File detection method, device, equipment and storage medium

Abstract

This application discloses a file detection method, apparatus, device, and storage medium. The method comprises: obtaining identification information and path information of a data object in a target electronic file; matching at least one of the identification information and path information with a preset set of security data objects indicating the target electronic file; determining the target data object based on the matching result; and transmitting the data of the target data object to a detection device for static file detection. Embodiments of the present application can effectively filter security data objects in a target electronic file, thereby reducing the amount of data transmitted to the detection device, thereby conserving resources and improving the efficiency of static file detection.

Description

Technical Field

[0001] The present application relates to anti-virus technology, and in particular to a file detection method, apparatus, device and storage medium. Background Art

[0002] With the rapid development of computer technology and the widespread use of various computing devices (personal computers, laptops, tablets, smartphones, etc.), the number of malicious files is also growing rapidly.

[0003] In related technologies, when detecting malicious files based on static detection technology, it is often necessary to parse out all data objects contained in the file to be detected and then send them to a static engine for detection, resulting in large resource consumption and low detection efficiency. Summary of the Invention

[0004] In view of this, embodiments of the present application provide a file detection method, apparatus, device, and storage medium, aiming to save resource consumption and improve detection efficiency.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a file detection method, comprising:

[0007] Obtaining identification information and path information of the data object of the target electronic file;

[0008] matching, based on at least one of the identification information and the path information, with preset set information indicating a set of security data objects of the target electronic file;

[0009] determining a target data object based on a matching result of the matching;

[0010] The data of the target data object is sent to a detection device for static file detection.

[0011] In some embodiments, obtaining identification information and path information of the data object of the target electronic file includes:

[0012] The identification information and path information of each data object are obtained based on the document format of the target electronic file.

[0013] In some embodiments, obtaining identification information and path information of each data object based on the document format of the target electronic file includes at least one of the following:

[0014] If the document format of the target electronic file is a composite binary document (CFBC) format, obtaining identification information and path information of each data object in the target electronic file based on a file allocation table;

[0015] If the document format of the target electronic file is Open Office Extensible Markup Language (OOXML) format, obtaining identification information and path information of each data object in the target electronic file based on the central directory area;

[0016] If the document format of the target electronic file is a portable document (PDF) format, identification information of each data object in the target electronic file and reference relationships between the data objects are obtained, and path information of each data object is generated based on the reference relationships.

[0017] In some embodiments, the method further comprises:

[0018] The collection information is constructed based on identification information and path information of data objects of multiple target electronic files.

[0019] In some embodiments, matching at least one of the identification information and the path information with preset set information indicating a set of secure data objects of the target electronic file includes:

[0020] If it is determined that the identification information and / or the path information of the data object belongs to the set information, the corresponding data object is determined to be a safe data object.

[0021] In some embodiments, determining the target data object based on the matching result includes:

[0022] The safe data object is filtered out from the acquired data objects, and the target data object is determined based on the filtered data objects.

[0023] In some embodiments, before sending the data of the target data object to the detection device for static file detection, the method further includes:

[0024] Parse data based on the path information of the target data object to obtain data of the target data object.

[0025] In a second aspect, an embodiment of the present application provides a file detection device, comprising:

[0026] An acquisition module, used to acquire identification information and path information of a data object of a target electronic file;

[0027] a matching module, configured to match, based on at least one of the identification information and the path information, a preset set of security data objects indicating the target electronic file;

[0028] A filtering module, configured to determine a target data object based on a matching result of the matching;

[0029] The sending module is used to send the data of the target data object to the detection device for static file detection.

[0030] In a third aspect, an embodiment of the present application provides an electronic device comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein the processor, when running the computer program, executes the steps of the method described in the first aspect of the embodiment of the present application.

[0031] In a fourth aspect, an embodiment of the present application provides a storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method described in the first aspect of the embodiment of the present application are implemented.

[0032] The technical solution provided by the embodiments of the present application obtains identification information and path information of a data object in a target electronic file; matches at least one of the identification information and path information with a preset set of security data objects indicating the target electronic file; determines the target data object based on the matching result; and transmits the data of the target data object to a detection device for static file detection. The embodiments of the present application can effectively filter the security data objects in the target electronic file, thereby reducing the amount of data transmitted to the detection device, thereby saving resources and improving the efficiency of static file detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flowchart of the file detection method according to an embodiment of the present application;

[0034] Figure 2 This is a schematic diagram of the principle of a file allocation table in an example of this application;

[0035] Figure 3 This is a schematic diagram of the principle of a cross-reference table in an example of this application;

[0036] Figure 4 This is a flowchart of a file detection method in an application embodiment of the present application;

[0037] Figure 5 This is a schematic structural diagram of a file detection device according to an embodiment of the present application;

[0038] Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] The present application will be described in further detail below with reference to the accompanying drawings and embodiments.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application pertains. The terms used herein in the specification of this application are for the purpose of describing specific embodiments only and are not intended to limit this application.

[0041] In related technologies, when detecting malicious files based on static detection technology, it is often necessary to parse all data objects contained in the file to be detected and then send them to the static engine for detection, resulting in high resource consumption and low detection efficiency. Based on this, the embodiments of the present application provide a file detection method that can effectively filter safe data objects in the file to be detected, thereby reducing the amount of data sent to the detection device for static file detection, thereby saving resource consumption and improving the detection efficiency of static file detection.

[0042] like Figure 1 As shown, the embodiment of the present application provides a file detection method, including:

[0043] Step 101: Obtain identification information and path information of a data object of a target electronic file.

[0044] In the embodiments of the present application, the target electronic file is a composite document type electronic file. This composite document can be understood as a file containing not only text but also other information such as graphics, spreadsheet data, sound, video images, and hyperlinks. For example, the target electronic file can be an office document type electronic file, including but not limited to electronic files created in Word, Excel, and PowerPoint. The target electronic file can also include electronic files that store multiple data objects in a specific format, such as PDFs and email archives.

[0045] It is understood that the target electronic file in the embodiments of the present application uses a structured storage mechanism to store multiple data objects, for example, using the structured storage mechanism of COM (Component Object Model). COM, based on the file system, proposes the concept of structured storage to meet the needs of component software. Using structured storage, component programs can work well together. One component program can share the same file with another, just as one application program shares the same disk file system with another. COM is a set of binary interface standards for software components developed by Microsoft, which enables inter-process communication and dynamic object creation across programming languages.

[0046] In the embodiments of the present application, the data object of the target electronic file can be a stream object or a specific storage object. For example, in the case of an Office document file, its data object can be a stream object, which can be understood as a sequence containing data. In the case of a PDF file, its data object can be a specific storage object, including but not limited to: an array, a Boolean value, a dictionary, an integer, a tag name, a null value, a real number, and a string data. For example, each storage object can have an object number and a version number.

[0047] Exemplarily, the step of obtaining identification information and path information of a data object of a target electronic file includes:

[0048] The identification information and path information of each data object are obtained based on the document format of the target electronic file.

[0049] It is understandable that, because compound documents organize multiple different types of data objects and store them in a single electronic file, they typically have a location for storing path information. However, different compound documents store this path information in different ways. Therefore, in the embodiments of the present application, the path information of each data object is obtained based on different document formats and converted into a unified format, thereby eliminating the differences between different compound documents.

[0050] Exemplarily, the acquiring identification information and path information of each data object based on the document format of the target electronic file includes at least one of the following:

[0051] If the document format of the target electronic file is a Compound File Binary Format (CFBC) document format, obtaining identification information and path information of each data object in the target electronic file based on a file allocation table;

[0052] If the document format of the target electronic file is Office Open Extensible Markup Language (OOXML) format, obtaining identification information and path information of each data object in the target electronic file based on the central directory area;

[0053] If the document format of the target electronic file is a portable document format (PDF), identification information of each data object in the target electronic file and reference relationships between the data objects are obtained, and path information of each data object is generated based on the reference relationships.

[0054] Here, the CFBC format refers to a file format developed by Microsoft for implementing COM structured storage, which is used to store multiple data object contents in the same hard disk file. For example, Figure 2 As shown, a target electronic file in CFBC format is divided into multiple sectors, which are linked together via the File Allocation Table (FAT). Based on this, the FAT can be read to obtain the identification and path information of each data object. As shown in the figure, the path information for Data 1 is: Directory 1 / Directory 2 / Data 1.

[0055] The OOXML format is a compressed, XML-based (Extensible Markup Language) file format developed by Microsoft for representing Excel, Word, and PowerPoint documents. An OOXML target electronic file can be understood as a ZIP archive. The ZIP archive stores the path information for all files within the archive. For example, the ZIP archive's central directory area can store relevant information. This central directory area allows for the identification and path information of each data object within the target electronic file to be retrieved.

[0056] Here, the PDF format is a file format that presents documents in a manner that is independent of applications, hardware, and operating systems. The target electronic file in the PDF format has a cross-reference table for recording the relevant information of the data objects stored therein, wherein each data object is organized using a tree structure. In an embodiment of the present application, the identification information of each data object in the target electronic file and the reference relationship between the data objects can be obtained based on the cross-reference table, and the path information of each data object can be generated based on the reference relationship. For example, Figure 3 As shown in the figure, the cross-reference table starts with the word xref. In the figure, "05" represents 5 consecutive objects starting with object number 0. Each line below corresponds to the information of an object. The three parts represent: file offset, modification times, and existence. The corresponding object can be found in the PDF file through the file offset. Each object can use other objects through the object number. Figure 3 As shown, the path information of each data object is converted as follows:

[0057] Path information of obj 0: root / obj 0;

[0058] Path information of obj 1: root / obj 1;

[0059] Path information of obj 2: root / obj 1 / obj 2.

[0060] Step 102: Matching is performed based on at least one of the identification information and the path information with preset set information indicating a set of security data objects of the target electronic file.

[0061] Exemplarily, the collection information may be a whitelist, and thus at least one of the identification information and path information of the acquired data objects of the target electronic file is matched with the whitelist, thereby filtering out safe data objects in the target electronic file.

[0062] It is understandable that, before performing data object filtering, the method of the embodiment of the present application further includes:

[0063] The collection information is constructed based on identification information and path information of data objects of multiple target electronic files.

[0064] Exemplarily, the identification information and path information of data objects can be extracted from multiple target electronic files in advance, and the extracted identification information and path information of the data objects can be stored in a database. Then, a security audit can be performed on the information in the database, and the collection information can be constructed based on the results of the security audit, that is, a whitelist representing the collection of secure data objects is generated.

[0065] Here, the process of pre-extracting identification information and path information of data objects from a plurality of target electronic files may refer to the description of the aforementioned step 101 and will not be repeated here.

[0066] Here, security audit refers to the process of determining whether a data object is safe. Taking PDF format files as an example, the PDF format supports adding JavaScript code to the file to implement complex functions. However, since JavaScript is very flexible to use, it may be maliciously exploited by attackers. However, for the pictures added in the PDF format, they will only be read and displayed, with a single function. Attackers will not use them, and they can be judged as safe data objects that cannot be attacked. In this way, the aforementioned collection information, i.e., the whitelist, can be constructed based on the identification information and path information of the safe data objects identified after the security audit. It can be understood that the path information of the identified safe data objects is stored in the collection information.

[0067] Exemplarily, the matching based on at least one of the identification information and the path information with preset set information indicating a set of security data objects of the target electronic file includes:

[0068] If it is determined that the identification information and / or the path information of the data object belongs to the set information, the corresponding data object is determined to be a safe data object.

[0069] Exemplarily, it is possible to determine whether the identification information and / or path information of the data object of the target electronic file to be detected exists in the collection information based on a string search method. If so, the data object is determined to be a safe data object.

[0070] Step 103: Determine the target data object based on the matching result.

[0071] Exemplarily, determining the target data object based on the matching result includes:

[0072] The safe data object is filtered out from the acquired data objects, and the target data object is determined based on the filtered data objects.

[0073] It is understandable that based on the matching results, the security data objects in the target electronic file to be detected can be effectively filtered out, thereby reducing the amount of data sent to the detection device, saving resource consumption and improving the detection efficiency of static file detection.

[0074] Exemplarily, before sending the data of the target data object to the detection device for static file detection, the method further includes:

[0075] Parse data based on the path information of the target data object to obtain data of the target data object.

[0076] Here, when extracting data from the storage path of the target data object, there may often be differences in format, etc., and the data needs to be converted to a unified format, which in turn requires parsing. In the embodiment of the present application, since the safe data objects have been effectively filtered before parsing the data, the parsing workload can be effectively reduced, achieving the effect of lazy parsing.

[0077] Here, lazy parsing is different from traditional parsing, as it parses less data and is more efficient. For example, in an Office document, traditional parsing would traverse the entire file's data objects, extracting everything from the author information, text content, images, macro code, and URLs pointed to by hyperlinks. Lazy parsing, on the other hand, only parses the aforementioned target data objects. For example, lazy parsing skips the document's text content, images, and other information, parsing only relevant data objects like macro code.

[0078] Step 104: Send the data of the target data object to a detection device for static file detection.

[0079] Here, the detection device used for static file detection can be a static engine or a remote server, which is not limited in the embodiment of the present application.

[0080] It is understandable that the detection device may return information indicating whether the target electronic file is a malicious file based on the detection result.

[0081] The present application will be described in further detail below in conjunction with application examples.

[0082] like Figure 4 As shown, the file detection method of this application embodiment includes:

[0083] Step 1) For a document file library, extract the path information of the stream or object in the document file and generate a path information library.

[0084] Here, the document file library stores multiple electronic files of compound document types. The aforementioned electronic file-based document format can be used to obtain identification information and path information of each data object (stream object or storage object) to construct a path information library.

[0085] Step 2) Conduct a security audit on the path information database and build a whitelist.

[0086] Here, a security audit may be performed on each data object in the path information library, and the set information may be constructed based on the result of the security audit, that is, a whitelist representing the set of secure data objects may be generated.

[0087] Step 3) For the electronic file to be detected, obtain the identification information and path information of the data object.

[0088] Here, for office documents, the path information of all streams in the document file can be traversed. For PDF documents, the reference relationship of all objects in the document file can be traversed and the reference relationship can be converted into the path information of the data object.

[0089] Step 4) determines whether the data object hits the whitelist, if not, proceeds to step 5).

[0090] Here, whether the data object of the electronic file to be detected is in the whitelist is determined by string search. For example, if both the identification information and the path information of the data object hit the whitelist, step 5) is executed; otherwise, the data object is not processed.

[0091] Step 5), parse the flow on the path and submit it to the engine for detection.

[0092] Here, the data is parsed based on the path information of the target data object, and the data of the target data object is obtained and sent to the static engine for detection.

[0093] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a file detection device, which corresponds to the above-mentioned file detection method. The various steps in the above-mentioned file detection method embodiment are also fully applicable to the embodiment of the present file detection device.

[0094] like Figure 5 As shown, the file detection device includes: an acquisition module 501, a matching module 502, a filtering module 503 and a sending module 504, wherein the acquisition module 501 is used to obtain identification information and path information of the data object of the target electronic file; the matching module 502 is used to match at least one of the identification information and the path information with the preset set information of the security data object set indicating the target electronic file; the filtering module 503 is used to determine the target data object based on the matching result of the matching; and the sending module 504 is used to send the data of the target data object to the detection device for static file detection.

[0095] In some embodiments, the acquisition module 501 is specifically configured to:

[0096] The identification information and path information of each data object are obtained based on the document format of the target electronic file.

[0097] In some embodiments, the acquisition module 501 acquires identification information and path information of each data object based on the document format of the target electronic file, including at least one of the following:

[0098] If the document format of the target electronic file is a composite binary document (CFBC) format, obtaining identification information and path information of each data object in the target electronic file based on a file allocation table;

[0099] If the document format of the target electronic file is Open Office Extensible Markup Language (OOXML) format, obtaining identification information and path information of each data object in the target electronic file based on the central directory area;

[0100] If the document format of the target electronic file is a portable document (PDF) format, identification information of each data object in the target electronic file and reference relationships between the data objects are obtained, and path information of each data object is generated based on the reference relationships.

[0101] In some embodiments, the file detection device further includes: a construction module 505 for constructing the collection information based on identification information and path information of data objects of multiple target electronic files.

[0102] In some embodiments, the matching module 502 is specifically configured to:

[0103] If it is determined that the identification information and / or the path information of the data object belongs to the set information, the corresponding data object is determined to be a safe data object.

[0104] In some embodiments, the filtering module 503 is specifically configured to:

[0105] The safe data object is filtered out from the acquired data objects, and the target data object is determined based on the filtered data objects.

[0106] In some embodiments, the file detection device further includes: a parsing module 506, configured to parse data based on the path information of the target data object to obtain the data of the target data object.

[0107] In actual application, the acquisition module 501, matching module 502, filtering module 503, sending module 504, construction module 505 and parsing module 506 can be implemented by a processor in the file detection device. Of course, the processor needs to run the computer program in the memory to realize its functions.

[0108] It should be noted that the file detection device provided in the above embodiment is merely illustrated by the division of the aforementioned program modules when performing file detection. In actual applications, the aforementioned processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the aforementioned processing. Furthermore, the file detection device provided in the above embodiment and the file detection method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0109] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an electronic device. Figure 6 Only the exemplary structure of the electronic device is shown, not all structures, and can be implemented as needed. Figure 6 Partial or complete structure shown.

[0110] like Figure 6 As shown, the electronic device 600 provided in the embodiment of the present application includes: at least one processor 601, a memory 602, a user interface 603 and at least one network interface 606. The various components in the electronic device 600 are coupled together through a bus system 605. It can be understood that the bus system 605 is used to realize the connection and communication between these components. In addition to including a data bus, the bus system 605 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 6 Various buses are labeled as bus system 605.

[0111] The user interface 603 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0112] The memory 602 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device. Examples of such data include: any computer program used to operate on the electronic device.

[0113] The file detection method disclosed in the embodiments of the present application can be applied to or implemented by processor 601. Processor 601 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the file detection method can be completed by hardware integrated logic circuits in processor 601 or by software instructions. The aforementioned processor 601 can be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 601 can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented as being executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium located in memory 602. Processor 601 reads the information in memory 602 and, in conjunction with its hardware, completes the steps of the file detection method provided in the embodiments of the present application.

[0114] In an exemplary embodiment, the electronic device may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0115] It is understood that memory 602 can be volatile memory or non-volatile memory, or can include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disk, or compact disc read-only memory (CD-ROM); magnetic surface memory can be magnetic disk memory or tape memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0116] It is understood that the electronic devices of the embodiments of the present application may include but are not limited to personal computers, laptops, tablet computers, smart phones and other devices with data processing capabilities.

[0117] In an exemplary embodiment, the present application also provides a storage medium, namely, a computer storage medium, which may be a computer-readable storage medium, for example, including a memory 602 storing a computer program. The computer program may be executed by a processor 601 of an electronic device to complete the steps of the method described in the embodiment of the present application. The computer-readable storage medium may be a memory such as a ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0118] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0119] In addition, the technical solutions described in the embodiments of the present application can be arbitrarily combined without conflict.

[0120] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A file detection method, characterized in that: include: Obtaining identification information and path information of each data object based on a document format of a target electronic file, and converting the obtained path information into a unified format; the target electronic file includes an electronic file of a composite document type; and the data objects are stored in the target electronic file using a structured storage mechanism; matching, based on the identification information and the path information, with preset set information indicating a set of security data objects of the target electronic file; determining a target data object based on a matching result of the matching; The data of the target data object is sent to a detection device for static file detection.

2. The method according to claim 1, characterized in that The acquiring of identification information and path information of each data object based on the document format of the target electronic file includes at least one of the following: If the document format of the target electronic file is a composite binary document CFBC format, obtaining identification information and path information of each data object in the target electronic file based on the file allocation table; If the document format of the target electronic file is the Open Office Extensible Markup Language (OOXML) format, obtaining identification information and path information of each data object in the target electronic file based on the central directory area; If the document format of the target electronic file is a portable document (PDF) format, identification information of each data object in the target electronic file and reference relationships between the data objects are obtained, and path information of each data object is generated based on the reference relationships.

3. The method according to claim 1, characterized in that The method further comprises: The collection information is constructed based on identification information and path information of data objects of multiple target electronic files.

4. The method according to claim 1, wherein The matching based on the identification information and the path information with preset set information indicating a set of security data objects of the target electronic file includes: If it is determined that the identification information and the path information of the data object belong to the set information, the corresponding data object is determined to be a secure data object.

5. The method according to claim 4, characterized in that The determining the target data object based on the matching result includes: The safe data object is filtered out from the acquired data objects, and the target data object is determined based on the filtered data objects.

6. The method according to claim 1, wherein Before sending the data of the target data object to the detection device for static file detection, the method further includes: Parse data based on the path information of the target data object to obtain data of the target data object.

7. A file detection device, characterized in that: include: an acquisition module configured to acquire identification information and path information of each data object based on a document format of a target electronic file, and convert the acquired path information into a unified format; the target electronic file includes an electronic file of a composite document type; and the data object is stored in the target electronic file using a structured storage mechanism; a matching module, configured to match the identification information and the path information with preset set information indicating a set of security data objects of the target electronic file; A filtering module, configured to determine a target data object based on a matching result of the matching; The sending module is used to send the data of the target data object to the detection device for static file detection.

8. An electronic device, characterized in that: include: A processor and a memory for storing a computer program capable of being executed on the processor, wherein The processor is configured to execute the steps of the method according to any one of claims 1 to 6 when running a computer program.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images