Data detection method, model training method and related device

Abstract

The invention provides a data detection method, a model training method and a related device, which are applied to the field of data processing and are used for improving the accuracy of log event anomaly detection. The method comprises the following steps: extracting at least one first feature of any event in a plurality of events and vectorizing to obtain at least one first feature vector; encoding the at least one first feature vector through an encoder to obtain at least one second feature vector; decoding the at least one second feature vector through a decoder to obtain at least one third feature vector; calculating a reconstruction error of the at least one first feature vector and the at least one third feature vector; inputting the at least one second feature vector into a one-dimensional convolutional neural network, and obtaining the abnormal probability of the any output event; and calculating an abnormal score of the any event according to a preset rule based on the reconstruction error and the abnormal probability, and executing an alarm on the event of which the abnormal score is greater than a threshold value.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data detection method, a model training method and related devices. Background Art

[0002] With the continuous evolution of cyber attack methods, especially the emergence of complex attack forms such as Advanced Persistent Threats (APTs) targeting corporate internal networks, traditional security protection measures cannot meet current security protection needs. Traditional security solutions such as signature-based anti-virus software can only identify known malicious behavior patterns and cannot accurately identify unknown attacks that appear for the first time. In this case, once the attack successfully penetrates the internal network, it can lurk for a long time and gradually carry out malicious activities, such as stealing sensitive information, destroying system functions, or leaking personal privacy.

[0003] In view of this, how to improve the accuracy of log event anomaly detection is an urgent problem to be solved. Summary of the invention

[0004] The embodiments of the present application provide a data detection method, a model training method and related devices, which can improve the accuracy of log event anomaly detection.

[0005] In a first aspect, an embodiment of the present application provides a data detection method, which can be applied to an electronic device with processing capabilities, and the method includes:

[0006] Acquire multiple events in the log, extract at least one first feature of any event in the multiple events; vectorize at least one first feature of any event to obtain at least one first feature vector;

[0007] Inputting at least one first feature vector into an autoencoder, the autoencoder comprising an encoder and a decoder, encoding the at least one first feature vector by the encoder to obtain at least one second feature vector; and decoding the at least one second feature vector by the decoder to obtain at least one third feature vector; obtaining at least one second feature vector and at least one third feature vector;

[0008] calculating a reconstruction error between at least one first eigenvector and at least one third eigenvector;

[0009] Inputting at least one second feature vector into a one-dimensional convolutional neural network for abnormality prediction, and obtaining an abnormal probability of any event output by the one-dimensional convolutional neural network;

[0010] The anomaly score of any event is calculated according to preset rules based on the reconstruction error and anomaly probability of any event, and an alarm is issued for events whose anomaly score is greater than a threshold.

[0011] In this scheme, the feature vector of any event is compressed into a smaller dimension through the encoder in the autoencoder, the abnormal probability of the feature vector is evaluated through a one-dimensional convolutional neural network, and the anomaly score of any event is calculated in combination with the reconstruction error of the autoencoder. There is no need to know the specific characteristics of the unknown attack in advance. The autoencoder and the one-dimensional convolutional neural network can learn the normal behavior pattern to identify anomalies, which can effectively identify abnormal behaviors that deviate from normal event logs and improve the accuracy of log event anomaly detection.

[0012] Optionally, at least one first feature includes: at least one of: process path and command line parameters, sub-process path and command line parameters, target IP type, event time, process type, event type, and file type; at least one first feature of any event is vectorized, including: vectorizing the process path and command line parameters, sub-process path and command line parameters respectively based on a multi-hash feature encoding algorithm; matching the feature values ​​corresponding to the target IP type, event time, process type, event type, and file type respectively according to a preset feature value mapping table, and vectorizing the target IP type, event time, process type, and event type based on the feature values.

[0013] Optionally, the anomaly score of any event is calculated according to preset rules based on the reconstruction error and anomaly probability of any event, including: performing weighted calculation on the reconstruction error and anomaly probability of any event based on preset weighting rules to obtain the anomaly value of any event; and performing standardization on the anomaly value of any event based on the cumulative distribution function to obtain the anomaly score of any event.

[0014] In a second aspect, an embodiment of the present application provides a model training method, which can be applied to an electronic device with processing capabilities, including:

[0015] Acquire a first training sample, the first training sample including an event with a status mark; the status mark is used to indicate whether the status of the event is normal or abnormal;

[0016] Extract at least one first feature of the first training sample, vectorize the at least one first feature, and obtain at least one first feature vector; input the at least one first feature vector into an autoencoder, the autoencoder includes an encoder and a decoder, encode the at least one first feature vector by the encoder, obtain at least one second feature vector, and obtain at least one second feature vector;

[0017] Inputting at least one second feature vector into a one-dimensional convolutional neural network for abnormality prediction, and obtaining an abnormality probability of a first training sample output by the one-dimensional convolutional neural network;

[0018] A first loss value between the abnormal probability of the first training sample and the state mark of the first training sample is calculated, and the parameters of the one-dimensional convolutional neural network are adjusted with the first loss value being less than a first preset threshold as a goal.

[0019] In this scheme, the autoencoder can be obtained by training with a large number of stateless labeled training samples, and then only a small number of statefully labeled first training samples can be used to train the autoencoder and the one-dimensional convolutional network, thereby improving the accuracy of detecting abnormal data. In practical applications, it is extremely difficult and expensive to obtain a large number of first training samples. Semi-supervised learning can effectively reduce the cost of data labeling and improve the robustness of the model.

[0020] Optionally, at least one first feature includes: at least one of: process path and command line parameters, sub-process path and command line parameters, target IP type, event time, process type, event type, and file type; vectorizing at least one first feature includes: vectorizing the process path and command line parameters, sub-process path and command line parameters respectively based on a multi-hash feature encoding algorithm; matching the feature values ​​corresponding to the target IP type, event time, process type, event type, and file type respectively according to a preset feature value mapping table, and vectorizing the target IP type, event time, process type, and event type based on the feature values.

[0021] Optionally, before obtaining the first training sample, the method also includes: obtaining a second training sample, the second training sample including events without state tags; extracting at least one third feature of the second training sample, vectorizing the at least one third feature, and obtaining at least one third feature vector; inputting the at least one third feature vector into the autoencoder, encoding the at least one third feature vector through the encoder, decoding the output of the encoder through the decoder, and obtaining at least one fourth feature vector; obtaining at least one fourth feature vector; calculating a second loss value between the at least one fourth feature vector and the at least one third feature vector, and adjusting the parameters of the autoencoder with the second loss value being less than a second preset threshold as the goal.

[0022] In a third aspect, an embodiment of the present application provides a data detection device, including:

[0023] The acquisition module is used to: obtain multiple events in the log;

[0024] The extraction module is used to: extract at least one first feature of any event from among the multiple events; vectorize at least one first feature of any event to obtain at least one first feature vector; input at least one first feature vector into an autoencoder, the autoencoder comprising an encoder and a decoder, encode at least one first feature vector by the encoder to obtain at least one second feature vector; decode at least one second feature vector by the decoder to obtain at least one third feature vector; obtain at least one second feature vector and at least one third feature vector;

[0025] A processing module, configured to: calculate a reconstruction error between at least one first eigenvector and at least one third eigenvector;

[0026] The extraction module is also used to: input at least one second feature vector into the one-dimensional convolutional neural network for abnormality prediction, and obtain the abnormal probability of any event output by the one-dimensional convolutional neural network;

[0027] The processing module is also used to: calculate the anomaly score of any event according to preset rules based on the reconstruction error and anomaly probability of any event, and issue an alarm for events with an anomaly score greater than a threshold.

[0028] Optionally, at least one first feature includes: at least one of: process path and command line parameters, sub-process path and command line parameters, target IP type, event time, process type, event type, and file type; when the extraction module vectorizes at least one first feature of any event, it is specifically used to: vectorize the process path and command line parameters, sub-process path and command line parameters based on a multi-hash feature encoding algorithm; match the feature values ​​corresponding to the target IP type, event time, process type, event type, and file type according to a preset feature value mapping table, and vectorize the target IP type, event time, process type, and event type based on the feature values.

[0029] Optionally, when the processing module calculates the anomaly score of any event based on the reconstruction error and anomaly probability of any event according to preset rules, it is specifically used to: perform weighted calculation on the reconstruction error and anomaly probability of any event based on preset weighting rules to obtain the anomaly value of any event; and perform normalization on the anomaly value of any event based on the cumulative distribution function to obtain the anomaly score of any event.

[0030] In a fourth aspect, an embodiment of the present application provides a model training device, including:

[0031] The acquisition module is used to: acquire a first training sample, where the first training sample includes an event with a status mark; the status mark is used to indicate whether the status of the event is normal or abnormal;

[0032] The extraction module is used to: extract at least one first feature of the first training sample, vectorize the at least one first feature, and obtain at least one first feature vector; input the at least one first feature vector into an autoencoder, the autoencoder includes an encoder and a decoder, encode the at least one first feature vector by the encoder, obtain at least one second feature vector, and obtain at least one second feature vector; input the at least one second feature vector into a one-dimensional convolutional neural network for anomaly prediction, and obtain the anomaly probability of the first training sample output by the one-dimensional convolutional neural network;

[0033] The optimization module is used to calculate a first loss value between the abnormal probability of the first training sample and the state mark of the first training sample, and adjust the parameters of the one-dimensional convolutional neural network with the first loss value being less than a first preset threshold as the goal.

[0034] Optionally, at least one first feature includes: at least one of: process path and command line parameters, sub-process path and command line parameters, target IP type, event time, process type, event type, and file type; when the extraction module vectorizes at least one first feature, it is specifically used to: vectorize the process path and command line parameters, sub-process path and command line parameters based on a multi-hash feature encoding algorithm; match the feature values ​​corresponding to the target IP type, event time, process type, event type, and file type according to a preset feature value mapping table, and vectorize the target IP type, event time, process type, and event type based on the feature value.

[0035] Optionally, before obtaining the first training sample, the acquisition module is also used to: obtain a second training sample, the second training sample includes events without state tags; the extraction module is also used to: extract at least one third feature of the second training sample, vectorize the at least one third feature, and obtain at least one third feature vector; input the at least one third feature vector into the autoencoder, encode the at least one third feature vector through the encoder, decode the output of the encoder through the decoder to obtain at least one fourth feature vector, and obtain at least one fourth feature vector; the optimization module is also used to: calculate a second loss value between at least one fourth feature vector and at least one third feature vector, and adjust the parameters of the autoencoder with the second loss value being less than a second preset threshold as the goal.

[0036] In a fifth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store instructions, and when the instructions are executed, the method in the first aspect or any optional implementation of the first aspect is implemented.

[0037] In a sixth aspect, the present application provides a computer program product, which includes a computer program code. When the computer code is run on a computer, the computer executes the method in the first aspect or any optional embodiment of the first aspect.

[0038] The technical effects or advantages of one or more technical solutions provided in the second, third, fourth, fifth and sixth aspects of the embodiments of the present application can be correspondingly explained by the technical effects or advantages of one or more corresponding technical solutions provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A flowchart of a data detection method provided in an embodiment of the present application;

[0040] Figure 2 A schematic diagram of a structure of a collection event log provided in an embodiment of the present application;

[0041] Figure 3 A schematic diagram of the principle of an event collector provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of the structure of an autoencoder provided in an embodiment of the present application;

[0043] Figure 5 A schematic diagram of a partial structure of a one-dimensional convolutional neural network provided in an embodiment of the present application;

[0044] Figure 6 A structural diagram of a data detection device provided in an embodiment of the present application;

[0045] Figure 7 A structural diagram of a model training device provided in an embodiment of the present application;

[0046] Figure 8 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The technical solution of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0048] It should be understood that the term "multiple" in the description of the embodiments of the present application refers to two or more. The term "and / or" in the present embodiment is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship.

[0049] The following is an introduction to the professional terms involved in the embodiments of this application:

[0050] 1. Semi-supervised learning is a machine learning technique that combines supervised learning and unsupervised learning methods. In this learning method, the algorithm can not only process labeled data (that is, data of known categories), but also a large amount of unlabeled data (that is, data of unknown categories or not output). Semi-supervised learning can use the information of unlabeled data to improve the model's learning effect on labeled data. It is usually used in scenarios where labeled data is scarce or the cost of obtaining labeled data is very high.

[0051] 2. Endpoint Detection and Response (EDR) is a network security technology used to monitor and protect terminal devices (such as personal computers, services, etc.) within an organization from malware and other security threats. EDR systems can continuously collect and analyze data from terminals to detect suspicious activities and provide response mechanisms to these events. It helps security teams quickly identify and respond to potential security threats, thereby reducing the duration and scope of the threats.

[0052] 3. Autoencoder is an artificial neural network for unsupervised learning, mainly used for encoding and decoding data. Its purpose is to learn an effective representation of the data (i.e. encoding) so that the data can be compressed into a smaller form and then reconstructed back to data close to the original form (i.e. decoding). Autoencoders are often used for tasks such as data compression, feature learning, and anomaly detection. Autoencoders consist of two parts: an encoder and a decoder. The encoder is used to convert the input data into a shorter representation, i.e. encoding, and the decoder is used to convert the encoding into data close to the original input. In this way, the encoder can learn the key features of the input data and ignore the noise when reconstructing the data.

[0053] 4. ETW (Event Tracing for Windows) is a lightweight, efficient time tracking mechanism that is integrated into the Windows operating system. ETW is used to capture various events generated by the operating system and other applications, which can be used to diagnose performance problems, debug program errors, or monitor the operating status of the system. In an embodiment of the present application, ETW is used in an event collector to monitor system time. The event collector monitors specific types of system events by registering an ETW provider, and sends these event data to the control end for subsequent analysis and processing. In this way, events on the host can be collected and monitored in real time, providing the necessary data source for subsequent attack detection.

[0054] 5. One-Dimensional Convolutional Neural Network (1D CNN) is a convolutional neural network that specializes in processing one-dimensional data. Unlike traditional two-dimensional convolutional neural networks, 1D CNN is mainly used to process time series data or signal data, such as audio signals, time series data streams, etc. The core advantage of 1D CNN is that it can effectively capture one-dimensional local patterns in the input data, which is conducive to time series analysis.

[0055] 6. The probability density function (PDF) is a way to describe the probability distribution of a continuous random variable, which is used to describe the probability density of a random variable falling within a certain area. Unlike the probability mass function of a discrete random variable, the probability density function itself does not directly give the probability value of a certain point, but gives the probability size within a unit length near the point. The integral of the probability density function in a certain interval gives the probability that the random variable falls within the interval.

[0056] 7. Cumulative Distribution Function (CDF) is another way to express the probability distribution of a random variable, which can be applied to continuous or discrete random variables. The value of the cumulative distribution function at any point x represents the probability that the random variable is not greater than x. It can be understood that the cumulative distribution function is the integral of the probability density function. The important property of the cumulative distribution function is that it is a non-decreasing function, and it approaches 0 at negative infinity and approaches 1 at positive infinity. The cumulative distribution function can be used to calculate the probability that a random variable falls within a certain interval.

[0057] With the continuous evolution of network attack methods, especially the emergence of complex attack forms such as Advanced Persistent Threats (APTs) targeting corporate internal networks, traditional security protection measures have become inadequate. Traditional security protection measures such as signature-based anti-virus software can only identify known malicious behavior patterns and are often helpless against unknown attacks that appear for the first time. In this case, once the attack successfully penetrates the internal network, it may remain dormant for a long time and gradually carry out malicious activities, such as stealing sensitive information, destroying system functions, or leaking personal privacy.

[0058] In order to make up for the shortcomings of traditional security protection measures, EDR technology has developed rapidly in recent years. EDR technology focuses on providing comprehensive visibility of internal network activities of enterprises, and discovers suspicious activities by monitoring endpoint behavior and network traffic. However, although EDR has made significant progress in improving visibility, it still has shortcomings in actively defending against unknown attacks, especially when the attack mode and attack method are not identified and mastered by the defense personnel, the rule-based attack detection method has obvious shortcomings.

[0059] Faced with these challenges, researchers have begun to explore new methods and technologies to enhance the ability to detect unknown attacks. For example, methods based on machine learning (such as supervised learning) analyze a large amount of data on normal behavior patterns, identify behaviors that deviate from the normal range, and thus discover potential unknown attacks. However, traditional supervised learning methods require a large amount of labeled data, which is not applicable to unknown attacks because the number of existing unknown attack samples is very limited. Therefore, semi-supervised learning has become a popular choice, which can use a large amount of unlabeled data to improve the learning ability and generalization performance of the model based on a small amount of labeled data.

[0060] In view of this, the embodiment of the present application provides a data detection method and a model training method for improving the accuracy of log event anomaly detection. By combining an autoencoder and a one-dimensional convolutional neural network to score anomalies of events, the autoencoder can be obtained after training with a large number of stateless labeled training samples, and then only a small number of statefully labeled first training samples can be used to train the autoencoder and the one-dimensional convolutional network to improve the accuracy of detecting abnormal data; in practical applications, it is extremely difficult and expensive to obtain a large number of first training samples. Through this semi-supervised learning, the cost of data annotation can be effectively reduced, and the robustness of the model can be improved.

[0061] The data detection method provided in the embodiments of the present application can be applied to any data anomaly detection scenario, including but not limited to the network attack event detection exemplified above.

[0062] See also Figure 1, is a data detection method provided in an embodiment of the present application, which can be applied to any electronic device with processing capabilities, such as a computer, a tablet, a mobile phone, etc. The method includes steps S101 to S107:

[0063] S101. Obtain multiple events in a log.

[0064] A possible example is Figure 2 As shown, an event collector is deployed on each host, which is used to collect events of the host in real time and transmit them to the log of the control end for storage, so as to facilitate subsequent analysis and processing of events of each host.

[0065] For example, Figure 3 A schematic diagram of the principle of an event collector provided in an embodiment of the present application. The ETW provider is a Windows built-in event tracking mechanism that can capture various events generated by the operating system and other applications. The event collector monitors system events by registering the ETW provider. The ETW controller controls the event tracking session module to track events and stores the tracked data in the ETW cache pool. When the monitoring is completed, the event tracking session module stores the events in the database and periodically reports them to the event collector; or after the monitoring is completed, the monitored events are immediately reported to the event collector in real time.

[0066] Exemplarily, the multiple events obtained may be all events in the log, events of a specified host, frequently occurring events, etc., and may be obtained according to actual needs.

[0067] S102: Extract at least one feature of any event among multiple events.

[0068] It can be understood that the method of extracting features can be the same for each event in the multiple events.

[0069] In a possible example, at least one feature of any event includes at least one of the following: process path and command line parameters, sub-process path and command line parameters, target IP type, event time, process type, event type, and file type.

[0070] Among them, the process path and command line parameters, the sub-process path and command line parameters are text strings used to issue instructions to the process indicated by the process path or the sub-process path.

[0071] The target IP type can include intranet IP and extranet IP.

[0072] Event time indicates the date on which an event occurred.

[0073] Process types may include shell-based processes (eg, powershell.exe, cmd.exe, etc.), script-based processes (eg, wscript.exe, cscript.exe, etc.), document-based processes (eg, WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, etc.), and other types of processes.

[0074] Event types can include file, module, and process.

[0075] File types can include executable files (PE), scripts, ZIP, DOC, IMAGE, and other types.

[0076] S103: Vectorize at least one feature of any event to obtain at least one first feature vector.

[0077] In one possibility, the process path and command line parameters, sub-process path and command line parameters are vectorized based on a multi-hash feature encoding algorithm; or, according to a preset feature value mapping table, the feature values ​​corresponding to the target IP type, event time, process type, event type, and file type are matched respectively, and the target IP type, event time, process type, and event type are vectorized based on the feature values.

[0078] Exemplarily, taking the vectorization of process path and command line parameters by using a multi-hash feature encoding algorithm as an example, assuming that the text string (i.e., process path and command line parameters) is T, the length of the feature vector is m, and the number of hash functions (i.e., hash feature encoding algorithms) used is k, the method may specifically include:

[0079] 1. Create a vector v of length m and set all its values ​​to 0.

[0080] 2. Select k different hash functions H1, H2, …Hk, each of which maps a string to an integer in the interval [0, m-1].

[0081] 3. Split the text string T into word list W.

[0082] 4. For each word w in W:

[0083] For i=1 to k:

[0084] Calculate hi=Hi(w).

[0085] Update v[hi] to v[hi]+1.

[0086] 5. Return the eigenvector v.

[0087] Similarly, the subprocess path and command line parameters can be vectorized in the same way as the process path and command line parameters.

[0088] Exemplarily, the process path and command line parameters as well as the sub-process path and command line parameters may be mapped to m-dimensional (eg, 40-dimensional) feature vectors, respectively.

[0089] It can be understood that the above is only an example of a method for vectorizing (i.e., converting features into feature values) the process path and command line parameters and the sub-process path and command line parameters according to the multi-hash feature encoding algorithm. In actual applications, other feature vectorization methods can be selected according to needs to map them into feature vectors of other dimensions. The embodiments of the present application are not limited to this.

[0090] Exemplarily, taking the target IP type, event time, process type, event type, and file type given in step S102 as an example, according to a preset feature value mapping table, the feature values ​​corresponding to the target IP type, event time, process type, event type, and file type are matched respectively, and an example of a method for vectorizing the target IP type, event time, process type, and event type based on the feature value is as follows:

[0091] 1. Target IP: If the target IP is an intranet IP, the characteristic value is 0; if the target IP is an extranet IP, the characteristic value is 1.

[0092] 2. Event time: According to the time when the event occurred, the event time is converted into a two-tuple [week number, time period].

[0093] First, determine the corresponding eigenvalue based on the number of cycles. For example, if the event occurs on Monday, the eigenvalue is 1; if it occurs on Tuesday, the eigenvalue is 2; and so on until Sunday, where the eigenvalue is 7.

[0094] Then, the 24 hours of a day are divided into time periods, and the feature value is determined according to the time period in which the event time is located. For example, the feature value corresponding to the event time between 0 and 3 hours is 0, the feature value corresponding to the event time between 3 and 6 hours is 1, and the feature value corresponding to the event time between 21 and 24 hours is 8, etc. The division can also be performed in other ways, and this is just one possible example.

[0095] 3. Process type: If the process type is a shell-based process, the characteristic value is 1; if the process type is a script-based process, the characteristic value is 2; if the process type is a document-based process, the characteristic value is 3; if the process type is other types of processes, the characteristic value is 4.

[0096] 4. Event type: If the event type is file, the feature value is 1; if the event type is module, the feature value is 2; if the event type is process, the feature value is 3.

[0097] 5. File type: If the file type is PE, the feature value is 1; if the file type is script, the feature value is 2; if the file type is ZIP, the feature value is 3; if the file type is DOC, the feature value is 4; if the file type is IMAGE, the feature value is 5; if the file type is other, the feature value is 6.

[0098] After obtaining at least one feature vector, the at least one feature vector is concatenated (it can be understood that the feature value of a non-existent feature vector can be set to 0), and a feature vector of a preset dimension can be obtained (taking the above-mentioned process path and command line parameters and sub-process path and command line parameters as an example, all of which are mapped to 40 dimensions, a feature vector with a dimension of 86 can be obtained).

[0099] It can be understood that the above method of vectorizing at least one feature is only a possible example. In practical applications, other methods can be used to vectorize the at least one feature, or other features can be extracted according to actual needs.

[0100] S104, inputting at least one first feature vector into an autoencoder, encoding the at least one first feature vector through an encoder to obtain at least one second feature vector; and decoding the at least one second feature vector through a decoder to obtain at least one third feature vector; obtaining at least one second feature vector and at least one third feature vector.

[0101] For example, see Figure 4 , is a schematic diagram of the structure of an autoencoder provided in an embodiment of the present application. The autoencoder includes an encoder and a decoder, the encoder is used to encode and compress the input feature vector and output features of smaller dimensions, and the decoder is used to decode and restore the features of smaller dimensions to restore the original input feature vector as much as possible.

[0102] The autoencoder consists of an input layer, a hidden layer, an output layer, an activation function, and a loss function.

[0103] Take the 86-dimensional feature vector obtained in S103 above as an example:

[0104] The input layer consists of 86 nodes, corresponding to an 86-dimensional feature vector.

[0105] The hidden layer includes a first hidden layer and a second hidden layer, the first hidden layer contains 44 nodes, and the second hidden layer contains 26 nodes. The hidden layer is used to extract key features and achieve dimensionality reduction.

[0106] The output layer consists of 86 nodes, the same number of nodes as the input layer, and is used to reconstruct the input data.

[0107] Activation functions (such as ReLU activation function) exist between each layer to introduce nonlinear changes and improve the learning ability of the model.

[0108] As an example, the present embodiment uses the mean square error (MSE) as a loss function to measure the difference between the input data and its output data (i.e., the reconstructed data). The definition of the mean square error is as follows:

[0109]

[0110] Among them, δ i is the reconstruction error between input and output, x i represents the original value of the i-th feature, represents the i-th eigenvalue after reconstruction by the autoencoder, and p is the number of features.

[0111] S105: Calculate a reconstruction error between at least one first eigenvector and at least one third eigenvector.

[0112] Exemplarily, the above mean square error function can be used to calculate the reconstruction error between at least one first eigenvector and at least one third eigenvector. Other loss functions, such as cross entropy loss function, soft loss function, etc., can also be selected according to actual needs to calculate the reconstruction error between at least one first eigenvector and at least one third eigenvector, which is not limited in the embodiments of the present application.

[0113] S106. Input at least one second feature vector into a one-dimensional convolutional neural network for anomaly prediction, and obtain an abnormal probability of any event output by the one-dimensional convolutional neural network.

[0114] For example, see Figure 5 A partial structural diagram of a one-dimensional convolutional neural network provided in an embodiment of the present application. The one-dimensional convolutional neural network includes: an input layer, a convolutional layer, a pooling layer, a fully connected layer, an activation function, and a loss function.

[0115] The input layer is used to receive the 26-bit feature vector output from the encoder (i.e., the second hidden layer) of the encoder and use it as the input of the one-dimensional convolutional neural network.

[0116] The convolution layer is used to capture the local features of the input feature vector. For a one-dimensional convolutional neural network, the filter slides in one dimension.

[0117] The pooling layer is used to reduce the spatial dimension of the feature vector output by the convolutional layer, reduce the amount of calculation and prevent overfitting.

[0118] The fully connected layer is used to further process and classify the feature vector output by the pooling layer, and convert the feature vector output by the pooling layer into a single data to solve the binary classification problem.

[0119] An activation function (such as the Sigmoid activation function) is applied to the output of the fully connected layer to introduce nonlinearity, enabling the network to learn more complex feature relationships.

[0120] Loss function, illustratively, the embodiment of the present application adopts a binary cross entropy loss function, which is applicable to binary classification problems and is defined as follows:

[0121]

[0122] It can be understood that the above loss function is only a possible example. In practical applications, other loss functions can be selected according to needs, and the embodiments of the present application do not limit this.

[0123] S107 , calculating an anomaly score of any event according to a preset rule based on the reconstruction error and anomaly probability of any event, and issuing an alarm for an event whose anomaly score is greater than a threshold.

[0124] In a possible embodiment, the method for calculating the anomaly score of any event specifically includes:

[0125] First, the reconstruction error and abnormal probability of any event are weighted and calculated based on the preset weighting rules to obtain the abnormal value of any event.

[0126] Exemplarily, the reconstruction error calculated in step S105 is denoted as δ n , the abnormal probability obtained from step S106 is recorded as p n , the reconstruction error and anomaly probability can be weighted according to the following preset rules:

[0127] ε=aδ n +bp n

[0128] Among them, ε is the outlier, a and b are weighted coefficients used to balance the contribution of the two outliers, which can be set according to actual conditions.

[0129] Then, the outlier value of any event is normalized based on the cumulative distribution function to obtain the anomaly score of any event.

[0130] Exemplarily, the outlier is mapped to the interval [0, 1] based on the cumulative distribution function. Specifically, the CDF of the normal distribution can be used to implement the mapping:

[0131]

[0132] Among them, μ and σ are the mean and standard deviation of all outliers, respectively, and Φ represents the CDF of the standard normal distribution. For unknown event i, the standardized anomaly score CDF (ε i )If it is greater than the threshold, the event i is identified as an abnormal event.

[0133] In this method, the feature vector of any event is compressed into a smaller dimension through the encoder in the autoencoder, the abnormal probability of the feature vector is evaluated through a one-dimensional convolutional neural network, and the abnormal score of any event is calculated in combination with the reconstruction error of the autoencoder. There is no need to know the specific characteristics of the unknown attack in advance. The autoencoder and the one-dimensional convolutional neural network can learn the pattern of normal behavior to identify anomalies, which can effectively identify abnormal behaviors that deviate from normal event logs and improve the accuracy of log event anomaly detection.

[0134] In a possible design, the embodiment of the present application further provides a model training method, which includes steps S201 to S204:

[0135] S201: Obtain a first training sample.

[0136] The first training sample includes an event with a status mark; the status mark is used to indicate whether the status of the event is normal or abnormal.

[0137] S202, extract at least one first feature of the first training sample, vectorize the at least one first feature, and obtain at least one first feature vector; input the at least one first feature vector into an autoencoder, the autoencoder includes an encoder and a decoder, encode the at least one first feature vector by the encoder to obtain at least one second feature vector, and obtain at least one second feature vector.

[0138] It can be understood that the specific method of vectorizing at least one first feature, and the specific method of encoding the at least one first feature vector through an encoder to obtain at least one second feature vector can refer to the methods in step S103 and step S104 above, and the embodiments of the present application will not be repeated here.

[0139] S203: Input at least one second feature vector into a one-dimensional convolutional neural network for abnormality prediction, and obtain an abnormality probability of a first training sample output by the one-dimensional convolutional neural network.

[0140] It can be understood that the method for obtaining the abnormal probability of the first training sample can also refer to the method for obtaining the abnormal probability of any event in step S106 above, and the embodiment of the present application will not be repeated here.

[0141] S204, calculating a first loss value between the abnormal probability of the first training sample and the state mark of the first training sample, and adjusting the parameters of the one-dimensional convolutional neural network with the goal of making the first loss value less than a first preset threshold.

[0142] Exemplarily, if the state mark is normal, the abnormal probability of the state mark is set to 0; if the state mark is abnormal, the abnormal probability of the state mark is set to 1, and then a preset loss function can be used to calculate the first loss value between the abnormal probability of the first training sample and the state mark of the first training sample, and adjust the parameters of the one-dimensional convolutional neural network until the first loss value is less than the preset value.

[0143] It can be understood that the loss function and the first preset threshold can be set according to actual needs.

[0144] In a possible design, all event logs collected historically in the controller can be divided into two parts, one of which is manually identified and marked as the first training sample. The first training sample includes normal events and abnormal events, which respectively represent the operation records when the host is operating normally and the operation records when it is subjected to malicious behavior. The number of the first training samples is small; the other part is not manually marked and is recorded as the second training sample. The number of the second training samples is relatively large.

[0145] Optionally, in order to obtain a better model training effect and log event anomaly detection effect using only a small amount of the first training samples, before S201, the second training samples need to be used to train the autoencoder. The method for training the autoencoder includes steps S301 to S303:

[0146] S301: Obtain a second training sample.

[0147] The second training sample includes events without state labels.

[0148] S302. Extract at least one third feature of the second training sample, vectorize the at least one third feature, and obtain at least one third feature vector; input the at least one third feature vector into the autoencoder, encode the at least one third feature vector through the encoder, decode the output of the encoder through the decoder, obtain at least one fourth feature vector, and acquire at least one fourth feature vector.

[0149] It can be understood that the method for obtaining at least one fourth eigenvector may be the same as the method for obtaining at least one third eigenvector in step S104 above, and the embodiment of the present application will not be described in detail herein.

[0150] S303, calculating a second loss value between at least one fourth eigenvector and at least one third eigenvector, and adjusting the parameters of the autoencoder with the second loss value being less than a second preset threshold as a goal.

[0151] Exemplarily, the mean square error in the above text can be used to calculate the reconstruction error between at least one fourth eigenvector and at least one third eigenvector, and the parameters (such as weights and biases) of the autoencoder can be adjusted by the back propagation algorithm until the reconstruction error is less than the second preset threshold. In this way, the autoencoder can learn how to effectively encode and decode the input data so that the reconstructed data is as close to the original data as possible.

[0152] It can be understood that the above method of calculating the loss value is only a possible example. In actual applications, other loss functions can be selected according to needs, and the second preset threshold can be set according to needs.

[0153] In this embodiment, the autoencoder can be obtained by training with a large number of stateless labeled training samples, and then only a small number of statefully labeled first training samples can be used to train the autoencoder and the one-dimensional convolutional network, thereby improving the accuracy of detecting abnormal data. In practical applications, it is extremely difficult and expensive to obtain a large number of first training samples. Semi-supervised learning can effectively reduce the cost of data labeling and improve the robustness of the model.

[0154] The method provided by the embodiment of the present application is introduced above, and the device provided by the embodiment of the present application is introduced below.

[0155] Based on the same technical concept, see Figure 6 , which is a structural diagram of a data detection device provided in an embodiment of the present application, and the device includes a template / unit / technical means of the method executed by an electronic device in the above method.

[0156] Exemplarily, the apparatus 600 may include:

[0157] The acquisition module 601 is used to: acquire multiple events in the log;

[0158] The extraction module 602 is used to: extract at least one first feature of any event from among the multiple events; vectorize at least one first feature of any event to obtain at least one first feature vector; input the at least one first feature vector into an autoencoder, the autoencoder including an encoder and a decoder, encode the at least one first feature vector by the encoder to obtain at least one second feature vector; decode the at least one second feature vector by the decoder to obtain at least one third feature vector; obtain at least one second feature vector and at least one third feature vector;

[0159] The processing module 603 is used to: calculate a reconstruction error between at least one first eigenvector and at least one third eigenvector;

[0160] The extraction module 602 is further used to: input at least one second feature vector into the one-dimensional convolutional neural network for abnormality prediction, and obtain the abnormal probability of any event output by the one-dimensional convolutional neural network;

[0161] The processing module 603 is further used to calculate the anomaly score of any event according to a preset rule based on the reconstruction error and anomaly probability of any event, and to issue an alarm for an event whose anomaly score is greater than a threshold.

[0162] Optionally, at least one first feature includes: at least one of: process path and command line parameters, sub-process path and command line parameters, target IP type, event time, process type, event type, and file type; when the extraction module 602 vectorizes at least one first feature of any event, it is specifically used to: vectorize the process path and command line parameters, sub-process path and command line parameters based on a multi-hash feature encoding algorithm; match the feature values ​​corresponding to the target IP type, event time, process type, event type, and file type according to a preset feature value mapping table, and vectorize the target IP type, event time, process type, and event type based on the feature value.

[0163] Optionally, when the processing module 603 calculates the anomaly score of any event based on the reconstruction error and anomaly probability of any event according to preset rules, it is specifically used to: perform weighted calculation on the reconstruction error and anomaly probability of any event based on preset weighting rules to obtain the anomaly value of any event; and perform normalization on the anomaly value of any event based on the cumulative distribution function to obtain the anomaly score of any event.

[0164] Based on the same technical concept, see Figure 7 , which is a structural diagram of a data detection device provided in an embodiment of the present application, and the device includes a template / unit / technical means of the method executed by an electronic device in the above method.

[0165] Exemplarily, the apparatus 700 may include:

[0166] The acquisition module 701 is used to: acquire a first training sample, where the first training sample includes an event with a status mark; the status mark is used to indicate whether the status of the event is normal or abnormal;

[0167] The extraction module 702 is used to: extract at least one first feature of the first training sample, vectorize the at least one first feature, and obtain at least one first feature vector; input the at least one first feature vector into an autoencoder, the autoencoder includes an encoder and a decoder, encode the at least one first feature vector by the encoder, obtain at least one second feature vector, and obtain at least one second feature vector; input the at least one second feature vector into a one-dimensional convolutional neural network for anomaly prediction, and obtain the anomaly probability of the first training sample output by the one-dimensional convolutional neural network;

[0168] The optimization module 703 is used to calculate a first loss value between the abnormal probability of the first training sample and the state mark of the first training sample, and adjust the parameters of the one-dimensional convolutional neural network with the first loss value being less than a first preset threshold as the goal.

[0169] Optionally, at least one first feature includes: at least one of: process path and command line parameters, sub-process path and command line parameters, target IP type, event time, process type, event type, and file type; when the extraction module 702 vectorizes at least one first feature, it is specifically used to: vectorize the process path and command line parameters, sub-process path and command line parameters based on a multi-hash feature encoding algorithm; match the feature values ​​corresponding to the target IP type, event time, process type, event type, and file type according to a preset feature value mapping table, and vectorize the target IP type, event time, process type, and event type based on the feature value.

[0170] Optionally, before obtaining the first training sample, the acquisition module 701 is also used to: obtain a second training sample, the second training sample includes events without state tags; the extraction module 702 is also used to: extract at least one third feature of the second training sample, vectorize at least one third feature, and obtain at least one third feature vector; input at least one third feature vector into the autoencoder, encode at least one third feature vector through the encoder, decode the output of the encoder through the decoder to obtain at least one fourth feature vector, and obtain at least one fourth feature vector; the optimization module 703 is also used to: calculate a second loss value between at least one fourth feature vector and at least one third feature vector, and adjust the parameters of the autoencoder with the second loss value being less than a second preset threshold as the goal.

[0171] It should be understood that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0172] As a possible product form of the above device, see Figure 8The embodiment of the present application also provides an electronic device 800, comprising: at least one processor 801; and a communication interface 803 that is communicatively connected to the at least one processor 801; the at least one processor 801 executes instructions stored in the memory 802, so that the electronic device 800 executes the method steps performed by the electronic device in the above method embodiment through the communication interface 803.

[0173] Optionally, the memory 802 is located outside the electronic device 800 .

[0174] Optionally, the electronic device 800 includes the memory 802, the memory 802 is connected to the at least one processor 801, and the memory 802 has instructions that can be executed by the at least one processor 801. Figure 8 The dashed lines indicate that the memory 802 is optional for the electronic device 800 .

[0175] The at least one processor 801 and the memory 802 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0176] The specific connection medium between the at least one processor 801, the memory 802 and the communication interface 803 is not limited in the embodiment of the present application. Figure 8 In the figure, at least one processor 801, memory 802 and communication interface 803 are connected via bus 804, which is represented by a thick line in the figure. The connection between other components is only for schematic illustration and is not limited thereto. The bus part can be an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 It is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.

[0177] It should be understood that the processor mentioned in the embodiments of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor implemented by reading software code stored in a memory.

[0178] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0179] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both a volatile memory and a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct RAM bus random access memory (DRRAM).

[0180] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0181] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0182] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps performed by any device in the above method example.

[0183] Based on the same technical concept, an embodiment of the present application also provides a computer program product, including computer program code, which, when running on a computer, enables the computer to execute the above method, which is the method steps executed by any device in the embodiment.

[0184] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0185] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0186] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0187] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0188] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data detection method, characterized in that: include: Acquire multiple events in the log, and extract at least one first feature of any event among the multiple events; Vectorizing at least one first feature of any one of the events to obtain at least one first feature vector; Inputting the at least one first feature vector into an autoencoder, the autoencoder comprising an encoder and a decoder, encoding the at least one first feature vector by the encoder to obtain at least one second feature vector; and decoding the at least one second feature vector by the decoder to obtain at least one third feature vector; obtaining the at least one second feature vector and the at least one third feature vector; calculating a reconstruction error between the at least one first eigenvector and the at least one third eigenvector; Inputting the at least one second feature vector into a one-dimensional convolutional neural network for abnormality prediction, and obtaining an abnormal probability of any event output by the one-dimensional convolutional neural network; An anomaly score of any event is calculated according to a preset rule based on the reconstruction error and anomaly probability of any event, and an alarm is issued for an event whose anomaly score is greater than a threshold.

2. The method according to claim 1, characterized in that The at least one first feature includes: at least one of a process path and command line parameters, a subprocess path and command line parameters, a target IP type, an event time, a process type, an event type, and a file type; The vectorizing of at least one first feature of any event comprises: Based on a multi-hash feature encoding algorithm, the process path and command line parameters, and the sub-process path and command line parameters are respectively vectorized; According to the preset feature value mapping table, the feature values ​​corresponding to the target IP type, the event time, the process type, the event type, and the file type are matched respectively, and the target IP type, the event time, the process type, and the event type are vectorized based on the feature values.

3. The method according to claim 1, characterized in that The calculating the anomaly score of any event according to a preset rule based on the reconstruction error and the anomaly probability of any event includes: Performing weighted calculation on the reconstruction error and abnormal probability of any event based on a preset weighting rule to obtain an abnormal value of any event; The abnormal value of any event is standardized based on the cumulative distribution function to obtain an abnormal score of any event.

4. A model training method, characterized in that: include: Acquire a first training sample, wherein the first training sample includes events with state labels; The status mark is used to indicate whether the status of the event is normal or abnormal; Extracting at least one first feature of the first training sample, vectorizing the at least one first feature to obtain at least one first feature vector; inputting the at least one first feature vector into an autoencoder, the autoencoder comprising an encoder and a decoder, encoding the at least one first feature vector by the encoder to obtain at least one second feature vector, and acquiring the at least one second feature vector; Inputting the at least one second feature vector into a one-dimensional convolutional neural network for abnormality prediction, and obtaining an abnormality probability of the first training sample output by the one-dimensional convolutional neural network; A first loss value between the abnormal probability of the first training sample and the state mark of the first training sample is calculated, and the parameters of the one-dimensional convolutional neural network are adjusted with the first loss value being less than a first preset threshold as a goal.

5. The method according to claim 4, characterized in that The at least one first feature includes: at least one of a process path and command line parameters, a subprocess path and command line parameters, a target IP type, an event time, a process type, an event type, and a file type; The vectorizing the at least one first feature comprises: Based on a multi-hash feature encoding algorithm, the process path and command line parameters, and the sub-process path and command line parameters are respectively vectorized; According to the preset feature value mapping table, the feature values ​​corresponding to the target IP type, the event time, the process type, the event type, and the file type are matched respectively, and the target IP type, the event time, the process type, and the event type are vectorized based on the feature values.

6. The method according to claim 4, characterized in that Before obtaining the first training sample, the method further includes: Acquire a second training sample, where the second training sample includes events without the state mark; Extracting at least one third feature of the second training sample, and vectorizing the at least one third feature to obtain at least one third feature vector; Inputting the at least one third feature vector into the autoencoder, encoding the at least one third feature vector by the encoder, decoding the output of the encoder by the decoder to obtain at least one fourth feature vector, and acquiring the at least one fourth feature vector; A second loss value between the at least one fourth eigenvector and the at least one third eigenvector is calculated, and parameters of the autoencoder are adjusted with the second loss value being less than a second preset threshold as a goal.

7. A data detection device, characterized in that: include: The acquisition module is used to: obtain multiple events in the log; An extraction module, used to: extract at least one first feature of any event among the multiple events; Vectorizing at least one first feature of any event to obtain at least one first feature vector; inputting the at least one first feature vector into an autoencoder, the autoencoder comprising an encoder and a decoder, encoding the at least one first feature vector by the encoder to obtain at least one second feature vector; decoding the at least one second feature vector by the decoder to obtain at least one third feature vector; acquiring the at least one second feature vector and the at least one third feature vector; A processing module, configured to: calculate a reconstruction error between the at least one first eigenvector and the at least one third eigenvector; The extraction module is further used to: input the at least one second feature vector into a one-dimensional convolutional neural network for abnormality prediction, and obtain the abnormal probability of any event output by the one-dimensional convolutional neural network; The processing module is further used for: calculating an abnormality score of any event according to a preset rule based on the reconstruction error and abnormality probability of any event, and issuing an alarm for an event whose abnormality score is greater than a threshold.

8. A model training device, characterized in that: include: An acquisition module is used to: acquire a first training sample, wherein the first training sample includes events with status marks; The status mark is used to indicate whether the status of the event is normal or abnormal; An extraction module is used to: extract at least one first feature of the first training sample, vectorize the at least one first feature, and obtain at least one first feature vector; input the at least one first feature vector into an autoencoder, the autoencoder includes an encoder and a decoder, encode the at least one first feature vector by the encoder, obtain at least one second feature vector, and obtain the at least one second feature vector; input the at least one second feature vector into a one-dimensional convolutional neural network for anomaly prediction, and obtain the anomaly probability of the first training sample output by the one-dimensional convolutional neural network; The optimization module is used to calculate a first loss value between the abnormal probability of the first training sample and the state mark of the first training sample, and adjust the parameters of the one-dimensional convolutional neural network with the first loss value being less than a first preset threshold as the goal.

9. An electronic device, characterized in that: The electronic device comprises at least one processor, and the at least one processor is used to implement the method according to any one of claims 1 to 3 or the method according to any one of claims 4 to 6 when executing a computer program stored in a memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 3 or the method according to any one of claims 4 to 6 is implemented.

Images