Method, system, device and storage medium for realizing host security protection and early warning

Abstract

The present invention discloses a method, system, device and storage medium for achieving host security protection and early warning, belonging to the field of network security technology, and solving the technical problem of how to actively, efficiently and accurately implement risk protection measures and predict potential security threats. The method is as follows: based on modular RAG+fine-tuning Fine-Tuning technology, a hybrid enhancement strategy is implemented, structured prompt words are retrieved and generated, a standardized instruction set is output, invalid information branches are avoided, and data is updated in the security knowledge base to enhance the quality and accuracy of AI-Agent execution; an AI-Agent host security monitoring model is constructed, data on security vulnerabilities, user operations and network activities are analyzed and trained to obtain a mature risk monitoring model; the target's operating feature data is collected in real time, and data analysis and feature point extraction are performed; risk features are correlated and analyzed to generate a repair strategy that meets the instruction set trigger conditions, and future risk trends are predicted. Multi-dimensional and multi-level host security protection can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a method, system, device and storage medium for implementing host security protection and early warning. Background Art

[0002] With the development of the times and technological advancements, the development of network security continues to deepen. Early on, a key security concern was restricting computer access rights. Weak passwords and simple access control methods were vulnerable to hacker attacks. With the rapid development of the internet, security defenses such as encryption, virtual private networks (VPNs), and network traffic analysis have emerged, but most network security management focuses on passive defenses. Today, network security boundaries are becoming increasingly generalized and blurred, exhibiting characteristics such as volatility, complexity, ambiguity, and uncertainty. This exposes data assets to constant security threats. The emergence and development of artificial intelligence (AI), particularly the widespread application of deep learning, has provided new solutions that enhance the accuracy, real-time nature, and flexibility of risk identification, predict and identify potential security threats, and make network security management proactive.

[0003] With the widespread application of artificial intelligence (AI), large AI models have proven to have significant advantages in natural language understanding, complex data analysis, and rapid response. While AI offers numerous advantages in cybersecurity, it also presents new challenges and issues. Faced with complex and volatile network environments and attacks, proactively, efficiently, and accurately implementing risk mitigation measures and predicting potential security threats remain significant challenges. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned shortcomings of the prior art. The first purpose of the present invention is to provide a method for realizing host security protection and early warning, which can timely detect abnormal activities and potential security threats, and actively, efficiently and accurately implement risk protection measures.

[0005] The second purpose of the present invention is to provide a system for realizing host security protection and early warning.

[0006] A third object of the present invention is to provide a computer device.

[0007] A fourth object of the present invention is to provide a computer storage medium.

[0008] In order to achieve the above-mentioned first objective, the present invention provides a method for realizing host security protection and early warning, comprising the following steps:

[0009] S1. Build a cybersecurity knowledge base based on modular RAG technology, generate structured prompts based on the cybersecurity knowledge base and user task retrieval data, and output a standard instruction set. Based on the structured prompts and standard instruction set, interact with the AI-Agent and construct customized security monitoring requirements.

[0010] S2. Build a security protection monitoring model using deep learning technology based on the security monitoring requirements. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data. Collect data and build a training dataset. Train the vulnerability perception model, security protection model, and intrusion detection model based on the training dataset to obtain a mature security protection monitoring model.

[0011] S3. Based on a well-trained security protection monitoring model, monitor the target's operational characteristic data in real time and identify and extract risk characteristic data;

[0012] S4. Perform risk association analysis by analyzing security vulnerabilities, user operations, and network activity risk data. Generate a security transaction dataset based on the risk trigger conditions of the standard instruction set. Perform frequent item set mining on the security transaction dataset to obtain risk item sets and predict risk trigger conditions.

[0013] S5. Generate a risk trend analysis report based on the trigger conditions of the identified predicted risks and output the corresponding security repair strategy.

[0014] As a further improvement, step S1 specifically includes:

[0015] S11. Build an offline network security knowledge base based on modular RAG technology. The offline network security knowledge base includes knowledge data collection, structured processing, and text block segmentation functions.

[0016] S12. Embedding the embedding model in the offline network security knowledge base to build a vector database for converting text blocks of the offline network security knowledge base into vector data for easy retrieval operations;

[0017] S13. Generate structured prompt words by querying, reconstructing, sorting, and understanding the data in the offline network security knowledge base;

[0018] S14. Finally, use the Fine-Tuning technology to output the standard instruction set.

[0019] Furthermore, the modular RAG architecture improves performance by enhancing its functional modules, adding a search module for similarity retrieval, and making fine adjustments to the retrieval tool. The modular RAG architecture can add, replace, or adjust the workflow between modules according to specific task requirements.

[0020] Furthermore, step S2 specifically includes:

[0021] S21. Establish feature engineering for the security protection monitoring model, including data collection, data cleaning, feature extraction, feature selection, and labeling of normal and abnormal data samples, for use in training and testing sets for risk identification based on three aspects: security vulnerabilities, user operations, and network activity risk data;

[0022] S22. Build the vulnerability perception model, behavioral security protection model, and intrusion detection model based on the Long Short-Term Memory (LSTM) and Deep Q-Network (DQN) algorithms. Through continuous training, optimization, and adjustment, the vulnerability perception model, behavioral security protection model, and intrusion detection model have optimal fitting and generalization capabilities.

[0023] S23. Verify, evaluate and integrate the security protection monitoring model, including classification model evaluation and regression model evaluation.

[0024] Furthermore, the feature engineering includes an input layer, a feature extraction layer, and a neural network layer;

[0025] The input layer is a module for receiving the operational characteristic data of the monitoring target;

[0026] The feature extraction layer is a module for interpreting the instruction set and extracting instruction set features from the data of the input layer;

[0027] The neural network layer is used to perform deep learning and pattern recognition on the extracted features. The neural network layer includes multiple hidden layers, which are used to perform nonlinear transformation and feature extraction on the input data, thereby learning the high-level representation and abstract features of the data to better complete various complex tasks.

[0028] Furthermore, step S4 specifically includes:

[0029] S41. Serialize the activity data of three aspects, namely, security vulnerabilities, user operations, and network activity risk data, and convert them into standardized structured data corresponding to the security protection monitoring model;

[0030] S42. The standardized structure data is classified according to the monitoring indicators to obtain multiple data item sets, each data item set being a set of time series security transaction data sets for the monitoring indicator;

[0031] S43. Perform frequent item set mining on the time series security transaction data set based on the association analysis FP-growth algorithm, and output the risk item set that is higher than the preset threshold of the standard instruction set;

[0032] S44. Generate association rules based on the risk item set, evaluate them through support and confidence indicators to determine the reliability and importance of the rules, and identify the triggering conditions for predicting risks.

[0033] Furthermore, the process of risk association analysis includes association rule mining, association rule evaluation, result interpretation and application; association rule mining is to use the association analysis FP-growth algorithm to mine the data set to discover the association rules and patterns between different variables; association rule evaluation is to evaluate and screen the association rules obtained by mining, usually considering support and confidence indicators to determine the reliability and importance of the rules; result interpretation and application is to interpret and analyze the association rules obtained by mining to discover hidden risk information and trends in the data.

[0034] In order to achieve the above-mentioned second objective, the present invention provides a system for realizing host security protection and early warning, comprising:

[0035] The knowledge base module is used to build a cybersecurity knowledge base based on modular RAG technology, generate structured prompts based on the cybersecurity knowledge base and user task retrieval data, and output a standard instruction set. Based on the structured prompts and standard instruction set, it interacts with the AI-Agent and constructs customized security monitoring requirements.

[0036] A monitoring model module is used to build a security protection monitoring model based on the security monitoring requirements using deep learning technology. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data. The module collects data and builds a training dataset. The vulnerability perception model, security protection model, and intrusion detection model are trained based on the training dataset to obtain a mature security protection monitoring model.

[0037] The monitoring module is used to monitor the target's operational characteristic data in real time and identify and extract risk characteristic data based on a well-trained security protection monitoring model;

[0038] An association analysis module is used to perform risk association analysis by analyzing security vulnerabilities, user operations, and network activity risk data, generate a security transaction data set based on the risk trigger conditions of the standard instruction set, and perform frequent item set mining on the security transaction data set to obtain risk item sets and predict risk trigger conditions;

[0039] The risk trend analysis module is used to generate a risk trend analysis report based on the trigger conditions of the identified predicted risks and output corresponding security repair strategies.

[0040] In order to achieve the third objective above, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned method for host security protection and early warning when executing the computer program.

[0041] In order to achieve the fourth objective above, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned method for host security protection and early warning.

[0042] Beneficial effects

[0043] Compared with the prior art, the present invention has the following advantages:

[0044] The present invention uses modular RAG+fine-tuning technology to retrieve and generate standard instructions to meet complex and changeable risk monitoring needs, and uses deep learning technology to build a professional risk monitoring model to monitor security vulnerabilities, user operations and network activities in real time, and promptly discover abnormal activities and potential security threats; automatically respond to common network attacks and threats, reduce the need for manual intervention, and improve response speed and efficiency; continuously learn and adapt to new threats and attack methods through machine learning and deep learning technology, and improve the accuracy and credibility of security incidents; predict risk trends and potential security threats, and continuously optimize security strategies to provide personalized security recommendations, which are of great significance in responding to the increasingly complex Internet environment and security threats in the future. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a flow chart of the present invention;

[0046] Figure 2 This is a flow chart of the hybrid strategy of RAG+Fine-Tuning in the present invention. DETAILED DESCRIPTION

[0047] The present invention will be further described below with reference to the specific embodiments in the accompanying drawings.

[0048] See Figures 1 and 2 A method for implementing host security protection and early warning includes the following steps S1 to S5:

[0049] S1. Build a network security knowledge base based on modular RAG technology, generate structured prompt words based on the network security knowledge base and user task retrieval data, and output a standard instruction set. Interact with AI-Agent based on the structured prompt words and standard instruction set to construct customized security monitoring requirements.

[0050] Step S1 specifically includes:

[0051] S11. Build an offline network security knowledge base based on modular RAG technology. The offline network security knowledge base includes knowledge data collection, structured processing, and text block segmentation functions.

[0052] S12. Embedding the embedding model in the offline cybersecurity knowledge base to build a vector database for converting text blocks in the offline cybersecurity knowledge base into vector data to facilitate retrieval operations;

[0053] S13. Generate structured prompts based on the data in the offline cybersecurity knowledge base through query reconstruction, sorting, and semantic understanding.

[0054] S14. Finally, use the Fine-Tuning technology to output the standard instruction set.

[0055] In this example, the modular RAG architecture improves performance by enhancing its functional modules, such as adding a search module for similarity retrieval and making fine adjustments to the retrieval tool. Modular RAG can add, replace, or adjust the workflow between modules according to specific task requirements, thereby achieving greater diversity and flexibility. This design not only allows modular RAG to include two fixed modes: simple RAG and advanced RAG, but also expands to include multiple modules including search, memory, fusion, routing, prediction, and task adaptation to solve various problems. Fine-Tuning technology can be equipped on modular RAG, allowing it to have more refined standards on data sets in the field of network security, thereby optimizing the performance of command output and allowing the AI-Agent interacting with it to more accurately perform monitoring, early warning, and protection.

[0056] S2. Build a security protection monitoring model using deep learning technology based on security monitoring requirements. This model includes a vulnerability awareness model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data. Collect data and build a training dataset. Use this training dataset to train the vulnerability awareness model, security protection model, and intrusion detection model, resulting in a mature security protection monitoring model.

[0057] Step S2 specifically includes:

[0058] S21. Build feature engineering for security protection monitoring models, including data collection, data cleaning, feature extraction, feature selection, and labeling of normal and abnormal data samples. This will be used to categorize training and test sets for risk identification based on three aspects: security vulnerabilities, user operations, and network activity risk data.

[0059] S22. Build vulnerability perception models, behavioral security protection models, and intrusion detection models based on the Long Short-Term Memory (LSTM) and Deep Q-Network (DQN) algorithms. Through continuous training, optimization, and adjustment, these models achieve optimal fitting and generalization capabilities.

[0060] S23. Verify, evaluate and integrate security protection monitoring models, including classification model evaluation and regression model evaluation.

[0061] Feature engineering involves the input layer, feature extraction layer, and neural network layer. The input layer receives operational feature data of the monitored target. The feature extraction layer interprets the instruction set and extracts its features from the input layer data. The neural network layer performs deep learning and pattern recognition on the extracted features. The neural network layer, comprising multiple hidden layers, performs nonlinear transformations and feature extraction on the input data, thereby learning high-level representations and abstract features of the data to better accomplish various complex tasks.

[0062] S3. Based on a well-trained security protection monitoring model, monitor the target’s operational characteristic data in real time, and identify and extract risk characteristic data.

[0063] S4. Perform risk association analysis by analyzing security vulnerabilities, user operations, and network activity risk data. Generate a security transaction dataset based on the risk trigger conditions of the standard instruction set. Perform frequent item set mining on the security transaction dataset to obtain risk item sets and predict risk trigger conditions.

[0064] Step S4 specifically includes:

[0065] S41. Serialize activity data on security vulnerabilities, user operations, and network activity risk data and convert them into standardized structured data corresponding to the security protection monitoring model;

[0066] S42. The standardized structure data is classified according to the monitoring indicators to obtain multiple data item sets, each data item set being a set of time series security transaction data sets for the monitoring indicator;

[0067] S43. Perform frequent item set mining on the time series security transaction dataset based on the association analysis FP-growth algorithm, and output risk item sets that are higher than the preset threshold of the standard instruction set;

[0068] S44. Generate association rules based on the risk item set, evaluate them through support and confidence indicators to determine the reliability and importance of the rules, and identify the triggering conditions for predicting risks.

[0069] The risk association analysis process includes association rule mining, association rule evaluation, and result interpretation and application. Association rule mining uses the FP-growth algorithm to mine a dataset to discover association rules and patterns between different variables. Association rule evaluation involves evaluating and screening the mined association rules, typically considering support and confidence metrics to determine the reliability and importance of the rules. Result interpretation and application involves interpreting and analyzing the mined association rules to uncover hidden risk information and trends in the data.

[0070] In this example, FP-growth is an algorithm for efficiently mining frequent itemsets and association rules in data. It employs a divide-and-conquer strategy, compressing a database of frequent itemsets into a frequent pattern tree (FP-tree) while retaining the item set association information. The FP-tree is a compact data structure composed of a frequent item header table and an item prefix tree, which efficiently stores frequent item set information. This structure accelerates the entire data mining process. Compared to other association analysis algorithms such as Apriori, the FP-growth algorithm offers performance advantages, enabling faster mining of frequent itemsets and association rules. Through association analysis using the FP-growth algorithm, potential risks can be effectively identified, such as excessive system load, frequent network activity, and unusual operational behavior, which could be potential threats to an attacker, and corresponding risk trigger conditions can be generated.

[0071] S5. Generate a risk trend analysis report based on the trigger conditions of the identified predicted risks and output the corresponding security repair strategy, which adopts the existing mature repair strategy.

[0072] A system for implementing host security protection and early warning, comprising:

[0073] The knowledge base module is used to build a cybersecurity knowledge base based on modular RAG technology. It generates structured prompts based on the cybersecurity knowledge base and user task retrieval data, and outputs a standard instruction set. Based on the structured prompts and standard instruction set, it interacts with the AI-Agent and constructs customized security monitoring requirements.

[0074] The monitoring model module is used to build a security protection monitoring model based on security monitoring needs using deep learning technology. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data. The module collects data and builds a training dataset. The vulnerability perception model, security protection model, and intrusion detection model are trained based on the training dataset to obtain a mature security protection monitoring model.

[0075] The monitoring module is used to monitor the target's operational characteristic data in real time and identify and extract risk characteristic data based on a well-trained security protection monitoring model;

[0076] The association analysis module is used to perform risk association analysis by analyzing security vulnerabilities, user operations, and network activity risk data. Based on the risk trigger conditions of the standard instruction set, it generates a security transaction data set. It then performs frequent item set mining on the security transaction data set to obtain risk item sets and predict risk trigger conditions.

[0077] The risk trend analysis module is used to generate a risk trend analysis report based on the trigger conditions of the identified predicted risks and output corresponding security repair strategies.

[0078] A computer device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the method for realizing host security protection and early warning is implemented.

[0079] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned method for achieving host security protection and early warning.

[0080] The present invention uses modular RAG+fine-tuning technology to learn and adapt to increasingly complex risk monitoring needs, outputs standardized responsive instructions, and interacts with AI-Agent to extract, analyze, and predict the operational characteristic data of the monitored targets, thereby achieving data security protection and early warning for the monitored targets, in response to the increasingly complex and changing network security threats.

[0081] The above is only a preferred embodiment of the present invention. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the structure of the present invention. These will not affect the effect of the implementation of the present invention and the practicality of the patent.

Claims

1. A method for realizing host security protection and early warning, characterized in that: The following steps are involved: S1. Build a cybersecurity knowledge base based on modular RAG technology, generate structured prompts based on the cybersecurity knowledge base and user task retrieval data, and use Fine-Tuning technology to output a standard instruction set. This structured prompt and standard instruction set interact with the AI-Agent to construct customized security monitoring requirements. S2. Build a security protection monitoring model using deep learning technology based on the security monitoring requirements. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data. Collect data and build a training dataset. Train the vulnerability perception model, security protection model, and intrusion detection model based on the training dataset to obtain a mature security protection monitoring model. S3. Based on a well-trained security protection monitoring model, monitor the target's operational characteristic data in real time and identify and extract risk characteristic data; S4. Perform risk association analysis by analyzing security vulnerabilities, user operations, and network activity risk data. Generate a security transaction dataset based on the risk trigger conditions of the standard instruction set. Perform frequent item set mining on the security transaction dataset to obtain risk item sets and predict risk trigger conditions. S5. Generate a risk trend analysis report based on the identified trigger conditions of the predicted risks and output the corresponding security remediation strategy; Step S4 specifically includes: S41. Serialize the activity data of three aspects, namely, security vulnerabilities, user operations, and network activity risk data, and convert them into standardized structured data corresponding to the security protection monitoring model; S42. The standardized structure data is classified according to the monitoring indicators to obtain multiple data item sets, each data item set being a set of time series security transaction data sets for the monitoring indicator; S43. Perform frequent item set mining on the time series security transaction data set based on the association analysis FP-growth algorithm, and output the risk item set that is higher than the preset threshold of the standard instruction set; S44. Generate association rules based on the risk item set, evaluate them through support and confidence indicators to determine the reliability and importance of the rules, and identify the triggering conditions for predicting risks.

2. The method for realizing host security protection and early warning according to claim 1, characterized in that: Step S1 specifically includes: S11. Build an offline network security knowledge base based on modular RAG technology. The offline network security knowledge base includes knowledge data collection, structured processing, and text block segmentation functions. S12. Embedding the embedding model in the offline network security knowledge base to build a vector database for converting text blocks of the offline network security knowledge base into vector data for easy retrieval operations; S13. Generate structured prompt words by querying, reconstructing, sorting, and understanding the data in the offline network security knowledge base; S14. Finally, use the Fine-Tuning technology to output the standard instruction set.

3. The method for realizing host security protection and early warning according to claim 2, characterized in that: The modular RAG architecture improves performance by enhancing its functional modules, adding a search module for similarity retrieval, and making fine-tuning on the retrieval tool. The modular RAG architecture can add, replace, or adjust the workflow between modules according to specific task requirements.

4. The method for realizing host security protection and early warning according to claim 1, characterized in that: Step S2 specifically includes: S21. Establish feature engineering for the security protection monitoring model, including data collection, data cleaning, feature extraction, feature selection, and labeling of normal and abnormal data samples, for use in training and testing sets for risk identification based on three aspects: security vulnerabilities, user operations, and network activity risk data; S22. Build the vulnerability perception model, behavioral security protection model, and intrusion detection model based on the Long Short-Term Memory (LSTM) and Deep Q-Network (DQN) algorithms. Through continuous training, optimization, and adjustment, the vulnerability perception model, behavioral security protection model, and intrusion detection model have optimal fitting and generalization capabilities. S23. Verify, evaluate and integrate the security protection monitoring model, including classification model evaluation and regression model evaluation.

5. The method for realizing host security protection and early warning according to claim 4, characterized in that: The feature engineering includes an input layer, a feature extraction layer, and a neural network layer; The input layer is a module for receiving the operational characteristic data of the monitoring target; The feature extraction layer is a module for interpreting the instruction set and extracting instruction set features from the data of the input layer; The neural network layer is used to perform deep learning and pattern recognition on the extracted features. The neural network layer includes multiple hidden layers, which are used to perform nonlinear transformation and feature extraction on the input data, thereby learning the high-level representation and abstract features of the data to better complete various complex tasks.

6. The method for realizing host security protection and early warning according to claim 1, characterized in that: The process of risk association analysis includes association rule mining, association rule evaluation, result interpretation and application; association rule mining is to use the association analysis FP-growth algorithm to mine the data set to discover the association rules and patterns between different variables; association rule evaluation is to evaluate and screen the association rules obtained by mining, usually considering support and confidence indicators to determine the reliability and importance of the rules; result interpretation and application is to interpret and analyze the association rules obtained by mining to discover hidden risk information and trends in the data.

7. A system for realizing host security protection and early warning, characterized in that: include: The knowledge base module is used to build a cybersecurity knowledge base based on modular RAG technology, generate structured prompt words based on the cybersecurity knowledge base and user task retrieval data, and output a standard instruction set using Fine-Tuning technology. Based on the structured prompt words and standard instruction set, it interacts with the AI-Agent and constructs customized security monitoring requirements; A monitoring model module is used to build a security protection monitoring model based on the security monitoring requirements using deep learning technology. The security protection monitoring model includes a vulnerability perception model for analyzing security vulnerabilities, a behavioral security protection model for analyzing user operations, and an intrusion detection model for analyzing network activity risk data. The module collects data and builds a training dataset. The vulnerability perception model, security protection model, and intrusion detection model are trained based on the training dataset to obtain a mature security protection monitoring model. The monitoring module is used to monitor the target's operational characteristic data in real time and identify and extract risk characteristic data based on a well-trained security protection monitoring model; The association analysis module is used to perform risk association analysis by analyzing security vulnerabilities, user operations, and network activity risk data, generate a security transaction data set based on the risk trigger conditions of the standard instruction set, and perform frequent item set mining on the security transaction data set to obtain risk item sets and predict risk trigger conditions; specifically, it includes: Serialize the activity data of security vulnerabilities, user operations and network activity risk data and convert them into standardized structured data corresponding to the security protection monitoring model; The standardized structural data is classified according to the monitoring indicators to obtain multiple data item sets, each of which is a set of time-series security transaction data sets for the monitoring indicator; Perform frequent item set mining on the time series security transaction dataset based on the association analysis FP-growth algorithm, and output risk item sets that are higher than a preset threshold of the standard instruction set; Generate association rules based on risk item sets, evaluate them through support and confidence indicators to determine the reliability and importance of the rules, and identify the triggering conditions for predicting risks; The risk trend analysis module is used to generate a risk trend analysis report based on the trigger conditions of the identified predicted risks and output corresponding security repair strategies.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method for realizing host security protection and early warning as described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for realizing host security protection and early warning as described in any one of claims 1 to 6 is implemented.

Images