A safety-related event detection method and terminal

Abstract

The application discloses a kind of safety-related event detection method and terminal, the first branch of the parallel structure model constructed is time convolution network model, the second branch is the black box reconstruction structure of auto-encoder, based on the safety-related event data set for training, the parallel structure model is trained, obtains the training completed parallel structure model, using the training completed parallel structure model to the safety-related event data of gathering for judging is detected, obtains event security score, according to event security score determines the safety index of safety-related event data, parallel structure model considers the feature attribute and time attribute of data simultaneously, ensure the accuracy of safety-related event detection, and parallel structure model double branch synchronous calculation, reduce the time required for detection, to effectively improve the precision and efficiency of security defense.

Description

Technical Field

[0001] The present invention relates to the field of security defense technology, and in particular to a security-related event detection method and terminal. Background Art

[0002] Security-related events include both normal and abnormal security-related events. In the current digital age, the complexity and frequency of security-related events are increasing, posing a threat to traditional rule-based security defenses. Therefore, real-time detection and accurate identification of security-related events have become a top priority.

[0003] However, existing technologies use time series data as input, reconstructing the sequence using a sliding window and an autoencoder composed of a long short-term memory network to calculate the reconstruction error and obtain anomaly detection results. This solution uses a basic machine learning model and a traditional single-branch structure to calculate the reconstruction error, using only the encoder result as the reconstruction error metric. The autoencoder's calculation only considers the reconstruction performance of the feature, ignoring the overall temporal continuity. In addition, the traditional single-branch structure not only has a long runtime but also has low accuracy.

[0004] Therefore, how to effectively improve the accuracy and efficiency of security defense is an urgent problem that technical personnel in this field need to solve. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a security-related event detection method and terminal, which can effectively improve the accuracy and efficiency of security defense.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A method for detecting security-related events, comprising the steps of:

[0008] Obtaining a security-related event dataset for training and constructing a parallel structure model, wherein the first branch of the parallel structure model is a temporal convolutional network model, and the second branch of the parallel structure model is a black box reconstruction structure of an autoencoder;

[0009] Training the parallel structure model based on the security-related event data set for training to obtain a trained parallel structure model;

[0010] Collecting security-related event data to be judged, and using the trained parallel structure model to detect the security-related event data to be judged to obtain an event safety score;

[0011] A security index of the security-related event data is determined according to the event security score.

[0012] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0013] A security-related event detection terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0014] Obtaining a security-related event dataset for training and constructing a parallel structure model, wherein the first branch of the parallel structure model is a temporal convolutional network model, and the second branch of the parallel structure model is a black box reconstruction structure of an autoencoder;

[0015] Training the parallel structure model based on the security-related event data set for training to obtain a trained parallel structure model;

[0016] Collecting security-related event data to be judged, and using the trained parallel structure model to detect the security-related event data to be judged to obtain an event safety score;

[0017] A security index of the security-related event data is determined according to the event security score.

[0018] The beneficial effects of the present invention are: the first branch of the constructed parallel structure model is a time convolutional network model, and the second branch is a black box reconstruction structure of the autoencoder. The parallel structure model is trained based on the security-related event data set used for training to obtain a trained parallel structure model. The trained parallel structure model is used to detect the collected security-related event data to be judged to obtain an event security score. The security index of the security-related event data is determined according to the event security score. The parallel structure model simultaneously considers the characteristic attributes and time attributes of the data, ensuring the accuracy of security-related event detection, and the two branches of the parallel structure model are calculated synchronously, which reduces the time required for detection, thereby effectively improving the accuracy and efficiency of security defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart of a method for detecting security-related events according to an embodiment of the present invention;

[0020] Figure 2 This is a schematic structural diagram of a security-related event detection terminal according to an embodiment of the present invention;

[0021] Figure 3 This is a detection flow chart of a security-related event detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] To illustrate the technical content, achieved objectives and effects of the present invention in detail, the following description is given in conjunction with the embodiments and accompanying drawings.

[0023] Please refer to Figure 1 , a security-related event detection method, comprising the steps of:

[0024] Obtaining a security-related event dataset for training and constructing a parallel structure model, wherein the first branch of the parallel structure model is a temporal convolutional network model, and the second branch of the parallel structure model is a black box reconstruction structure of an autoencoder;

[0025] Training the parallel structure model based on the security-related event data set for training to obtain a trained parallel structure model;

[0026] Collecting security-related event data to be judged, and using the trained parallel structure model to detect the security-related event data to be judged to obtain an event safety score;

[0027] A security index of the security-related event data is determined according to the event security score.

[0028] From the above description, it can be seen that the beneficial effects of the present invention are: the first branch of the constructed parallel structure model is a time convolutional network model, and the second branch is a black box reconstruction structure of the autoencoder. The parallel structure model is trained based on the security-related event data set used for training to obtain a trained parallel structure model. The trained parallel structure model is used to detect the collected security-related event data to be judged to obtain an event security score. The security index of the security-related event data is determined based on the event security score. The parallel structure model simultaneously considers the characteristic attributes and time attributes of the data to ensure the accuracy of security-related event detection, and the two branches of the parallel structure model are calculated synchronously, which reduces the time required for detection, thereby effectively improving the accuracy and efficiency of security defense.

[0029] Furthermore, the training of the parallel structure model based on the security-related event dataset for training to obtain a trained parallel structure model includes:

[0030] Performing data cleaning on the security-related event dataset used for training to obtain a cleaned security-related event dataset;

[0031] Reconstructing the cleaned security-related event dataset into groups using a window grouping mechanism to obtain a reconstructed security-related event dataset;

[0032] dividing the cleaned security-related event data set into first training data and first test data, and dividing the reconstructed security-related event data set into second training data and second test data;

[0033] Training the parallel structure model using the first training data and the second training data to obtain a preliminarily trained parallel structure model;

[0034] Performing a performance test on the preliminarily trained parallel structure model using the first test data and the second test data to obtain a test result;

[0035] If the test result meets the requirements, the parallel structure model that has been preliminarily trained is used as the parallel structure model that has been trained.

[0036] From the above description, we can see that there are two ways to process the data: one is to perform data cleaning only, and the other is to perform data cleaning + group reconstruction, which is more in line with the requirements of the subsequent parallel structure model for input data, thereby achieving better model training results.

[0037] Furthermore, the using the first training data and the second training data to train the parallel structure model to obtain a preliminarily trained parallel structure model includes:

[0038] Inputting the first training data and the second training data into the first branch and the second branch of the parallel structure model respectively to obtain a first output result;

[0039] Calculating a difference between the first output result and the safety-related event dataset used for training, and using the difference as a prediction error;

[0040] The internal parameters of the parallel structure model are updated with the goal of minimizing the prediction error to obtain a parallel structure model that has been preliminarily trained.

[0041] From the above description, it can be seen that the first training data and the second training data are respectively input into the first branch and the second branch of the parallel structure model to obtain the first output result, and the internal parameters of the parallel structure model are updated with the goal of minimizing the prediction error, thereby effectively improving the accuracy of the model and ensuring the accuracy of safety-related event detection.

[0042] Furthermore, the use of the trained parallel structure model to detect the security-related event data to be judged to obtain the event safety score includes:

[0043] Cleaning the security-related event data to be determined to obtain cleaned security-related event data, and grouping and reconstructing the cleaned security-related event data using a window grouping mechanism to obtain reconstructed security-related event data;

[0044] Inputting the cleaned safety-related event data and the reconstructed safety-related event data into the first branch and the second branch of the trained parallel structure model respectively to obtain a second output result;

[0045] An event safety score is calculated according to the second output result and the security-related event data.

[0046] From the above description, it can be seen that the cleaned security-related event data and the reconstructed security-related event data are respectively input into the first branch and the second branch of the trained parallel structure model to obtain the output results, which not only takes into account the characteristic attributes and time attributes of the data, but also improves the computational efficiency.

[0047] Furthermore, the calculating the event safety score according to the second output result and the security-related event data includes:

[0048]

[0049] In the formula, Score represents the event safety score, X test Represents the security-related event data, Y test Indicates the second output result, n test Indicates the number of security-related event data, y i Indicates the result of the model output of the i-th number, x i Represents the model input of the i-th number.

[0050] As can be seen from the above description, the event safety score is calculated based on the second output result and the security-related event data. The event safety score can accurately reflect the safety level of the security-related event and achieve more effective security-related event detection.

[0051] Furthermore, after using the trained parallel structure model to detect the security-related event data to be judged and obtaining the event safety score, the method further includes:

[0052] Determining the mean, minimum, and maximum safety scores of the events;

[0053] Determine a minimum value of the safety threshold according to the mean and minimum values ​​of the safety scores of the events;

[0054] Determine a maximum value of the safety threshold according to the mean and maximum values ​​of the safety scores of the events;

[0055] A safety threshold interval is generated according to the lowest value of the safety threshold and the highest value of the safety threshold.

[0056] As can be seen from the above description, the security threshold interval is not fixed, but is generated based on the event security score, so that the security threshold intervals for different events are different, which improves the adaptability of the security threshold interval and thus improves the reliability of security-related event detection.

[0057] Furthermore, determining the lowest value of the safety threshold according to the mean and minimum values ​​of the event safety scores includes:

[0058] lower=1 / 4(mean(Score)-min(Sciore));

[0059] Where, lower represents the lowest value of the safety threshold, mean(Score) represents the mean value of the safety score of the event, and min(Score) represents the minimum value of the safety score of the event;

[0060] Determining the highest value of the safety threshold according to the mean and maximum values ​​of the event safety scores includes:

[0061] upper=3 / 4(max(Score)-mean(Score));

[0062] In the formula, upper represents the highest value of the security threshold, and max(Score) represents the maximum value of the event security score.

[0063] From the above description, it can be seen that it is more objective and reasonable to determine the lowest value of the safety threshold based on the mean and minimum value of the event safety scores, and to determine the highest value of the safety threshold based on the mean and maximum value of the event safety scores.

[0064] Furthermore, determining the security index of the security-related event data according to the event security score includes:

[0065] If the event safety score is below the safety threshold range, determining that the safety index corresponding to the event safety score is a first preset value;

[0066] If the event safety score is above the safety threshold range, determining that the safety indicator corresponding to the event safety score is a second preset value;

[0067] If the event safety score is within the safety threshold range, the safety index corresponding to the event safety score is determined to be a third preset value.

[0068] From the above description, it can be seen that if the event safety score is below the security threshold range, it means that the security-related event is normal; if the event safety score is above the security threshold range, it means that the security-related event is abnormal; if the event safety score is within the security threshold range, it means that the security-related event is in a critical security state. Determining the safety index by comparing the event safety score with the security threshold range is simple and effective.

[0069] Furthermore, after determining the security index of the security-related event data according to the event security score, the method further includes:

[0070] Obtain the abnormal duration of the security-related event data whose safety indicator is the second preset value; if the abnormal duration exceeds a preset number of sampling periods, issue an early warning for the security-related event data whose safety indicator is the second preset value.

[0071] As can be seen from the above description, when the abnormal duration of security-related events exceeds a preset number of sampling periods, these events are warned to ensure safety.

[0072] Please refer to Figure 2 Another embodiment of the present invention provides a security-related event detection terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step in the above-mentioned security-related event detection method is implemented.

[0073] The above-mentioned security-related event detection method and terminal of the present invention can be applied to security-related event detection scenarios, and are described below through specific implementation methods:

[0074] Please refer to Figure 1 and Figure 3 , embodiment 1 of the present invention is:

[0075] A method for detecting security-related events, comprising the steps of:

[0076] S1. Obtain a security-related event dataset for training and construct a parallel structure model, wherein the first branch of the parallel structure model is a temporal convolutional network model, and the second branch of the parallel structure model is a black box reconstruction structure of an autoencoder.

[0077] The internal structure of the temporal convolutional network model sequentially performs convolution calculation, edge filling, function activation and discarding, and repeats the execution twice in sequence. The internal hidden layer undergoes zooming in and out, and the batch size parameter is initialized to s. The output of the first branch is set to The size is s×m×m.

[0078] The black box reconstruction structure of the autoencoder (AE) includes an encoder and a decoder, which automatically generate mapping functions f and g respectively. The output of the AE structure is The internal mapping function is learned using the long short-term memory network (LSTM). The mapping function f has a two-layer LSTM structure. According to the LSTM characteristics, f(X train ) has an input size of s×ω×m and outputs the last timestamp f(X train ) last The size is s×1×m, the mapping function g has two layers of LSTM structure, and the transposition f(X train ) last back Input mapping function g to get the output of the second branch The size is s×m×1.

[0079] The two branches are merged, and the batch processing s represents the total number of event data currently being processed. Each data in the batch is merged, and the first branch outputs Size m×m, second branch output The size is m×1, and the two are multiplied to obtain the final output of the parallel structure model The size is s×1×m.

[0080] S2, training the parallel structure model based on the security-related event dataset for training to obtain a trained parallel structure model, specifically including S21-S26:

[0081] S21. Clean the security-related event dataset used for training to obtain a cleaned security-related event dataset.

[0082] S22: Use a window grouping mechanism to group and reconstruct the cleaned security-related event dataset to obtain a reconstructed security-related event dataset.

[0083] For example, the cleaned security-related event dataset is X=(x1,x2,…,x i ,…,x n ), x i Represents the information collection under timestamp i, Represents a single piece of information in the information collection, initializes the window parameter ω and the initial sliding step size to 1, adds ω first timestamp information to the front of the cleaned security-related event dataset X, cuts the cleaned security-related event dataset, and uses the window data group to replace the information collection under a single timestamp. The expression is: x i →(x (i-ω) ,x (i-ω) ,…,x i-1), and thus obtain the reconstructed security-related event dataset.

[0084] S23: Divide the cleaned security-related event data set into first training data and first test data, and divide the reconstructed security-related event data set into second training data and second test data.

[0085] The first training data and the second training data include normal security-related event data, and the first test data and the second test data include normal security-related event data and abnormal security-related event data. The ratio of training data to test data in the original dataset is 3:7.

[0086] S24, using the first training data and the second training data to train the parallel structure model to obtain a preliminarily trained parallel structure model, specifically including S241-S243:

[0087] S241: Input the first training data and the second training data into the first branch and the second branch of the parallel structure model respectively to obtain a first output result.

[0088] Specifically, the first training data is input into the first branch of the parallel structure model, and the second training data is input into the second branch of the parallel structure model to obtain a first output result.

[0089] Assume that the original cleaned security-related event dataset X train Size is n train ×m, then the parallel structure model output Y size is n train ×m.

[0090] S242: Calculate the difference between the first output result and the security-related event dataset used for training, and use it as the prediction error, specifically:

[0091]

[0092] Where, Error represents the difference, X train represents the cleaned security-related event dataset, Y represents the first output result, n train Indicates the number of data items in the cleaned security-related event dataset, y i Indicates the result of the model output of the i-th number, x i Represents the model input of the i-th number.

[0093] S243 , updating the internal parameters of the parallel structure model with the goal of minimizing the prediction error, to obtain a parallel structure model that has been preliminarily trained.

[0094] The goal of minimizing the prediction error Loss is:

[0095]

[0096] During the iteration process, when the change of Loss is in a stable fluctuation, the parameter update is stopped and the parallel structure model is saved, that is, the parallel structure model that has been preliminarily trained is obtained.

[0097] S25. Use the first test data and the second test data to perform a performance test on the parallel structure model that has been preliminarily trained to obtain a test result.

[0098] S26. If the test result meets the requirement, the parallel structure model that has been preliminarily trained is used as the trained parallel structure model.

[0099] S3, collect the security-related event data to be judged, and use the trained parallel structure model to detect the security-related event data to be judged to obtain the event security score, such as Figure 3 As shown, specifically including S31-S34:

[0100] S31. Collect security-related event data to be judged.

[0101] S32. Clean the security-related event data to be determined to obtain cleaned security-related event data, and group and reconstruct the cleaned security-related event data using a window grouping mechanism to obtain reconstructed security-related event data.

[0102] S33: input the cleaned safety-related event data and the reconstructed safety-related event data into the first branch and the second branch of the trained parallel structure model respectively to obtain a second output result.

[0103] Specifically, the cleaned safety-related event data is input into the first branch of the trained parallel structure model, and the reconstructed safety-related event data is input into the second branch of the trained parallel structure model to obtain a second output result.

[0104] S34. Calculate an event safety score based on the second output result and the security-related event data, specifically:

[0105]

[0106] In the formula, Score represents the event safety score, X test Indicates the security-related event data to be judged, Y testIndicates the second output result, n test Indicates the number of security-related event data to be judged.

[0107] S4. Determine the mean, minimum, and maximum values ​​of the event safety scores.

[0108] S5. Determine the lowest value of the safety threshold according to the mean and minimum values ​​of the event safety scores, specifically:

[0109] lower=1 / 4(mean(Score)-min(Score));

[0110] Where, lower represents the lowest value of the safety threshold, mean(Score) represents the mean value of the safety score of the event, and min(Score) represents the minimum value of the safety score of the event;

[0111] S6. Determine the highest value of the safety threshold based on the mean and maximum values ​​of the event safety scores, specifically:

[0112] upper=3 / 4(max(Score)-mean(Score));

[0113] In the formula, upper represents the highest value of the security threshold, and max(Score) represents the maximum value of the event security score.

[0114] S7. Generate a safety threshold interval SafetyValve=[lower, upper] according to the lowest value of the safety threshold and the highest value of the safety threshold.

[0115] S8. Determine the security index of the security-related event data based on the event security score, such as Figure 3 As shown, specifically including S81-S83:

[0116] S81. If the event safety score is below the safety threshold range, determine that the safety index corresponding to the event safety score is a first preset value.

[0117] S82: If the event safety score is above the safety threshold range, determine that the safety index corresponding to the event safety score is a second preset value.

[0118] S83: If the event safety score is within the safety threshold range, determine that the safety index corresponding to the event safety score is a third preset value.

[0119] In an optional implementation, the first preset value is 1, the second preset value is 0, and the third preset value is *.

[0120] S9. Obtain the abnormal duration of the security-related event data whose security indicator is the second preset value.

[0121] In an optional implementation, while collecting the security-related event data to be determined, the process further includes: obtaining event information corresponding to the security-related event data collected by routing, wherein the event information includes an event time.

[0122] Specifically, the abnormal duration of the security-related event data in which the security indicator is the second preset value is obtained according to the event time.

[0123] S10. If the abnormality duration exceeds a preset number of sampling periods, an early warning is issued for the security-related event data whose security indicator is the second preset value.

[0124] For example, if the abnormality lasts for more than five sampling periods, an early warning is issued for the safety-related event data whose safety indicator is the second preset value, so that the staff can take emergency risk avoidance measures.

[0125] Please refer to Figure 2 , the second embodiment of the present invention is:

[0126] A security-related event detection terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step of the security-related event detection method in the first embodiment is implemented.

[0127] In summary, the present invention provides a security-related event detection method and terminal, in which the first branch of the constructed parallel structure model is a temporal convolutional network model, and the second branch is a black box reconstruction structure of an autoencoder. The parallel structure model is trained based on the security-related event data set used for training to obtain a trained parallel structure model. The trained parallel structure model is used to detect the collected security-related event data to be judged to obtain an event security score. The security index of the security-related event data is determined based on the event security score. The parallel structure model simultaneously considers the characteristic attributes and time attributes of the data to ensure the accuracy of security-related event detection, and the two branches of the parallel structure model are calculated synchronously, which reduces the time required for detection, thereby effectively improving the accuracy and efficiency of security defense. In addition, the security threshold interval is not fixed, but is generated based on the event security score, so that the security threshold interval of different events is different, which improves the adaptability of the security threshold interval, and thereby improves the reliability of security-related event detection. When the abnormal duration of a security-related event exceeds a preset number of sampling periods, these events are warned to ensure safety.

[0128] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's description and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for detecting security-related events, characterized in that: Including steps: Obtaining a security-related event dataset for training and constructing a parallel structure model, wherein the first branch of the parallel structure model is a temporal convolutional network model, and the second branch of the parallel structure model is a black box reconstruction structure of an autoencoder; Performing data cleaning on the security-related event dataset used for training to obtain a cleaned security-related event dataset; Reconstructing the cleaned security-related event dataset into groups using a window grouping mechanism to obtain a reconstructed security-related event dataset; dividing the cleaned security-related event data set into first training data and first test data, and dividing the reconstructed security-related event data set into second training data and second test data; Training the parallel structure model using the first training data and the second training data to obtain a preliminarily trained parallel structure model; Performing a performance test on the preliminarily trained parallel structure model using the first test data and the second test data to obtain a test result; If the test result meets the requirements, the parallel structure model that has been preliminarily trained is used as the parallel structure model that has been trained; Collecting security-related event data to be judged, and using the trained parallel structure model to detect the security-related event data to be judged to obtain an event safety score; Determining a security index of the security-related event data according to the event security score; The method of using the trained parallel structure model to detect the security-related event data to be judged to obtain the event safety score includes: Cleaning the security-related event data to be determined to obtain cleaned security-related event data, and grouping and reconstructing the cleaned security-related event data using a window grouping mechanism to obtain reconstructed security-related event data; Inputting the cleaned safety-related event data and the reconstructed safety-related event data into the first branch and the second branch of the trained parallel structure model respectively to obtain a second output result; Calculating an event safety score based on the second output result and the security-related event data; After detecting the security-related event data to be determined using the trained parallel structure model to obtain the event safety score, the method further includes: Determining the mean, minimum, and maximum safety scores of the events; Determine a minimum value of the safety threshold according to the mean and minimum values ​​of the safety scores of the events; Determine a maximum value of the safety threshold according to the mean and maximum values ​​of the safety scores of the events; A safety threshold interval is generated according to the lowest value of the safety threshold and the highest value of the safety threshold.

2. A security-related event detection method according to claim 1, characterized in that: The using the first training data and the second training data to train the parallel structure model to obtain a preliminarily trained parallel structure model includes: Inputting the first training data and the second training data into the first branch and the second branch of the parallel structure model respectively to obtain a first output result; Calculating a difference between the first output result and the safety-related event dataset used for training, and using the difference as a prediction error; The internal parameters of the parallel structure model are updated with the goal of minimizing the prediction error to obtain a parallel structure model that has been preliminarily trained.

3. A security-related event detection method according to claim 1, characterized in that: Calculating the event safety score according to the second output result and the security-related event data includes: ； In the formula, Score represents the event safety score, X test Indicates the security-related event data to be judged, Y test Indicates the second output result, n test Indicates the number of security-related event data to be judged, y i Indicates the result of the model output of the i-th number, x i Represents the model input of the i-th number.

4. A security-related event detection method according to claim 1, characterized in that: Determining the lowest value of the safety threshold according to the mean and minimum values ​​of the event safety scores includes: ； Where, lower represents the lowest value of the safety threshold, mean(Score) represents the mean value of the safety score of the event, and min(Score) represents the minimum value of the safety score of the event; Determining the highest value of the safety threshold according to the mean and maximum values ​​of the event safety scores includes: ； In the formula, upper represents the highest value of the security threshold, and max(Score) represents the maximum value of the event security score.

5. A security-related event detection method according to claim 1, characterized in that: Determining the security index of the security-related event data according to the event security score includes: If the event safety score is below the safety threshold range, determining that the safety index corresponding to the event safety score is a first preset value; If the event safety score is above the safety threshold range, determining that the safety indicator corresponding to the event safety score is a second preset value; If the event safety score is within the safety threshold range, the safety index corresponding to the event safety score is determined to be a third preset value.

6. A method for detecting security-related events according to claim 5, characterized in that: After determining the security index of the security-related event data according to the event security score, the method further includes: Obtaining the abnormal duration of the security-related event data whose security indicator is the second preset value; If the abnormality lasts for more than a preset number of sampling periods, an early warning is issued for the security-related event data whose security indicator is the second preset value.

7. A security-related event detection terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, each step of the security-related event detection method according to any one of claims 1 to 6 is implemented.

Images