Security monitoring method and device for edge computing service, equipment, medium and product

Abstract

The invention relates to the technical field of data processing, and particularly provides an edge computing service security monitoring method and device, equipment, a medium and a product, and the method comprises the steps: obtaining first real-time business data of each edge computing business in an edge node; training an original algorithm model correspondingly used for the edge computing service based on the first real-time service data to obtain a trained algorithm model; evaluating the trained algorithm model to obtain an evaluation result; and under the condition of determining that evaluation of the trained algorithm model is passed based on the evaluation result, performing security monitoring on each edge computing service of the edge node through the trained algorithm model.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a security monitoring method, device, equipment, medium and product for edge computing services. Background Art

[0002] Edge computing is a distributed computing architecture that uses an open platform that integrates network, computing, storage, and application core capabilities close to the source of objects or data to provide services to edge devices nearby. Edge nodes can be responsible for data computing and storage within a certain range, solving the problem of large amounts of data uploaded by edge devices causing huge pressure on the cloud.

[0003] In the related art, after the algorithm model of the edge node of the edge service is determined based on the historical log data of the edge service, the algorithm model is deployed to the edge node and put into use, and the log data of the edge device is processed by the edge node. In the related art, since the real-time service data generated by the edge device is uncertain compared with the historical log data during actual use, the prediction result of the algorithm model for the real-time service data has poor accuracy. Summary of the invention

[0004] In view of the above problems, the present disclosure is proposed. The present disclosure provides a security monitoring method, device, equipment, medium and product for edge computing services.

[0005] According to one aspect of the present disclosure, a method for security monitoring of an edge computing service is provided, comprising:

[0006] Obtaining first real-time business data of each edge computing business in the edge node;

[0007] Training an original algorithm model applied to the edge computing service based on the first real-time service data to obtain a trained algorithm model;

[0008] Evaluating the trained algorithm model to obtain an evaluation result;

[0009] When it is determined based on the evaluation result that the trained algorithm model has passed the evaluation, security monitoring is performed on each edge computing service of the edge node through the trained algorithm model.

[0010] In addition, according to another embodiment of one aspect of the present disclosure, the obtaining of first real-time service data of each edge computing service in the edge node includes:

[0011] Obtain edge observability data collected by the data collection component, and determine the edge observability data as the first real-time business data.

[0012] In addition, according to another embodiment of one aspect of the present disclosure, the evaluating the trained algorithm model to obtain an evaluation result includes:

[0013] Processing the first real-time business data through the trained algorithm model to obtain a first security monitoring result;

[0014] The trained algorithm model is evaluated based on the first security monitoring result and the true value label of the first real-time business data to obtain the evaluation result.

[0015] In addition, according to another embodiment of one aspect of the present disclosure, the evaluating the trained algorithm model based on the first security monitoring result and the true value label of the first real-time business data to obtain the evaluation result includes:

[0016] Determining an evaluation index of the trained algorithm model based on the first security monitoring result and the true value label;

[0017] The evaluation index is compared with an index threshold, and the evaluation result is determined according to the index comparison result.

[0018] In addition, according to another embodiment of one aspect of the present disclosure, the evaluation index includes: a coefficient of determination and a relative analysis error; comparing the evaluation index with an index threshold, and determining the evaluation result according to the index comparison result, includes:

[0019] When the determination coefficient is greater than a preset determination coefficient threshold and the relative analysis error is within a preset range, a first evaluation result is obtained; wherein the first evaluation result is used to indicate that the training algorithm model has passed the evaluation;

[0020] When the determination coefficient is less than or equal to the preset determination coefficient threshold and the relative analysis error is outside the preset range, a second evaluation result is obtained; wherein, the second evaluation result is used to indicate that the evaluation of the trained algorithm model has failed.

[0021] In addition, according to another embodiment of one aspect of the present disclosure, the security monitoring of each edge computing service of the edge node by using the trained algorithm model includes:

[0022] Determine business scenario parameters of the edge computing business;

[0023] Collecting second real-time business data; wherein the second real-time business data is business data collected after the first real-time business data;

[0024] Processing the second real-time business data based on the business scenario parameters through the trained algorithm model to obtain a second security monitoring result;

[0025] Based on the business rules and scenario routing configuration of the edge computing business, the second security monitoring result is processed to obtain a target business result; wherein the target business result is used to indicate the possibility of failure of the edge computing business in various business scenarios.

[0026] According to another aspect of the present disclosure, there is provided a model evaluation system for edge services, including: an edge computing platform and an edge node;

[0027] The edge computing platform is used to obtain first real-time business data of each edge computing business in the edge node; based on the first real-time business data, train the original algorithm model applied to the edge computing business to obtain a trained algorithm model; evaluate the trained algorithm model to obtain an evaluation result; if it is determined based on the evaluation result that the trained algorithm model has passed the evaluation, send the trained algorithm model to the edge node;

[0028] The edge node is used to receive and deploy the trained algorithm model; and to perform security monitoring on each edge computing service of the edge node through the trained algorithm model.

[0029] In addition, according to another embodiment of one aspect of the present disclosure, the edge node is further configured to:

[0030] Determine business scenario parameters of the edge computing business;

[0031] Acquire second real-time business data;

[0032] The second real-time business data is processed by the trained algorithm model based on the business scenario parameters to obtain a second security monitoring result.

[0033] In addition, according to another embodiment of one aspect of the present disclosure, the system further includes: an edge computing service hub, configured to:

[0034] The second security monitoring result is processed based on the business rules and scenario routing configuration of the edge computing business to obtain a target business result; wherein the target business result is used to indicate the possibility of failure of the edge computing business in various business scenarios.

[0035] In addition, according to another embodiment of one aspect of the present disclosure, the system further includes: a vulnerability scoring system for:

[0036] During the process of the trained algorithm model performing security monitoring on each edge computing service of the edge node, the model evaluation system of the edge service is security monitored to obtain a security scoring result of the model evaluation system of the edge service; and based on the security scoring result, a repair strategy for the model evaluation system of the edge service is determined.

[0037] According to another aspect of the present disclosure, a security monitoring device for an edge computing service is provided, comprising:

[0038] An acquisition module, used to acquire first real-time business data of each edge computing business in the edge node;

[0039] A training module, used to train an original algorithm model applied to the edge computing service based on the first real-time service data to obtain a trained algorithm model;

[0040] An evaluation module, used to evaluate the trained algorithm model and obtain an evaluation result;

[0041] The security monitoring module is used to perform security monitoring on each edge computing service of the edge node through the trained algorithm model when it is determined that the trained algorithm model has passed the evaluation based on the evaluation result.

[0042] According to another aspect of the present disclosure, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement steps of a method for determining a log template.

[0043] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of a method for determining a log template are implemented.

[0044] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, which implements the steps of a method for determining a log template when the computer program / instruction is executed by a processor.

[0045] As described in detail below, according to an embodiment of the present disclosure, a method, device, equipment, medium and product for security monitoring of edge computing services are provided. In the embodiment of the present disclosure, first, the first real-time business data of each edge computing service in the edge node is obtained; then, based on the first real-time business data, the original algorithm model applied to the edge computing service is trained to obtain a trained algorithm model; next, the trained algorithm model is evaluated to obtain an evaluation result; wherein, when it is determined based on the evaluation result that the trained algorithm model has passed the evaluation, the trained algorithm model is used to perform security monitoring on each edge computing service of the edge node.

[0046] In the above implementation, by obtaining the first real-time business data of the edge computing business and training the original algorithm model through the first real-time business data to obtain the trained algorithm model, the diversity and uncertainty of the training samples of the original algorithm model can be increased, so that the trained algorithm model can still output more accurate security monitoring results for various types of input data, thereby improving the robustness of the trained algorithm model. At the same time, after obtaining the trained algorithm model and determining that the trained algorithm model has passed the evaluation, the edge computing business is securely monitored using the trained algorithm model after the evaluation, which can further improve the accuracy of the trained algorithm model.

[0047] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0049] Figure 1 A flowchart of a method for security monitoring of edge computing services provided in an embodiment of the present disclosure.

[0050] Figure 2 A schematic diagram of a security monitoring architecture for edge computing services provided in an embodiment of the present disclosure.

[0051] Figure 3 A schematic diagram of a security monitoring system for edge computing services provided in an embodiment of the present disclosure.

[0052] FIG4( a ) is a schematic diagram of scoring details of a vulnerability scoring system in a security monitoring system of a first optional edge computing service provided in an embodiment of the present disclosure.

[0053] FIG4( b ) is a schematic diagram of the scoring rules of the vulnerability scoring system in the security monitoring system of the second optional edge computing service provided in an embodiment of the present disclosure.

[0054] FIG4( c ) is a schematic diagram of the scoring details of the vulnerability scoring system in the security monitoring system of the third optional edge computing service provided in an embodiment of the present disclosure.

[0055] Figure 5 A schematic diagram of a security monitoring device for an edge computing service provided in an embodiment of the present disclosure.

[0056] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0058] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0059] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0060] Research has found that edge computing is a distributed computing architecture that uses an open platform that integrates network, computing, storage, and application core capabilities close to the source of objects or data to provide services to edge devices nearby. Edge nodes can be responsible for data computing and storage within a certain range, solving the problem of large amounts of data uploaded by edge devices causing huge pressure on the cloud.

[0061] In the related art, after the algorithm model of the edge node of the edge service is determined based on the historical log data of the edge service, the algorithm model is deployed to the edge node and put into use, and the log data of the edge device is processed by the edge node. In the related art, since the real-time service data generated by the edge device is uncertain compared with the historical log data during actual use, the prediction result of the algorithm model for the real-time service data has poor accuracy.

[0062] Based on the above research, by obtaining the first real-time business data of the edge computing business and training the original algorithm model through the first real-time business data to obtain the trained algorithm model, the diversity and uncertainty of the training samples of the original algorithm model can be increased, so that the trained algorithm model can still output more accurate security monitoring results for various types of input data, thereby improving the robustness of the trained algorithm model. At the same time, after obtaining the trained algorithm model and determining that the trained algorithm model has passed the evaluation, the edge computing business is securely monitored using the trained algorithm model after the evaluation, which can further improve the accuracy of the trained algorithm model.

[0063] To facilitate understanding of this embodiment, a security monitoring method for an edge computing service disclosed in an embodiment of the present disclosure is first introduced in detail. The execution subject of the security monitoring method for an edge computing service provided in an embodiment of the present disclosure is generally an electronic device with certain computing capabilities. In some possible implementations, the security monitoring method for an edge computing service can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0064] Figure 1 As shown, it is a flowchart of a security monitoring method for edge computing services provided by an embodiment of the present disclosure, the method comprising steps S101 to S104, wherein:

[0065] S101. Obtain first real-time business data of each edge computing business in an edge node.

[0066] In an embodiment of the present disclosure, the first real-time business data of each edge computing business can be collected by a data collection component installed in the edge node.

[0067] Here, the first real-time business data includes log (Logs) data, statistical indicator (Metrics) data and link tracking (Traces) data of each edge computing business. Among them, the log data is used to monitor the status and performance indicators of the edge devices connected to the edge node. The statistical indicator data is used to monitor the network status of the edge devices connected to the edge node. The link tracking data is used to provide health status and performance information of the relevant applications on the edge devices connected to the edge node.

[0068] Log data is data that can provide information about the health and operating load of edge devices connected to edge nodes. For example, the utilization rate of the edge device's central processing unit (CPU), memory usage, network traffic, etc. Statistical indicator data includes but is not limited to: network performance indicators such as network latency, bandwidth utilization, and packet loss rate. Link tracking data includes but is not limited to application logs, error reports, and request response time.

[0069] S102: Train an original algorithm model applied to the edge computing service based on the first real-time service data to obtain a trained algorithm model.

[0070] In an embodiment of the present disclosure, after determining the first real-time service data, the first real-time service data may be preprocessed. Then, the original algorithm model applied to the edge computing service may be trained using the preprocessed first real-time service data to obtain a trained algorithm model.

[0071] Here, the first real-time service data may be preprocessed by the following steps to obtain the preprocessed first real-time service data, specifically including:

[0072] First, the first real-time service data may be vectorized to obtain vectorized first real-time service data;

[0073] Secondly, the vectorized first real-time business data is normalized to obtain the normalized first real-time business data.

[0074] Here, the vectorized first real-time service data includes the following vectors: log data vector L = {l1, l2, ..., l n}, statistical indicator data vector M = {m1, m2, ..., m q}, link tracking data vector T = {t1, t2, ..., t e}. Next, the log data vector L, the statistical indicator data vector M and the link tracking data vector T can be normalized to obtain the normalized first real-time business data. Assume that the mean of each type of data vector in the vectorized first real-time business data under the feature dimension is 0 and the variance is 1. Among them, the i-th normalized log data l i , the pth normalized statistical index data m p and the hth normalized link tracking data t h Meet the following conditions respectively:

[0075]

[0076] Among them, l i is the i-th log data element in the vectorized first real-time business data, i ranges from 1 to n, n is the number of log data elements in the first real-time business data, l mean is the average value of the log data vector in each feature dimension, l dev is the standard deviation of the log data vector in each feature dimension, m p is the pth statistical indicator data element in the vectorized first real-time business data, where p ranges from 1 to q, q is the number of statistical indicator data elements in the first real-time business data, and m mean is the average value of the statistical indicator data vector in each feature dimension, m dev is the standard deviation of the statistical indicator data vector in each feature dimension, t h is the hth link tracking data element in the vectorized first real-time service data vector, where h ranges from 1 to e, and e is the number of link tracking data elements in the first real-time service data. mean is the average value of each feature dimension of the link tracking data vector, t dev is the standard deviation of each feature dimension of the link tracking data vector.

[0077] Secondly, the vectorized first real-time business data can be decomposed by eigenvalue based on the covariance matrix to determine the eigenvector corresponding to the eigenvalue of each element in each type of data vector. Finally, the pre-processed first real-time business data can be determined based on the eigenvector and the normalized first real-time business data.

[0078] Among them, the i-th preprocessed log data L i , the pth preprocessed statistical indicator data M p and the hth preprocessed link tracking data T h Meet the following conditions respectively:

[0079] L i =d1 T l i , d2 T l i , ..., d k T l i ;

[0080] M i =f1 T m i , f2 T m i , ..., f k T m i ;

[0081] T i =b1 T t, b2 T t i , ..., b k T t i ;

[0082] Among them, d1, d2, ... d k is the feature vector corresponding to the first k elements in the target data vector, f1, f2, ... f k is the eigenvector corresponding to the first k elements in the statistical indicator data vector, b1, b2, ... b k is the feature vector corresponding to the first k elements in the link tracking data vector.

[0083] Here, the original algorithm model may be an LSTM algorithm model, and the LSTM algorithm model may be trained by the preprocessed first real-time business data to obtain a trained algorithm model.

[0084] Here, the ground truth label (i.e., the actual prediction result corresponding to the first real-time business data) corresponding to the preprocessed first real-time business data can be determined; then, the original algorithm model is trained based on the ground truth label through the preprocessed first real-time business data until the original algorithm model converges to obtain the trained algorithm model.

[0085] S103: Evaluate the trained algorithm model to obtain an evaluation result.

[0086] In the example of the present disclosure, the trained algorithm model can be evaluated using the preprocessed first real-time business data and the true value label to obtain an evaluation result.

[0087] Here, the true value label corresponding to the preprocessed first real-time business data can be determined in the historical information of the edge computing business.

[0088] S104: When it is determined based on the evaluation result that the trained algorithm model has passed the evaluation, security monitoring of each edge computing service of the edge node is performed through the trained algorithm model.

[0089] In an embodiment of the present disclosure, after the trained algorithm model is evaluated, the trained algorithm model can be sent to each edge node. After the edge node receives the trained algorithm model, the trained algorithm model can be installed and each edge computing service can be securely monitored through the trained algorithm model.

[0090] Here, in the process of security monitoring of each edge computing service, the edge node can collect the real-time business data of each edge computing service through the data collection component. After that, the collected real-time business data can be processed through the trained algorithm model to obtain the security monitoring result.

[0091] Here, the security status of each edge computing service can be determined through the security monitoring results, so that users can make decisions based on the security status of each edge computing service, thereby realizing security monitoring of each edge computing service.

[0092] In the above implementation, by obtaining the first real-time business data of the edge computing business and training the original algorithm model through the first real-time business data to obtain the trained algorithm model, the diversity and uncertainty of the training samples of the original algorithm model can be increased, so that the trained algorithm model can still output more accurate security monitoring results for various types of input data, thereby improving the robustness of the trained algorithm model. At the same time, after obtaining the trained algorithm model and determining that the trained algorithm model has passed the evaluation, the edge computing business is securely monitored using the trained algorithm model after the evaluation, which can further improve the accuracy of the trained algorithm model.

[0093] In an optional implementation, the above step of obtaining the first real-time service data of each edge computing service in the edge node specifically includes the following steps:

[0094] The edge observability data collected by the data collection component is obtained, and the edge observability data is determined as the first real-time business data.

[0095] In an embodiment of the present disclosure, the data collection component can collect edge observability data of each edge computing service in real time (i.e., log data, statistical indicator data, and link tracking data of each edge computing service).

[0096] Here, the edge observability data of each edge computing service can be collected every preset time period. The data collection component is a component that aggregates multiple functions, wherein the multiple functions respectively include at least one of the following: a log collection component, a monitoring collection component, and a monitoring data export component (exporter).

[0097] The specific logic of multiple functions can be described as: collecting log data through the log collection component; collecting statistical indicator data and link tracking data through the monitoring collection component; exporting the statistical indicator data and link tracking data collected by the monitoring collection component to the edge device connected to the edge node through the monitoring data export component.

[0098] Among them, log data is collected through the ELK (Elasticsearch-distributed search and analysis engine, Logstash-data collection engine, Kibana-data analysis and visualization platform) tool in the data collection component.

[0099] The ELK tool is an open source distributed search engine with features such as distribution, automatic index sharding, index copy mechanism, multiple data sources, and automatic search load. The ELK tool can install Filebeats (a lightweight log collector) as an agent on the server to monitor the log files in the specified path and collect log data, or use Fluentd (a data collector) to collect logs in real time and regularly collect execution command output and HTTP (Hypertext Transfer Protocol) request content. Then, use Logstash to collect, analyze and filter logs. Its working mode is C / S architecture. The client is installed on the host where logs need to be collected. The server is responsible for filtering and modifying the received logs of each node and transmitting them to Elasticsearch. Finally, Kibana is used to summarize, analyze and search important log data and provide a log analysis-friendly Web (World Wide Web) interface.

[0100] Among them, statistical indicator data collection is implemented by Prometheus (monitoring framework) and Grafana (data visualization) tools, mainly through the application embedded SDK (Software Development Kit), using Push to store data in Prometheus, and using Grafana to visualize data. Link tracking data collection is based on Google Dapper (distributed tracing) or Open Tracing (open distributed tracing) or Open Census (open source distributed tracing) or Zipkin (link tracing) technology. Finally, the above-collected observability time series data is saved in a time series database such as TimescaleDB, Prometheus, InfluxDB, DolphinDB, etc.

[0101] Because the existence of edge computing business will involve the safety of user property, for example, banking business. The nature of banking business determines that it has extremely high requirements for service quality. Therefore, this proposal reflects the operation of banking business by monitoring banking business related indicators. For example, by deploying monitoring tools such as Prometheus on the server, business indicators such as transaction success rate and transaction response time are regularly collected. The transaction success rate is calculated by collecting the processing results of each transaction request. If a transaction request is successfully processed, it can be considered that the transaction is successful. The transaction response time is calculated by recording the time taken for each transaction request from initiation to completion. Finally, the calculation results are pushed to visualization platforms such as Grafana based on the Prometheus API for display and summary analysis.

[0102] In an optional implementation, the above steps evaluate the trained algorithm model to obtain an evaluation result, which specifically includes the following steps:

[0103] First, the first real-time business data is processed by the trained algorithm model to obtain a first security monitoring result;

[0104] Then, the trained algorithm model is evaluated based on the first security monitoring result and the true value label of the first real-time business data to obtain an evaluation result.

[0105] In an embodiment of the present disclosure, the first real-time business data may be input into a trained algorithm model to obtain an output of the trained algorithm model for the first real-time business data, and the output may be determined as a first security monitoring result.

[0106] Here, the true value labels of the first security monitoring result and the first real-time business data can be calculated to determine the evaluation result of the trained algorithm model.

[0107] In an embodiment of the present disclosure, the original algorithm model can be trained through the following steps: first, the first real-time business data is processed through an input gate, a forget gate, an output gate, and an input modulation gate to obtain an input gate processing result i', a forget gate processing result f', an output gate processing result o', and an input modulation gate processing result g'.

[0108] Secondly, based on the input gate processing result i', the forget gate processing result f', the output gate processing result o', and the input modulation gate processing result g', the element state c' and the hidden state h' are determined.

[0109] Secondly, the intermediate security monitoring result of the first real-time business data can be determined based on the element state c' and the hidden state h'. Secondly, the loss function L of the original algorithm model can be determined based on the intermediate security monitoring result and the true value label. Finally, the parameters of the original algorithm model are adjusted based on the loss function L until the original algorithm model converges, and the converged original algorithm model is determined as the trained algorithm model.

[0110] In an optional implementation, the above steps evaluate the trained algorithm model based on the first security monitoring result and the true value label of the first real-time business data to obtain an evaluation result, which specifically includes the following steps:

[0111] First, based on the first security monitoring results and the true value labels, the evaluation indicators of the trained algorithm model are determined;

[0112] Then, the evaluation index is compared with the index threshold, and the evaluation result is determined according to the index comparison result.

[0113] In the embodiment of the present disclosure, the determination coefficient and relative analysis error between the first security monitoring result and the true value label can be determined, and the determination coefficient and the relative analysis error can be determined as the determination coefficient R of the trained algorithm model. 2 and relative analytical error RPD.

[0114] Here, the root mean square error RMSE can be determined based on the first safety monitoring result and the true value label; then, the relative analysis error RPD can be determined based on the root mean square error RMSE, the first safety monitoring result and the true value label.

[0115] Among them, the determination coefficient R of the algorithm model after training 2 Meet the following conditions:

[0116]

[0117] Among them, x v is the vth element in the first security monitoring result, where v ranges from 1 to s, where s is the number of elements in the first security monitoring result, and y v is the vth element in the true value label, and y is the average value of the elements in the true value label.

[0118] Among them, the relative analysis error RPD of the algorithm model after training meets the following conditions:

[0119]

[0120] Among them, the root mean square error RMSE meets the following conditions:

[0121]

[0122] Here, the coefficient of determination R 2 The relative analysis error RPD is compared with the index threshold to obtain the index comparison result. Among them, the index threshold can be set according to historical experience, which will not be repeated here.

[0123] In an optional embodiment, the evaluation index includes: a coefficient of determination and a relative analytical error; the above step compares the evaluation index with the index threshold, and determines the evaluation result according to the index comparison result, specifically including the following steps:

[0124] First, when the determination coefficient is greater than a preset determination coefficient threshold and the relative analysis error is within a preset range, a first evaluation result is obtained; wherein the first evaluation result is used to indicate that the evaluation of the trained algorithm model has passed;

[0125] Then, when the determination coefficient is less than or equal to the preset determination coefficient threshold and the relative analysis error is outside the preset range, a second evaluation result is obtained; wherein the second evaluation result is used to indicate that the evaluation of the trained algorithm model has failed.

[0126] In an embodiment of the present disclosure, the indicator threshold includes: a preset determination coefficient threshold and a preset range.

[0127] Here, the coefficient of determination R 2 The larger the value, the higher the prediction accuracy of the algorithm model after training; the smaller the root mean square error RMSE value, the higher the prediction accuracy of the algorithm model after training.

[0128] For example, when the relative analysis error RPD is within a preset range (e.g., relative analysis error RPD∈[2.0, 2.5]) and the determination coefficient R 2 When it is greater than the preset determination coefficient threshold, it can be considered that the trained algorithm model has good quantitative prediction ability.

[0129] Here, when the second evaluation result is obtained, the trained algorithm model can be retrained until the evaluation result of the trained algorithm model is the first evaluation result. Among them, the edge observability data of each edge computing service can be recollected to retrain the trained algorithm model.

[0130] In the above embodiment, after the trained algorithm model is determined, the trained algorithm model is evaluated, and after the trained algorithm model passes the evaluation, the trained algorithm model is put into use, thereby further improving the accuracy of the security monitoring results output by the trained algorithm model.

[0131] In an optional implementation, the above steps perform security monitoring on each edge computing service of the edge node through the trained algorithm model, specifically including the following steps:

[0132] First, determine the business scenario parameters of edge computing services;

[0133] Secondly, collecting second real-time business data; wherein the second real-time business data is business data collected after the first real-time business data;

[0134] Secondly, the second real-time business data is processed based on the business scenario parameters by the trained algorithm model to obtain a second security monitoring result;

[0135] Finally, based on the business rules and scenario routing configuration of the edge computing service, the second security monitoring result is processed to obtain the target business result; wherein the target business result is used to indicate the possibility of failure of the edge computing service in various business scenarios.

[0136] In the embodiments of the present disclosure, the business scenario parameters include, but are not limited to: the camera angle of the edge computing business, the employee uniforms of each outlet, and the identification area division parameters.

[0137] Here, the data collection component in the edge node can collect data for each edge computing service once every preset time period, and use the collected data as the second real-time service data.

[0138] Here, users can configure business rules and scenario routing for edge computing services. The second security monitoring result can be processed in combination with business rules and scenario routing configuration to determine the target business result. Afterwards, the target business result can be stored or forwarded to facilitate subsequent statistics and calls on the target business result.

[0139] See also Figure 2 FIG. 1 is a schematic diagram of a security monitoring architecture of an edge computing service provided by an embodiment of the present disclosure, specifically:

[0140] Edge computing services can be divided into a central cloud (i.e., the edge computing service hub described in the following embodiments), a regional cloud (i.e., the edge computing platform described in the following embodiments), and an edge cloud (i.e., the edge computing platform described in the following embodiments). A central cloud can have multiple regional clouds or edge clouds, and each edge cloud or regional cloud can be connected to multiple edge nodes, and each edge node communicates and transmits data with the central cloud through the regional cloud or edge cloud.

[0141] In the above embodiment, since the edge nodes are distributed in different geographical locations, there are problems such as scattered distribution of edge nodes and difficulty in management. Therefore, this embodiment builds a unified security monitoring architecture for edge computing services to uniformly monitor and manage edge nodes distributed in the cloud and edge clouds in various regions.

[0142] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0143] Based on the same inventive concept, the embodiment of the present disclosure also provides a model evaluation system for edge services corresponding to the model evaluation method for edge services. Since the principle of solving the problem by the system in the embodiment of the present disclosure is similar to the model evaluation method for edge services mentioned above in the embodiment of the present disclosure, the implementation of the system can refer to the implementation of the method, and the repeated parts will not be repeated.

[0144] The model evaluation system for edge services provided in this embodiment includes: an edge computing platform and an edge node;

[0145] The edge computing platform is used to obtain first real-time business data of each edge computing business in the edge node; based on the first real-time business data, train the original algorithm model applied to the edge computing business to obtain a trained algorithm model; evaluate the trained algorithm model to obtain an evaluation result; if it is determined based on the evaluation result that the trained algorithm model has passed the evaluation, send the trained algorithm model to the edge node;

[0146] The edge node is used to receive and deploy the trained algorithm model; and to perform security monitoring on each edge computing service of the edge node through the trained algorithm model.

[0147] In an embodiment of the present disclosure, the first real-time business data of each edge computing business can be collected by a data collection component installed in the edge node.

[0148] Here, the first real-time business data includes log (Logs) data, statistical indicator (Metrics) data and link tracking (Traces) data of each edge computing business. Among them, the log data is used to monitor the status and performance indicators of the edge devices connected to the edge node. The statistical indicator data is used to monitor the network status of the edge devices connected to the edge node. The link tracking data is used to provide health status and performance information of the relevant applications on the edge devices connected to the edge node.

[0149] The log data is data that can provide information about the health status and operating load of edge devices connected to edge nodes, such as CPU (Central Processing Unit) utilization, memory usage, network traffic, etc. of edge devices.

[0150] Among them, statistical indicator data include but are not limited to: network performance indicators such as network delay, bandwidth utilization, and packet loss rate.

[0151] Here, after the data collection component of the edge node collects the first real-time business data of an edge computing business, the first real-time business data can be sent to the edge computing platform.

[0152] In an embodiment of the present disclosure, first, after the edge computing platform determines the first real-time business data, the first real-time business data can be preprocessed. Then, the original algorithm model applied to the edge computing business can be trained by the preprocessed first real-time business data to obtain a trained algorithm model.

[0153] In the example disclosed in the present invention, the edge computing platform can evaluate the trained algorithm model through the preprocessed first real-time business data and the true value label to obtain an evaluation result.

[0154] Here, the edge computing platform can determine the true value label corresponding to the preprocessed first real-time business data in the historical information of the edge computing business.

[0155] In an embodiment of the present disclosure, after the algorithm model is evaluated after training, the edge computing platform can determine the algorithm image container based on the algorithm model after training and store it in the image warehouse. Afterwards, the edge computing platform can send the algorithm image container to each edge node, or notify the completion of algorithm model training.

[0156] After the edge node receives the notification that the algorithm model training is completed, it can pull the algorithm image container from the storage area of ​​the edge computing platform.

[0157] After the edge node deploys the algorithm image container, the security of each edge computing business can be monitored by running the trained algorithm model in the algorithm image container.

[0158] Here, in the process of security monitoring of each edge computing service, the edge node can collect the real-time business data of each edge computing service through the data collection component. After that, the edge node can process the collected real-time business data through the trained algorithm model to obtain the security monitoring results, and send the security monitoring results to the edge computing platform.

[0159] Here, the edge computing platform can determine the security status of each edge computing service through security monitoring results, so that users can make decisions based on the security status of each edge computing service, thereby realizing security monitoring of each edge computing service.

[0160] In the above implementation, by obtaining the first real-time business data of the edge computing business and training the original algorithm model through the first real-time business data to obtain the trained algorithm model, the diversity and uncertainty of the training samples of the original algorithm model can be increased, so that the trained algorithm model can still output more accurate security monitoring results for various types of input data, thereby improving the robustness of the trained algorithm model. At the same time, after obtaining the trained algorithm model and determining that the trained algorithm model has passed the evaluation, the edge computing business is securely monitored using the trained algorithm model after the evaluation, which can further improve the accuracy of the trained algorithm model.

[0161] In an optional implementation, the edge node is further configured to perform the following steps:

[0162] First, determine the business scenario parameters of edge computing services;

[0163] Secondly, obtain the second real-time business data;

[0164] Finally, the second real-time business data is processed based on the business scenario parameters through the trained algorithm model to obtain the second security monitoring result.

[0165] In the embodiments of the present disclosure, the business scenario parameters include, but are not limited to: the camera angle of the edge computing business, the employee uniforms of each outlet, and the identification area division parameters.

[0166] Here, the data collection component in the edge node can collect data for each edge computing service once every preset time period, and use the collected data as the second real-time service data.

[0167] Here, the second real-time business data of the trained algorithm model in the algorithm image container deployed to the edge node can be processed to obtain the second security monitoring result.

[0168] In an optional embodiment, the system further includes: an edge computing service hub, configured to:

[0169] The second security monitoring result is processed based on the business rules and scenario routing configuration of the edge computing business to obtain a target business result; wherein the target business result is used to indicate the possibility of failure of the edge computing business in various business scenarios.

[0170] Here, users can configure business rules and scenario routing for edge computing services. The edge computing business hub can process the second security monitoring results in combination with business rules and scenario routing configurations to determine the target business results. Afterwards, the target business results can be stored in the local storage area or forwarded to the edge computing business hub corresponding to other edge computing services, or to the downstream sub-business systems (i.e., the edge computing platform and edge nodes corresponding to the edge computing business hub) to facilitate subsequent statistics and calls on the target business results.

[0171] See also Figure 3 As shown, it is a schematic diagram of a security monitoring system for edge computing services provided by an embodiment of the present disclosure, the system comprising: an edge computing platform, an edge node, and an edge computing service hub; wherein,

[0172] The edge computing platform includes: scenario requirement clarification module, algorithm development module, image warehouse module, image distribution and deployment module, business parameter management module and configuration file generation module.

[0173] The edge node includes: algorithm mirror module, configuration file module and algorithm operation module.

[0174] The edge computing business hub includes: data processing module, hub configuration module and scene center module.

[0175] The scenario requirement clarification module is used to analyze the needs of edge computing business and determine the business problems that need to be solved by artificial intelligence algorithms in edge computing business; then, it generates artificial intelligence algorithm requirements based on the business problems and sends the artificial intelligence algorithm requirements to the algorithm development module.

[0176] The algorithm development module is used to determine the original algorithm model that matches the edge computing business based on the artificial intelligence algorithm requirements, and train and evaluate the original algorithm model based on the edge computing business to obtain the target algorithm model. After that, the target algorithm model is sent to the image warehouse module.

[0177] The image warehouse module is used to image the target algorithm model to obtain an algorithm image container; then, the algorithm image container is stored locally and sent to the image distribution and deployment module.

[0178] The image distribution and deployment module is used to send the received algorithm image container to the algorithm image module of the edge node.

[0179] The business parameter management module is used to receive business scenario parameters input by the user and send the business scenario parameters to the configuration file generation module.

[0180] The configuration file generating module is used to generate a configuration file based on the business scenario parameters after receiving the business scenario parameters, and send the configuration file to the configuration file receiving module in the edge node.

[0181] The algorithm image module is used to store the algorithm image container sent by the image distribution and deployment module.

[0182] The configuration file module is used to store the configuration file sent by the configuration file generation module.

[0183] The algorithm running module is used to schedule the algorithm image container and configuration file to process the edge observability data, obtain the security monitoring results, and send the security monitoring results to the data processing module.

[0184] The central configuration module is used to receive the business rules and scenario routing configurations of the edge computing business input by the user, and send the business rules and scenario routing configurations to the scenario center module.

[0185] The scene center module is used to receive business rules and scene routing configurations, and store the business rules and scene routing configurations locally.

[0186] The data processing module is used to receive security monitoring results and call the business rules and scene routing configurations stored in the scene center module to process the security monitoring results.

[0187] In the above embodiment, by determining the algorithm image container of the edge computing service and deploying the image algorithm container to the edge node, the edge node can process the real-time service data. The management and control of the edge nodes can be unified, and the real-time service data collected by the edge nodes does not need to be sent to the edge computing platform, which reduces the risk of leakage during the transmission of real-time service data and improves security.

[0188] In addition, the edge computing business center can also process the security monitoring results again in combination with scenario rules and scenario routing configurations, and can combine the security monitoring results with the business scenarios of the edge computing business to obtain the target business results, and store the target business results for predicting edge computing business failures, thereby improving the disaster recovery of the system in this embodiment.

[0189] In an optional embodiment, the system further includes: a vulnerability scoring system for:

[0190] In the process of security monitoring of each edge computing business of the edge node by the trained algorithm model, the model evaluation system of the edge service is security monitored to obtain the security scoring result of the model evaluation system of the edge service; and based on the security scoring result, the repair strategy of the model evaluation system of the edge service is determined.

[0191] In an embodiment of the present disclosure, CVSS (Common Vulnerability Scoring System) may be determined as a vulnerability scoring system.

[0192] 4(a), 4(b) and 4(c), which are schematic diagrams of scoring details of a vulnerability scoring system in a security monitoring system for a first optional edge computing service provided in an embodiment of the present disclosure; schematic diagrams of scoring details of a vulnerability scoring system in a security monitoring system for a second optional edge computing service provided in an embodiment of the present disclosure; and schematic diagrams of scoring details of a vulnerability scoring system in a security monitoring system for a third optional edge computing service provided in an embodiment of the present disclosure.

[0193] Here, there are three main scoring dimensions of CVSS, including the base metric group score, which is used to evaluate the inherent characteristics of the vulnerabilities of the edge service model assessment system and the possible impact of these characteristics, the life cycle assessment (temporal metric group) score, and the environmental assessment (environmental metric group) score.

[0194] The final score of the CVSS model assessment system for edge services is between 0 and 10.

[0195] When the security score is between 9.0 and 10.0, it indicates that the model evaluation system of the edge service has serious security vulnerabilities. It is necessary to remind the relevant operation and maintenance or R&D personnel to check for security vulnerabilities and promptly repair the existing security vulnerabilities as the repair strategy for the model evaluation system of the edge service.

[0196] When the security score result is between 7.0 and 8.9, it indicates that the system has high-risk vulnerabilities and security risks, and relevant personnel need to be notified to repair the problem as the repair strategy of the model evaluation system of the edge service.

[0197] When the security score result is between 4.0 and 6.9, it indicates that there is a certain risk of security vulnerabilities, and relevant personnel will be regularly arranged to conduct security inspections to determine the repair strategy for the model evaluation system of edge services.

[0198] When the security score result is between 0.1 and 3.9, it indicates that there is no major security risk in the system for the time being, and the model evaluation system of the edge service will continue to operate normally as the repair strategy for the model evaluation system of the edge service.

[0199] Based on the same inventive concept, the embodiments of the present disclosure also provide a security monitoring device for edge computing services corresponding to the security monitoring method for edge computing services. Since the principle of solving the problem by the device in the embodiments of the present disclosure is similar to the security monitoring method for edge computing services mentioned above in the embodiments of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0200] Reference Figure 5 As shown, it is a schematic diagram of a security monitoring device for edge computing services provided by an embodiment of the present disclosure, the device comprising: an acquisition module 11, a training module 12, an evaluation module 13, and a security monitoring module 14; wherein,

[0201] An acquisition module, used to acquire first real-time business data of each edge computing business in the edge node;

[0202] A training module, used to train an original algorithm model applied to the edge computing service based on the first real-time service data to obtain a trained algorithm model;

[0203] An evaluation module, used to evaluate the trained algorithm model and obtain an evaluation result;

[0204] The security monitoring module is used to perform security monitoring on each edge computing service of the edge node through the trained algorithm model when it is determined that the trained algorithm model has passed the evaluation based on the evaluation result.

[0205] The disclosed embodiment obtains the first real-time business data of the edge computing business and trains the original algorithm model through the first real-time business data to obtain the trained algorithm model, which can increase the diversity and uncertainty of the training samples of the original algorithm model, so that the trained algorithm model can still output more accurate security monitoring results for various types of input data, thereby improving the robustness of the trained algorithm model. At the same time, after obtaining the trained algorithm model and determining that the trained algorithm model has passed the evaluation, the edge computing business is securely monitored using the trained algorithm model after the evaluation, which can further improve the accuracy of the trained algorithm model.

[0206] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0207] Corresponds to Figure 1 The security monitoring method of the edge computing service in the present disclosure also provides an electronic device 600, such as Figure 6 FIG. 6 is a schematic diagram of the structure of an electronic device 600 provided in an embodiment of the present disclosure, including:

[0208] Processor 61, memory 62, and bus 63; memory 62 is used to store execution instructions, including internal memory 621 and external memory 622; the internal memory 621 is also called internal memory, which is used to temporarily store the operation data in the processor 61 and the data exchanged with the external memory 622 such as a hard disk. The processor 61 exchanges data with the external memory 622 through the internal memory 621. When the electronic device 600 is running, the processor 61 communicates with the memory 62 through the bus 63, so that the processor 61 executes the following instructions:

[0209] Obtaining first real-time business data of each edge computing business in the edge node;

[0210] Training an original algorithm model applied to the edge computing service based on the first real-time service data to obtain a trained algorithm model;

[0211] Evaluating the trained algorithm model to obtain an evaluation result;

[0212] When it is determined based on the evaluation result that the trained algorithm model has passed the evaluation, security monitoring is performed on each edge computing service of the edge node through the trained algorithm model.

[0213] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0214] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0215] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0216] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0217] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0218] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0219] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A security monitoring method for edge computing services, characterized in that: include: Obtaining first real-time business data of each edge computing business in the edge node; Training an original algorithm model applied to the edge computing service based on the first real-time service data to obtain a trained algorithm model; Evaluating the trained algorithm model to obtain an evaluation result; When it is determined based on the evaluation result that the trained algorithm model has passed the evaluation, security monitoring is performed on each edge computing service of the edge node through the trained algorithm model.

2. The method according to claim 1, characterized in that The obtaining of first real-time service data of each edge computing service in the edge node includes: Obtain edge observability data collected by the data collection component, and determine the edge observability data as the first real-time business data.

3. The method according to claim 1, characterized in that The step of evaluating the trained algorithm model to obtain an evaluation result includes: Processing the first real-time business data through the trained algorithm model to obtain a first security monitoring result; The trained algorithm model is evaluated based on the first security monitoring result and the true value label of the first real-time business data to obtain the evaluation result.

4. The method according to claim 3, characterized in that The evaluating the trained algorithm model based on the first security monitoring result and the true value label of the first real-time business data to obtain the evaluation result includes: Determining an evaluation index of the trained algorithm model based on the first security monitoring result and the true value label; The evaluation index is compared with an index threshold, and the evaluation result is determined according to the index comparison result.

5. The method according to claim 4, characterized in that The evaluation index includes: a coefficient of determination and a relative analysis error; the evaluation index is compared with an index threshold, and the evaluation result is determined according to the index comparison result, including: When the determination coefficient is greater than a preset determination coefficient threshold and the relative analysis error is within a preset range, a first evaluation result is obtained; wherein the first evaluation result is used to indicate that the training algorithm model has passed the evaluation; When the determination coefficient is less than or equal to the preset determination coefficient threshold and the relative analysis error is outside the preset range, a second evaluation result is obtained; wherein, the second evaluation result is used to indicate that the evaluation of the trained algorithm model has failed.

6. The method according to claim 1, characterized in that The performing security monitoring on each edge computing service of the edge node by using the trained algorithm model includes: Determine business scenario parameters of the edge computing business; Collecting second real-time business data; wherein the second real-time business data is business data collected after the first real-time business data; Processing the second real-time business data based on the business scenario parameters through the trained algorithm model to obtain a second security monitoring result; Based on the business rules and scenario routing configuration of the edge computing business, the second security monitoring result is processed to obtain a target business result; wherein the target business result is used to indicate the possibility of failure of the edge computing business in various business scenarios.

7. A model evaluation system for edge services, characterized in that: include: Edge computing platforms and edge nodes; The edge computing platform is used to obtain first real-time business data of each edge computing business in the edge node; Based on the first real-time service data, the original algorithm model applied to the edge computing service is trained to obtain a trained algorithm model; the trained algorithm model is evaluated to obtain an evaluation result; if it is determined based on the evaluation result that the trained algorithm model passes the evaluation, the trained algorithm model is sent to the edge node; The edge node is used to receive and deploy the trained algorithm model; and to perform security monitoring on each edge computing service of the edge node through the trained algorithm model.

8. The system according to claim 7, characterized in that The edge node is further used for: Determine business scenario parameters of the edge computing business; Acquire second real-time business data; The second real-time business data is processed by the trained algorithm model based on the business scenario parameters to obtain a second security monitoring result.

9. The system according to claim 8, characterized in that The system also includes an edge computing service hub, which is used to: The second security monitoring result is processed based on the business rules and scenario routing configuration of the edge computing business to obtain a target business result; wherein the target business result is used to indicate the possibility of failure of the edge computing business in various business scenarios.

10. The system according to claim 9, characterized in that The system also includes a vulnerability scoring system for: During the process of the trained algorithm model performing security monitoring on each edge computing service of the edge node, the model evaluation system of the edge service is security monitored to obtain a security scoring result of the model evaluation system of the edge service; and based on the security scoring result, a repair strategy for the model evaluation system of the edge service is determined.

11. A security monitoring device for edge computing services, characterized in that: include: An acquisition module, used to acquire first real-time business data of each edge computing business in the edge node; A training module, used to train an original algorithm model applied to the edge computing service based on the first real-time service data to obtain a trained algorithm model; An evaluation module, used to evaluate the trained algorithm model and obtain an evaluation result; The security monitoring module is used to perform security monitoring on each edge computing service of the edge node through the trained algorithm model when it is determined that the trained algorithm model has passed the evaluation based on the evaluation result.

12. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method of claim 1.

13. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 are implemented.

14. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claim 1 are implemented.

Images