍图片 自拍| 午夜福利免费观看在线| 亚洲 欧美一区二区三区| 色综合亚洲欧美另类图片| 自拍欧美九色日韩亚洲蝌蚪91| 精品一区二区三区四区五区乱码| 女同久久另类99精品国产91| 一级片免费观看大全| 美国免费a级毛片| 国产亚洲欧美在线一区二区| 看片在线看免费视频| 国产精品二区激情视频| 成人18禁高潮啪啪吃奶动态图| 美女午夜性视频免费| 精品无人区乱码1区二区| 亚洲熟妇熟女久久| 多毛熟女@视频| 日日干狠狠操夜夜爽| 国产精品爽爽va在线观看网站 | 妹子高潮喷水视频| 亚洲伊人色综图| 久久精品国产清高在天天线| 国产精品二区激情视频| 在线视频色国产色| 91av网站免费观看| 国产成人一区二区三区免费视频网站| 老司机在亚洲福利影院| 91av网站免费观看| 咕卡用的链子| 欧美日本中文国产一区发布| 国产精品久久视频播放| 国产精品秋霞免费鲁丝片| 欧美成狂野欧美在线观看| 欧美日韩亚洲综合一区二区三区_| 麻豆国产av国片精品| 在线观看日韩欧美| 又大又爽又粗| 国产精品久久视频播放| 夜夜夜夜夜久久久久| 黄色丝袜av网址大全| 一卡2卡三卡四卡精品乱码亚洲| 亚洲精品国产色婷婷电影| 午夜老司机福利片| 久久午夜综合久久蜜桃| 成年版毛片免费区| 国产男靠女视频免费网站| 91精品三级在线观看| av超薄肉色丝袜交足视频| 欧美中文日本在线观看视频| 久久精品亚洲熟妇少妇任你| 精品国产一区二区三区四区第35| 亚洲精品中文字幕一二三四区| 国产精品野战在线观看| 变态另类丝袜制服| 久久久久久久久免费视频了| 亚洲男人天堂网一区| 欧美国产日韩亚洲一区| 国产高清激情床上av| 精品久久蜜臀av无| 丁香欧美五月| www.www免费av| 国产高清videossex| 亚洲av成人不卡在线观看播放网| 久9热在线精品视频| 国产亚洲av高清不卡| 中国美女看黄片| 最新美女视频免费是黄的| 久久婷婷成人综合色麻豆| 99riav亚洲国产免费| av免费在线观看网站| 一个人观看的视频www高清免费观看 | 99在线视频只有这里精品首页| 麻豆成人av在线观看| 啪啪无遮挡十八禁网站| 欧美日韩精品网址| 国产精品 国内视频| 亚洲一区中文字幕在线| 一个人观看的视频www高清免费观看 | 久久精品国产综合久久久| 天堂√8在线中文| 欧美一级a爱片免费观看看 | 国产一区在线观看成人免费| 精品无人区乱码1区二区| 无限看片的www在线观看| 欧美亚洲日本最大视频资源| 啦啦啦观看免费观看视频高清 | 88av欧美| 国产成人av教育| 中文字幕精品免费在线观看视频| 精品人妻在线不人妻| tocl精华| 女人爽到高潮嗷嗷叫在线视频| 国产蜜桃级精品一区二区三区| 欧美日韩乱码在线| 国产亚洲av嫩草精品影院| 级片在线观看| 少妇粗大呻吟视频| 国产三级黄色录像| 免费在线观看亚洲国产| 色播在线永久视频| 搡老岳熟女国产| 99riav亚洲国产免费| 成人精品一区二区免费| 男女下面进入的视频免费午夜 | 男人舔女人的私密视频| 99re在线观看精品视频| 搡老妇女老女人老熟妇| 制服人妻中文乱码| 无遮挡黄片免费观看| 亚洲成av人片免费观看| 99国产精品一区二区三区| 人人妻人人爽人人添夜夜欢视频| 大码成人一级视频| 亚洲成人久久性| 99国产精品一区二区蜜桃av| 国产精品一区二区免费欧美| 美女午夜性视频免费| 别揉我奶头~嗯~啊~动态视频| 美女国产高潮福利片在线看| 国产亚洲欧美在线一区二区| 国内久久婷婷六月综合欲色啪| 国产精品影院久久| 国产av又大| 午夜激情av网站| 久久久精品欧美日韩精品| 国产精品一区二区在线不卡| 久久中文看片网| 看免费av毛片| 亚洲无线在线观看| 亚洲一区二区三区不卡视频| 国产成人精品久久二区二区91| 国产免费男女视频| 夜夜爽天天搞| 日本黄色视频三级网站网址| 国产麻豆成人av免费视频| 日韩免费av在线播放| av片东京热男人的天堂| 巨乳人妻的诱惑在线观看| 久久久国产成人精品二区| 中文字幕人成人乱码亚洲影| 久久影院123| 国产精品一区二区三区四区久久 | 熟妇人妻久久中文字幕3abv| 一级,二级,三级黄色视频| 亚洲国产高清在线一区二区三 | 精品欧美一区二区三区在线| 亚洲视频免费观看视频| 丁香六月欧美| 免费看美女性在线毛片视频| 色婷婷久久久亚洲欧美| 亚洲国产欧美一区二区综合| 欧美成人午夜精品| 一级作爱视频免费观看| 国产av在哪里看| 老司机福利观看| 黄色女人牲交| 成人欧美大片| 岛国在线观看网站| 午夜亚洲福利在线播放| 精品不卡国产一区二区三区| 可以在线观看的亚洲视频| 女人高潮潮喷娇喘18禁视频| 国产亚洲欧美精品永久| 国产91精品成人一区二区三区| 亚洲欧美日韩高清在线视频| 久久久久久大精品| 亚洲最大成人中文| 青草久久国产| 此物有八面人人有两片| 欧美成人免费av一区二区三区| 黄色女人牲交| 中文字幕av电影在线播放| 香蕉丝袜av| 成年版毛片免费区| 久久久国产成人免费| 日本五十路高清| 色综合欧美亚洲国产小说| 色综合亚洲欧美另类图片| 黄色a级毛片大全视频| 91成年电影在线观看| 757午夜福利合集在线观看| 亚洲精品久久国产高清桃花| 欧美一区二区精品小视频在线| 女人被狂操c到高潮| 欧美黑人精品巨大| 国产激情欧美一区二区| 免费观看人在逋| 久热爱精品视频在线9| 在线观看日韩欧美| 99re在线观看精品视频| 高潮久久久久久久久久久不卡| 91成年电影在线观看| 亚洲午夜精品一区,二区,三区| 亚洲aⅴ乱码一区二区在线播放 | 黄色成人免费大全| 久9热在线精品视频| 精品久久久久久,| 午夜久久久久精精品| 色综合站精品国产| 无限看片的www在线观看| 又大又爽又粗| av天堂在线播放| 国产激情久久老熟女| 日韩欧美三级三区| 咕卡用的链子| 18禁裸乳无遮挡免费网站照片 | 日韩 欧美 亚洲 中文字幕| 久久人人爽av亚洲精品天堂| 极品教师在线免费播放| 一边摸一边做爽爽视频免费| 一级作爱视频免费观看| 国产精品久久久av美女十八| 精品第一国产精品| 日韩欧美免费精品| 一边摸一边做爽爽视频免费| 97超级碰碰碰精品色视频在线观看| 国产主播在线观看一区二区| 久久国产亚洲av麻豆专区| 91大片在线观看| 嫩草影院精品99| 老司机在亚洲福利影院| 国产欧美日韩综合在线一区二区| 欧美在线黄色| 窝窝影院91人妻| 51午夜福利影视在线观看| 亚洲精品在线美女| 国产区一区二久久| 免费av毛片视频| 成人精品一区二区免费| 中亚洲国语对白在线视频| 欧美一区二区精品小视频在线| 成人三级做爰电影| 亚洲熟妇中文字幕五十中出| 搡老熟女国产l中国老女人| 色播亚洲综合网| 丝袜在线中文字幕| 成人亚洲精品av一区二区| 久久久水蜜桃国产精品网| 不卡av一区二区三区| 久久性视频一级片| 亚洲美女黄片视频| 成人18禁高潮啪啪吃奶动态图| 国产成人精品在线电影| 麻豆成人av在线观看| 极品人妻少妇av视频| 久久婷婷人人爽人人干人人爱 | 夜夜爽天天搞| 亚洲av成人不卡在线观看播放网| 国产片内射在线| 90打野战视频偷拍视频| 变态另类成人亚洲欧美熟女 | 精品人妻在线不人妻| 看黄色毛片网站| 夜夜爽天天搞| 人人妻,人人澡人人爽秒播| 日本在线视频免费播放| 亚洲av日韩精品久久久久久密| 亚洲av五月六月丁香网| 三级毛片av免费| 精品国产美女av久久久久小说| 中文字幕高清在线视频| www.www免费av| 亚洲自拍偷在线| 国内精品久久久久精免费| 亚洲一码二码三码区别大吗| 亚洲全国av大片| √禁漫天堂资源中文www| 精品乱码久久久久久99久播| 精品久久久久久久久久免费视频| 亚洲熟妇中文字幕五十中出| 看免费av毛片| 久久久久久国产a免费观看| 亚洲专区字幕在线| 日韩av在线大香蕉| 国产精品99久久99久久久不卡| 精品免费久久久久久久清纯| 欧美精品啪啪一区二区三区| 两个人视频免费观看高清| 熟妇人妻久久中文字幕3abv| 国产成人精品无人区| 成人国产综合亚洲| 最近最新免费中文字幕在线| 精品不卡国产一区二区三区| 亚洲色图 男人天堂 中文字幕| 一区二区三区高清视频在线| 非洲黑人性xxxx精品又粗又长| 日本五十路高清| 99久久综合精品五月天人人| av视频免费观看在线观看| 久久人人爽av亚洲精品天堂| 啦啦啦 在线观看视频| 色播在线永久视频| 国产高清有码在线观看视频 | 免费看美女性在线毛片视频| 免费无遮挡裸体视频| 又大又爽又粗| 久久久久久人人人人人| 操美女的视频在线观看| 国产成人系列免费观看| 国产av一区在线观看免费| 国产成年人精品一区二区| 可以在线观看毛片的网站| 亚洲av电影在线进入| 熟妇人妻久久中文字幕3abv| 老鸭窝网址在线观看| 黑人巨大精品欧美一区二区蜜桃| 最新美女视频免费是黄的| 亚洲av熟女| 久久人人97超碰香蕉20202| av天堂久久9| 欧美成人性av电影在线观看| 亚洲专区中文字幕在线| 国产av一区在线观看免费| 久久人妻熟女aⅴ| 一进一出抽搐gif免费好疼| 亚洲国产精品久久男人天堂| 亚洲性夜色夜夜综合| 亚洲中文字幕一区二区三区有码在线看 | 动漫黄色视频在线观看| 99久久综合精品五月天人人| 国产成人精品在线电影|