Network abnormal behavior detection and dynamic defense method and system

Abstract

The invention provides a network abnormal behavior detection and dynamic defense method and system, and the method comprises the steps: collecting multi-source data which comprises network flow data, terminal behavior data, application log data and threat intelligence data; performing anomaly analysis on the network flow data through an auto-encoder to obtain an anomaly result; taking the terminal behavior data, the application log data and the threat intelligence data as input data; analyzing the input data through a graph neural network to obtain a transverse penetration behavior; performing strategy adjustment, dynamic isolation and vulnerability repair according to the attribute of the abnormal result and the attribute of the transverse penetration behavior; through anomaly detection of the graph neural network and anomaly detection of the auto-encoder, novel unknown network threats and intrusion attacks are effectively dealt with; the accuracy of network threat alarm is effectively improved; and automatically optimizing a detection model and a defense strategy based on environment change and attack feedback.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for detecting and dynamically defending against abnormal network behavior. Background Art

[0002] With the popularization of personal computers and Internet application technologies, network security threats and risks are becoming increasingly prominent. The international macro-environment is in turmoil, global cyber attacks continue to escalate, and network security is gradually spreading and penetrating into political, economic, national defense, social and other fields. Preventing network security risks and maintaining cyberspace security have become major security issues that we must face and solve.

[0003] At present, traditional network security defense measures (such as rule base matching and static firewalls) rely on known attack feature libraries and are difficult to deal with new unknown threats (such as zero-day attacks and APT attacks); existing machine learning models have problems such as high false alarm rates, delayed model updates, and insufficient real-time performance in dynamic network environments; network attack methods are becoming increasingly complex (such as adversarial sample attacks), and traditional detection methods are easily bypassed and cannot cope with new unknown threats. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method and system for network abnormal behavior detection and dynamic defense, which can effectively respond to new unknown network threats and intrusion attacks through anomaly detection of graph neural networks and autoencoders; effectively improve the accuracy of network threat alerts; and automatically optimize detection models and defense strategies based on environmental changes and attack feedback.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting and dynamically preventing abnormal network behavior, the method comprising:

[0006] Collect multi-source data, including network traffic data, terminal behavior data, application log data, and threat intelligence data;

[0007] Performing an anomaly analysis on the network traffic data by an autoencoder to obtain an anomaly result;

[0008] Taking the terminal behavior data, the application log data, and the threat intelligence data as input data;

[0009] Analyzing the input data through a graph neural network to obtain lateral penetration behavior;

[0010] Policy adjustment, dynamic isolation, and vulnerability repair are performed based on the attributes of the abnormal results and the attributes of the lateral penetration behavior.

[0011] Furthermore, the network traffic data includes protocols, payloads, sessions, packet lengths, and transmission intervals; the terminal behavior data includes terminal process activity logs, file operation records, registry changes, and user permission changes; the application log data includes business API calls, user authentication records, user behavior sequences, and database access audits; and the threat intelligence data includes intrusion indicators, vulnerability databases, and hacker group TTPs obtained from connected open threat libraries.

[0012] Furthermore, the network traffic data is analyzed for anomalies by an autoencoder to obtain anomaly results, including:

[0013] Performing dimensionality reduction on the network traffic data by using the autoencoder to extract key features;

[0014] Reconstructing the key features to obtain output traffic data;

[0015] Comparing the output traffic data with the network traffic data;

[0016] Determine whether there is abnormal network traffic data;

[0017] If so, the exception result is generated.

[0018] Furthermore, the input data is analyzed through a graph neural network to obtain lateral penetration behavior, including:

[0019] Utilize the relationship information in graph structure data to build anomaly detection models;

[0020] generating a relationship graph according to the anomaly detection model;

[0021] The input data is analyzed through the relationship map to obtain the lateral penetration behavior.

[0022] Furthermore, policy adjustments, dynamic isolation, and vulnerability remediation are performed based on the attributes of the abnormal results and the attributes of the lateral penetration behavior, including:

[0023] Training the abnormal results through reinforcement learning to obtain an adaptive decision framework;

[0024] Performing the strategy adjustment according to the adaptive decision framework;

[0025] Calculating a first weight ratio according to the lateral penetration behavior;

[0026] Calculating a second weight ratio according to the abnormal result;

[0027] If the first weight ratio is greater than a first preset threshold, or the second weight ratio is greater than a second preset threshold, dynamic isolation is performed based on the software-defined network.

[0028] Furthermore, policy adjustments, dynamic isolation, and vulnerability remediation are performed based on the attributes of the abnormal results and the attributes of the lateral penetration behavior, including:

[0029] When the lateral penetration behavior and the abnormal result contain attack traffic, the attack traffic is sent to a honeypot environment to collect attack features of the attack traffic;

[0030] Determine whether the attack signature exists in the threat intelligence database;

[0031] If it exists, the vulnerability management system will be linked to automatically send patches to repair the vulnerability.

[0032] In a second aspect, an embodiment of the present invention provides a network abnormal behavior detection and dynamic defense system, the system comprising:

[0033] A multi-source data collection module is used to collect multi-source data, including network traffic data, terminal behavior data, application log data, and threat intelligence data;

[0034] An intelligent analysis module is configured to perform an anomaly analysis on the network traffic data using an autoencoder to obtain an anomaly result; use the terminal behavior data, the application log data, and the threat intelligence data as input data; and analyze the input data using a graph neural network to obtain lateral penetration behavior;

[0035] A real-time response and dynamic defense module is used to adjust policies, dynamically isolate, and repair vulnerabilities based on the attributes of the abnormal results and the attributes of the lateral penetration behavior.

[0036] Furthermore, the network traffic data includes protocols, payloads, sessions, packet lengths, and transmission intervals; the terminal behavior data includes terminal process activity logs, file operation records, registry changes, and user permission changes; the application log data includes business API calls, user authentication records, user behavior sequences, and database access audits; and the threat intelligence data includes intrusion indicators, vulnerability databases, and hacker group TTPs obtained from connected open threat libraries.

[0037] In a third aspect, an embodiment of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the processor implements the above-mentioned method when executing the computer program.

[0038] In a fourth aspect, an embodiment of the present invention provides a computer-readable medium having a non-volatile program code executable by a processor, wherein the program code enables the processor to execute the method as described above.

[0039] An embodiment of the present invention provides a method and system for detecting and dynamically defending against abnormal network behavior. The method includes: collecting multi-source data, where the multi-source data includes network traffic data, terminal behavior data, application log data, and threat intelligence data; performing anomaly analysis on the network traffic data through an autoencoder to obtain abnormal results; using the terminal behavior data, application log data, and threat intelligence data as input data; analyzing the input data through a graph neural network to obtain lateral penetration behavior; adjusting strategies, dynamically isolating, and repairing vulnerabilities based on the attributes of the abnormal results and the attributes of the lateral penetration behavior; effectively responding to new unknown network threats and intrusion attacks through anomaly detection of graph neural networks and anomaly detection of autoencoders; effectively improving the accuracy of network threat alerts; and automatically optimizing detection models and defense strategies based on environmental changes and attack feedback.

[0040] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or understood by practicing the present invention. The purposes and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0041] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 Flowchart of the network abnormal behavior detection and dynamic defense method provided in Example 1 of the present invention;

[0044] Figure 2 A schematic diagram of the adaptive network security system architecture provided in Example 1 of the present invention;

[0045] Figure 3 Schematic diagram of the network abnormal behavior detection and dynamic defense system provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0047] To facilitate understanding of this embodiment, the embodiment of the present invention is described in detail below.

[0048] Example 1:

[0049] Figure 1 This is a flow chart of the network abnormal behavior detection and dynamic defense method provided in Example 1 of the present invention.

[0050] Reference Figure 1 , the method comprises the following steps:

[0051] Step S101: Collect multi-source data, including network traffic data, terminal behavior data, application log data, and threat intelligence data;

[0052] Step S102, performing an anomaly analysis on the network traffic data through an autoencoder (AE) to obtain an anomaly result;

[0053] Step S103: using terminal behavior data, application log data, and threat intelligence data as input data;

[0054] Step S104: Analyze the input data through Graph Neural Networks (GNN) to obtain lateral penetration behavior;

[0055] Step S105: perform policy adjustment, dynamic isolation, and vulnerability repair based on the attributes of the abnormal results and the attributes of the lateral penetration behavior.

[0056] This application is applicable to the security protection of Internet application systems, cloud computing, the Internet of Things (IoT) and industrial control systems.

[0057] This application combines graph neural network GNN anomaly detection and autoencoder AE anomaly detection to effectively respond to new unknown network threats and intrusion attacks. Through the joint analysis of data such as network traffic, terminal behavior, application logs and threat intelligence, full-link protection from network boundaries, terminal devices to business applications is achieved, effectively improving the accuracy of network threat alerts. Based on environmental changes and attack feedback, detection models and defense strategies are automatically optimized. Through the "perception-analysis-response-evolution" closed-loop design, deep learning is integrated into the entire life cycle of network security protection, realizing the transition from passive defense to active immunity, which can effectively cope with the complex and changing network threat environment in the future.

[0058] Furthermore, network traffic data includes protocols, payloads, sessions, packet lengths, and transmission intervals; terminal behavior data includes terminal process activity logs, file operation records, registry changes, and user permission changes; application log data includes business API calls, user authentication records, user behavior sequences (e.g., API call frequency, login time distribution), and database access audits; and threat intelligence data includes intrusion indicators (IOCs, Indicators of Compromise), vulnerability databases (CVE, Common Vulnerabilities and Exposures), and hacker group TTPs (Tactics, Techniques and Procedures) obtained from connected open threat libraries.

[0059] Here, network traffic mirroring is used to collect real-time network traffic data and extract its features to identify protocols, payloads, and sessions. Metadata extraction from encrypted traffic is also supported to determine packet length and transmission intervals. Network traffic data, terminal behavior data, application log data, and threat intelligence data are not limited to the following data and may also include other data.

[0060] Further, refer to Figure 2 , step S102 includes the following steps:

[0061] Step S201, reducing the dimension of network traffic data by an autoencoder to extract key features;

[0062] Step S202: reconstruct the key features to obtain output flow data;

[0063] Step S203, comparing the output traffic data with the network traffic data;

[0064] Step S204, determining whether there is abnormal network traffic data;

[0065] Step S205: If it exists, generate an abnormal result.

[0066] Specifically, in the unsupervised learning process, the autoencoder is used to reduce the dimensionality of network traffic data and extract key features. The reconstruction error (the difference between input and output) is then used to identify abnormal network traffic, thus achieving network traffic anomaly detection. For example, it can identify C2 (Command and Control) communications and high-frequency heartbeat packets.

[0067] exist Figure 2 In the system, the multi-source data acquisition module is mainly used to realize: network traffic, terminal behavior, application logs and data, and threat intelligence. The intelligent analysis module is mainly used to realize: autoencoder anomaly detection, graph neural network anomaly detection, reinforcement learning, adaptive update mechanism, adversarial sample generation and defense enhancement. The real-time response and dynamic defense module is mainly used to realize: SDN micro-isolation, adaptive honeypot, dynamic security policy adjustment, human-machine collaboration, vulnerability repair, and dynamic feature weight adjustment. The function of the hardware adapter interface: to encapsulate different types of hardware interfaces (such as switches, firewalls) in a unified format to facilitate the call of the upper-level application module. When the hardware is subsequently replaced and upgraded, the upper-level application module does not need to be changed, which is beneficial to the compatibility and scalability of the entire system. It also includes system basic hardware facilities, and the system basic hardware facilities interact with the upper-level application modules through the hardware adapter interface.

[0068] Furthermore, step S104 includes the following steps:

[0069] Step S301, using the relationship information in the graph structure data to build an anomaly detection model;

[0070] Step S302, generating a relationship graph based on the anomaly detection model;

[0071] Step S303: Analyze the input data through a relationship graph to obtain lateral penetration behavior.

[0072] Specifically, the relationship information in the graph structure data is used to build an effective anomaly detection model; the relationship graph between users, terminals and applications is analyzed to determine the lateral penetration behavior.

[0073] Furthermore, step S105 includes the following steps:

[0074] Step S401, training the abnormal results through reinforcement learning to obtain an adaptive decision framework;

[0075] Step S402: adjusting the strategy according to the adaptive decision framework;

[0076] Specifically, through reinforcement learning (RL), environmental modeling and training are used to implement a dynamic and adaptive decision-making framework, allowing real-time policy adjustments to respond to unknown attacks. For example, firewall rule priority adjustments and firewall enable / disable rule adjustments can be made.

[0077] Step S403, calculating a first weight ratio according to the lateral penetration behavior;

[0078] Step S404, calculating a second weight ratio according to the abnormal result;

[0079] Step S405: If the first weight ratio is greater than the first preset threshold, or the second weight ratio is greater than the second preset threshold, dynamic isolation is performed based on the software defined network.

[0080] Specifically, the infected host is dynamically isolated based on Software Defined Networking (SDN).

[0081] Furthermore, step S105 includes the following steps:

[0082] Step S501: When there is attack traffic in the lateral penetration behavior and abnormal results, the attack traffic is made to enter a honeypot environment (camouflage environment) to collect attack features of the attack traffic;

[0083] Step S502: Determine whether the attack signature exists in the threat intelligence database;

[0084] Step S503: If the vulnerability exists, the vulnerability management system is linked to automatically issue a patch to repair the vulnerability.

[0085] Here, feature weights are dynamically adjusted based on threat intelligence, such as increasing the weights of indicators related to recently active vulnerabilities.

[0086] In addition, if there is a high risk in the lateral penetration behavior and abnormal results, manual confirmation is required (such as deleting key files); if there is a low risk in the lateral penetration behavior and abnormal results, it is automatically executed (such as banning the IP).

[0087] When in a scenario where unknown malware invades, the data collection module is used to sense abnormal processes occurring on the terminal device (for example, high-frequency encrypted file operations).

[0088] The intelligent analysis module is used to detect graph structure anomalies through graph neural networks and identify covert communications between the process and external IP addresses. It also detects reconstruction errors through autoencoders and determines that traffic characteristics deviate from historical baselines, indicating the occurrence of unknown intrusions.

[0089] The real-time response and dynamic defense module is used to automatically isolate terminal devices and block malicious IP connections; extract samples for analysis, and generate new rules to feed back to the threat library.

[0090] The online learning module in the adaptive deep learning model is used to add new samples to the training set and update the detection model.

[0091] In application scenarios with data leakage risks, the data collection module is used to display the batch export of sensitive data from a certain account through database audit logs.

[0092] The intelligent analysis module is used to detect abnormal behavior sequences based on the user-terminal-application relationship map through graph neural networks. For example, abnormal login time of the account (non-working hours) and sudden changes in access patterns can be identified as data leaks.

[0093] The real-time response and dynamic defense module is used to automatically freeze accounts and trigger data breach emergency response processes; back up operation records and generate forensic reports.

[0094] The online learning module in the adaptive deep learning model is used to update the internal threat detection model and simultaneously adjust parameter thresholds to address related data leakage risks.

[0095] Example 2:

[0096] Figure 3 Schematic diagram of the network abnormal behavior detection and dynamic defense system provided in Example 2 of the present invention.

[0097] Reference Figure 3 , the system comprises:

[0098] Multi-source data collection module, used to collect multi-source data, including network traffic data, terminal behavior data, application log data and threat intelligence data;

[0099] The intelligent analysis module is used to analyze network traffic data for anomalies using an autoencoder to obtain anomaly results. It uses terminal behavior data, application log data, and threat intelligence data as input data and analyzes the input data using a graph neural network to obtain lateral penetration behavior.

[0100] The real-time response and dynamic defense module is used to adjust policies, dynamically isolate, and repair vulnerabilities based on the attributes of abnormal results and lateral penetration behaviors.

[0101] Furthermore, network traffic data includes protocols, payloads, sessions, packet lengths, and transmission intervals; terminal behavior data includes terminal process activity logs, file operation records, registry changes, and user permission changes; application log data includes business API calls, user authentication records, user behavior sequences, and database access audits; and threat intelligence data includes intrusion indicators, vulnerability databases, and hacker group TTPs obtained from connected open threat libraries.

[0102] An embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the network abnormal behavior detection and dynamic defense method provided in the above embodiment are implemented.

[0103] An embodiment of the present invention also provides a computer-readable medium having a non-volatile program code executable by a processor, wherein a computer program is stored on the computer-readable medium, and when the computer program is executed by the processor, the steps of the network abnormal behavior detection and dynamic defense method of the above embodiment are executed.

[0104] The computer program product provided in the embodiments of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the previous method embodiments. For specific implementation, please refer to the method embodiments and will not be repeated here.

[0105] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems and devices can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0106] In addition, in the description of the embodiments of the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; they may refer to mechanical connections or electrical connections; they may refer to direct connections or indirect connections through an intermediate medium; and they may refer to internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on the specific circumstances.

[0107] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0108] In the description of the present invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0109] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for detecting and dynamically preventing abnormal network behavior, characterized in that: The method comprises: Collect multi-source data, including network traffic data, terminal behavior data, application log data, and threat intelligence data; Performing an anomaly analysis on the network traffic data by an autoencoder to obtain an anomaly result; Taking the terminal behavior data, the application log data, and the threat intelligence data as input data; Analyzing the input data through a graph neural network to obtain lateral penetration behavior; Policy adjustment, dynamic isolation, and vulnerability repair are performed based on the attributes of the abnormal results and the attributes of the lateral penetration behavior.

2. The method for detecting and dynamically preventing abnormal network behavior according to claim 1, wherein: The network traffic data includes protocols, payloads, sessions, packet lengths, and transmission intervals; the terminal behavior data includes terminal process activity logs, file operation records, registry changes, and user permission changes; the application log data includes business API calls, user authentication records, user behavior sequences, and database access audits; and the threat intelligence data includes intrusion indicators, vulnerability databases, and hacker group TTPs obtained from connected open threat libraries.

3. The method for detecting and dynamically preventing abnormal network behavior according to claim 1, wherein: The network traffic data is analyzed for anomalies by an autoencoder to obtain anomaly results, including: Performing dimensionality reduction on the network traffic data by using the autoencoder to extract key features; Reconstructing the key features to obtain output traffic data; Comparing the output traffic data with the network traffic data; Determine whether there is abnormal network traffic data; If so, the exception result is generated.

4. The method for detecting and dynamically preventing abnormal network behavior according to claim 1, wherein: The input data is analyzed through a graph neural network to obtain lateral penetration behavior, including: Utilize the relationship information in graph structure data to build anomaly detection models; generating a relationship graph according to the anomaly detection model; The input data is analyzed through the relationship map to obtain the lateral penetration behavior.

5. The method for detecting and dynamically preventing abnormal network behavior according to claim 1, wherein: Perform policy adjustments, dynamic isolation, and vulnerability remediation based on the attributes of the abnormal results and the attributes of the lateral penetration behavior, including: Training the abnormal results through reinforcement learning to obtain an adaptive decision framework; Performing the strategy adjustment according to the adaptive decision framework; Calculating a first weight ratio according to the lateral penetration behavior; Calculating a second weight ratio according to the abnormal result; If the first weight ratio is greater than a first preset threshold, or the second weight ratio is greater than a second preset threshold, dynamic isolation is performed based on the software-defined network.

6. The method for detecting and dynamically preventing abnormal network behavior according to claim 1, wherein: Perform policy adjustments, dynamic isolation, and vulnerability remediation based on the attributes of the abnormal results and the attributes of the lateral penetration behavior, including: When the lateral penetration behavior and the abnormal result contain attack traffic, the attack traffic is sent to a honeypot environment to collect attack features of the attack traffic; Determine whether the attack signature exists in the threat intelligence database; If it exists, the vulnerability management system will be linked to automatically send patches to repair the vulnerability.

7. A network abnormal behavior detection and dynamic defense system, characterized in that: The system comprises: A multi-source data collection module is used to collect multi-source data, including network traffic data, terminal behavior data, application log data, and threat intelligence data; An intelligent analysis module is configured to perform an anomaly analysis on the network traffic data using an autoencoder to obtain an anomaly result; use the terminal behavior data, the application log data, and the threat intelligence data as input data; and analyze the input data using a graph neural network to obtain lateral penetration behavior; A real-time response and dynamic defense module is used to adjust policies, dynamically isolate, and repair vulnerabilities based on the attributes of the abnormal results and the attributes of the lateral penetration behavior.

8. The network abnormal behavior detection and dynamic defense system according to claim 7, characterized in that: The network traffic data includes protocols, payloads, sessions, packet lengths, and transmission intervals; the terminal behavior data includes terminal process activity logs, file operation records, registry changes, and user permission changes; the application log data includes business API calls, user authentication records, user behavior sequences, and database access audits; and the threat intelligence data includes intrusion indicators, vulnerability databases, and hacker group TTPs obtained from connected open threat libraries.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable medium having a non-volatile program code executable by a processor, characterized in that The program code causes the processor to execute the method according to any one of claims 1 to 6.

Images