Lateral movement attack detection method and device based on abnormal link discovery in heterogeneous graph

Abstract

The present application proposes a method and device for detecting lateral movement attacks based on abnormal link discovery in heterogeneous graphs, which relates to the field of network security technology, including: obtaining log information, determining network entities based on the log information, and constructing a heterogeneous user authentication graph, wherein the heterogeneous user authentication graph includes network entities and the relationship between network entities; processing the heterogeneous user authentication graph according to a random walk neighbor node sampling strategy based on a meta-path to determine a set of neighbor nodes; performing feature aggregation on the set of neighbor nodes according to a meta-path attention mechanism to obtain a characterization vector of the login link; calculating the relative reconstruction error of the characterization vector, and identifying the login link according to the relative reconstruction error. The present invention processes the association between nodes based on the random walk neighbor node sampling strategy and the attention mechanism of the meta-path, automatically completes lateral movement identification according to the relative reconstruction error, does not require manual setting of anomaly detection thresholds, is easy to deploy and implement in actual network scenarios, and improves efficiency.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for detecting lateral movement attacks based on abnormal link discovery in heterogeneous graphs. Background Art

[0002] Advanced persistent threat (APT) attacks are characterized by complex processes, long duration, high concealment, and strong destructiveness, which seriously threaten the interests of organizations and the privacy of individual users. The APT life cycle includes six stages: intelligence reconnaissance and attack tool construction, attack tool delivery and initial intrusion, command and control (C&C) communication, lateral movement, network asset and data discovery, and the final attack target. Among them, lateral movement is the key for attackers to penetrate into the network, expand the scope of threats, and achieve the final attack goal. Accurately detecting and blocking lateral movement behavior can effectively defend against APT attacks and prevent major security incidents and economic losses.

[0003] The current lateral movement detection method based on the user authentication graph model has problems in detection accuracy and feasibility of the actual solution. First, in terms of detection effect, the current method is limited by the expressive power of isomorphic graphs or bipartite graph models, ignoring the rich multi-source heterogeneous information between various network entities and not fully exploring the internal network scenarios. Second, in terms of feasibility, the current method has idealized requirements in training data set construction and model deployment that are difficult to achieve in actual scenarios. Specifically, supervised learning methods require large-scale labeled data sets for model training, but label information is difficult to obtain in actual scenarios and samples are usually unbalanced. Unsupervised learning methods rely on pure benign data to complete normal behavior modeling, but in practice, due to the presence of noise and attack samples, it is difficult to ensure that all links in the current graph data are normal links. In addition, this method relies on manually set thresholds for anomaly identification, and the thresholds will greatly affect the detection effect. Manually setting the detection system threshold based on expert experience is difficult to operate in actual applications. Summary of the invention

[0004] To solve the above problems, a lateral movement attack detection method and device based on abnormal link discovery in heterogeneous graphs were proposed.

[0005] The first aspect of the present application proposes a lateral movement attack detection method based on abnormal link discovery in a heterogeneous graph, comprising:

[0006] Acquire log information, determine network entities according to the log information, and construct a heterogeneous user authentication graph, wherein the heterogeneous user authentication graph includes the network entities and the relationships between the network entities;

[0007] Processing the heterogeneous user authentication graph according to a random walk neighbor node sampling strategy based on a meta-path to determine a neighbor node set;

[0008] Perform feature aggregation on the neighbor node set according to the meta-path attention mechanism to obtain a representation vector of the login link;

[0009] A relative reconstruction error of the characterization vector is calculated, and the entry link is identified according to the relative reconstruction error.

[0010] Optionally, the log information includes one or more of a user authentication event log, a file access log, a process log, and a network flow log.

[0011] Optionally, the processing the heterogeneous user authentication graph according to the meta-path-based random walk neighbor node sampling strategy to determine the neighbor node set includes:

[0012] For a given heterogeneous user authentication graph G = <V,E,X,T V ,T E > and meta-path The transition probability of the i-th step in the random walk process under the meta-path node type constraint is:

[0013]

[0014] in Indicates that the type of node v is The set of adjacent nodes of

[0015] Nodes whose access count ranking is within a preset range are selected to form the neighbor node set.

[0016] Optionally, before performing feature aggregation on the neighbor node set according to the meta-path attention mechanism, the method further includes:

[0017] The feature aggregation expression of the meta-path attention mechanism is obtained and formulated as:

[0018]

[0019]

[0020] Among them, V A is a set of nodes of type A, P A is a set of symmetric meta-paths with A-type nodes as the starting and ending nodes, W A , A and α A Represent the weight matrix, bias vector and attention coefficient respectively, is a node v via meta-path p j Get the representation vector.

[0021] Optionally, the performing feature aggregation on the neighbor node set according to the meta-path attention mechanism to obtain a representation vector of the login link includes:

[0022] The attribute information X of the login link in the neighbor node set is recorded through the fully connected network e Encoded into vector h e ;

[0023] Process the neighbor node set according to the graph neural network to obtain the representation vector h of the user node u and the characterization vector h of the device node g ;

[0024] According to the h e 、 u With the h d Determine the characterization vector h of the login link A , wherein the

[0025] Optionally, calculating a relative reconstruction error of the characterization vector and identifying the login link according to the relative reconstruction error includes:

[0026] Inputting the representation vector into a white decoder and a gray decoder to obtain reconstruction errors of the representation vector on the white decoder and the gray decoder;

[0027] If the reconstruction error obtained on the white decoder is greater than the reconstruction error obtained on the gray decoder, the login link is considered as an abnormal login;

[0028] If the reconstruction error obtained on the white decoder is not greater than the reconstruction error obtained on the gray decoder, the login link is regarded as a normal login.

[0029] Optionally, the white decoder and the gray decoder include:

[0030] The white decoder is trained based on the normal login link samples, and the loss function is:

[0031]

[0032] in, represents the normal login link sample, D white represents the white decoder, A characterization vector representing the normal login link sample;

[0033] The white decoder and the gray decoder are trained based on unlabeled login link samples, and the loss function is:

[0034]

[0035] in, represents the unlabeled login link sample, D eray represents the gray decoder, A characterization vector representing the unlabeled login link sample.

[0036] The second aspect of the present application proposes a lateral movement attack detection device based on abnormal link discovery of a heterogeneous graph, comprising:

[0037] A construction module is provided to obtain log information, determine network entities according to the log information, and construct a heterogeneous user authentication graph;

[0038] A sampling module, processing the heterogeneous user authentication graph according to a random walk neighbor node sampling strategy based on a meta-path, and determining a neighbor node set;

[0039] A processing module, which performs feature aggregation on nodes in the neighbor node set according to a meta-path attention mechanism to obtain a representation vector of a login link;

[0040] An identification module calculates a relative reconstruction error of the characterization vector and identifies the login link according to the relative reconstruction error.

[0041] In a third aspect of the present application, a computer device is proposed, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method described in any one of the first aspects above is implemented.

[0042] In a fourth aspect of the present application, a non-temporary computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method described in any one of the first aspects above is implemented.

[0043] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0044] The random walk neighbor node sampling strategy based on meta-path and the attention mechanism process the association between nodes, and automatically complete the lateral movement identification according to the relative reconstruction error. There is no need to manually set the anomaly detection threshold. It is easy to deploy and implement in actual network scenarios to improve efficiency.

[0045] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0047] Figure 1 It is a flow chart of a lateral movement attack detection method based on abnormal link discovery of heterogeneous graphs according to an exemplary embodiment of the present application;

[0048] Figure 2 It is a block diagram of a lateral movement attack detection device based on heterogeneous graph abnormal link discovery according to an exemplary embodiment of the present application;

[0049] Figure 3 It is a block diagram of an electronic device. DETAILED DESCRIPTION

[0050] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0051] Figure 1 is a flow chart of a lateral movement attack detection method based on abnormal link discovery in a heterogeneous graph according to an exemplary embodiment of the present application. Figure 1 As shown, including:

[0052] Step 101, obtaining log information, determining network entities according to the log information, and constructing a heterogeneous user authentication graph, wherein the heterogeneous user authentication graph includes network entities and relationships between network entities.

[0053] In the embodiment of the present application, multiple types of log information such as user authentication event logs, file access logs, process logs, network flow logs, etc. are analyzed to extract network entities and construct a heterogeneous user authentication graph containing the relationship between users, devices, files, and processes. The relationship between various entities can be obtained based on the heterogeneous user authentication graph. The relationship between various types of network entities is as follows:

[0054] Login R L , the adjacency matrix is ​​M L , if user i attempts to authenticate to device j, then M L(i,j) =1, otherwise M L(i,j) =0;

[0055] Operation R O , the adjacency matrix is ​​M O , if user i uses device j, then M O(i,j) =1, otherwise M O(i,j) =0;

[0056] Run R R , the adjacency matrix is ​​M R , if process i runs on device j, then M R(i,j)=1, otherwise M R(i,j) =0;

[0057] CommunicationR Cn , the adjacency matrix is ​​M Cn , if there is a network communication flow between devices i and j, then M Cn(i,j) =1, otherwise M Cn(i,j) =0;

[0058] Control R Co , the adjacency matrix is ​​M Co , if user i controls process j, then M Co(i,j) =1, otherwise M Co(i,j) =0;

[0059] Visit R A , the adjacency matrix is ​​M A , if process i accesses file j during its execution, then M A(i,j) =1, otherwise M A(i,j) =0.

[0060] In order to more clearly express the complex association relationship between various types of network entities, multiple symmetric meta-paths with users and devices as start and end nodes are designed according to the heterogeneous user authentication graph as shown in the following table:

[0061]

[0062] Among them, the above table clearly illustrates the meta-path details obtained by the heterogeneous user authentication graph.

[0063] Step 102 : Process the heterogeneous user authentication graph according to the meta-path-based random walk neighbor node sampling strategy to determine a neighbor node set.

[0064] In order to reduce the dependence on label information, the present invention firstly uses a random walk neighbor node sampling strategy based on meta-path to process the heterogeneous user authentication graph and determine the neighbor node set in the encoding process of abnormal login link detection. The specific processing process is as follows: for a given heterogeneous user authentication graph G = <V,E,X,T V ,T E > and meta-path The transition probability of the i-th step in the random walk process under the meta-path node type constraint is:

[0065]

[0066] in Indicates that the type of node v is The set of adjacent nodes.

[0067] After obtaining the adjacent node set, nodes whose access count ranking is within a preset range are selected to form a neighbor node set.

[0068] In a possible embodiment, the top five nodes ranked by the number of visits are selected to form a neighbor node set.

[0069] Step 103: perform feature aggregation on the neighbor node set according to the meta-path attention mechanism to obtain a representation vector of the login link.

[0070] In the embodiment of the present application, after determining the set of neighbor nodes, considering that different meta-paths play different roles in lateral movement detection, the present invention uses a meta-path attention mechanism to complete node feature aggregation, and the feature aggregation expression operation is defined as follows:

[0071]

[0072]

[0073] Among them, V A is a set of nodes of type A, P A is a set of symmetric meta-paths with A-type nodes as the starting and ending nodes, W A ,b A and α A Represent the weight matrix, bias vector and attention coefficient respectively, is a node v via meta-path p j Get the representation vector.

[0074] In the present invention, according to the relationship between the nodes in the fully connected network and the graph neural network aggregated neighbor node set, the specific situation is as follows:

[0075] The attribute information X of the link in the neighbor node set is logged through the fully connected network e Encoded into vector h e ;

[0076] Process the neighbor node set according to the graph neural network to obtain the representation vector h of the user node u and the characterization vector h of the device node d ;

[0077] Finally, the login link attributes are combined with the user and device node information to obtain the login link representation vector h A ,in,

[0078] Step 104, calculate the relative reconstruction error of the characterization vector, and identify the login link according to the relative reconstruction error.

[0079] In this embodiment, the characterization vector h of the login link is AAfter being input into the decoder part, the relative reconstruction error of the login link is calculated to complete the abnormal login link identification.

[0080] The present invention adopts a dual decoder structure, including a white decoder and a gray decoder, and the process of training the two is as follows:

[0081] First, some normal login link samples are used as weak supervision information to train the white decoder, and the loss function is:

[0082]

[0083] in, Indicates the normal login link attribute, D white Represents white decoder.

[0084] Afterwards, for an unmarked login link, if the reconstruction error calculated on the white decoder is greater than the reconstruction error on the gray decoder, the link is regarded as an abnormal login; if the reconstruction error obtained on the white decoder is not greater than the reconstruction error obtained on the gray decoder, the login link is regarded as a normal login.

[0085] Correspondingly, the loss function of the white decoder and the gray decoder trained with unlabeled login link data is:

[0086]

[0087] in, Indicates the unmarked login link sample, D grat represents the gray decoder, Represents the representation vector of the unlabeled login link sample.

[0088] In addition, after the login link is identified, the normal and abnormal login links can be further distinguished by maximizing the mutual information between the abnormal link and its representation information. The present invention regards the abnormal login link detected by the dual decoder as a positive sample, and regards the pre-labeled and detected normal login link as a negative sample, uses a bilinear binary classifier as a discriminator, and maximizes the mutual information between the abnormal link and its representation information based on the Jenson-Shannon divergence:

[0089]

[0090] In summary, the training loss function of the detector is: Loss = Loss normal +Loss unlabel -λLoss rrg , where λ is a hyperparameter used to adjust the importance of the mutual information regularization term.

[0091] The embodiment of the present application is based on the neighbor node sampling strategy and attention mechanism of random walks of heterogeneous graph element paths, fully explores internal network scenarios, and automatically completes lateral movement recognition according to relative reconstruction errors through a dual decoder structure and mutual information regularization operation, thereby reducing the requirements for label information of the training data set, and getting rid of the reliance on manually set anomaly detection thresholds. It is also easy to deploy and implement in actual network scenarios, thereby improving efficiency.

[0092] Figure 2 200 is a block diagram of a lateral movement attack detection device based on heterogeneous graph abnormal link discovery according to an exemplary embodiment of the present application, as shown in FIG. Figure 2 As shown, it includes: a construction module 210, a sampling module 220, a processing module 230 and an identification module 240.

[0093] A construction module 210 is used to obtain log information, determine network entities based on the log information, and construct a heterogeneous user authentication graph;

[0094] The sampling module 220 processes the heterogeneous user authentication graph according to the random walk neighbor node sampling strategy based on the meta-path to determine the neighbor node set;

[0095] The processing module 230 performs feature aggregation on the nodes in the neighbor node set according to the meta-path attention mechanism to obtain a representation vector of the login link;

[0096] The identification module 240 calculates the relative reconstruction error of the characterization vector and identifies the entry link according to the relative reconstruction error.

[0097] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0098] Figure 3 A schematic block diagram of an example electronic device 300 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0099] like Figure 3As shown, the device 300 includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the device 300 can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0100] A number of components in the device 300 are connected to the I / O interface 305, including: an input unit 306, such as a keyboard, a mouse, etc.; an output unit 307, such as various types of displays, speakers, etc.; a storage unit 308, such as a disk, an optical disk, etc.; and a communication unit 309, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 309 allows the device 300 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0101] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above, such as the voice instruction response method. For example, in some embodiments, the voice instruction response method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 300 via ROM 302 and / or communication unit 309. When the computer program is loaded into RAM 303 and executed by the computing unit 301, one or more steps of the voice instruction response method described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the voice instruction response method in any other appropriate manner (e.g., by means of firmware).

[0102] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0103] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0104] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0105] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0106] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0107] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0108] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0109] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A lateral movement attack detection method based on abnormal link discovery in heterogeneous graphs, characterized in that: include: Acquire log information, determine network entities according to the log information, and construct a heterogeneous user authentication graph, wherein the heterogeneous user authentication graph includes the network entities and the relationships between the network entities; Processing the heterogeneous user authentication graph according to a meta-path-based random walk neighbor node sampling strategy to determine a neighbor node set; Perform feature aggregation on the neighbor node set according to the meta-path attention mechanism to obtain a representation vector of the login link; Calculating a relative reconstruction error of the characterization vector, and identifying the login link according to the relative reconstruction error; The calculating the relative reconstruction error of the characterization vector and identifying the login link according to the relative reconstruction error comprises: Inputting the representation vector into a white decoder and a gray decoder to obtain reconstruction errors of the representation vector on the white decoder and the gray decoder; If the reconstruction error obtained on the white decoder is greater than the reconstruction error obtained on the gray decoder, the login link is regarded as an abnormal login; If the reconstruction error obtained on the white decoder is not greater than the reconstruction error obtained on the gray decoder, the login link is regarded as a normal login.

2. The method according to claim 1, characterized in that The log information includes one or more of a user authentication event log, a file access log, a process log, and a network flow log.

3. The method according to claim 1, characterized in that: The step of performing feature aggregation on the neighbor node set according to the meta-path attention mechanism to obtain a representation vector of the login link includes: The attribute information of the link in the neighbor node set is logged in through the fully connected network Encoding to Vector ; Process the neighbor node set according to the graph neural network to obtain the representation vector of the user node and the characterization vector of the device node ; According to the , With the Determine the characterization vector of the login link , wherein the .

4. A lateral movement attack detection device based on abnormal link discovery in heterogeneous graphs, characterized in that: include: A construction module, configured to obtain log information, determine network entities according to the log information, and construct a heterogeneous user authentication graph, wherein the heterogeneous user authentication graph includes the network entities and the relationships between the network entities; A sampling module, used for processing the heterogeneous user authentication graph according to a random walk neighbor node sampling strategy based on a meta-path to determine a neighbor node set; A processing module, used for performing feature aggregation on nodes in the neighbor node set according to a meta-path attention mechanism to obtain a representation vector of a login link; An identification module, used to calculate a relative reconstruction error of the characterization vector, and identify the login link according to the relative reconstruction error; The identification module is further used for: Inputting the representation vector into a white decoder and a gray decoder to obtain reconstruction errors of the representation vector on the white decoder and the gray decoder; If the reconstruction error obtained on the white decoder is greater than the reconstruction error obtained on the gray decoder, the login link is regarded as an abnormal login; If the reconstruction error obtained on the white decoder is not greater than the reconstruction error obtained on the gray decoder, the login link is regarded as a normal login.

5. A computer device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images