Abnormal maintenance method, device, computer equipment and computer-readable storage medium for power grid fault identification model

Abstract

The present application relates to a method, apparatus, computer equipment, and computer-readable storage medium for abnormal maintenance of a power grid fault identification model. The method includes: performing static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the range and frequency of trusted system calls; monitoring the operating status of the power grid fault identification model in real time based on the whitelist to obtain monitoring results of the power grid fault identification model; the monitoring results include two conditions: normal operation and abnormality; normal operation indicates that the operating status complies with the whitelist; abnormality indicates that the operating status does not comply with the whitelist; when the monitoring result indicates that an abnormality exists, an adaptive strategy is used to maintain the power grid fault identification model. This method can improve the maintenance effect of the model.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence model maintenance technology, and in particular to a method, device, computer equipment and computer-readable storage medium for abnormal maintenance of a power grid fault identification model. Background Art

[0002] In power grid fault identification models, bit-flip attacks can cause the model to misclassify, failing to accurately identify the fault type or misreporting normal states as faults, impacting the normal operation of the power grid. Furthermore, attacks can significantly reduce model accuracy, making it unable to correctly detect and classify faults, reducing the reliability and effectiveness of fault identification. The model's robustness can also be weakened, potentially generating false positives for normal grid fluctuations and noise, increasing the operational and maintenance burden. However, current machine learning model fault detection methods analyze a large number of software anomalies, extract their features, and abstract them into abnormal patterns. These methods rely on manually defined thresholds for abnormal patterns and then match the model's software features with the established abnormal patterns. This results in low anomaly detection accuracy and, in turn, poor model maintenance. Summary of the Invention

[0003] Based on this, it is necessary to provide an abnormal maintenance method, device, computer equipment, computer-readable storage medium and computer program product for a power grid fault identification model that can improve the maintenance effect of the model in order to address the above technical problems.

[0004] In a first aspect, the present application provides an abnormal maintenance method for a power grid fault identification model, comprising:

[0005] Perform static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls.

[0006] The operating status of the power grid fault identification model is monitored in real time according to the whitelist to obtain monitoring results of the power grid fault identification model. The monitoring results include two conditions: normal operation and abnormality. Normal operation indicates that the operating status complies with the whitelist; abnormality indicates that the operating status does not comply with the whitelist.

[0007] When the monitoring results show abnormalities, an adaptive strategy is used to maintain the power grid fault identification model.

[0008] In one embodiment, a power grid fault identification model is subjected to static analysis and dynamic analysis to generate a whitelist, including:

[0009] Without executing the code of the power grid fault identification model, static analysis is performed on the code of the power grid fault identification model to obtain an initial whitelist;

[0010] In the case of executing the code of the power grid fault identification model, dynamically analyzing the code of the power grid fault identification model to obtain a supplementary whitelist;

[0011] A whitelist is generated based on the union of the initial whitelist and the supplementary whitelist.

[0012] In one embodiment, the operating status of the power grid fault identification model is monitored in real time according to the whitelist to obtain monitoring results of the power grid fault identification model, including:

[0013] Real-time acquisition of the operational status of the power grid fault identification model, including code execution path, disk access behavior, and system call status;

[0014] According to the preset detection rules, the whitelist is compared with the code execution path, disk access behavior and system call situation respectively to obtain the monitoring results of the power grid fault identification model.

[0015] In one embodiment, the code execution path, disk access behavior, and system call status are compared respectively according to the whitelist to obtain monitoring results of the power grid fault identification model, including:

[0016] Calculate the similarity between the code execution path, disk access behavior, and system call situation and the whitelist data respectively;

[0017] If any similarity is lower than a preset threshold, the monitoring result is determined to be abnormal;

[0018] When all similarities are higher than the preset threshold, the monitoring result is determined to be normal operation.

[0019] In one embodiment, when the monitoring result indicates that an abnormality exists, after the adaptive strategy is used to maintain the power grid fault identification model, the method further includes:

[0020] Based on the adaptive strategy and abnormal behavior detection results of the monitoring results, the feedback function is used to update the whitelist and detection rules;

[0021] Among them, the corresponding functions for updating the whitelist and detection rules using feedback functions include:

[0022] W'=F(W,E)

[0023] φ'=F(φ,E)

[0024] Where F() represents the feedback function, E represents the abnormal behavior detection result, W represents the whitelist, φ represents the detection rule, W' represents the updated whitelist, and φ' represents the updated detection rule.

[0025] In one embodiment, when the monitoring result indicates an abnormality, an adaptive strategy is used to maintain the power grid fault identification model, including:

[0026] If the monitoring result shows an abnormality, the code segment or disk memory area where the abnormality occurs is determined based on the abnormal behavior detection result;

[0027] Isolate code segments or disk memory areas and perform root cause analysis to determine the cause of the anomaly;

[0028] According to the abnormal cause, an adaptive strategy is adopted to maintain the power grid fault identification model.

[0029] In one embodiment, an adaptive strategy is used to maintain the power grid fault identification model based on the cause of the abnormality, including:

[0030] Based on the cause of the exception, the code segment or data in the disk memory area is rolled back or repaired using the online repair function;

[0031] Among them, the functions corresponding to the online repair function include:

[0032] S repair (t)=R(S(t),E)

[0033] Among them, S(t) is the current operating state of the power grid fault identification model, E represents the abnormal behavior detection result, and S repair (t) represents the operating status of the power grid fault identification model after repair, and R() represents the online repair function.

[0034] In a second aspect, the present application further provides an abnormal maintenance device for a power grid fault identification model, comprising:

[0035] A whitelist generation module is used to perform static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls;

[0036] The model monitoring module is used to monitor the operating status of the power grid fault identification model in real time according to the whitelist and obtain the monitoring results of the power grid fault identification model. The monitoring results include normal operation and abnormality. Normal operation indicates that the operating status complies with the whitelist; abnormality indicates that the operating status does not comply with the whitelist.

[0037] The model maintenance module is used to maintain the power grid fault identification model using an adaptive strategy when the monitoring result shows that there is an abnormality.

[0038] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0039] Perform static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls.

[0040] The operating status of the power grid fault identification model is monitored in real time according to the whitelist to obtain monitoring results of the power grid fault identification model. The monitoring results include two conditions: normal operation and abnormality. Normal operation indicates that the operating status complies with the whitelist; abnormality indicates that the operating status does not comply with the whitelist.

[0041] When the monitoring results show abnormalities, an adaptive strategy is used to maintain the power grid fault identification model.

[0042] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0043] Perform static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls.

[0044] The operating status of the power grid fault identification model is monitored in real time according to the whitelist to obtain monitoring results of the power grid fault identification model. The monitoring results include two conditions: normal operation and abnormality. Normal operation indicates that the operating status complies with the whitelist; abnormality indicates that the operating status does not comply with the whitelist.

[0045] When the monitoring results show abnormalities, an adaptive strategy is used to maintain the power grid fault identification model.

[0046] The aforementioned abnormality maintenance method, apparatus, computer device, computer-readable storage medium, and computer program product for a power grid fault identification model generate a whitelist by sequentially performing static and dynamic analysis on the power grid fault identification model. The whitelist includes trusted code segments, trusted disk access behaviors, and the range and frequency of trusted system calls. The selection of these two analysis methods comprehensively defines the legitimate behavior range for the normal operation of the power grid fault identification model. The operational status of the power grid fault identification model is monitored in real time based on the whitelist to obtain monitoring results. The monitoring results include both normal operation and abnormality conditions. Normal operation indicates that the operational status complies with the whitelist, while abnormality conditions indicate that the operational status does not comply with the whitelist. Using the whitelist, abnormal behavior of the power grid fault identification model can be more accurately determined and the model's operational status monitored. Furthermore, if the monitoring result indicates an abnormality, an adaptive strategy is employed to maintain the power grid fault identification model, eliminating manual intervention. The adaptive strategy can be automatically and timely applied based on abnormal conditions to ensure the normal operation of the model, thereby improving the effectiveness of model maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 1 is a flow chart of an abnormal maintenance method for a power grid fault identification model according to an embodiment;

[0049] Figure 2 A flowchart of a monitoring result determination step in one embodiment;

[0050] Figure 3 A structural block diagram of a whitelist-based smart grid fault identification model bit flip vulnerability intrusion detection and self-healing system in one embodiment;

[0051] Figure 4 is a structural block diagram of an abnormality maintenance device for a power grid fault identification model in one embodiment;

[0052] Figure 5 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0054] In one embodiment, Figure 1 As shown, a method for abnormal maintenance of a power grid fault identification model is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0055] Step S102 : performing static analysis and dynamic analysis on the power grid fault identification model to generate a whitelist.

[0056] Whitelists include trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls. A whitelist can be a security mechanism used to allow specific users, devices, network addresses, or applications to access certain resources or perform specific operations. In network security, certain IP addresses, domain names, or software applications may be whitelisted to allow them to bypass certain security checks or restrictions.

[0057] Among them, the power grid fault identification model can be an artificial intelligence model trained based on the historical parameters of the equipment included in the power grid. By inputting the real-time parameters of the power grid equipment into the power grid fault identification model in real time, the fault prediction results can be output to understand the operation status of the power grid.

[0058] Static analysis involves analyzing source or binary code without executing the program, focusing on code structure, syntax, potential errors, and compliance with coding standards. Dynamic analysis involves analyzing software behavior during program execution, identifying issues by calling the program and monitoring its runtime behavior, performance, and resource usage.

[0059] Optionally, the server first performs a static analysis on the power grid fault identification model without executing the code of the power grid fault identification model, and performs a dynamic analysis on the power grid fault identification model while executing the code of the power grid fault identification model, and generates a whitelist based on the two analysis results.

[0060] Step S104 : monitoring the operating status of the power grid fault identification model in real time according to the whitelist to obtain a monitoring result of the power grid fault identification model.

[0061] Among them, the monitoring results include two situations: normal operation and abnormality. Normal operation means that the operating status complies with the whitelist; abnormality means that the operating status does not comply with the whitelist.

[0062] Optionally, the server monitors the operating status of the power grid fault identification model according to the data included in the whitelist, determines whether the operating status meets the range of the whitelist, and obtains the monitoring result of the power grid fault identification model.

[0063] Step S106: When the monitoring result shows that an abnormality exists, an adaptive strategy is adopted to maintain the power grid fault identification model.

[0064] Among them, the adaptive strategy can be an automatic maintenance method for the abnormal type of the monitoring results. For example, if the abnormal type is that the model code is attacked by a bit flip, resulting in abnormalities in some code segments, the adaptive strategy is to automatically repair the part of the code segment or roll back the code version to the version before the bit flip attack.

[0065] Optionally, when the monitoring result indicates that an abnormality exists, the server adopts a corresponding adaptive strategy to maintain the power grid fault identification model to correct the abnormality and ensure the normal operation of the power grid fault identification model.

[0066] In the aforementioned abnormality maintenance method for a power grid fault identification model, a whitelist is generated by sequentially performing static and dynamic analysis on the power grid fault identification model. The whitelist includes trusted code segments, trusted disk access behaviors, and the range and frequency of trusted system calls. The selection of these two analysis methods comprehensively defines the legitimate behavior range for the normal operation of the power grid fault identification model. The operating status of the power grid fault identification model is monitored in real time based on the whitelist to obtain monitoring results. The monitoring results include both normal operation and abnormality conditions. Normal operation indicates that the operating status complies with the whitelist, while abnormality conditions indicate that the operating status does not comply with the whitelist. The whitelist can more accurately identify abnormal behavior of the power grid fault identification model and monitor the model's operation. Furthermore, if the monitoring result indicates an abnormality, an adaptive strategy is employed to maintain the power grid fault identification model, eliminating manual intervention. The adaptive strategy can be automatically and timely applied based on abnormal conditions to ensure the normal operation of the model, thereby improving the effectiveness of model maintenance.

[0067] In an exemplary embodiment, step S102 performs static analysis and dynamic analysis on the power grid fault identification model to generate a whitelist, including:

[0068] Without executing the code of the power grid fault identification model, the power grid fault identification model is statically analyzed to obtain an initial whitelist; while executing the code of the power grid fault identification model, the power grid fault identification model is dynamically analyzed to obtain a supplementary whitelist; and a whitelist is generated according to the union of the initial whitelist and the supplementary whitelist.

[0069] The initial whitelist can be composed of normal code execution paths, disk access, and system call patterns identified through static analysis. The supplementary whitelist can be composed of normal execution paths, function call sequences, disk access behaviors, and system call records of the model collected through dynamic analysis.

[0070] Optionally, without executing the code of the power grid fault identification model, the code of the power grid fault identification model is statically analyzed, including code parsing, control flow analysis, data flow analysis, and disk access and system calls. Code parsing uses static analysis tools (such as LLVM, Low Level Virtual Machine) to parse the source code of the power grid fault identification model to generate an abstract syntax tree (AST) and a control flow graph (CFG). Control flow analysis identifies all possible execution paths in the program based on the control flow graph (CFG), including loops, branches, exception handling, etc. Data flow analysis identifies all possible data dependencies based on the flow of data in the program to ensure the legality of data access. Disk access determines the legal disk access range and pattern by analyzing the memory allocation and access operations in the code. With the help of the above static analysis content, an initial whitelist is generated. Specifically, let P be the set of execution paths of the program of the power grid fault identification model, p be any execution path in P, and W static The initial whitelist generated for static analysis is:

[0071] W static ={p|p∈P,static_analysis(p)}

[0072] The server further dynamically analyzes the code of the power grid fault identification model while executing it, and obtains a supplementary whitelist, including four processes: test case design, code instrumentation, execution monitoring, and behavior recording. The test case design covers as many comprehensive test cases as possible to ensure that the smart grid fault identification model can be fully tested under various possible input conditions. Code instrumentation includes inserting monitoring code into key code segments, function entry and exit, disk access points, and system call points to collect runtime data. The fault identification model is run during execution monitoring, and the execution path, function call sequence, disk access behavior, and system call records are collected with the assistance of monitoring tools. The behavior recording stage records detailed information on the code path, function call, disk access, and system call for each run, including call frequency and parameters. Specifically, let B be the behavior set of the power grid fault identification model under dynamic analysis, b be any behavior in B, and W dynamic The whitelist generated for dynamic analysis is:

[0073] W dynamic ={b|b∈B,dynamic_analysis(b)}

[0074] The server generates a whitelist based on the union of the initial whitelist and the supplementary whitelist. Specifically, let W static Initial whitelist generated for static analysis, W dynamic is the whitelist generated by dynamic analysis, W is the final whitelist, then

[0075] W=W static ∪W dynamic

[0076] In this embodiment, static analysis and dynamic analysis are performed on the code of the power grid fault identification model respectively, and an initial whitelist and a supplementary whitelist are generated accordingly. The union of the two is used to obtain the final whitelist to ensure the comprehensiveness and accuracy of the whitelist. At the same time, conflicts between the static analysis and dynamic analysis results are checked, possible causes are analyzed, and manual verification and correction are performed. According to the system's operating environment and application requirements, the whitelist is optimized to ensure that it is concise and effective, and avoid being too loose or too strict.

[0077] In an exemplary embodiment, Figure 2 As shown, step S204 monitors the operating status of the power grid fault identification model in real time according to the whitelist to obtain the monitoring result of the power grid fault identification model, including the following steps S202 to S204.

[0078] Step S202 , obtaining the running status of the power grid fault identification model in real time, including: code execution path, disk access behavior and system call status.

[0079] Among them, the code execution path refers to the specific code path that the program takes during runtime, which can usually be monitored through debugging tools or performance analysis tools. The execution path may contain multiple function calls and conditional judgments, which affect the generation of the final output. Among them, disk access behavior involves the read and write operations of the model on the disk during operation. For example, the model reads files when loading a dataset; during the training process, the model may save checkpoints or log files. Among them, the system call situation can be the way a program requests the operating system to perform a specific task. The power grid fault identification model may make multiple system calls, such as memory management, file operations, network requests, etc.

[0080] Optionally, the server obtains the operating status of the power grid fault identification model in real time, including using debugging tools or performance analysis tools to monitor its code execution path; using tools (such as I / O input / output analysis tools) to monitor the frequency and type of file operations (such as reading and writing) of the model accessing the disk to obtain disk access behavior; using tools (such as strace tools for tracking system calls and signals or dtrace dynamic tracing framework) to track the interaction between the model and the operating system during runtime to obtain system call status.

[0081] In step S204 , the whitelist is compared with respect to the code execution path, disk access behavior and system call status respectively according to the preset detection rules to obtain the monitoring result of the power grid fault identification model.

[0082] The preset detection rule may be a comparison criterion between a preset whitelist and a power grid fault identification model.

[0083] Optionally, according to preset detection rules, the trusted code segments, trusted disk access behaviors, and the range and frequency of trusted system calls included in the whitelist are compared with the code execution paths, disk access behaviors and system call situations of the power grid fault identification model, and the comparison results are used as the monitoring results of the power grid fault identification model.

[0084] In this embodiment, by real-time monitoring of the code execution path, disk access behavior, and system call status of the power grid fault identification model and comparing them with the whitelist, abnormal behavior of the model can be discovered in a timely manner, and corresponding measures can be taken to correct the problem, thereby reducing the time for fault occurrence, improving the maintenance effect of the model, and ensuring the reliability of the power grid monitoring system.

[0085] In an exemplary embodiment, step S204 compares the whitelist with respect to the code execution path, disk access behavior, and system call status according to the preset detection rules to obtain monitoring results of the power grid fault identification model, including:

[0086] Calculate the similarity between the code execution path, disk access behavior and system call situation and the whitelist data respectively; if any similarity is lower than the preset threshold, the monitoring result is determined to be abnormal; if all similarities are higher than the preset threshold, the monitoring result is determined to be normal operation.

[0087] Similarity can be the degree of similarity between two or more objects, which is used to measure their similarity in specific features or attributes.

[0088] Optionally, the server calculates the similarity between the code execution path, disk access behavior and system call situation and the trusted code segment, trusted disk access behavior, and the range and frequency of trusted system calls in the whitelist. For example, for control flow data, the deviation value of the N most frequently called code execution paths of the monitored power grid fault identification model and the normal execution path recorded in the whitelist is calculated, and weights are assigned to different positions according to the call frequency. For example, the abnormality represented by the control flow with the highest triggering frequency should be higher than the control flow with the highest triggering frequency ranking N. The specific weighting method can be set according to the degree of relaxation of the administrator's security policy. In this way, the abnormality degree T of the control flow execution data is obtained. control-flow , the higher the abnormality, the lower the similarity.

[0089] Specifically, let the control flow execution path in the whitelist be P whitelist ={p1,p2,…,p n}, the monitored control flow execution path is P monitor ={q1,q2,…,q n}, then the deviation value is defined as:

[0090]

[0091] Among them, p ij and q ij Represents the path p i and q i The value at position j.

[0092] Let f i For path p i The trigger frequency, weight assignment w i Can be allocated according to trigger frequency:

[0093]

[0094] Abnormality degree T of control flow execution data control-flow It can be calculated by weighted deviation:

[0095]

[0096] Similarly, the same whitelist matching steps are performed on data flow execution data, disk access feature data, and system call feature data, and the matching results T of each type of data are calculated. data-flow ,T read-disk and T syscall .

[0097] The final outlier calculation method is the weighted sum of the four outliers, namely:

[0098] T=n1*T control-flow +n2*T data-flow +n3*T read-disk +n4*T syscall ,

[0099] in, The weight assignment strategy is also set by the administrator according to the conditions. After obtaining the abnormality T, it is compared with the abnormality threshold P to determine whether an abnormality has occurred. That is, if any similarity is lower than the preset threshold, the monitoring result is determined to be abnormal and the alarm process is entered. Specifically, let B real-time is the set of behaviors monitored during system operation, and T is the length of the monitored time series, then:

[0100] B real-time ={b t |t=1,2…,T}

[0101] For the alarm mechanism, the system reports the detected abnormal behavior through log records, real-time alarm notifications, etc., and triggers corresponding security response measures. Let E be the set of abnormal events, then When all similarities are higher than the preset threshold, the monitoring result is determined to be normal operation.

[0102] In this embodiment, by calculating the similarity between the operating status of the power grid fault identification model and the data included in the whitelist and comparing it with a preset threshold, it is determined whether there is an abnormality in the monitoring result, thereby improving the abnormality monitoring accuracy of the power grid fault identification model, paving the way for the subsequent execution of corresponding adaptive strategies for existing abnormalities, and improving the maintenance effect of the power grid fault identification model.

[0103] In an exemplary embodiment, after adopting an adaptive strategy to maintain the power grid fault identification model when the monitoring result indicates that an abnormality exists, step S206 further includes:

[0104] According to the abnormal behavior detection results of the adaptive strategy and monitoring results, the feedback function is used to update the whitelist and detection rules.

[0105] Among them, the corresponding functions for updating the whitelist and detection rules using feedback functions include:

[0106] W'=F(W,E)

[0107] φ'=F(φ,E)

[0108] Where F() represents the feedback function, E represents the abnormal behavior detection result, W represents the whitelist, φ represents the detection rule, W' represents the updated whitelist, and φ' represents the updated detection rule.

[0109] Optionally, the server uses a feedback function to update the whitelist and detection rules based on the adaptive strategy adopted and the abnormal behavior monitoring results of the monitoring results. For example, the adaptive strategy corrects the abnormal code segment, updates the corrected code segment to the whitelist, and updates the calculation weight of the similarity included in the detection rules based on the abnormal behavior monitoring results.

[0110] In this embodiment, after the server completes the repair of the power grid fault identification model, it will also perform behavioral learning. The main content is that the server learns from the abnormal behavior monitoring results of the adaptive strategy and monitoring results, optimizes the whitelist and detection rules to improve detection accuracy and response speed. At the same time, the system will also regularly update the whitelist and self-healing strategy according to the latest attack methods and changes in the system operating environment to maintain the system's defense capabilities.

[0111] In an exemplary embodiment, in step S206, when the monitoring result indicates that an abnormality exists, an adaptive strategy is used to maintain the power grid fault identification model, including:

[0112] When the monitoring results show an abnormality, the code segment or disk memory area that caused the abnormality is determined based on the abnormal behavior detection results; the code segment or disk memory area is isolated, and a root cause analysis is performed to determine the cause of the abnormality; based on the cause of the abnormality, an adaptive strategy is used to maintain the power grid fault identification model.

[0113] Root Cause Analysis (RCA) is a systematic approach designed to identify and address the root causes of problems, rather than just the symptoms. By identifying the underlying causes of a problem, organizations can take effective measures to prevent similar issues from recurring in the future.

[0114] Optionally, when the monitoring result of the power grid fault identification model indicates an anomaly, the server determines the code segment or disk memory area that caused the anomaly based on the abnormal behavior detection result, isolates the code segment or disk memory area, and performs root cause analysis to determine the cause of the anomaly, such as determining whether the anomaly is caused by a change in the characteristics of the input sample or a violation of the program integrity. Adaptive strategies are used to maintain the power grid fault identification model based on the cause of the anomaly. For example, when an anomaly is detected in the control flow and data flow of the power grid fault identification model, due to a significant change in the program execution logic in a short period of time, assuming that the abnormal behavior detection result indicates a bit-flip attack, if the input sample is far from the historical sample, it is determined that an adversarial sample attack may have occurred, and the model needs to be retrained. For example, the Basic Linear Algebra Subprogram (BLAS) that the original model relies on is soft-linked to a backup, normal dynamic link library, and the model is rerun to observe whether it returns to normal. If it still does not recover, a lower-priority preset repair solution is executed until the model returns to normal after rerunning, or if the repair fails, an alarm is sent to a higher layer.

[0115] In this embodiment, the code segment or disk memory area that generates the abnormality is isolated to prevent the fault from spreading to other locations. Based on the root cause analysis of the abnormal code segment or disk memory area, the corresponding abnormal cause is obtained, and an adaptive strategy is adopted to maintain the code segment and disk memory area, thereby reducing the impact of the abnormality on the model performance and further improving the maintenance effect of the power grid fault identification model.

[0116] In an exemplary embodiment, the steps of the above embodiment adopt an adaptive strategy to maintain the power grid fault identification model according to the abnormal cause, including:

[0117] Depending on the cause of the exception, the code segment or data in the disk memory area is rolled back or repaired using the online repair function.

[0118] Among them, the functions corresponding to the online repair function include:

[0119] S repair (t)=R(S(t),E)

[0120] Among them, S(t) is the current operating state of the power grid fault identification model, E represents the abnormal behavior detection result, and S repair (t) represents the operating status of the power grid fault identification model after repair, and R() represents the online repair function.

[0121] Optionally, the server detects whether the anomaly is due to a change in input sample characteristics or an anomaly in the model program itself, and then rolls back the code segment or disk memory area data or uses online repair functions to repair it. Specifically, if the code segment is anomaly, the code segment version is rolled back to the normal working code segment version, and the data in the disk memory area can also be rolled back to the data version without the anomaly.

[0122] In this embodiment, a corresponding adaptive strategy is adopted according to the abnormal cause of the power grid fault identification model to reduce the downtime, improve the availability of the model, and further improve the maintenance effect of the model.

[0123] In an exemplary embodiment, another abnormal maintenance method of a power grid fault identification model is provided, which is applied to Figure 3 The whitelist-based smart grid fault identification model bit flip vulnerability intrusion detection and self-healing system shown includes:

[0124] The system's whitelist generation module, real-time monitoring module, and adaptive and self-healing module run on the hardware device deployed with the smart grid fault identification model, while the anomaly detection and alarm module runs on the cloud server. During operation, the whitelist generation module sends the generated whitelist to the corresponding address on the cloud server. Similarly, during the model operation process, the data collected by the real-time monitoring module is also uploaded to the cloud server. At this time, the cloud server will compare the model operation status data with the whitelist, and determine whether an anomaly has occurred and whether an alarm is required. After generating the judgment result, it will be sent to the model operation device. If the server determines that an anomaly has occurred, the device will first try to self-heal, such as replacing a dynamic link library that is determined to have an anomaly with a backup normal link library. If the anomaly is not resolved, the model local device will request the cloud server for the last backup status for model status rollback. At this time, the cloud server will also extract the characteristics of this abnormal behavior and update the local whitelist of the model.

[0125] This system can also be run completely locally. The above-mentioned running of the anomaly detection and alarm module on the cloud server is based on the following considerations: on the one hand, the whitelist of all smart grid fault detection models is stored on the cloud server, which is convenient for administrators to manage; on the other hand, the comparison process between real-time data and the whitelist is relatively complicated and requires a lot of computing power. Therefore, running it on the server can reduce the burden on the local equipment of the model and provide better real-time performance.

[0126] This embodiment describes a whitelist-based smart grid fault identification model bit flip vulnerability intrusion detection and self-healing system, which is mainly divided into four modules: a whitelist generation module, a real-time monitoring module, an anomaly detection and alarm module, and an adaptive and self-healing module. In addition, it also includes a behavioral learning process, as follows:

[0127] Whitelist Generation Module: The static analysis process of the whitelist generation module sequentially performs four steps: code parsing, control flow analysis, data flow analysis, and disk access and system call analysis. Regarding the code analysis process, this embodiment primarily focuses on analyzing the underlying code base of the machine learning framework. This is because bit-flip attacks often target the underlying code base, enabling white-box attacks and being more versatile. The smart grid fault identification model in this embodiment is a deep neural network-based image recognition model developed using PyTorch. It is used to detect the presence of foreign objects such as tree branches and plastic packaging on transmission lines that may cause grid equipment failures. The model source code relies on the underlying basic linear algebra subroutines, or BLAS libraries. This is reflected in the executable program's dependency on the libblas.so or libopenblas.so libraries (on Linux systems). During static code analysis, the system first uses the IDA Pro tool to analyze the BLAS dynamic link library on the model's local device, generating the dynamic link library's control flow graph (CFG) and data flow graph (DFG). Control flow and data flow analysis are then performed, respectively.

[0128] Control flow analysis mainly extracts the program execution path at the function level based on the control flow graph generated by code analysis. Since the control flow graph can essentially be stored using a multi-tree data structure, with nodes as functions and edges as control flow transfer relationships, this embodiment can use reverse traversal from leaf nodes to obtain all execution paths.

[0129] Specifically, let the node be V and the edge be E, then:

[0130] CFG=(V,E)

[0131] Let P CFG is the set of all execution paths in the control flow graph, each execution path p i is a sequence of nodes, m is the tree depth, then:

[0132] P CFG ={p1,p2,…,p n}

[0133] p i =(v i1 ,v i2 ,…,v im ),v ij ∈V

[0134] By traversing backward from the leaf node v L To begin, you can get all execution paths:

[0135]

[0136] Similarly, data flow analysis uses the same processing method, starting from a leaf node and obtaining the path of all data flowing into this leaf node.

[0137] Specifically, let the node be V′ and the edge be E′, then:

[0138] DFG=(V′,E′)

[0139] Let P DFG is the set of all data flow paths in the control flow graph, each execution path d i is a sequence of nodes, m is the tree depth, then:

[0140] P DFG ={d1,d2,…,d n}

[0141] d i =(v′ i1 ,v′ i2 ,…,v′ im ),v′ ij ∈V′

[0142] By traversing backward from the leaf node v′ L To begin, you can get all execution paths:

[0143]

[0144] In addition, during the control flow and data flow analysis, the intermediate code accesses memory, such as the locations in the execution path where disk access occurs, the size and frequency of the accesses, and other characteristics, are recorded. Through these steps, static analysis of the code of the power grid fault identification model is achieved. The dynamic analysis of this embodiment includes four steps: test case design, code instrumentation, execution monitoring, and behavior recording. Regarding test case design, this embodiment uses a large amount of grid equipment monitoring image data to input into the model for fault identification. It is important to note that the input data must be representative. This is achieved by inputting images of different time periods, regions, equipment, and climate characteristics into the model to cover as much of the input image feature space as possible. The purpose of dynamic analysis is to collect state characteristics of the model during normal operation to generate a whitelist. To achieve this, dynamic code instrumentation is required, such as setting a counter for a key function to count the number of times the function is called during a normal fault identification, the order in which different functions are called, and the frequency of their calls. The execution monitoring step utilizes the control flow graph and data flow graph obtained from static code analysis, primarily monitoring the frequency of execution of different paths during the normal operation of the model. The behavior of the monitored information is recorded. In this embodiment, it is reflected in recording the execution of the control flow path and the data flow path, and sorting them according to frequency to obtain the program characteristics when the model is executed normally. At the same time, the disk access characteristics (functions that trigger disk access, access size, number of disk accesses, etc.) and system call characteristics (functions that trigger system calls, types of system calls, number of system calls, etc.) during the execution of the path are recorded. Finally, the data obtained from static analysis and dynamic analysis are combined to generate a whitelist. In this embodiment, the whitelist is generated mainly considering four aspects: control flow path frequency, data flow path frequency, disk access characteristics, and system call characteristics. Specifically, a threshold N is set, and the control flow paths and data flow paths ranked in the top N in frequency are extracted, and the disk access and system call characteristics during the execution of the path are recorded. This is stored locally as a whitelist, or uploaded for storage when using a cloud server.

[0145] Real-time monitoring module, the real-time monitoring module in this embodiment includes three aspects: code execution monitoring, disk access monitoring and system call monitoring. The code execution monitoring in this embodiment is to collect the control flow and data flow program running path in the BLAS library part (such as libblas.so or libopenblas.so under the Linux platform) during the model running process with the help of the plug-in code, record all execution paths and extract the top N control flows and data flow paths with the highest frequency. The disk access monitoring in this embodiment is responsible for collecting the disk access characteristics during the model running process, including the size and frequency of accessed memory blocks. Similarly, the system call in this embodiment mainly monitors the system call characteristics during the program running process, including the type and number of system calls triggered. Ultimately, all collected data will be transmitted to the anomaly detection and alarm module of the local or cloud server for processing.

[0146] The anomaly detection and alarm module compares received smart grid fault detection model operation data with a whitelist during anomaly detection. Specifically, it matches control flow execution data, data flow execution data, disk access feature data, and system call feature data according to whitelist rules. This is done by calculating similarity between the four types of data and the whitelist data. For example, for control flow data, the deviation between the N most frequently monitored control flow execution paths and the normal execution paths recorded in the whitelist is calculated. Different locations are weighted based on call frequency. For example, the anomaly represented by the control flow with the highest trigger frequency should be higher than the anomaly represented by the control flow with the highest trigger frequency. The specific weighting method can be set based on the degree of laxity of the administrator's security policy. This method determines the anomaly level of the control flow execution data. The anomaly value of each feature is used to determine which feature caused the anomaly, and the cause and the judgment result are passed to the adaptive and self-healing module.

[0147] The adaptive and self-healing module is used to trigger the abnormal detection and alarm module when it generates an alarm message. In this embodiment, the module will perform three steps: fault isolation, root cause analysis, and automatic repair. In this embodiment, fault isolation mainly means that the module will immediately notify the device to stop the operation of the fault detection model to prevent the fault from spreading to other locations and causing more serious impact. In order to restore the normal operation of the model as soon as possible, the system will first perform a root cause analysis of the model anomaly to determine whether the cause of the anomaly is due to a change in the characteristics of the input sample or the destruction of the program integrity. For example, when an abnormal control flow and data flow execution is detected, since the execution logic of the program has changed significantly in a short period of time, it is assumed that a bit flip attack has occurred. When the input sample is far away from the historical sample, it is determined that an adversarial sample attack may have occurred, and the model needs to be retrained. After determining the cause of the anomaly, the automatic repair process will be initiated. Preset solutions will be executed based on the specific cause, such as soft-linking the Basic Linear Algebra Subprogram (BLAS) that the original model relies on to a backup, normal dynamic link library. The model will be re-run to see if it returns to normal. If it still does not, the preset repair solution with a lower priority will be executed until the model returns to normal after re-execution, or if the repair fails, an alarm will be sent to a higher level. After the module successfully repairs the anomaly, it will also learn from the abnormal behavior to improve the whitelist. In this embodiment, when the module performs root cause analysis and finds that the system has executed a large number of write system calls during the anomaly, it will remind the whitelist generation module to appropriately limit the number or frequency of corresponding system calls in the whitelist during behavior learning, thereby achieving the purpose of more accurate identification of such attacks.

[0148] In this embodiment, by generating a whitelist based on a deep neural network (DNN) model in the smart grid, the operating behavior of the model is monitored in real time, compared with the whitelist, and abnormal behavior is detected, especially anomalies caused by bit flip attacks. Once an anomaly is detected, the system will automatically self-heal and restore the normal state of the model to ensure the accuracy and reliability of fault detection. This method improves the security and robustness of the smart grid, reduces manual intervention and maintenance costs, ensures the stable operation of the power grid, and reduces economic losses. This innovative method promotes the development of smart grid security technology and provides new ideas and methods for future related research.

[0149] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0150] Based on the same inventive concept, an embodiment of the present application further provides a device for abnormal maintenance of a power grid fault identification model for implementing the aforementioned abnormal maintenance method for a power grid fault identification model. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more embodiments of the device for abnormal maintenance of a power grid fault identification model provided below can be found in the above-mentioned limitations of the abnormal maintenance method for a power grid fault identification model, and will not be repeated here.

[0151] In an exemplary embodiment, Figure 4 As shown, a device 400 for abnormal maintenance of a power grid fault identification model is provided, comprising: a whitelist generation module 402, a model monitoring module 404 and a model maintenance module 406, wherein:

[0152] The whitelist generation module is used to perform static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls.

[0153] The model monitoring module is used to monitor the operating status of the power grid fault identification model in real time according to the whitelist to obtain the monitoring results of the power grid fault identification model; the monitoring results include normal operation and abnormality; normal operation indicates that the operating status complies with the whitelist; abnormality indicates that the operating status does not comply with the whitelist.

[0154] The model maintenance module is used to maintain the power grid fault identification model using an adaptive strategy when the monitoring result shows that there is an abnormality.

[0155] Furthermore, in one embodiment, the whitelist generation module 402 is also used to perform static analysis on the code of the power grid fault identification model without executing the code of the power grid fault identification model to obtain an initial whitelist; perform dynamic analysis on the code of the power grid fault identification model while executing the code of the power grid fault identification model to obtain a supplementary whitelist; and generate a whitelist based on the union of the initial whitelist and the supplementary whitelist.

[0156] Furthermore, in one embodiment, the model monitoring module 404 is also used to obtain the operating status of the power grid fault identification model in real time, including: code execution path, disk access behavior and system call status; according to the preset detection rules, the whitelist is compared with the code execution path, disk access behavior and system call status respectively to obtain the monitoring results of the power grid fault identification model.

[0157] Furthermore, in one embodiment, the model monitoring module 404 is also used to respectively calculate the similarity between the code execution path, disk access behavior and system call status and the data in the whitelist; when any similarity is lower than a preset threshold, the monitoring result is determined to be abnormal; when all similarities are higher than the preset threshold, the monitoring result is determined to be normal operation.

[0158] Furthermore, in one embodiment, the model maintenance module 406 is further configured to update the whitelist and detection rules using a feedback function based on the adaptive strategy and abnormal behavior detection results of the monitoring results; wherein the functions corresponding to updating the whitelist and detection rules using the feedback function include:

[0159] W'=F(W,E)

[0160] φ'=F(φ,E)

[0161] Where F() represents the feedback function, E represents the abnormal behavior detection result, W represents the whitelist, φ represents the detection rule, W' represents the updated whitelist, and φ' represents the updated detection rule.

[0162] Furthermore, in one embodiment, the model maintenance module 406 is also used to, when the monitoring result indicates an abnormality, determine the code segment or disk memory area that generates the abnormality based on the abnormal behavior detection result; isolate the code segment or disk memory area, and perform root cause analysis to determine the cause of the abnormality; and maintain the power grid fault identification model using an adaptive strategy based on the cause of the abnormality.

[0163] Furthermore, in one embodiment, the model maintenance module 406 is further configured to roll back the code segment or the data in the disk memory area or perform repair using an online repair function based on the cause of the exception. The functions corresponding to the repair using the online repair function include:

[0164] S repair (t)=R(S(t),E)

[0165] Among them, S(t) is the current operating state of the power grid fault identification model, E represents the abnormal behavior detection result, and S repair (t) represents the operating status of the power grid fault identification model after repair, and R() represents the online repair function.

[0166] Each module in the abnormal maintenance device 400 for the power grid fault identification model can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0167] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store trusted code segments, trusted disk access behaviors, and the range and frequency data of trusted system calls. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for an abnormal maintenance device of a power grid fault identification model is implemented.

[0168] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0169] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0170] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0171] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0172] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile memory and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a programmable logic unit (PLC), a data processing logic unit based on quantum computing, an artificial intelligence (AI) processor, and the like.

[0173] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0174] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for abnormal maintenance of a power grid fault identification model, characterized in that: The method comprises: Performing static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls; Real-time acquisition of the operating status of the power grid fault identification model includes: code execution path, disk access behavior, and system call status; the code execution path includes control flow execution data and data flow execution data; outliers between the control flow execution data, the data flow execution data, the disk access behavior, and the system call status and the data in the whitelist are respectively calculated to obtain a monitoring result of the power grid fault identification model; the monitoring result includes two conditions: normal operation and abnormality; the normal operation condition indicates that the operating status complies with the whitelist; the abnormality condition indicates that the operating status does not comply with the whitelist; When the monitoring result shows that there is an abnormality, an adaptive strategy is adopted to maintain the power grid fault identification model.

2. The method according to claim 1, characterized in that The power grid fault identification model is subjected to static analysis and dynamic analysis to generate a whitelist, including: Without executing the code of the power grid fault identification model, performing static analysis on the code of the power grid fault identification model to obtain an initial whitelist; In the case of executing the code of the power grid fault identification model, dynamically analyzing the code of the power grid fault identification model to obtain a supplementary whitelist; A whitelist is generated according to the union of the initial whitelist and the supplementary whitelist.

3. The method according to claim 1, characterized in that The step of respectively calculating outliers between the control flow execution data, the data flow execution data, the disk access behavior, and the system call situation and the data in the whitelist to obtain monitoring results of the power grid fault identification model includes: Performing weighted summation on outliers between the control flow execution data, the data flow execution data, the disk access behavior, the system call situation, and the data in the whitelist to obtain a final outlier value; According to the comparison result between the final abnormal value and the abnormal threshold, a monitoring result of the power grid fault identification model is obtained.

4. The method according to claim 1, wherein After the adaptive strategy is used to maintain the power grid fault identification model when the monitoring result indicates that an abnormality exists, the method further includes: Based on the adaptive strategy and the abnormal behavior detection results of the monitoring results, the whitelist and the detection rules are updated using a feedback function; the detection rules are comparison and judgment criteria between a preset whitelist and a power grid fault identification model; Among them, the corresponding functions for updating the whitelist and the detection rules using the feedback function include: W'=F(W,E) φ'=F(φ,E) Wherein, F() represents the feedback function, E represents the abnormal behavior detection result, W represents the whitelist, φ represents the detection rule, W' represents the updated whitelist, and φ' represents the updated detection rule.

5. The method according to claim 4, characterized in that When the monitoring result indicates that an abnormality exists, an adaptive strategy is adopted to maintain the power grid fault identification model, including: If the monitoring result indicates that an anomaly exists, determining the code segment or disk memory area where the anomaly occurs based on the abnormal behavior detection result; Isolating the code segment or the disk memory area and performing root cause analysis to determine the cause of the anomaly; According to the abnormal cause, an adaptive strategy is adopted to maintain the power grid fault identification model.

6. The method according to claim 5, characterized in that The maintaining the power grid fault identification model by using an adaptive strategy according to the abnormal cause includes: According to the cause of the exception, the code segment or the data in the disk memory area is rolled back or repaired using an online repair function; Among them, the functions corresponding to the online repair function include: S repair (t)=R(S(t),E) Wherein, S(t) is the current operating state of the power grid fault identification model, E represents the abnormal behavior detection result, and S repair (t) represents the operating state of the power grid fault identification model after repair, and R() represents the online repair function.

7. An abnormal maintenance device for a power grid fault identification model, characterized in that: The device comprises: A whitelist generation module is used to perform static and dynamic analysis on the power grid fault identification model to generate a whitelist; the whitelist includes trusted code segments, trusted disk access behaviors, and the scope and frequency of trusted system calls; A model monitoring module is configured to obtain in real time the operating status of the power grid fault identification model, including: code execution path, disk access behavior, and system call status; the code execution path includes control flow execution data and data flow execution data; anomaly values ​​between the control flow execution data, the data flow execution data, the disk access behavior, and the system call status and the data in the whitelist are respectively calculated to obtain monitoring results of the power grid fault identification model; the monitoring results include two conditions: normal operation and abnormality; the normal operation condition indicates that the operating status complies with the whitelist; the abnormality condition indicates that the operating status does not comply with the whitelist; The model maintenance module is used to maintain the power grid fault identification model by using an adaptive strategy when the monitoring result shows that there is an abnormality.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images