Host security monitoring method, device, medium and electronic device based on blockchain

Abstract

The present disclosure relates to the field of computer technology, and in particular to a host security monitoring method, device, computer-readable medium and electronic device based on blockchain. The host security monitoring method in the embodiment of the present disclosure includes: monitoring the traffic data of the host in the network communication, and determining whether the traffic data is malicious traffic; if the traffic data is malicious traffic, obtaining the security status information of the host, and saving the security status information to the security status blockchain; generating an intrusion log corresponding to the malicious traffic, and saving the intrusion log and the security status information to the log storage blockchain. The method has the advantages of high monitoring accuracy and good reliability.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a host security monitoring method based on blockchain, a host security monitoring device based on blockchain, a computer-readable medium, and an electronic device. Background Art

[0002] With the continuous development of computer and Internet technology, enterprises are enjoying the benefits of Internet development while also being constantly attacked by cyber attacks, which have brought varying degrees of impact on corporate business, assets, image, etc., and network security issues are receiving more and more attention. In recent years, cyber attacks have evolved from individual combat to team collaboration, from focusing on system vulnerabilities to focusing on business vulnerabilities. Therefore, large enterprise organizations are facing more complex targeted threat attacks (Advanced Persistent Threat, APT).

[0003] Discovering attack behaviors, restoring attack paths, determining the scope of attack, and collecting evidence of attacks have become the most important concerns for enterprises when they suffer security attacks. However, in current large organizations, the internal network topology is complex, and security intrusion detection devices are mainly distributed at various network nodes and edges. Although attack behaviors can be discovered, it is impossible to determine whether the attacker has successfully compromised the target host, and whether the attack has caused a greater impact by using covert channels after the successful attack. Therefore, there are blind spots in network security equipment. In addition, the attacker may delete the log records after compromising the host, which has a certain impact on the vulnerability impact investigation. Therefore, how to accurately and reliably monitor host security is an urgent problem to be solved.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide a host security monitoring method based on blockchain, a host security monitoring device based on blockchain, a computer-readable medium and an electronic device, so as to at least overcome the technical problems such as poor accuracy of security monitoring and monitoring loopholes caused by the limitations and defects of related technologies to a certain extent.

[0006] According to one aspect of the present disclosure, a host security monitoring method based on blockchain is provided, the method comprising:

[0007] Monitor the traffic data of the host in network communication and determine whether the traffic data is malicious traffic;

[0008] If the traffic data is malicious traffic, obtaining security status information of the host, and saving the security status information to the security status blockchain;

[0009] An intrusion log corresponding to the malicious traffic is generated, and the intrusion log and the security status information are saved to a log storage blockchain.

[0010] In some embodiments of the present disclosure, based on the above technical solution, the determining whether the traffic data is malicious traffic includes:

[0011] Performing feature extraction on the flow data to obtain flow features of the flow data;

[0012] The traffic features are input into a pre-trained support vector machine model to identify the data type of the traffic data through the support vector machine model, where the data type includes normal traffic and malicious traffic.

[0013] In some embodiments of the present disclosure, based on the above technical solution, the feature extraction of the traffic data to obtain the traffic features of the traffic data includes:

[0014] Acquire application layer protocol traffic in the traffic data, and perform feature extraction on the application layer protocol traffic to obtain protocol traffic features of the application layer protocol traffic;

[0015] When there is a file object in the application layer protocol flow, feature extraction is performed on the file object to obtain a file object feature of the file object;

[0016] Running the file object in the sandbox of the host, and determining the file running characteristics related to the host according to the running result;

[0017] The flow characteristics of the flow data are determined according to the protocol flow characteristics, the file object characteristics and the file operation characteristics.

[0018] In some embodiments of the present disclosure, based on the above technical solution, obtaining the security status information of the host includes:

[0019] Obtaining operating status data of the host;

[0020] The security status information of the host is determined according to the operating status data and the malicious traffic.

[0021] In some embodiments of the present disclosure, based on the above technical solution, determining the security status information of the host according to the running status data and the malicious traffic includes:

[0022] Extracting features from the running status data to obtain status features of the host;

[0023] Determining traffic characteristics corresponding to the malicious traffic;

[0024] The state feature and the traffic feature are input into a pre-trained random forest model to obtain security state information of the host.

[0025] In some embodiments of the present disclosure, based on the above technical solution, the step of saving the security status information to the security status blockchain includes:

[0026] The network address of the host and the security status information are stored in the block body of the current security status block to be agreed upon;

[0027] When the block generation condition is met, the block header data of the previous security state block in the security state blockchain is obtained, and the parent block hash value is calculated based on the block header data;

[0028] Calculate the block body hash value of the current security status block according to the data stored in the block body of the current block;

[0029] The parent block hash value, the block body hash value and the timestamp of the current time are saved in the block header of the current security status block;

[0030] The current security status block is broadcast to the security status blockchain network to perform consensus authentication on the current security status block, and when the authentication is passed, the current security status block is linked to the security status blockchain.

[0031] In some embodiments of the present disclosure, based on the above technical solution, the step of saving the intrusion log and the security status information to a log storage blockchain includes:

[0032] The network address of the host, the intrusion log and the security status information are stored in the block body of the current log storage block to be agreed upon;

[0033] When the block generation condition is met, the block header data of the previous log storage block in the log storage blockchain is obtained, and the parent block hash value is calculated based on the block header data;

[0034] Calculating a block body hash value of the current log storage block according to the data stored in the block body of the current log storage block;

[0035] The parent block hash value, the block body hash value and the timestamp of the current time are saved in the block header of the current log storage block;

[0036] The current log storage block is broadcasted to the log storage blockchain network to perform consensus authentication on the current log storage block, and when the authentication is passed, the current log storage block is linked to the log storage blockchain.

[0037] According to one aspect of the present disclosure, a host security monitoring device based on blockchain is provided, the device comprising:

[0038] A flow data monitoring unit is configured to monitor flow data of a host in network communication and determine whether the flow data is malicious flow;

[0039] A security status saving unit is configured to obtain security status information of the host and save the security status information to a security status blockchain when the traffic data is determined to be malicious traffic;

[0040] The log storage unit is configured to generate an intrusion log corresponding to the malicious traffic, and save the intrusion log and the security status information to a log storage blockchain.

[0041] According to one aspect of the present disclosure, a computer-readable medium is provided, on which a computer program is stored, and the particularity thereof is that when the computer program is executed by a processor, any of the above-mentioned methods is implemented.

[0042] According to one aspect of the present disclosure, an electronic device is provided, which is special in that it includes a processor and a memory; wherein the memory is used to store executable instructions of the processor, and the processor is configured to execute any of the above methods by executing the executable instructions.

[0043] The technical solution provided by the disclosed embodiment has the advantages of high monitoring accuracy and good reliability. By quickly and accurately identifying the current security status of the host, the scope of impact of network attacks on the enterprise can be determined; by establishing host status information based on the state machine, the historical security status of the host can be traced; based on the host level to identify the source of intrusion, the attack path can be restored and the emergency response capability of the enterprise can be improved; the host status identification and log storage are separated, and based on the characteristics of blockchain decentralization and non-repudiation, the non-repudiation and integrity of the log can be ensured.

[0044] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0046] Figure 1 The figure schematically shows a flowchart of the steps of a host security monitoring method based on blockchain in some embodiments of the present disclosure.

[0047] Figure 2 A flowchart of the steps for determining the attributes of traffic data in some embodiments of the present disclosure is schematically shown.

[0048] Figure 3 The flowchart schematically shows the steps of extracting features from traffic data in some embodiments of the present disclosure.

[0049] Figure 4 A flowchart schematically illustrates the steps of obtaining host security status information in some embodiments of the present disclosure.

[0050] Figure 5 A flowchart schematically illustrates the steps of determining host security status information in some embodiments of the present disclosure.

[0051] Figure 6 The flowchart schematically shows the steps of saving security status information based on blockchain in some embodiments of the present disclosure.

[0052] Figure 7 The flowchart schematically shows the steps of saving logs based on blockchain in some embodiments of the present disclosure.

[0053] Figure 8 The block diagram schematically shows the composition of a host security monitoring device based on blockchain in some embodiments of the present disclosure.

[0054] Fig. 9 The overall architecture of a host security monitoring system provided by the present disclosure is schematically shown.

[0055] Fig.10 The schematic diagram of the detection and judgment principle of the safety detection model is schematically shown.

[0056] Fig.11 The schematic diagram of the blockchain network principle of the log storage module is schematically shown.

[0057] Fig.12 The host security monitoring process based on the host security monitoring system is schematically shown.

[0058] Fig.13 The following is a schematic diagram schematically showing a program product in an embodiment of the present disclosure.

[0059] Fig.14 A module diagram of an electronic device in an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0060] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0061] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0062] In the related technology of the present disclosure, the host security status can be monitored through two methods: traffic analysis or local scanning.

[0063] Traffic analysis is to deploy an intrusion detection system in the bypass of the network trunk, analyze the data packets in the network, and match them with the predefined attack success characteristics. If the characteristics match, the target host is judged to be invaded, the attack log is recorded and an alarm is issued. This method can detect intrusion behavior in the network trunk, but when the attacker and the internal compromised host build a covert channel and then attack the LAN assets, the intrusion detection system cannot detect the attack traffic, and it is impossible to determine the scope of the attack and determine the attacker's subsequent attack path; in addition, traffic analysis needs to rely on malicious traffic characteristics, and it is difficult to identify 0day, time-based attacks, business attacks, etc.

[0064] The local scanning method is to install the client detection program on the host, scan the client regularly based on custom rules, and report alarms when the host has abnormal file, user, log, network, process, etc., and store the report logs in the background. This method can be deployed on all hosts, so as to comprehensively detect the security status of the host, but the update of detection rules has a certain lag, and can only detect known intrusion behaviors, and cannot determine the attacker's subsequent attack path.

[0065] In addition, both of the above two security monitoring methods use traditional log storage technology, and there are risks such as log tampering and loss.

[0066] Host security status monitoring technologies based on traffic analysis, local scanning or other methods all adopt centralized management and can only obtain the security status of current network assets at the central node. There is a lack of unified and reliable communication and interconnection mechanisms between hosts, and it is impossible to know the security status of the communicating party. Since the detection is mainly carried out at the network backbone nodes or only the security status of the host itself is detected, it is impossible to monitor malicious traffic connections and attack behaviors within the local area network, and there are detection blind spots. In addition, due to the lack of unified and reliable log synchronization and storage technology, the existing technology cannot simultaneously meet the needs of discovering attack behaviors, restoring attack paths, determining the scope of attack impact, and attack evidence collection.

[0067] In view of the problems existing in the above related technologies, the present invention provides a host security monitoring method based on blockchain. Figure 1 The following schematically shows a flowchart of the steps of the host security monitoring method based on blockchain in some embodiments of the present disclosure. Figure 1 As shown, the method can mainly include the following steps:

[0068] Step S110: Monitor the traffic data of the host in the network communication, and determine whether the traffic data is malicious traffic.

[0069] The current host in the security monitoring state can communicate with other hosts on the Internet through wired communication links or wireless communication links. This step monitors the traffic data of the current host during the network communication process, and determines through traffic analysis whether the traffic data of the current communication is malicious traffic with attack behavior or carrying abnormal files.

[0070] Step S120. If the traffic data is malicious traffic, obtain the security status information of the host and save the security status information to the security status blockchain.

[0071] According to the judgment result in step S110, if the monitored traffic data is determined to be malicious traffic, then the current host is at risk of being maliciously invaded. The security status information of the host reflects whether the host has been successfully invaded by malicious traffic. If the current host is successfully invaded, the files, users, logs, networks, processes and other related contents of the current host may be abnormal. On the contrary, if the malicious traffic fails to invade the current host, the relevant content of the current host will be in a normal state. The security status information of the host can be expressed as two security status identifiers of "safe" and "invasion", where "invasion" indicates that the host has been successfully invaded. As one of the nodes in the security status blockchain network, the current host can save the security status information to the security status blockchain, so that other nodes in the security status blockchain network can obtain the security status of the current host in a timely and accurate manner.

[0072] Step S130. Generate an intrusion log corresponding to the malicious traffic, and save the intrusion log and security status information to the log storage blockchain.

[0073] For the intrusion behavior of malicious traffic monitored, the corresponding intrusion log can be recorded and generated. Saving the intrusion log and the host's security status information on the log storage blockchain at the same time can realize the shared storage of intrusion behavior and intrusion results, so that other nodes in the log storage blockchain network can effectively trace the historical records of security monitoring.

[0074] In the blockchain-based host security monitoring method provided in the embodiment of the present disclosure, the scope of impact of network attacks on the enterprise can be determined by quickly and accurately identifying the current security status of the host; by establishing host status information based on the state machine, the historical security status of the host can be traced; by identifying the source of intrusion at the host level, the attack path can be restored, and the emergency response capability of the enterprise can be improved; the host status identification and log storage are separated, and based on the decentralization, non-repudiation and other characteristics of blockchain, the non-repudiation and integrity of the log can be ensured.

[0075] The present disclosure can use a pre-trained machine learning model to make judgments on the attributes of traffic data. Figure 2 The flowchart of the steps for determining the attributes of flow data in some embodiments of the present disclosure is schematically shown. Figure 2 As shown, based on the above embodiment, the determination of whether the traffic data is malicious traffic in step S110 may include the following steps:

[0076] Step S210: Extract features from the flow data to obtain flow features of the flow data.

[0077] The traffic characteristics of the traffic data may include communication data characteristics related to the communication content and source host characteristics related to the source host. The source host is another host that performs data communication with the current host in the network, and the source host characteristics may include the current security status information of the source host and the historical security status information of the source host. The current security status information and the historical security status information of the source host may be information directly obtained from the security status blockchain.

[0078] Step S220: Input the traffic features into a pre-trained support vector machine model to identify the data type of the traffic data through the support vector machine model, where the data type includes normal traffic and malicious traffic.

[0079] Support Vector Machine (SVM) is a generalized linear classifier that performs binary classification of data in a supervised learning manner. Its decision boundary is the maximum margin hyperplane solved for the learning sample. SVM uses the hinge loss function to calculate the empirical risk and adds a regularization term to the solution system to optimize the structural risk. It is a classifier with sparsity and robustness. The pre-trained support vector machine model can analyze and calculate the extracted traffic features, and classify the corresponding traffic data into normal traffic or malicious traffic based on the analysis and calculation results.

[0080] Figure 3 The flowchart schematically shows the steps of extracting features from traffic data in some embodiments of the present disclosure. Figure 3 As shown, based on the above embodiment, step S210. extracting features from the flow data to obtain flow features of the flow data may include the following steps:

[0081] Step S310: Acquire application layer protocol traffic in the traffic data, and perform feature extraction on the application layer protocol traffic to obtain protocol traffic features of the application layer protocol traffic.

[0082] The application layer protocol defines how application processes running on different end systems transmit messages to each other, such as File Transfer Protocol (FTP), HyperText Transfer Protocol (HTTP), etc. By extracting the characteristics of application layer protocol traffic, we can obtain various protocol traffic characteristics such as network address, port, protocol type, connection time, data packet length, data packet content, etc.

[0083] Step S320: When there is a file object in the application layer protocol traffic, feature extraction is performed on the file object to obtain file object features of the file object.

[0084] In addition to the relevant data of the request message and the response message, the application layer protocol traffic can also carry file objects for file transfer. If there are file objects in the monitored application layer protocol traffic, this step can separate the file objects and extract their features to obtain the corresponding file object features. File object features can include, for example, file name, file format, file size, etc.

[0085] Step S330: Run the file object in the sandbox of the host, and determine the file running characteristics related to the host according to the running result.

[0086] Sandbox is a security mechanism that provides an isolated environment for running file objects. Sandbox can strictly control the resources that file objects can access during operation. For example, sandbox can provide disk and memory space that can be recycled after use. In the sandbox, network access, access to the real system, and reading of input devices are usually prohibited or strictly restricted, and all changes in the sandbox will not cause any loss to the operating system. In this step, the separated file object is run in the sandbox of the host, and the running process of the file object can be monitored safely and reliably, and then the file running characteristics related to the host are determined according to the running results of the file object. File running characteristics may include, for example, the CPU status, memory status, network export traffic status and other characteristics of the host.

[0087] Step S340: Determine the flow characteristics of the flow data according to the protocol flow characteristics, the file object characteristics and the file operation characteristics.

[0088] In the case where there are file objects in the application layer protocol traffic, the protocol traffic features, file object features, and file operation features extracted in the above steps can be combined into traffic features of the traffic data. If the application layer protocol traffic does not carry file objects, the traffic features of the corresponding traffic data can be directly determined based on the protocol traffic features.

[0089] If the monitored traffic data is judged to be malicious traffic based on traffic characteristics, then the malicious traffic may generate malicious attack behaviors such as intrusion into the host, and therefore will also have a certain degree of impact on the security status of the host. Figure 4 The following schematically shows a flowchart of steps for obtaining host security status information in some embodiments of the present disclosure. Figure 4 As shown, based on the above embodiment, obtaining the security status information of the host in step S120 may include the following steps:

[0090] Step S410: Obtain the operating status data of the host.

[0091] Step S420: Determine the security status information of the host according to the operation status data and malicious traffic.

[0092] The host's operating status data is obtained by collecting the current host's local information. Based on the analysis of the operating status data and malicious traffic, the current host's security status information can be determined. Figure 5 The following schematically shows a flowchart of steps for determining host security status information in some embodiments of the present disclosure. Figure 5 As shown, based on the above embodiment, step S420. Determining the security status information of the host according to the running status data and the malicious traffic may include the following steps:

[0093] Step S510: Extract features from the running status data to obtain status features of the host.

[0094] By extracting features from the running status data, we can obtain various status data such as the host's CPU usage, memory occupancy, network traffic size, and root privilege users.

[0095] Step S520: Determine traffic characteristics corresponding to malicious traffic.

[0096] The traffic features corresponding to malicious traffic may include various features such as protocol traffic features, file object features, and file operation features obtained by feature extraction in the above embodiments.

[0097] Step S530: Input the state characteristics and traffic characteristics into the pre-trained random forest model to obtain the security state information of the host.

[0098] The random forest model is a classifier that uses multiple decision trees to train and predict samples. In this step, the random forest model can be used to analyze the state characteristics and traffic characteristics to determine the host's security status information. Taking the binary classification identification as an example, this step can classify the host's security status information into two types: "safe" and "intrusion".

[0099] By using blockchain technology to save the host's security status information, data can be shared among multiple nodes in the blockchain network while ensuring the accuracy of the information. Figure 6 The following schematically shows a flowchart of steps for saving security status information based on blockchain in some embodiments of the present disclosure. Figure 6 As shown, based on the above embodiment, saving the security status information to the security status blockchain in step S120 may include the following steps:

[0100] Step S610: Save the network address and security status information of the host in the block body of the current security status block to be agreed upon.

[0101] Each security state block that makes up the security state blockchain includes two data storage areas: the block header and the block body. The block body is used to store all the data recorded in the current security state block, such as the host's network address and security state information, which are stored in the block body of the current security state block. The block header is used to store the link information between the current security state block and the previous security state block. The data stored in the block header can be used to link all security state blocks one by one to form a complete security state blockchain.

[0102] Step S620. When the block generation conditions are met, the block header data of the previous security state block in the security state blockchain is obtained, and the parent block hash value is calculated based on the block header data.

[0103] When certain block generation conditions are met, this step can obtain the block header data of the previous security state block (i.e., the most recently generated new security state block) in the security state blockchain network, and the parent block hash value of the current security state block can be calculated based on the block header data. For example, the SHA256 algorithm can be used to perform a hash operation on the block header data of the previous security state block to obtain a hash value as the parent block hash value of the current security state block. The block generation condition in this step can be that the generation time of the previous security state block reaches a time threshold, or that the data stored in the block body of the current security state block reaches a data volume threshold, and can also be any other preset conditions for triggering the generation of new blocks, which are not specifically limited in this embodiment.

[0104] Step S630: Calculate the block body hash value of the current security status block according to the data stored in the block body of the current security status block.

[0105] The block body of the current security status block stores the network address and security status information of the host formed within a period of time. According to the data stored in the block body, this step can obtain a hash value as the block body hash value of the current security status block. Taking hash coding as an example, all network addresses and security status information in the block body can be stored in the block body in the form of a Merkle Tree. Specifically, the network address and security status information can be stored in the leaf nodes of the Merkle tree, and the network address and security status information stored in each two adjacent leaf nodes are combined and hashed again to obtain the hash value stored in a child node. By using this method of combining the hash values ​​stored in the child nodes in pairs and performing hash operations layer by layer, a root node hash value can be finally obtained, and the root node hash value can be used as the block body hash value of the current security status block.

[0106] Step S640. Save the parent block hash value, block body hash value and current time stamp in the block header of the current security status block.

[0107] After the parent block hash value and the block body hash value are calculated by step S620 and step S630 respectively, this step can generate a timestamp according to the current time, and the timestamp is used to record the generation time of the current security status block. Then the parent block hash value, the block body hash value and the timestamp can be saved together in the block header of the current security status block.

[0108] Step S650. Broadcast the current security status block to the security status blockchain network to perform consensus authentication on the current security status block, and link the current security status block to the security status blockchain when the authentication passes.

[0109] After completing the preservation of the block header data, this step will broadcast the current security state block consisting of the block header and the block body to the security state blockchain network. After passing the consensus certification, all or part of the blockchain nodes in the security state blockchain network will save the current security state block, that is, complete the process of the current security state block being included in the security state blockchain.

[0110] Figure 7 The following schematically shows a flowchart of the steps of saving logs based on blockchain in some embodiments of the present disclosure. Figure 7 As shown, based on the above embodiment, saving the intrusion log and security status information to the log storage blockchain in step S130 may include the following steps:

[0111] Step S710: Save the network address, intrusion log and security status information of the host in the block body of the current log storage block to be agreed upon.

[0112] Each log storage block that makes up the log storage blockchain includes two data storage areas: the block header and the block body. The block body is used to store all the data recorded in the current log storage block, such as the host's network address, intrusion log, and security status information, which are stored in the block body of the current log storage block. The block header is used to store the link information between the current log storage block and the previous log storage block. Using the data stored in the block header, all log storage blocks can be linked one by one to form a complete log storage blockchain.

[0113] Step S720. When the block generation condition is met, the block header data of the previous log storage block in the log storage blockchain is obtained, and the parent block hash value is calculated based on the block header data.

[0114] When certain block generation conditions are met, this step can obtain the block header data of the previous log storage block (i.e., the most recently generated new log storage block) in the log storage blockchain network, and the parent block hash value of the current log storage block can be calculated based on the block header data. For example, the SHA256 algorithm can be used to perform a hash operation on the block header data of the previous log storage block to obtain a hash value as the parent block hash value of the current log storage block. The block generation condition in this step can be that the generation time of the previous log storage block reaches a time threshold, or that the data stored in the block body of the current log storage block reaches a data volume threshold, and can also be any other preset conditions for triggering the generation of new blocks, which are not specifically limited in this embodiment.

[0115] Step S730: Calculate the block body hash value of the current log storage block according to the data stored in the block body of the current log storage block.

[0116] The block body of the current log storage block stores the network address, intrusion log and security status information of the host formed within a period of time. According to the data stored in the block body, this step can obtain a hash value as the block body hash value of the current log storage block. Taking hash coding as an example, all network addresses, intrusion logs and security status information in the block body can be stored in the block body in the form of a Merkle Tree. Specifically, the network address, intrusion log and security status information can be stored in the leaf node of the Merkle tree, and the network address, intrusion log and security status information stored in each two adjacent leaf nodes are combined and hashed again to obtain the hash value stored in a child node. By using this method of performing hash operations on the hash values ​​stored in the child nodes in pairs and layer by layer, a root node hash value can be finally obtained, and the root node hash value can be used as the block body hash value of the current log storage block.

[0117] Step S740: Save the parent block hash value, block body hash value and current time stamp in the block header of the current log storage block.

[0118] After the parent block hash value and the block body hash value are calculated by step S720 and step S730 respectively, this step can generate a timestamp according to the current time, and the timestamp is used to record the generation time of the current log storage block. Then the parent block hash value, the block body hash value and the timestamp can be saved together in the block header of the current log storage block.

[0119] Step S750. Broadcast the current log storage block to the log storage blockchain network to perform consensus authentication on the current log storage block, and link the current log storage block to the log storage blockchain when the authentication is passed.

[0120] After completing the preservation of the block header data, this step will broadcast the current log storage block consisting of the block header and the block body to the log storage blockchain network. After passing the consensus certification, all or part of the blockchain nodes in the log storage blockchain network will save the current log storage block, that is, the process of entering the current log storage block into the log storage blockchain is completed.

[0121] It should be noted that, although the above exemplary embodiments describe the various steps of the method in the present disclosure in a specific order, this does not require or imply that the steps must be performed in this specific order, or that all steps must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0122] Figure 8 The following schematically shows a block diagram of a host security monitoring device based on blockchain in some embodiments of the present disclosure. Figure 8 As shown, the host security monitoring device 800 may mainly include:

[0123] The traffic data monitoring unit 810 is configured to monitor the traffic data of the host in the network communication and determine whether the traffic data is malicious traffic.

[0124] The security status saving unit 820 is configured to obtain the security status information of the host if the traffic data is malicious traffic, and save the security status information to the security status blockchain.

[0125] The log storage unit 830 is configured to generate an intrusion log corresponding to malicious traffic and save the intrusion log and security status information to the log storage blockchain.

[0126] In some embodiments of the present disclosure, based on the above embodiments, the traffic data monitoring unit 810 may further include:

[0127] A flow feature extraction unit is configured to extract features from the flow data to obtain flow features of the flow data;

[0128] The first model prediction unit is configured to input the traffic features into a pre-trained support vector machine model to identify the data type of the traffic data through the support vector machine model, where the data type includes normal traffic and malicious traffic.

[0129] In some embodiments of the present disclosure, based on the above embodiments, the traffic feature extraction unit may further include:

[0130] The protocol flow feature extraction unit is configured to obtain the application layer protocol flow in the flow data, and perform feature extraction on the application layer protocol flow to obtain the protocol flow feature of the application layer protocol flow;

[0131] A file object feature extraction unit is configured to extract features of the file object to obtain file object features of the file object when the file object exists in the application layer protocol traffic;

[0132] A file running feature extraction unit is configured to run the file object in the sandbox of the host and determine the file running feature related to the host according to the running result;

[0133] The first flow characteristic determination unit is configured to determine the flow characteristics of the flow data according to the protocol flow characteristics, the file object characteristics and the file operation characteristics.

[0134] In some embodiments of the present disclosure, based on the above embodiments, the security state saving unit 820 may include:

[0135] An operation status data acquisition unit is configured to acquire operation status data of the host;

[0136] The security status information determining unit is configured to determine the security status information of the host according to the operation status data and malicious traffic.

[0137] In some embodiments of the present disclosure, based on the above embodiments, the security status information determining unit may include:

[0138] A state feature extraction unit is configured to extract features from the running state data to obtain state features of the host;

[0139] A second traffic feature determination unit configured to determine traffic features corresponding to malicious traffic;

[0140] The second model prediction unit is configured to input the state feature and the traffic feature into a pre-trained random forest model to obtain the security state information of the host.

[0141] In some embodiments of the present disclosure, based on the above embodiments, the security state saving unit 820 further includes:

[0142] A first block body storage unit is configured to store the network address and security status information of the host in the block body of the current security status block to be agreed upon;

[0143] A first parent block hash value generating unit is configured to obtain block header data of a previous security state block in the security state blockchain when a block generation condition is met, and calculate a parent block hash value according to the block header data;

[0144] A first block body hash value generating unit, configured to calculate a block body hash value of a current security state block according to data stored in a block body of a current block;

[0145] A first block header storage unit is configured to store a parent block hash value, a block body hash value, and a timestamp of a current time in a block header of a current security status block;

[0146] The first block linking unit is configured to broadcast the current security status block to the security status blockchain network to perform consensus authentication on the current security status block, and link the current security status block to the security status blockchain when the authentication is passed.

[0147] In some embodiments of the present disclosure, based on the above embodiments, the log storage unit 830 may include:

[0148] A second block body storage unit is configured to store the network address, intrusion log, and security status information of the host in the block body of the current log storage block to be agreed upon;

[0149] The second parent block hash value generating unit is configured to obtain the block header data of the previous log storage block in the log storage blockchain when the block generation condition is met, and calculate the parent block hash value according to the block header data;

[0150] A second block body hash value generating unit, configured to calculate a block body hash value of the current log storage block according to data stored in the block body of the current log storage block;

[0151] A second block header storage unit is configured to store the parent block hash value, the block body hash value, and the timestamp of the current time in the block header of the current log storage block;

[0152] The second block linking unit is configured to broadcast the current log storage block to the log storage blockchain network to perform consensus authentication on the current log storage block, and link the current log storage block to the log storage blockchain when the authentication is passed.

[0153] The specific details of the above-mentioned blockchain-based host security monitoring device have been described in detail in the corresponding blockchain-based host security monitoring method, so they will not be repeated here.

[0154] The following describes the details of the host security monitoring method based on blockchain and the host security monitoring device based on blockchain in the above embodiments of the present disclosure in conjunction with a specific application scenario.

[0155] Fig. 9 The overall architecture of a host security monitoring system provided by the present disclosure is schematically shown. Fig. 9 As shown, the host security monitoring system 900 mainly includes three parts: a security management center 910, a local intrusion detection module 920 and a log storage module 930.

[0156] The security management center 910 is mainly responsible for the management and maintenance operations of the local intrusion detection module 920, distributing the manually trained and optimized machine learning detection model, and can also obtain logs from the log storage module 930 and display the log results.

[0157] The local intrusion detection module 920 is deployed on the operating system of each host under system monitoring and is the terminal node of the host security monitoring system. The local intrusion detection module 920 performs scheduled scanning and real-time traffic monitoring on the current host, and is responsible for identifying attack behaviors, recording attack logs and timestamps, maintaining the host security status identification, and calculating the hash of the host security status, logs, and timestamps.

[0158] The local intrusion detection module 920 may mainly include four submodules: a local information collection module 921, a local traffic monitoring module 922, an intrusion judgment module 923, and a host security status identification module 924. The host security status includes "safe" and "intrusion", and intrusion means that the host is successfully invaded.

[0159] The local information collection module 921 is responsible for collecting various status information of the local client.

[0160] The local traffic monitoring module 922 is responsible for monitoring the communication traffic of the current host in real time.

[0161] The intrusion judgment module 923 judges the results of local information collection and traffic sniffing through the security detection model, and makes further responses.

[0162] Fig.10The schematic diagram of the detection and judgment principle of the safety detection model is shown schematically. Fig.10 As shown, the local traffic monitoring module 922 can obtain the network traffic data set 1010 by monitoring the communication traffic of the current host, and then extract the characteristics of the application layer protocol traffic in the traffic data to obtain the protocol traffic characteristics. If the traffic data contains a file, the file is extracted and executed in the sandbox to extract the file object characteristics of the file itself and the file operation characteristics after the file is executed.

[0163] Among them, the protocol traffic characteristics can mainly include: source host network address, source host port, destination host network address, destination host port, protocol type, connection time, request packet length, request packet content, response packet length, response packet content, the number of the previous p communication connections that are the same as the current data packet, the source host's previous q security status identification, and the source host's current security status identification. p and q are preset numbers, for example, p can be 50 and q can be 5.

[0164] File object features and file operation features may mainly include: file name, file hash, user execution permissions, CPU status, memory status, hard disk read and write status, network export traffic status, system user changes, whether a daemon process is included, daemon process name, shell command execution records, and host firewall configuration changes.

[0165] The traffic characteristics of the above traffic data can be input into the intrusion judgment module 923, and then the support vector machine model 1020 judges whether the currently monitored traffic data is normal traffic or malicious traffic according to the characteristics of the traffic data.

[0166] If the traffic data is judged to be normal traffic, the current judgment result is directly output as safe.

[0167] If the traffic data is determined to be malicious traffic, it is necessary to further determine whether the current host is successfully invaded under the attack of the malicious traffic.

[0168] The local information collection module 921 can obtain the local feature data set 1030 of the host by collecting local information. The state features of the running state data can be obtained by extracting features from the local feature data set 1030.

[0169] The status characteristics of the running status data may mainly include: CPU usage, memory usage, network traffic size, root privilege users, system user changes, main command file link locations, main command file hashes, the last s login status of all users, and the last t shell execution records of users. Both s and t are preset numbers, for example, s can be 5 and t can be 100.

[0170] The state characteristics of the current host and the traffic characteristics of the malicious traffic are input into the intrusion judgment module 923, and then the random forest model 1040 judges whether the current host is successfully invaded based on the state characteristics and traffic characteristics, and outputs the corresponding judgment result.

[0171] The host security status identification module 924 can identify the current host security status based on the judgment result of the intrusion judgment module 923. When it is found that the attack traffic or host behavior characteristics match the intrusion rules, the host status is marked as "intrusion" and the logging function is enabled; when it is found that an intruding host sends malicious traffic to the host machine but the invasion is not successful, only the logging function is enabled.

[0172] When the host is invaded, the current state is marked as invasion, and the current host timestamp, security state identifier, and hash (timestamp + host IP + host security state) are written into the security state blockchain corresponding to the local intrusion detection module 920; the current host timestamp, security state identifier, intrusion log, and hash (timestamp + host IP + intrusion log + host security state) are reported to the log storage module 930, and written into the log storage blockchain by the log storage module 930.

[0173] The security status blockchain mainly maintains the security identification information of the host, ensuring that each host knows the security status identification of the other host during communication. When the local intrusion detection module 920 detects that a host with a security status identification of "intrusion" initiates a connection to the host machine, the communication traffic between the two parties can be analyzed and the attack behavior can be reported to the log storage module.

[0174] The intrusion logs for attacking network traffic can be divided into two levels: intrusion behavior and successful intrusion. Specifically, the level of the intrusion log reported to the log storage module 930 can be adjusted by setting a threshold.

[0175] The log storage module 930 is the information collection place of the host security monitoring system 900, and uses blockchain technology to store the client's reported logs. Compared with the security status blockchain, the log storage blockchain adds intrusion logs, and transfers the intrusion log storage from the client to the log storage blockchain, which can effectively reduce the client's load and ensure the non-repudiation and integrity of the information.

[0176] like Fig.11 As shown, the log storage module 930 includes multiple log storage nodes 931 that constitute the blockchain network. Each log storage node is deployed on a log server, and these nodes jointly maintain the log storage blockchain.

[0177] The local intrusion detection module 920 randomly selects n log storage nodes 931 that can communicate normally and sends intrusion logs to them, where n>=2, to prevent the log recording module from losing logs due to single point failure. After receiving the data, the log storage module node verifies the data and writes it into the log storage blockchain after successful verification.

[0178] Fig.12 The host security monitoring process based on the host security monitoring system is schematically shown. Fig.12 As shown, the monitoring process can mainly include the following steps:

[0179] Step S1201: Obtain host communication traffic.

[0180] Step S1202: Obtain the local status of the host.

[0181] Step S1203: Pre-process the host communication traffic to determine file objects and other traffic.

[0182] Step S1204: Execute the file object in the sandbox and extract features.

[0183] Step S1205: Input the features of other traffic and the features obtained by executing the file object into the support vector machine model.

[0184] Step S1206: Determine whether the current communication traffic data is malicious traffic based on the output result of the support vector machine. If it is not malicious traffic, the process ends; if it is malicious traffic, execute step S1207.

[0185] Step S1207: Input the characteristics of malicious traffic and the characteristics of the host local state into the random forest model.

[0186] Step S1208: Determine whether the current host is successfully invaded based on the output result of the random forest model. If the invasion fails, the process ends; if the invasion succeeds, steps S1209 and S1210 are executed.

[0187] Step S1209. Record the timestamp, hash and host status, save to the secure status blockchain and end the process.

[0188] Step S1210. Record the timestamp, log, hash and host status, save to the log storage blockchain and end the process.

[0189] The present disclosure grants intrusion detection capabilities to each asset in an organization, which can significantly improve the organization's intrusion detection capabilities. It can more comprehensively monitor the historical status information of the organization's assets, and can quickly and reliably record intrusion logs for attack behaviors, helping the organization to promptly determine the scope of attack impact, improve the organization's emergency response capabilities, and ensure the organization's business continuity. At the same time, reliable logs ensure the effectiveness of forensics.

[0190] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0191] In an exemplary embodiment of the present disclosure, a computer-readable medium is also provided, on which a computer program is stored, and when the computer program is executed by a processor, the above method of the present disclosure can be implemented. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product, which includes a program code; the program product can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, or a mobile hard disk, etc.) or on a network; when the program product is run on a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.), the program code is used to enable the computing device to execute the method steps in the above exemplary embodiments of the present disclosure.

[0192] See also Fig.13 As shown, according to the program product 1300 for implementing the above method according to an embodiment of the present disclosure, it can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a computing device (such as a personal computer, a server, a terminal device or a network device, etc.). However, the program product of the present disclosure is not limited to this. In this exemplary embodiment, the computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0193] The program product may adopt any combination of one or more readable media, which may be readable signal media or readable storage media.

[0194] The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more conductors, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0195] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0196] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0197] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user computing device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), etc.; or, it may be connected to an external computing device, such as through the Internet using an Internet service provider.

[0198] In an exemplary embodiment of the present disclosure, an electronic device is also provided, comprising at least one processor and at least one memory for storing executable instructions of the processor; wherein the processor is configured to execute the method steps in the above-mentioned exemplary embodiments of the present disclosure by executing the executable instructions.

[0199] Combine the following Fig.14The electronic device 1400 in this exemplary embodiment is described. The electronic device 1400 is only an example and should not bring any limitation to the functions and scope of use of the embodiment of the present disclosure.

[0200] See also Fig.14 As shown, the electronic device 1400 is in the form of a general computing device. The components of the electronic device 1400 may include, but are not limited to: at least one processing unit 1410, at least one storage unit 1420, a bus 1430 connecting different system components (including the processing unit 1410 and the storage unit 1420), and a display unit 1440.

[0201] The storage unit 1420 stores program codes, which can be executed by the processing unit 1410, so that the processing unit 1410 executes the method steps in the above-mentioned exemplary embodiments of the present disclosure.

[0202] The storage unit 1420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit 1421 (RAM) and / or a cache storage unit 1422, and may further include a read-only storage unit 1423 (ROM).

[0203] The storage unit 1420 may also include a program / utility 1424 having a set (at least one) of program modules 1425, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0204] Bus 1430 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0205] The electronic device 1400 may also communicate with one or more external devices 1500 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that allow a user to interact with the electronic device 1400, and / or communicate with any device that enables the electronic device 1400 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 1450. Furthermore, the electronic device 1400 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 1460. Fig.14As shown, the network adapter 1460 can communicate with other modules of the electronic device 1400 through the bus 1430. It should be understood that although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 1400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0206] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuit", "module" or "system".

[0207] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

[0208] The features, structures or characteristics described above may be combined in one or more embodiments in any suitable manner, and if possible, the features discussed in each embodiment are interchangeable. In the above description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, materials, etc. may be adopted. In other cases, known structures, materials or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

Claims

1. A host security monitoring method based on blockchain, characterized in that: The method comprises: Monitor the traffic data of the host in network communication and determine whether the traffic data is malicious traffic; If the traffic data is malicious traffic, the security status information of the host is obtained and saved to the security status blockchain, where the security status information of the host reflects whether the host has been successfully invaded by malicious traffic; Generate an intrusion log corresponding to the malicious traffic, and save the intrusion log and the security status information to the log storage blockchain to achieve shared storage of intrusion behavior and intrusion results; The determining whether the traffic data is malicious traffic includes: Performing feature extraction on the flow data to obtain flow features of the flow data; The extracting features from the flow data to obtain flow features of the flow data includes: Acquire application layer protocol traffic in the traffic data, and perform feature extraction on the application layer protocol traffic to obtain protocol traffic features of the application layer protocol traffic; When there is a file object in the application layer protocol flow, feature extraction is performed on the file object to obtain a file object feature of the file object; Running the file object in the sandbox of the host, and determining the file running characteristics related to the host according to the running result; The flow characteristics of the flow data are determined according to the protocol flow characteristics, the file object characteristics and the file operation characteristics.

2. The host security monitoring method based on blockchain according to claim 1 is characterized in that: The determining whether the traffic data is malicious traffic also includes: The traffic features are input into a pre-trained support vector machine model to identify the data type of the traffic data through the support vector machine model, where the data type includes normal traffic and malicious traffic.

3. The host security monitoring method based on blockchain according to claim 1 is characterized in that: The obtaining of the security status information of the host comprises: Obtaining operating status data of the host; The security status information of the host is determined according to the operating status data and the malicious traffic.

4. The host security monitoring method based on blockchain according to claim 3 is characterized in that: The determining the security status information of the host according to the running status data and the malicious traffic includes: Extracting features from the running status data to obtain status features of the host; Determining traffic characteristics corresponding to the malicious traffic; The state feature and the traffic feature are input into a pre-trained random forest model to obtain security state information of the host.

5. The host security monitoring method based on blockchain according to claim 1 is characterized in that: The step of saving the security status information to a security status blockchain includes: The network address of the host and the security status information are stored in the block body of the current security status block to be agreed upon; When the block generation condition is met, the block header data of the previous security state block in the security state blockchain is obtained, and the parent block hash value is calculated based on the block header data; Calculate the block body hash value of the current security status block according to the data stored in the block body of the current block; The parent block hash value, the block body hash value and the timestamp of the current time are saved in the block header of the current security status block; The current security status block is broadcast to the security status blockchain network to perform consensus authentication on the current security status block, and when the authentication is passed, the current security status block is linked to the security status blockchain.

6. The host security monitoring method based on blockchain according to claim 1 is characterized in that: The step of saving the intrusion log and the security status information to a log storage blockchain includes: The network address of the host, the intrusion log and the security status information are stored in the block body of the current log storage block to be agreed upon; When the block generation condition is met, the block header data of the previous log storage block in the log storage blockchain is obtained, and the parent block hash value is calculated based on the block header data; Calculating a block body hash value of the current log storage block according to the data stored in the block body of the current log storage block; The parent block hash value, the block body hash value and the timestamp of the current time are saved in the block header of the current log storage block; The current log storage block is broadcasted to the log storage blockchain network to perform consensus authentication on the current log storage block, and when the authentication is passed, the current log storage block is linked to the log storage blockchain.

7. A host security monitoring device based on blockchain, characterized in that: The device comprises: A traffic data monitoring unit is configured to monitor traffic data of a host in network communication and determine whether the traffic data is malicious traffic; wherein the determination of whether the traffic data is malicious traffic comprises: obtaining application layer protocol traffic in the traffic data, and performing feature extraction on the application layer protocol traffic to obtain protocol traffic features of the application layer protocol traffic; when a file object exists in the application layer protocol traffic, performing feature extraction on the file object to obtain file object features of the file object; running the file object in a sandbox of the host and determining file running features related to the host according to the running results; determining traffic features of the traffic data according to the protocol traffic features, the file object features and the file running features; inputting the traffic features into a pre-trained support vector machine model to identify the data type of the traffic data through the support vector machine model, wherein the data type comprises normal traffic and malicious traffic; A security status saving unit is configured to obtain security status information of the host and save the security status information to a security status blockchain when the traffic data is determined to be malicious traffic, wherein the security status information of the host reflects whether the host is successfully invaded by malicious traffic; The log storage unit is configured to generate an intrusion log corresponding to the malicious traffic, and save the intrusion log and the security status information to a log storage blockchain to achieve shared storage of intrusion behavior and intrusion results.

8. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: include: processor; A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 6 by executing the executable instructions.

Images