A ransomware detection method, device, equipment and medium

Abstract

The present application relates to the technical field of integrated circuits, and particularly relates to a ransomware detection method, device, equipment and medium.The method comprises the following steps: traversing a target service directory and creating a virtual service directory with higher search priority than the target service directory based on the traversal result; marking a new file according to a preset marking rule when the new file is created; in response to detecting that a certain file operates on the virtual service directory, determining whether the certain file is marked; in response to the certain file being marked, scoring the operation to generate a score value; and determining whether the certain file belongs to ransomware based on the score value.The scheme of the present application creates a virtual service directory to trap files from the perspective of the user's service, which improves the security and reliability of the protection of key services against ransomware.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a ransomware detection method, apparatus, device, and medium. Background Technology

[0002] Ransomware is a new type of computer virus that primarily spreads through emails, Trojan programs, and malicious website installations. This type of virus is extremely malicious and harmful, causing incalculable losses to users once infected. Common ransomware targets document data on users' computers, encrypting document content using various encryption techniques and deleting the original files. Files can only be recovered by paying a ransom for the decryption key. It can spread through system vulnerabilities, Trojans, emails, and other means, and is one of the most dangerous virus programs in recent years. Ransomware is a nightmare for computer data centers; its rampant and difficult-to-defend nature permeates various industries, causing significant financial damage to numerous enterprise or organizational data centers every year.

[0003] Currently, there are two main methods to defend against ransomware: ransomware detection and removal techniques or ransomware decoy techniques. However, neither of these methods can cover all scenarios. For example, if the virus database on the internal network is not updated in a timely manner, the ransomware may not be detected. Some decoy techniques wait for the ransomware to encrypt itself and then detect it based on changes in the decoy file. This can lead to false positives and may also cause normal files to be encrypted during the detection process. Therefore, improvements are urgently needed. Summary of the Invention

[0004] In view of this, it is necessary to provide a ransomware detection method, device, equipment, and medium to address the above technical problems.

[0005] According to a first aspect of the present invention, a ransomware detection method is provided, the method comprising:

[0006] The target business directory is traversed, and a virtual business directory with a higher search priority than the target business directory is created based on the traversal results.

[0007] When creating a new file, the new file is marked according to a preset marking rule;

[0008] In response to detecting that a file is operating on the virtual service directory, it is determined whether the file has been tagged;

[0009] In response to a file being tagged, the operation is scored to generate a score value;

[0010] Based on the score, it is determined whether a certain file belongs to ransomware.

[0011] In some embodiments, the step of marking the new file according to a preset marking rule when creating a new file includes:

[0012] Obtain the file format, user creation information, and file source of the new file;

[0013] The file format, creator, and file source of the new file are matched with several preset file formats, several preset users, and several preset file sources to generate matching results;

[0014] Determine whether the new file belongs to the operational business file to generate a determination result;

[0015] The marking level is determined and a mark is added based on the matching result and the judgment result.

[0016] In some embodiments, the preset file formats include exe, js, wfs, and veb formats; the preset users include accessing users, unauthorized users, and disabled administrator users; the preset file sources include email, websites, unknown USB drives, and FTP servers; and the matching results include matching any one of the three items (file format, creating user, and file source), matching any two items, and matching all three items.

[0017] In some embodiments, the step of determining the tag level and adding a tag based on the matching result and the judgment result includes:

[0018] If the matching result is a match for any item and the new file does not belong to the operation business file, then the confirmation flag level is set to prompt, and a prompt flag is added to the new file;

[0019] If the matching result is that any two items match and the new file does not belong to the operation business file, then the flag level is confirmed as an alarm, and an alarm flag is added to the new file;

[0020] If the matching result is a triple match and the new file does not belong to the operation business file, then the label level is confirmed as a threat, and a threat label is added to the new file;

[0021] If the matching result is a triple match and the new file belongs to the operation business file, then the marking level is confirmed as dangerous, and a dangerous mark is added to the new file.

[0022] In some embodiments, the step of scoring the operation to generate a score value in response to the tagged file includes:

[0023] Each item in several preset file formats, several preset users, and several preset file sources is assigned a corresponding score.

[0024] The first score is calculated by summing the scores corresponding to the file format matching item of the file, the creation user matching item of the file, and the file source matching item of the file.

[0025] The corresponding scores are allocated for modifying the virtual business directory format and for the virtual business directory failing to open normally.

[0026] The second score is determined based on the matching between the status of the virtual business directory after the operation and the changes in the virtual business directory format and the inability to open the virtual business directory normally;

[0027] The first score and the second score are multiplied together to generate a score value.

[0028] In some embodiments, the step of determining whether a file belongs to ransomware based on the score value includes:

[0029] If the score value is greater than or equal to a preset minimum score value and less than or equal to a preset maximum score value, then the file is confirmed to be ransomware and the file is blocked.

[0030] If the score is less than the preset minimum score or greater than the preset maximum score, it is confirmed that the file does not belong to ransomware, and a reminder is issued to the user based on the file's tag.

[0031] In some embodiments, the method further includes:

[0032] In response to the detection that a file is operating on the virtual service directory and that file is not tagged, a prompt is sent to the user to confirm whether to close the file.

[0033] According to a second aspect of the present invention, a ransomware detection device is provided, the device comprising:

[0034] Create a module and configure it to traverse the target business directory and create a virtual business directory with a higher search priority than the target business directory based on the traversal results;

[0035] A tagging module, configured to tag new files according to preset tagging rules when creating new files;

[0036] The detection module is configured to determine whether a file has been tagged in response to the detection that a file has been used to operate on the virtual business directory.

[0037] The scoring module is configured to score the operation and generate a score value in response to a file being marked.

[0038] The determination module is configured to determine whether a file belongs to ransomware based on the score value.

[0039] According to a third aspect of the present invention, a computer device is also provided, the computer device comprising:

[0040] At least one processor; and

[0041] The memory stores computer programs that can run on the processor, which executes the aforementioned ransomware detection method when executing the program.

[0042] According to a fourth aspect of the present invention, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, performs the aforementioned ransomware detection method.

[0043] The aforementioned ransomware detection method creates a virtual business directory with a higher search priority than the target business directory. When creating new files, the method marks them according to preset marking rules. When an operation is performed on a file within the virtual business directory, the operation is scored if it is performed on a marked file. Finally, the score is used to determine whether a file belongs to ransomware. This method achieves targeted creation of decoy files from the user's business perspective, making the protection of critical businesses against ransomware more secure and reliable.

[0044] In addition, the present invention also provides a ransomware detection device, a computer device, and a computer-readable storage medium, which can achieve the above-mentioned technical effects, and will not be described in detail here. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a schematic flowchart of a ransomware detection method provided in one embodiment of the present invention;

[0047] Figure 2 A flowchart illustrating a ransomware detection method applied to a computer, provided as another embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of a ransomware detection device provided in one embodiment of the present invention;

[0049] Figure 4 This is an internal structural diagram of a computer device according to another embodiment of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to specific examples and the accompanying drawings.

[0051] It should be noted that all uses of "first" and "second" in the embodiments of the present invention are for the purpose of distinguishing two entities or parameters with the same name but different names. It is clear that "first" and "second" are only for the convenience of expression and should not be construed as limiting the embodiments of the present invention. Subsequent embodiments will not explain this in detail.

[0052] In one embodiment, please refer to Figure 1 As shown, the present invention provides a ransomware detection method, specifically, the method includes the following steps:

[0053] Step 101: Traverse the target business directory and create a virtual business directory with a higher search priority than the target business directory based on the traversal results;

[0054] In this embodiment, the virtual business directory is a directory result with the same structure and file format as the business directory but different content. The naming of the virtual directory can be set with reference to the search rules. For example, if the search is performed in alphabetical order from largest to smallest, the virtual directory name can be set to the letter "a", or a preset symbol can be added to the name so that the virtual business directory is searched before the original business directory.

[0055] Step 102: When creating a new file, mark the new file according to the preset marking rules;

[0056] Step 103: In response to detecting that a file is operating on the virtual business directory, determine whether the file has been marked.

[0057] Step 104: In response to the fact that a certain file is marked, the operation is scored to generate a score value;

[0058] Step 105: Determine whether a certain file belongs to ransomware based on the score value.

[0059] The aforementioned ransomware detection method creates a virtual business directory with a higher search priority than the target business directory. When creating new files, the method marks them according to preset marking rules. When an operation is performed on a file within the virtual business directory, the operation is scored if it is performed on a marked file. Finally, the score is used to determine whether a file belongs to ransomware. This method achieves targeted creation of decoy files from the user's business perspective, making the protection of critical businesses against ransomware more secure and reliable.

[0060] In some embodiments, step 102, which involves marking the new file according to a preset marking rule when creating a new file, specifically includes:

[0061] Obtain the file format, user creation information, and file source of the new file;

[0062] The file format, creator, and file source of the new file are matched with several preset file formats, several preset users, and several preset file sources to generate matching results;

[0063] Determine whether the new file belongs to the operational business file to generate a determination result;

[0064] The marking level is determined and a mark is added based on the matching result and the judgment result.

[0065] In some embodiments, the preset file formats include exe, js, wfs, and veb formats; the preset users include accessing users, unauthorized users, and disabled administrator users; the preset file sources include email, websites, unknown USB drives, and FTP servers; and the matching results include matching any one of the three items (file format, creating user, and file source), matching any two items, and matching all three items.

[0066] In some embodiments, the step of determining the tag level and adding a tag based on the matching result and the judgment result includes:

[0067] If the matching result is a match for any item and the new file does not belong to the operation business file, then the confirmation flag level is set to prompt, and a prompt flag is added to the new file;

[0068] If the matching result is that any two items match and the new file does not belong to the operation business file, then the flag level is confirmed as an alarm, and an alarm flag is added to the new file;

[0069] If the matching result is a triple match and the new file does not belong to the operation business file, then the label level is confirmed as a threat, and a threat label is added to the new file;

[0070] If the matching result is a triple match and the new file belongs to the operation business file, then the marking level is confirmed as dangerous, and a dangerous mark is added to the new file.

[0071] In some embodiments, step 104, which involves scoring the operation to generate a score value in response to the tagging of a file, specifically includes:

[0072] Each item in several preset file formats, several preset users, and several preset file sources is assigned a corresponding score.

[0073] The first score is calculated by summing the scores corresponding to the file format matching item of the file, the creation user matching item of the file, and the file source matching item of the file.

[0074] The corresponding scores are allocated for modifying the virtual business directory format and for the virtual business directory failing to open normally.

[0075] The second score is determined based on the matching between the status of the virtual business directory after the operation and the changes in the virtual business directory format and the inability to open the virtual business directory normally;

[0076] The first score and the second score are multiplied together to generate a score value.

[0077] In some embodiments, step 105, which involves determining whether a file belongs to ransomware based on the score, specifically includes:

[0078] If the score value is greater than or equal to a preset minimum score value and less than or equal to a preset maximum score value, then the file is confirmed to be ransomware and the file is blocked.

[0079] If the score is less than the preset minimum score or greater than the preset maximum score, it is confirmed that the file does not belong to ransomware, and a reminder is issued to the user based on the file's tag.

[0080] In some embodiments, the method further includes:

[0081] In response to the detection that a file is operating on the virtual service directory and that file is not tagged, a prompt is sent to the user to confirm whether to close the file.

[0082] In some embodiments, to facilitate understanding of the present invention, the following example demonstrates the application of this method to a computer. This embodiment provides another ransomware detection method, the main measures of which include the following three parts.

[0083] Part 1: Virtual file architecture for critical business operations. Create a directory with the same directory structure as the business directory under the user's critical data business directory, and name it using the initial naming convention so that it is accessed first during traversal.

[0084] Part Two: File Tagging and Alert Mechanism. Newly created files in the system, such as .exe, .js, and .jfs files, similar to ransomware files, are tagged.

[0085] Part 3: Real-time kernel detection. When a tagged process modifies or opens a file in the virtual file directory, causing the virtual file to become unreadable or unwriteable, an alert is issued.

[0086] Please refer to the following: Figure 2 The following details the implementation process of the method of the present invention:

[0087] The first step is to traverse the business directory specified by the customer, create a directory with the same structure and file format as the business directory, but with different content, and then name the directory the original name and hide it.

[0088] The second step is to implement a hook function in the kernel. When a new file is created, if the file is created by an abnormal user and the format is mostly exe, js, wfs, veb, etc., then the file is marked and recorded in the database.

[0089] For a specific example, please refer to Tables 1 to 4 to explain the file tagging method. Suppose that a certain file is an executable file in the format of .exe and is created by the user Test$ (hacker). The source of the file is a website. In this case, all files in Tables 1 to 3 will match the corresponding category. If the executable file of .exe can also operate on the target business, then the file will be marked with a danger tag.

[0090] Table 1. File formats and corresponding scores

[0091] Format js exe wfs Veb.. value 5 10 15 20

[0092] Table 2 Users and Corresponding Scores

[0093]

[0094] Table 3. Sources of the articles and their corresponding scores

[0095] source Email illegal websites USB flash drive FTP value 100 120 140 (Not commonly used) 160

[0096] Table 4 shows the format, the correspondence between various matching results from different user sources and the label levels.

[0097] mark Format user source other hint match warn match match threaten match match match Danger match match match Operation business files

[0098] It should be noted that the above definitions of file format, user, and file source, as well as the corresponding scores for each item, are for reference only. In the actual implementation process, users can set them according to the actual business needs of the computer.

[0099] Step 3: Use kernel technology to issue alerts for tagged actions that operate on the virtual file directory we defined. The virtual business directory differs from traditional decoy files. Traditional decoy files are relatively simple and can be bypassed. The virtual file architecture of the proposed virtual business directory is a copy of the business file directory and acts as a protective shield in front of it. Its complex directory structure provides valuable time for the system to detect virus behavior.

[0100] Monitor the actions of each file on the virtual business directory, and define the following two scenarios and their corresponding scores: modification of the file format of the virtual business directory (value: 10), and the case where the file cannot be opened normally and is suspected of being encrypted (value: 20).

[0101] The formula for calculating the overall score is as follows:

[0102] Score = Value1 (Tag Body) * Value2 (Monitoring Action Score);

[0103] Value1 (tag body) = V1 (format score) + V2 (user score) + V3 (source score);

[0104] Continuing with the example of an executable file created by the user Test$ (hacker) from an illegal website, the file's value (Value1, the tag body) is 10 + 60 + 120 = 190. If the file cannot be opened normally after operating on the virtual business directory, the score is 190 * 20 = 3800. If the final score falls between the preset minimum and maximum values, it is suspected to be a ransomware attack and will be intercepted. Furthermore, the following protection functions can be provided: for example, for malicious files or actions, we can alert the operator or directly refuse the operation, such as through targeted filtering and interception at the kernel level, notifying the user to handle the situation promptly.

[0105] The ransomware detection method of this embodiment has at least the following beneficial technical effects: (1) The protection of critical business is closer and more accurate by creating a virtual business directory; (2) The numerical parameters of the three dimensions of virus user, format and source are customized, making the search for virus files more flexible; (3) The score value of the access file subject and action behavior is calculated by a customized scoring formula, and finally the value is used to determine whether it is suspected to be ransomware, which is more intuitive.

[0106] In some embodiments, please refer to Figure 3 As shown, the present invention also provides a ransomware detection device 200, the device comprising:

[0107] Create module 201, configured to traverse the target business directory and create a virtual business directory with a higher search priority than the target business directory based on the traversal results;

[0108] The tagging module 202 is configured to tag the new file according to a preset tagging rule when a new file is created;

[0109] The detection module 203 is configured to determine whether a file has been marked in response to the detection that a file has been used to operate on the virtual business directory.

[0110] The scoring module 204 is configured to score the operation and generate a score value in response to a file being marked.

[0111] The determination module 205 is configured to determine whether a certain file belongs to ransomware based on the score value.

[0112] The aforementioned ransomware detection device creates a virtual business directory with a higher search priority than the target business directory. When creating a new file, it marks the new file according to a preset marking rule. When an operation is performed on a file within the virtual business directory, if the operation is performed on a marked file, the operation is scored. Finally, based on the score, it determines whether a file belongs to ransomware. This achieves targeted creation of decoy files from the user's business perspective, making the protection of critical businesses against ransomware more secure and reliable.

[0113] It should be noted that specific limitations regarding ransomware detection devices can be found in the limitations of ransomware detection methods described above, and will not be repeated here. Each module in the aforementioned ransomware detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0114] According to another aspect of the present invention, a computer device is provided, which may be a server, and its internal structure diagram is shown below. Figure 4 As shown. The computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the ransomware detection method described above. Specifically, the method includes the following steps:

[0115] The target business directory is traversed, and a virtual business directory with a higher search priority than the target business directory is created based on the traversal results.

[0116] When creating a new file, the new file is marked according to a preset marking rule;

[0117] In response to detecting that a file is operating on the virtual service directory, it is determined whether the file has been tagged;

[0118] In response to a file being tagged, the operation is scored to generate a score value;

[0119] Based on the score, it is determined whether a certain file belongs to ransomware.

[0120] According to another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, wherein when the computer program is executed by a processor, it implements the ransomware detection method described above, specifically including the following steps:

[0121] The target business directory is traversed, and a virtual business directory with a higher search priority than the target business directory is created based on the traversal results.

[0122] When creating a new file, the new file is marked according to a preset marking rule;

[0123] In response to detecting that a file is operating on the virtual service directory, it is determined whether the file has been tagged;

[0124] In response to a file being tagged, the operation is scored to generate a score value;

[0125] Based on the score, it is determined whether a certain file belongs to ransomware.

[0126] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0127] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0128] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method of detecting a ransomware, characterized by, The method comprises: traversing a target business directory and creating a virtual business directory with higher search priority than the target business directory based on the traversal result; when a new file is created, marking the new file according to preset marking rules, which comprises: obtaining the file format, the creation user and the file source of the new file; matching with a plurality of preset file formats, a plurality of preset users and a plurality of preset file sources respectively to generate a matching result; judging whether the new file belongs to an operation business file to generate a judgment result; determining a marking level based on the matching result and the judgment result and adding a mark; in response to detecting that a certain file operates on the virtual business directory, judging whether the certain file is marked; in response to the certain file being marked, scoring the operation to generate a score value, which comprises: respectively assigning a corresponding score value to each item in a plurality of preset file formats, a plurality of preset users and a plurality of preset file sources; calculating the sum of the score value corresponding to the file format matching item of the certain file, the score value corresponding to the creation user matching item of the certain file and the score value corresponding to the file source matching item of the certain file as a first score value; respectively assigning a corresponding score value to virtual business directory format modification and virtual business directory unable to be normally opened; determining a second score value based on the matching of the state of the virtual business directory after the operation with virtual business directory format modification and virtual business directory unable to be normally opened; multiplying the first score value and the second score value to generate a score value; determining whether the certain file belongs to a ransomware based on the score value.

2. The ransomware detection method of claim 1, wherein, The plurality of preset file formats comprises exe format, js format, wfs format and veb format, the plurality of preset users comprises access user, illegal user and disabled administrator user, the plurality of preset file sources comprises mailbox, website, unknown U disk and FTP server, and the matching result comprises any one matching, any two matching and three full matching of file format, creation user and file source.

3. The ransomware detection method of claim 2, wherein, The step of determining a marking level based on the matching result and the judgment result and adding a mark comprises: in response to the matching result being any one matching and the new file not belonging to an operation business file, confirming that the marking level is prompt and adding a prompt mark to the new file; in response to the matching result being any two matching and the new file not belonging to an operation business file, confirming that the marking level is warning and adding a warning mark to the new file; in response to the matching result being three full matching and the new file not belonging to an operation business file, confirming that the marking level is threat and adding a threat mark to the new file; in response to the matching result being three full matching and the new file belonging to an operation business file, confirming that the marking level is danger and adding a danger mark to the new file.

4. The ransomware detection method of claim 1, wherein, The step of determining whether the certain file belongs to a ransomware based on the score value comprises: In response to the score value being greater than or equal to a preset minimum score value and less than or equal to a preset maximum score value, it is determined that the certain file belongs to a ransomware, and the certain file is intercepted. In response to the score value being less than the preset minimum score value or greater than the preset maximum score value, it is determined that the certain file does not belong to a ransomware, and a user is prompted based on a tag of the certain file.

5. The ransomware detection method of claim 1, wherein, The method further comprises: In response to detecting that a certain file operates on the virtual business directory and the certain file is not tagged, a user is prompted to confirm whether to close the certain file.

6. A ransomware detection apparatus, characterized by, The device comprises: A creating module configured to traverse a target business directory and create a virtual business directory with a higher search priority than the target business directory based on a traversal result; A tagging module configured to tag a new file according to a preset tagging rule when the new file is created; A detecting module configured to, in response to detecting that a certain file operates on the virtual business directory, determine whether the certain file is tagged; A scoring module configured to, in response to the certain file being tagged, score the operation to generate a score value; A determining module configured to determine, based on the score value, whether the certain file belongs to a ransomware; The tagging module is configured to: obtain a file format of the new file, a creating user, and a file source; match the file format, the creating user, and the file source with a plurality of preset file formats, a plurality of preset users, and a plurality of preset file sources respectively to generate matching results; determine whether the new file belongs to an operating business file to generate a determination result; and determine a tagging level based on the matching results and the determination result and add a tag; The scoring module is configured to: assign a corresponding score value to each item in a plurality of preset file formats, a plurality of preset users, and a plurality of preset file sources respectively; calculate a sum of a score value corresponding to a file format matching item of the certain file, a score value corresponding to a creating user matching item of the certain file, and a score value corresponding to a file source matching item of the certain file as a first score value; assign a corresponding score value to a virtual business directory format modification and a virtual business directory unable to be normally opened respectively; determine a second score value based on a matching condition between a state of the virtual business directory after the operation and the virtual business directory format modification and the virtual business directory unable to be normally opened; and multiply the first score value and the second score value to generate a score value.

7. A computer device, characterized by Comprise: At least one processor; And A memory storing a computer program executable in the processor, the processor executing the program to execute the method of any one of claims 1-5.

8. A computer-readable storage medium storing a computer program, the computer-readable storage medium comprising: The computer program is executed by the processor to execute the method of any one of claims 1-5. The computer program is executed by the processor to execute the method of any one of claims 1-5.

Images