Network security defense method and device based on AI large model and ATTCK framework

Abstract

The invention provides a method based on an AI large model and ATTamp; the invention discloses a network security defense method and device of a CK framework. The method is based on ATTamp. The CK framework is used for comprehensively, automatically and individually providing security risk assessment and defense suggestions and attack recognition and pre-judgment for enterprises by using a network security field large model, so that the working intensity and the technical threshold of security operation personnel are greatly reduced; meanwhile, the network security field large model serves as a daily security event analysis assistant, a simple form of natural language questions and answers is adopted, a machine is used for reading and analyzing massive system logs, and the massive system logs are translated into ATTamp; the attack chain of the CK framework provides constructive opinions, so that the threshold of using a complex and highly professional security technology framework is greatly reduced, and the accuracy and efficiency of research and judgment of security events are improved. Meanwhile, as time goes on, the ATTamp can be effectively updated; the CK data source achieves timeliness and automation.

Description

Technical Field

[0001] The present invention relates to the field of electronic digital data processing technology, and in particular to a network security defense method and device based on an AI big model and an ATT&CK framework. Background Art

[0002] MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a framework, set of data matrices, and assessment tools developed by the MITRE Corporation to help organizations understand their security posture and discover gaps in their defenses.

[0003] The MITRE ATT&CK framework is usually presented in a table format, where columns represent tactics used during an attack (or expected results) and rows represent techniques used to achieve their tactical goals. This framework also records the usage of each technique and other metadata associated with each technique. It streamlines the attack chain of attackers infiltrating networks, invading hosts, escalating privileges, stealthily moving, and exfiltrating data. Using the universal classification of attacker behavior in MITRE ATT&CK can help security teams such as cyber incident response teams (CIRTs), security operations centers (SOCs), red and blue teams, threat hunters, and IT departments to better test, develop, and sort their detection and response mechanisms, and provide efficient security protection for the company's business, industry, and intellectual property.

[0004] Large Language Model (LLM) refers to machine learning models with a large number of parameters and computing resources. These models usually require a lot of data and computing power during training, and have millions to billions of parameters. The advantage of large models is that they can learn more features and patterns, thereby improving the understanding and processing capabilities of input data so that more accurate predictions and classifications can be made, more natural language generation results can be produced, or more informed choices can be made on complex decision problems.

[0005] In terms of modality support, AI big models can be divided into natural language processing big models, CV big models, scientific computing big models, etc. AI big models support more diverse modalities, gradually developing from supporting single tasks in a single modality of text, pictures, images, and voice to supporting multiple tasks in multiple modalities, enabling them to achieve remarkable results in fields such as natural language processing, computer vision, and speech recognition.

[0006] MITRE ATT&CK is effective because all tactics, techniques, and procedures (TTPs) are based on real attack groups observed in the real world. As the number and size of ATT&CK matrices continue to increase, the matrices are becoming more and more complex. Although the permutations and combinations of tactics and techniques in the framework are more complete and comprehensive, the amount of data that needs to be digested and processed has also increased, and the difficulty it brings to security personnel is also increasing day by day.

[0007] On the other hand, for most enterprises, the existing security products may not cover all the security detection capabilities required by the ATT&CK matrix. At the same time, each type or even each security attack chain has its own uniqueness. As a result, it is difficult to trace a complete attack chain in actual combat, and it is also difficult to determine whether the host is really compromised.

[0008] In response to new security incidents, security experts are unable to quickly and effectively map the current security attacks to the ATT&CK framework, identify and predict the attack chain, which in turn affects subsequent protection. Summary of the invention

[0009] The present invention is to solve the accuracy problem of network security protection, and provides a network security defense method and device based on AI big model and ATT&CK framework. Based on ATT&CK framework, using big model in network security field, it provides enterprises with security risk assessment and defense suggestions, attack identification and prediction in an all-round, automated and personalized manner, which greatly reduces the work intensity and technical threshold of security operators; at the same time, big model in network security field is used as a daily security incident analysis assistant, which adopts the simple form of natural language question and answer, and uses machine to "read and analyze" massive system logs, "translate" into attack chains of ATT&CK framework and provide constructive opinions, which greatly reduces the threshold of using complex and highly professional security technology frameworks, and improves the accuracy and efficiency of security incident research and judgment. At the same time, as time goes by, ATT&CK data source can also be effectively updated, achieving timeliness and automation.

[0010] The present invention provides a network security defense method based on an AI big model and an ATT&CK framework, comprising the following steps:

[0011] S1. Fine-tune the big model using training data including ATT&CK framework data to obtain a big model in the network security field based on the ATT&CK framework. The big model in the network security field based on the ATT&CK framework can understand security alert logs and map them to various attack methods in the ATT&CK framework.

[0012] S2. The security operations personnel of the enterprise to be assessed input the enterprise's key asset information into the ATT&CK framework network security domain big model in the form of interactive interviews, and then assess the enterprise to be assessed based on the ATT&CK framework network security domain big model and output a security risk assessment report;

[0013] S3. Input the actual attack cases as prompt words into the big model of network security field based on the ATT&CK framework. Read and discover the rules based on the big model of network security field based on the ATT&CK framework and map them into the attack chain of the ATT&CK framework. Fit the possible attacks and the trend of subsequent attack chains, give the probability of each attack route, and complete a network security defense method based on the AI ​​big model and the ATT&CK framework.

[0014] The network security defense method based on the AI ​​big model and the ATT&CK framework described in the present invention is, as a preferred method, in step S1, the training data includes basic training data, external knowledge as domain knowledge, and private data as background splicing;

[0015] Basic training data includes the latest ATT&CK knowledge base, ATT&CK framework best practices, and ATT&CK practical analysis;

[0016] External knowledge labels data for the industry;

[0017] Private data includes enterprise security equipment, enterprise IT information, and original traffic mirroring data.

[0018] The network security defense method based on the AI ​​big model and the ATT&CK framework described in the present invention, as a preferred method, the training data also includes security incident case reports, security incident analysis plans, industry threat intelligence information and laws and regulations;

[0019] Threat intelligence can be obtained from: threat intelligence services, security communities and forums, open source intelligence and dark web information;

[0020] Private data is uploaded locally to a large network security model based on the ATT&CK framework. The private data is spliced ​​into the prompt words as background information. The large network security model based on the ATT&CK framework analyzes the attack incident based on the background information.

[0021] The network security defense method based on the AI ​​big model and the ATT&CK framework described in the present invention is a preferred method. In step S2, the key asset information of the enterprise includes IT asset information, security products and network architecture. The big model of the network security field based on the ATT&CK framework can quickly discover the weak links and possible attack points of the security protection of the enterprise to be evaluated and convert them into a security risk assessment report output.

[0022] The network security defense method based on the AI ​​big model and the ATT&CK framework described in the present invention is, as a preferred method, the security risk assessment report includes the security risk status, potential threats, vulnerabilities, weaknesses, suggestions and improvement measures of the enterprise to be assessed.

[0023] The network security defense method based on the AI ​​big model and the ATT&CK framework described in the present invention, as a preferred embodiment, step S3 includes the following steps:

[0024] S31, input the actual attack case as a prompt word into the large model of network security field based on the ATT&CK framework. When the actual attack case has a log file, input the log file or alarm information into the large model of network security field based on the ATT&CK framework. When the actual attack case has no log file, input the language description into the large model of network security field based on the ATT&CK framework.

[0025] S32. Based on the ATT&CK framework, the cybersecurity domain model combines contextual understanding to map attack behaviors to the ATT&CK framework, and then infer the possible types of attacks.

[0026] S33. Based on the ATT&CK framework, the network security domain model predicts subsequent attack trends and analyzes the probability through log analysis based on the complete attack cycle of the ATT&CK framework;

[0027] S34. Output behavioral analysis solution based on ATT&CK framework large model in the network security field.

[0028] The network security defense method based on the AI ​​big model and the ATT&CK framework described in the present invention is, as a preferred method, in step S31, based on the ATT&CK framework network security field big model, the semantic expression of the security incident can be converted into the attack tactics and techniques listed in the ATT&CK framework.

[0029] The network security defense method based on the AI ​​big model and the ATT&CK framework described in the present invention is, as a preferred method, in step S31, the actual attack case may be a case of other network security frameworks except the ATT&CK framework; the actual attack case may also be the threat intelligence information and task log of the enterprise to be evaluated.

[0030] The network security defense method based on the AI ​​big model and the ATT&CK framework described in the present invention, as a preferred method, also includes step S4, analyzing the threat intelligence information and task logs of the enterprise according to the data sources listed in the ATT&CK framework based on the ATT&CK framework network security field big model, and incorporating the discovered new attack technologies and attack activities into the data source to update the data source;

[0031] The data sources in the ATT&CK framework include: information from security incidents, threat intelligence, penetration testing, malicious activity analysis, and community contributions.

[0032] The present invention provides a network security defense device based on an AI big model and an ATT&CK framework. A computer program is stored on the network security defense device, and the computer program can run a network security defense method based on the AI ​​big model and the ATT&CK framework.

[0033] This technical solution is based on the ATT&CK framework. By referencing the AI ​​big model, it fully utilizes the prediction, decision-making and natural language processing capabilities of the big model to better defend enterprise security.

[0034] The solution of the present invention is:

[0035] First, we use data to train a large model in the field of network security. This model has the ability to understand security alert logs and map them to various attack methods in the ATT&CK framework. It also has a sandbox-like method to assess the company's security weaknesses and fit possible attack chains based on past attack cases to predict the probability of compromise.

[0036] Training data is divided into three categories: basic training data, external knowledge, and private data.

[0037] 1) Basic training data: the latest ATT&CK knowledge base, security incident case reports, security incident analysis solutions, ATT&CK framework best practices, ATT&CK practical analysis, industry threat intelligence information, laws and regulations, etc.

[0038] 2) External knowledge: Industry annotation data, as domain knowledge, can be directly used as external knowledge for LLM retrieval to achieve rapid adaptation of the model.

[0039] 3) Private data: Enterprise security equipment, enterprise IT information, original traffic mirror data, etc. can be uploaded locally to LLM for background splicing.

[0040] By using the trained big model in the field of network security, security defense can be achieved step by step through the following steps.

[0041] (1) Security risk assessment. Self-check the status of corporate assets and discover the weak links of the enterprise in advance. By providing key asset information as input (prompt) to LLM, LLM can quickly discover the weak points of current corporate assets. These places may become the entry point for hackers to attack the system in the future and need to be protected or repaired in time. At the same time, using the ability of LLM to generate reports, output security risk assessment reports, summarize the overall security risk status, list potential threats, vulnerabilities and weaknesses, and provide suggestions and improvement measures.

[0042] (2) Compromise prediction. By analyzing the current events, possible attack paths are fitted and the probability of host compromise is predicted. The log files or alarm information generated by the system and application are provided to LLM as prompts. LLM combines the learned security incident cases, analysis plans, ATT&CK framework best practices, ATT&CK practical analysis, industry threat intelligence information, etc. to output a behavioral analysis plan, automatically fit the possible attacks and subsequent attack chain trends, and give the probability of each attack route.

[0043] At the same time, in the case where there is no log file record of the attack, that is, the attacker may take measures to evade, delete or modify the log to minimize the risk of detection. When security operations personnel discover attack activities through monitoring abnormal activities, user behavior analysis, internal audits, etc., they can provide a semantic description of the attack to LLM. At this time, threat mapping is required, that is, converting the description into the correct technology on the ATT&CK framework for subsequent compromise prediction.

[0044] a) Natural language expression mapping

[0045] ATT&CK covers many technologies and is constantly updated. The latest ATT&CK for Enterprise (v14) contains 14 tactics, 201 techniques, and 424 sub-techniques. Compared with v13, the matrix adds 18 new technologies. Operators cannot accurately describe attack activities as technologies on the matrix. In order to reduce the learning burden and learning costs of operators, the natural language processing capabilities of LLM are used to convert human semantic expressions of security events into attack tactics and technologies listed on the ATT&CK framework.

[0046] b) Other threat framework mapping

[0047] In addition to the MITRE ATT&CK framework, there are some other popular cybersecurity frameworks that can help professionals understand and combat threat behaviors in actual attacks, such as Cyber ​​Kill Chain, Diamond Model of Intrusion Analysis, CAR (Cyber ​​Analytics Repository) Framework, TTPs (Tactics, Techniques, and Procedures), Istio Threat Intelligence and Mitigation Framework, etc. The same attack technology may not be described exactly the same in different cybersecurity frameworks. For example, in the MITRE ATT&CK framework, email phishing belongs to the "Initial Access" tactic, with the technical number T1566-Phishing, while the Cyber ​​Kill Chain framework mainly classifies it as the "Delivery" stage in the attack life cycle. At present, the cybersecurity framework is still in a stage of flourishing, and there is no absolutely dominant framework that can unify the general description. In order to reduce the difficulty and learning cost for operators to learn various frameworks, LLM is used to map the attacks mentioned in other mainstream cybersecurity frameworks to the ATT&CK framework to facilitate subsequent compromise prediction.

[0048] Data source update. ATT&CK framework lists a large number of data sources, mainly from various security incidents, threat intelligence, penetration testing, malicious activity analysis and community contribution information. LLM analyzes the enterprise's threat intelligence information, task logs, etc., and incorporates the discovered new attack techniques and attack activities into the data source, so as to know both ourselves and the enemy and win every battle.

[0049] The present invention has the following advantages:

[0050] (1) The present invention can proactively discover weak links in enterprise security protection or possible attack points by utilizing AI big models. It can comprehensively conduct security deductions on enterprise assets without the need for third-party security vendor evaluation or manual analysis, making it easier for enterprises to conduct risk assessments, strengthen their own security deployment in advance, and consolidate their defense systems.

[0051] (2) Some hidden threats or vulnerabilities are difficult to detect and enterprises cannot perceive them. There may be no obvious warnings in the actual logs, or the current intrusion behavior has not formed a complete life cycle. Through the automatic analysis of the AI ​​big model, it can detect the attacks that the system may be suffering from and find out the events with high probability of failure so that enterprises can respond in time and fix the vulnerabilities, while reducing human misjudgment.

[0052] (3) As the ATT&CK matrix continues to expand with actual external attack cases, more and more tactics and techniques are emerging. This system can reduce the learning cost of security operations personnel. It does not require the ability of network security experts. Based on the learned security framework, the system can describe attacks through natural language and automatically map them to the corresponding ATT&CK technologies. It is easy to maintain and reduce operating costs.

[0053] (4) Cyber ​​attack techniques are becoming increasingly complex and threats are constantly evolving. Using the automation technology of the present invention to update the data set ensures timeliness and effectively updates the ATT&CK data source. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a schematic diagram of the architecture of a network security defense method and device based on the AI ​​big model and the ATT&CK framework;

[0055] Figure 2 Schematic diagram of different attack routes for malware infection attacks;

[0056] Figure 3 The figure is a schematic diagram of event fitting of a network security defense method and device based on an AI big model and an ATT&CK framework and based on the ATT&CK framework. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0058] Example 1

[0059] like Figures 1 to 3 As shown, a network security defense method and device based on AI big model and ATT&CK framework.

[0060] The core process of the big model can be simplified into two major steps: pre-training and fine-tuning. Through pre-training, we get the so-called "general big model". Then, based on this general model, we can use the data of a specific industry to fine-tune it, thus generating an "industry big model".

[0061] In order to realize the above-mentioned security risk assessment capabilities, breach prediction capabilities, threat mapping capabilities and automatic update of ATT&CK data sets, the first thing is to train LLM to form the company's own large model in the field of network security. By analyzing the log information and traffic of security incidents, combined with LLM's super analysis, judgment and natural language processing capabilities, the above capabilities can be realized.

[0062] The detailed implementation method is as follows:

[0063] Step 1: LLM training

[0064] 1. LLM training

[0065] Select a general large model and fine-tune the model to make it an industry large model in the security field.

[0066] Provide the latest ATT&CK knowledge base, security incident case reports, security incident analysis plans, ATT&CK framework best practices, ATT&CK practical analysis, industry threat intelligence information, and laws and regulations as training data to LLM.

[0067] Among them, threat intelligence can be obtained from the following methods: threat situation services, security communities and forums, open source intelligence (OSINT), dark web information, etc.

[0068] 2.LLM external knowledge retrieval

[0069] Industry standard data can be directly used as external knowledge for LLM retrieval, enabling rapid adaptation of the model.

[0070] 3. LLM private data processing

[0071] Enterprise asset information (security equipment, IT information) and original traffic mirror data cannot be made public on the Internet. You can choose to upload private data locally to LLM. These private data will be spliced ​​into the prompt words as background information and thrown to the big model, allowing the big model to analyze the attack event based on the background information.

[0072] Step 2: Security Risk Assessment

[0073] Generally speaking, operating systems, network devices (routers, switches, firewalls), web applications, databases, terminal nodes, application services, cloud services, IoT devices, etc. are easy targets for attack.

[0074] Security operators submit the company's IT asset information, security products, and network architecture to the security big model in the form of interactive interviews. The security big model can quickly discover the weak links in the current enterprise security protection and possible attack points, and convert this into a security risk assessment report and output it.

[0075] Step 3: Loss prediction

[0076] According to the MITRE ATT&CK statistical report released by Recorded Future, PowerShell ranked first in the 2019 top ten ATT&CK attack technology rankings.

[0077] The following is an actual case where an attacker used PowerShell to download and execute remote files, as shown in the following table.

[0078] Table 1

[0079]

[0080] Some obvious threats can be analyzed through log files, such as PowerShell in the example above. But some attacks will lurk in the system for a long time, allowing the invaded software to circulate normally for a long time and not be easily detected. For example, in the 2020 SolarWinds supply chain attack, the attacker successfully implanted malicious code by tampering with the SolarWinds Orion software update. This attack resulted in a long period of latency, and the attacker used the credentials and permissions of the infected system to perform highly complex network activities, including stealing confidential information. Technologies that lurk for a long time without being discovered, such as the use of evasion techniques (such as LOLBIN's fileless malware) or methods of covering footprints (such as encrypted channels, ports, and protocols used by attackers' legitimate applications).

[0081] By sending the relevant alarm information of log files or enterprise defense systems to LLM, LLM combines the learned security incident cases, analysis plans, ATT&CK framework best practices, ATT&CK actual analysis, industry threat intelligence information, etc., outputs a behavior analysis plan, fits the possible attacks and the trend of subsequent attack chains, and gives the probability of each possible attack. The steps are as follows:

[0082] 1. Input information. If there is a log file, input the log file or alarm information to LLM; if there is no log file, input the language description.

[0083] 2. LLM combines contextual understanding to map attack behaviors to the ATT&CK framework, and then infers the possible types of attacks.

[0084] 3. Based on the complete attack cycle of the ATT&CK framework, predict subsequent attack trends and analyze probabilities through more detailed log analysis.

[0085] 4. Output behavior analysis plan.

[0086] If the alarm message "Unusual outbound traffic patterns detected, including communication with known malicious IP addresses." is displayed, the system may be under malware infection or command and control attack. Malware may attempt to communicate with malicious IP addresses, or the infected system may be under external control. Combined with the current network environment, taking malware infection attack as an example, there are two complete attack routes that the attacker can carry out, as shown in the following table.

[0087] Table 2

[0088]

[0089]

[0090]

[0091] from Figure 2 From the perspective of the ATT&CK framework, hackers can achieve their ultimate goal through multiple attack chains. However, in actual combat, hackers have specific resources and tools, and will use similar methods when implementing a certain attack (such as ransomware). On the other hand, the real attack does not happen immediately but waits for the right time. In combination with the ATT&CK framework, actual attack cases are used as training samples, and the large model is trained by fine-tuning instructions to discover attack patterns. The large model reads security events and maps them to the attack chain of the ATT&CK framework, thereby predicting attacks that may have occurred but have not been discovered. Taking the attack chain 1 mentioned above as an example, through detailed analysis of the logs, the results mapped to the ATT&CK framework are as follows Figure 3 shown.

[0092] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A network security defense method based on AI big model and ATT&CK framework, characterized by: The following steps are involved: S1. Fine-tune the large model using training data including ATT&CK framework data to obtain a large model in the network security field based on the ATT&CK framework. The large model in the network security field based on the ATT&CK framework can understand security alert logs and map them to various attack methods in the ATT&CK framework. S2. The security operation personnel of the enterprise to be evaluated input the key asset information of the enterprise into the ATT&CK framework-based network security domain big model in the form of an interactive interview, and the ATT&CK framework-based network security domain big model evaluates the enterprise to be evaluated and outputs a security risk assessment report; S3. Input the actual attack case as a prompt word into the network security domain big model based on the ATT&CK framework. The network security domain big model based on the ATT&CK framework reads and discovers the rules and maps them into the attack chain of the ATT&CK framework, fits the possible attacks and the trend of the subsequent attack chain, and gives the probability of each attack route. A network security defense method based on the AI ​​big model and the ATT&CK framework is completed.

2. A network security defense method based on an AI big model and an ATT&CK framework according to claim 1, characterized in that: In step S1, the training data includes basic training data, external knowledge as domain knowledge, and private data as background splicing; The basic training data includes the latest ATT&CK knowledge base, ATT&CK framework best practices, and ATT&CK practical analysis; The external knowledge is industry annotation data; The private data includes enterprise security equipment, enterprise IT information and original traffic mirror data.

3. A network security defense method based on an AI big model and an ATT&CK framework according to claim 2, characterized in that: The training data also includes security incident case reports, security incident analysis plans, industry threat intelligence information, and laws and regulations; Said threat intelligence may be obtained from the following means: threat situation services, security communities and forums, open source intelligence and dark web information; The private data is locally uploaded to the ATT&CK framework-based network security domain big model, and the private data is spliced ​​into the prompt word as background information. The ATT&CK framework-based network security domain big model analyzes the attack event according to the background information.

4. According to claim 1, a network security defense method based on AI big model and ATT&CK framework is characterized by: In step S2, the enterprise's key asset information includes IT asset information, security products and network architecture. The large model of network security based on the ATT&CK framework can quickly discover the weak links and possible attack points of the security protection of the enterprise to be evaluated and convert them into the security risk assessment report output.

5. According to claim 4, a network security defense method based on AI big model and ATT&CK framework is characterized by: The security risk assessment report includes the security risk status, potential threats, loopholes, weaknesses, suggestions and improvement measures of the enterprise to be assessed.

6. According to claim 1, a network security defense method based on AI big model and ATT&CK framework is characterized by: Step S3 includes the following steps: S31, input the actual attack case as a prompt word into the large model of network security field based on the ATT&CK framework; when the actual attack case has a log file, input the log file or alarm information into the large model of network security field based on the ATT&CK framework; when the actual attack case has no log file, input the language description into the large model of network security field based on the ATT&CK framework; S32, the network security domain big model based on the ATT&CK framework combines context understanding to map the attack behavior to the ATT&CK framework, and then infer the possible attack type; S33. The ATT&CK framework-based network security domain big model predicts subsequent attack trends and analyzes probabilities through log analysis based on the complete attack cycle of the ATT&CK framework; S34. The large model output behavior analysis solution in the network security field based on the ATT&CK framework.

7. A network security defense method based on AI big model and ATT&CK framework according to claim 6, characterized in that: In step S31, the network security domain big model based on the ATT&CK framework can convert the semantic expression of security events into attack tactics and techniques listed in the ATT&CK framework.

8. According to claim 6, a network security defense method based on AI big model and ATT&CK framework is characterized by: In step S31, the actual attack case may be a case of a network security framework other than the ATT&CK framework; the actual attack case may also be threat intelligence information and task logs of the enterprise to be evaluated.

9. According to claim 1, a network security defense method based on AI big model and ATT&CK framework is characterized by: The step S4 is also included, wherein the ATT&CK framework-based network security domain big model analyzes the enterprise's threat intelligence information and task logs according to the data sources listed in the ATT&CK framework, and incorporates the discovered new attack techniques and attack activities into the data source to update the data source; The data sources in the ATT&CK framework include: information from security incidents, threat intelligence, penetration testing, malicious activity analysis, and community contributions.

10. A network security defense device based on an AI big model and the ATT&CK framework, characterized by: A computer program is stored on the network security defense device, and the computer program can run the network security defense method based on the AI ​​big model and the ATT&CK framework as described in any one of claims 1 to 9.

Images