Methods, systems, and related devices for countering attacks

Abstract

This application discloses a method, system, and related equipment for combating attacks. The method includes: intercepting the malicious program's attack request when the upper-layer API of the controlled API sends an attack request to the controlled API; and returning the controlled API's preset parameters corresponding to the intercepted request in the attack request to the upper-layer API, making the malicious program believe that the attack request has been successfully completed. Intercepting the attack request sent from the upper-layer API to the controlled API can effectively prevent the attack request from affecting the normal operation of the system. Furthermore, by cleverly using misleading logic to return the controlled API's preset parameters corresponding to the intercepted request to the upper-layer API, the malicious program can be tricked into believing that the attack has been successfully completed, thereby effectively defending against attacks and ensuring the normal operation of the system process.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to methods, systems and related devices for combating attacks. Background Technology

[0002] In network security systems, it is common to encounter situations where we must confront malicious programs. Typically, malicious programs use brute force to terminate the processes of system components, rendering the system unable to function properly. However, there is currently no effective solution to this problem in terms of relevant technologies. Summary of the Invention

[0003] This application provides methods, systems, and related devices for combating attacks, used to prevent malicious programs from terminating system processes.

[0004] The first aspect of this application provides a method for resisting attacks, including:

[0005] When the API above the controlled API sends a malicious attack request to the controlled API, the attack request is intercepted;

[0006] The controlled API preset parameters corresponding to the intercepted request in the attack request are returned to the upper-level API, so that the malicious program believes that the attack request has been successfully completed.

[0007] The method described in the first aspect of this application may be implemented using the content described in the second aspect of this application.

[0008] A second aspect of this application provides a system for combating attacks, comprising: an interception unit and a processing unit;

[0009] The interception unit is used to intercept the attack request when the upper-level API of the controlled API sends an attack request of malicious program to the controlled API;

[0010] The processing unit is used to return the controlled API preset parameters corresponding to the intercepted request in the attack request to the upper-level API, so that the malicious program believes that the attack request has been successfully completed.

[0011] A third aspect of this application provides an electronic device, including:

[0012] Central processing unit, memory, and input / output interfaces;

[0013] The memory is either a short-term storage memory or a persistent storage memory;

[0014] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method described in the first aspect of the embodiments of this application or any specific implementation thereof.

[0015] A fourth aspect of this application provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the method described in the first aspect of this application or any specific implementation thereof.

[0016] The fifth aspect of this application provides a computer program product comprising instructions or a computer program, which, when run on a computer, causes the computer to perform the method described in the first aspect of this application or any specific implementation thereof.

[0017] As can be seen from the above technical solutions, the embodiments of this application have at least the following advantages:

[0018] When faced with an attack request sent from the upper-level API to the controlled API, intercepting the attack request can effectively prevent the attack request from affecting the normal operation of the system. By cleverly using the idea of ​​misdirection, the controlled API corresponding to the intercepted request is returned to the upper-level API with preset parameters, which can trick malicious programs into thinking that their attack has been successfully completed, thereby effectively defending against malicious attacks and ensuring that the system process continues to run normally. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0020] Figure 1 This is a schematic diagram of an application environment according to an embodiment of this application;

[0021] Figure 2 This is a schematic flowchart of a method according to an embodiment of this application;

[0022] Figure 3 This is another schematic flowchart of the method in an embodiment of this application;

[0023] Figure 4 This is another flowchart illustrating the method of an embodiment of this application;

[0024] Figure 5 This is a schematic diagram of the system according to an embodiment of this application;

[0025] Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] In the following description, expressions such as "one specific implementation" or "one specific example" are used, which describe a subset of all possible embodiments. However, it is understood that "one specific implementation" or "one specific example" can be the same subset or a different subset of all possible embodiments, and can be combined with each other without conflict. In the following description, the term "plural" means at least two. The statement that a certain value reaches a threshold (if it exists) as used in this application may, in some specific examples, include cases where the former is greater than the latter.

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0030] For ease of understanding and explanation, before providing a further detailed description of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0031] API: Short for Application Programming Interface, it is a set of conventions that connect different components of a software system. An API is an abstract interface. The main purpose of an API is to provide applications and developers with the ability to access a set of routines without needing to access the source code or understand the details of the internal workings. Software that provides the functionality defined by an API can be called an implementation of that API.

[0032] Disconnection: Generally, operating system process information is stored in a linked list. Disconnection refers to breaking a certain element in the aforementioned storage chain and then connecting the preceding and following elements together, making the element an independent, detached state. In the embodiments of this application, the processes in the linked list can be regarded as elements in general.

[0033] Hook: Can be translated as hook or hook. Before or during API execution, a hook can redirect the running instructions or logic from the original normal flow to the operation flow that the user wants to jump to. After the user-defined or arranged operation instructions are executed, it will return to the original place before the jump.

[0034] Please see Figure 1 , Figure 1This diagram illustrates an application environment applicable to embodiments of this application, including a terminal device 101 and a server 102. The server 102 is communicatively connected to the terminal device 101. The server 102 can be a traditional server or a cloud server, without specific limitations. Of course, the server 102 can also be a terminal device. The terminal device 101 can be various electronic devices with a display screen and supporting data input, including but not limited to smartphones, tablets, laptops, desktop computers, and wearable electronic devices. A client application can be installed on the terminal device 101, allowing users to communicate with the server 102 based on the client application (e.g., a communication app). The server 102 can deploy security components and an operating system such as Windows, which can be configured with different levels of APIs. In some example scenarios, malicious program attack requests can be sent to the server 102 configured with APIs via the client application of the terminal device 101. Specifically, the request can be sent to a certain level of API to terminate the security component process on the server 102, thereby preventing the system processes on the server 102 from functioning properly. In response to this, when the upper-level API of the controlled API sends an attack request from a malicious program to the controlled API, the method of this application embodiment can intercept the attack request to prevent the attack from affecting the system operation process; then, the preset parameters of the controlled API can be returned to the upper-level API, causing the malicious program to finally believe that the attack request has been successfully completed, thereby deceiving the malicious program without affecting the normal operation process of the system.

[0035] It should be noted that the methods or scenarios provided in this application embodiment can be implemented jointly by the terminal device and the server as described above, or entirely on the server side, or entirely on the terminal device side. The specific implementation can be determined according to the actual application scenario, and no restrictions are imposed here. For example, the malicious program and the attacked server can come from different device sides, or they can come from the same device side (e.g., the server can be attacked by a malicious program on the same side). In other words, the terminal device may not exist in reality.

[0036] The methods for countering attacks described in this application will be explained in further detail below.

[0037] Please see Figure 2 The first aspect of this application provides a specific embodiment of a method for countering attacks, which includes the following operational steps:

[0038] Step 21: Intercept malicious program attack requests.

[0039] When a higher-level API of the controlled API sends a malicious attack request to the controlled API, the malicious attack request is intercepted. This attack request can be seen as a signal to terminate the security component process.

[0040] Generally, information from a higher-level API can be passed to its next-level API, and so on, until it reaches the lowest-level API. Conversely, information from a lower-level API can be passed to its higher-level API, and so on, until it reaches the highest-level API, thus enabling information flow between APIs at different levels. For example, there can be six APIs at different levels from top to bottom. The controlled API can be any one of them, such as API number 4. Its upper-level API is API number 3. Malicious program attack requests can be sent directly to API number 3, or they can be sent to the upper-level APIs 1 or 2 and then passed to API number 3. When API number 3 sends an attack request to API number 4, it can intercept the attack request.

[0041] Step 22: Return the default parameters of the controlled API so that the malicious program thinks the attack has been successful.

[0042] For example, at least some requests in an attack request can be intercepted. Intercepted requests will not be sent to API 4 mentioned above, while uninterrupted requests (referred to as security requests) can be allowed through and sent to API 4 because they have little impact on the normal system process. To create the illusion of a successful attack for the malicious program, psychological principles can be used to mislead it. Specifically, the controlled API parameters corresponding to the intercepted requests in the attack request can be returned to the upper-level API, making the malicious program believe that the attack has been successfully completed. However, in reality, the security component or the entire system's processes continue to run normally and have not been terminated.

[0043] In summary, when faced with an attack request sent from the upper-layer API to the controlled API, the embodiments of this application intercept the attack request, which can effectively prevent the attack request from affecting the normal operation process of the system. Furthermore, by cleverly using the idea of ​​misdirection, the controlled API corresponding to the intercepted request is returned to the upper-layer API with preset parameters, which can trick malicious programs into believing that their attack request has been successfully carried out, thereby effectively defending against attacks and ensuring the normal operation of the system process.

[0044] Based on the examples above, some specific possible implementation examples will be provided below. In practical applications, the implementation details of these examples can be combined as needed according to the corresponding functional principles and application logic.

[0045] Please see Figure 3 and Figure 4 This application provides another specific embodiment of a method for countering attacks, which includes the following steps:

[0046] Step 30: Process controlled APIs.

[0047] Specifically, a hooking method can be used to block the controlled API from receiving attack requests, causing the attack request to be redirected to a preset API before it reaches the controlled API. For example, the location of the controlled API can be found, and user-constructed operation code can be deployed at that location (such as the interception operation code corresponding to step 31, which can be understood as constructing a preset API). This hooks (i.e., binds) an API, thus forming a controlled API. After hooking the API, the process of the controlled API function (such as the process receiving the attack request) can be replaced by the constructed code, i.e., the process of the preset API. This interferes with the program that should have executed the controlled API process, instead redirecting it to execute the preset API process (i.e., changing the running process), such as redirecting to execute step 31. Of course, whether to call back the original process of the controlled API (such as sending uninterrupted requests to the lower-level API of the controlled API) can be determined by the user-constructed code.

[0048] Step 31: Intercept malicious program attack requests.

[0049] In some specific examples, the specific steps of step 31 include:

[0050] The system filters out attack requests that belong to the filter list and intercepts them to form intercepted requests. The filter list includes at least one of the following: a preset path to the image file, a preset name to the image file, and a preset parameter name.

[0051] For example, after successfully hooking an API and identifying the controlled API (such as API 4 mentioned above), the normal process (such as API 3 sending the attack request to API 4) will redirect to a user-defined target API. This target API can be seen as filtering out information from the attack requests that belongs to the filter list, i.e., selecting request information that meets expectations. Of course, information that does not belong to the filter list can be classified as a security request and allowed to pass or be sent to the controlled API. Specifically, the target API can be registered with operating systems such as Windows, and the operating system can use the target API as a callback function before execution. When this callback function is triggered, it can retrieve the preset path and / or preset name and / or preset parameter names of the image file in the attack request. Then, it can intercept these filtered or retrieved request information to form the intercepted request.

[0052] It should be noted that operating systems are generally divided into application layer and kernel layer. Taking Windows operating system as an example, the application layer is also called ring 3, and the kernel layer is also called ring 0. APIs running in ring 3 are application layer APIs (also called upper-level APIs), and similarly, APIs running in ring 0 are kernel layer APIs (also called lower-level APIs). Therefore, in some specific examples, the aforementioned controlled APIs can be system kernel layer APIs. The reasons for this setting are as follows: Considering that in actual situations, attackers often use lower-level APIs, as a possible implementation, lower-level APIs can be controlled. For example, selecting system kernel layer APIs as controlled APIs makes it more practical and targeted to deal with the actual attack behavior of malicious programs. On the other hand, another reason for using system kernel layer APIs instead of application layer APIs as controlled APIs is that if higher-level APIs (such as API 2) are used as controlled APIs, then when faced with attack requests sent directly to API 4, the interception function that API 2 can jump to will not be able to jump and use, thus letting the attack request pass, resulting in an attack and affecting the normal process of the operating system. In addition, it should be mentioned that the benefits of making the kernel layer API a controlled API are as follows: the lower the level of the API, the more difficult it is to be attacked, so setting the kernel layer API as a controlled API can enhance the defense capability; generally, attack requests sent to the upper layer API will eventually be sent to the lower layer API, so setting the kernel layer API as a controlled API can provide a fallback against attacks and prevent attack requests from getting through and achieving an attack.

[0053] Step 32: Return the default parameters of the controlled API so that the malicious program thinks the attack has been successful.

[0054] In some specific examples, the returned preset parameter may refer to a unique parameter (specifically a parameter value or parameter name) that the operating system pre-sets for the controlled API. This preset parameter can be used to deceive malicious programs into believing that they have successfully terminated the security component process, or more broadly, to mislead malicious programs into believing that they have successfully terminated the normal operating system process.

[0055] Step 33: Disconnect the original process linked list corresponding to the attack request.

[0056] In some specific examples, considering that after receiving feedback that the attack was successful, the malicious program will initiate a verification operation to check the authenticity of the result in order to verify whether the attack has really successfully terminated the target process, the original process linked list corresponding to the attack request can be broken. This will cause the malicious program to believe that the attack was successful because it cannot find the target process that the intercepted request was intended to attack. In this way, with the help of preset parameters, the malicious program can be further deceived into believing that the attack has been successfully carried out, thus enhancing the credibility of the malicious program's attack result.

[0057] Specifically, step 33 may include: hiding or isolating the target process in the original process list to obtain a new process list composed of the target process's preceding and succeeding processes, making it impossible for the malicious program to find the target process in the new process list. This allows the malicious program to perceive a successful attack, enhancing its trust in the illusion that the security component process has been terminated. In this case, the security component process still exists and runs normally, but the malicious program cannot detect it. When the malicious program launches its next attack, if it finds the attack ineffective, it will inevitably assume the previous target was incorrect and will seek other suspicious modules as targets. Given the illusion of a successful previous attack, the malicious program is unsure where to focus its efforts. Therefore, this embodiment utilizes a strategy of using softness to overcome hardness, making it impossible for the attacker to clearly identify the target, increasing the attacker's attack cost, and thus providing effective defense for the normal operation of the system.

[0058] Step 34: Send any uninterrupted requests from the attack request to the controlled API.

[0059] In some specific examples, to prevent increased code development costs, consumption of system operating resources, or occupation of storage resources, uninterrupted requests in attack requests (such as security requests) can be allowed to be sent to the controlled API along the original process.

[0060] Based on the above description, the method in this application embodiment can also perform the following operations:

[0061] Tagging request information within attack requests and configuring attack detection logic. In specific examples, to effectively prevent malicious programs from launching attacks based on similar requests in the future, the request information in the aforementioned attack requests can be tagged. For example, request information belonging to the filter list can be tagged, and attack detection logic can be configured based on the tagged request information. This allows for the issuance of an attack warning when the tagged attack request is detected being sent to a lower-level API of the controlled API, thereby improving the tracking level and defense strength of security components and other system components against malicious attacks.

[0062] Configure and run access denial logic for the underlying APIs of the controlled API. In some specific examples, to address the possibility that attack requests might be sent to the underlying APIs of the controlled API, access denial logic can be configured for the underlying APIs to handle attack requests, and triggered when the underlying API receives an attack request. For example, this access denial logic could be the logic to deny attack requests access to the underlying API. This helps to further enhance the defense system's ability to resist malicious program attacks, building upon steps 31 and 32 above, ensuring the normal operation of the operating system and improving the user's experience in office work or gaming.

[0063] In summary, the method of this application can combine system kernel hooking technology and psychological misleading techniques to cleverly prevent malicious programs from forcibly terminating the running process of security components, thereby improving the system security level.

[0064] Steps 31 and 32 are similar to steps 21 and 22, and will not be described in detail again. The order in which any two steps between steps 32 and 34 are executed is not limited, and they can be executed simultaneously, depending on the situation.

[0065] Please see Figure 5 The second aspect of this application provides a specific example of a system for combating attacks, the system comprising: an interception unit and a processing unit;

[0066] The interception unit 501 is used to intercept the malicious program's attack request when the upper-level API of the controlled API sends the malicious program's attack request to the controlled API. If the controlled API does not receive the attack request, it will jump to the hooked API of the interception operation.

[0067] The processing unit 502 is used to return the controlled API preset parameters corresponding to the intercepted request in the attack request to the upper-layer API, so that the malicious program believes that the attack request has been successfully completed.

[0068] Optionally, the processing unit 502 is also used for:

[0069] The chain of the original process corresponding to the attack request is broken, so that the malicious program will not be able to find the target process that the intercepted request intended to attack and will consider the attack successful.

[0070] Optionally, the processing unit 502 is specifically used for:

[0071] The target process is hidden or isolated from the original process list to obtain a new process list composed of the preceding and following processes of the target process, so that the malicious program cannot find the target process in the new process list.

[0072] Optionally, the interception unit 501 is specifically used for:

[0073] The system filters out attack requests that belong to the filter list and intercepts them to form intercepted requests. The filter list includes at least one of the following: a preset path to the image file, a preset name to the image file, and a preset parameter name.

[0074] Optionally, the controlled API is the system kernel layer API.

[0075] Optionally, the processing unit 502 is also used for:

[0076] The controlled API is blocked from receiving attack requests by using a hook method, so that the attack request is redirected to a preset API before it is sent to the controlled API.

[0077] Optionally, the processing unit 502 is also used for:

[0078] Uninterrupted requests from attack requests are sent to the controlled API.

[0079] In this embodiment, the operations performed by each unit of the anti-attack system are similar to those described in the first aspect or any specific method embodiment of the first aspect, and will not be repeated here. Of course, the specific implementation process of each operation in the first aspect of this application can also be found in the relevant description of the second aspect.

[0080] Please see Figure 6 The electronic device 600 of this application embodiment may include one or more central processing units (CPUs) 601 and a memory 605, wherein the memory 605 stores one or more applications or data.

[0081] The memory 605 can be volatile or persistent storage. The program stored in the memory 605 can include one or more modules, each module including a series of instruction operations on the electronic device. Furthermore, the central processing unit 601 can be configured to communicate with the memory 605 and execute the series of instruction operations stored in the memory 605 on the electronic device 600.

[0082] Electronic device 600 may also include one or more power supplies 602, one or more wired or wireless network interfaces 603, one or more input / output interfaces 604, and / or one or more operating systems, such as Windows Server™, MacOSX™, Unix™, Linux™, FreeBSD™, etc.

[0083] The central processing unit 601 can perform the operations performed by the first aspect or any specific method embodiment of the first aspect, which will not be described in detail here.

[0084] This application provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the method as described in the first aspect or any specific implementation thereof.

[0085] This application provides a computer program product containing instructions or computer programs, which, when run on a computer, causes the computer to perform the method described in the first aspect or any specific implementation thereof.

[0086] It is understood that, in the various embodiments of this application, the sequence number of each step does not imply the order of execution. The execution order of each step should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0087] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system (if it exists) and device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0088] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system or apparatus, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0089] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0090] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0091] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product (computer program product) is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a business server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for countering attacks, characterized in that, include: In an operating system, when a higher-level API of a controlled API sends an attack request from a malicious program to the controlled API, the API is pre-defined to intercept the attack request. The preset API returns the preset parameters of the controlled API corresponding to the intercepted request in the attack request to the upper-level API, so that the malicious program believes that the attack request has been successfully completed; The preset parameters refer to parameter values ​​or parameter names that are pre-set for the controlled API; The original process list corresponding to the attack request is broken, so that the malicious program cannot find the target process that the intercepted request intended to attack and therefore considers the attack successful.

2. The method for countering attacks according to claim 1, characterized in that, The step of breaking the chain of the original process corresponding to the attack request includes: The target process is hidden or isolated from the original process list to obtain a new process list composed of the preceding and succeeding processes of the target process, so that the malicious program cannot find the target process in the new process list.

3. The method for countering attacks according to claim 1, characterized in that, The process of intercepting the attack request includes: The request information belonging to the filter list information in the attack request is filtered out, and the request information belonging to the filter list information is intercepted to form the intercepted request. The filter list information includes at least one of the following: a preset path of the image file, a preset name of the image file, and a preset parameter name.

4. The method for countering attacks according to claim 1, characterized in that, The controlled APIs are APIs at the system kernel layer.

5. The method for countering attacks according to claim 1, characterized in that, Before intercepting the attack request, the method further includes: The controlled API is blocked from receiving the attack request by using a hook method, so that the attack request is redirected to a preset API before it is sent to the controlled API.

6. The method for countering attacks according to claim 1, characterized in that, After intercepting the attack request, the method further includes: The uninterrupted requests in the attack request are sent to the controlled API.

7. A system for countering attacks, characterized in that, include: Interception unit and processing unit; The interception unit is used to intercept the attack request when the upper-level API of the controlled API sends an attack request of a malicious program to the controlled API in the operating system. The processing unit is used to return the preset parameters of the controlled API corresponding to the intercepted request in the attack request to the upper-level API, so that the malicious program believes that the attack request has been successfully completed. The preset parameters refer to the parameter values ​​or parameter names that are pre-set for the controlled API; the original process list corresponding to the attack request is broken, so that the malicious program considers the attack successful because it cannot find the target process that the intercepted request intended to attack.

8. An electronic device, characterized in that, include: Central processing unit, memory, and input / output interfaces; The memory is either a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Includes instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 6.

10. A computer program product comprising instructions or a computer program, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1 to 6.

Images