Network attack prediction method and device, equipment and storage medium

Abstract

The invention provides a network attack prediction method and device, equipment and a storage medium, relates to the technical field of network security, and is used for improving the accuracy and timeliness of network attack prediction. The method comprises the steps of obtaining real-time monitoring data reported by network monitoring equipment, generating an aggregation data set of different time dimensions based on the data volume of the real-time monitoring data, generating attack prediction data based on the aggregation data set, and performing network attack prediction based on the attack prediction data through a target network prediction model. The target network prediction model is obtained by training in an optimization following mode based on attack training data.

Description

Background Art

[0002] With the development of technology, the types and complexity of cyber attacks are increasing. From traditional viruses and Trojans to more advanced ransomware and zero-day vulnerability exploits, threats are becoming increasingly diverse. At the same time, cyber attacks are not restricted by geography, and organizations around the world may become targets. This global feature increases the complexity of preventing cyber attacks.

[0003] Therefore, in order to help organizations take preventive measures in time to prevent cyber attacks and thus ensure network security, cyber attack prediction technology is proposed in the prior art. Through cyber attack prediction technology, it is possible to predict in advance whether there is a potential risk of cyber attacks. When the prediction result indicates the existence of cyber attacks, preventive measures can be taken in time, that is, preventive measures can be taken before a cyber attack occurs to avoid or mitigate the impact of the attack.

[0004] At present, network attack prediction is carried out by using models on network traffic data. Since the network traffic data is large and complex, the prediction is time-consuming. At the same time, the network traffic data will be disturbed, which affects the data quality and further affects the accuracy of the prediction results.

[0005] Therefore, how to improve the accuracy and timeliness of network attack predictions is a technical problem that needs to be solved at present. Summary of the invention

[0006] The embodiments of the present application provide a network attack prediction method, device, electronic device and storage medium to improve the accuracy and timeliness of network attack prediction.

[0007] In a first aspect, an embodiment of the present application provides a network attack prediction method, the method comprising:

[0008] Obtain real-time monitoring data reported by network monitoring equipment;

[0009] Based on the data volume of real-time monitoring data, generate aggregated data sets of different time dimensions, and generate attack prediction data based on the aggregated data sets;

[0010] The target network prediction model is used to predict network attacks based on attack prediction data; wherein the target network prediction model is obtained by training based on attack training data through an optimal follow-up method.

[0011] In a possible implementation, based on the data volume of real-time monitoring data, aggregated data of different time dimensions are generated, including:

[0012] According to the set data volume threshold, the real-time monitoring data is aggregated in the time dimension to generate aggregated data sets of different time dimensions;

[0013] The amount of data in the aggregated data set of each time dimension is consistent with the data amount threshold.

[0014] In a possible implementation, generating attack prediction data based on the aggregated data set includes:

[0015] According to the set data space, data sampling is performed on the aggregated data set to obtain sampled data;

[0016] The obtained sampling data is preprocessed by range normalization to generate attack prediction data.

[0017] In a possible implementation, the target network prediction model is obtained by performing cyclic iterative training on the network prediction model to be trained, and the following operations are performed in the first cyclic iterative training:

[0018] Attack training data is selected from the attack training data set; the attack training data at least includes: a first behavior label for characterizing whether there is a network attack behavior; the attack training data is determined based on different time dimensions;

[0019] Input the attack training data into the prediction model of the network to be trained, and obtain the corresponding first line prediction result;

[0020] Based on the difference between the prediction result of the first behavior and the label of the first behavior, the parameters of the training network prediction model are optimized through the optimal follow-up method to obtain the corresponding optimized network prediction model.

[0021] In a possible implementation, after performing parameter optimization processing on the network prediction model to be trained and obtaining the corresponding optimized network prediction model, the following steps are further included:

[0022] Input each attack test data in the attack test data set into the optimized network prediction model, and obtain the corresponding second behavior prediction result; wherein the attack test data at least includes: a second behavior label for characterizing whether there is a network attack behavior; the attack test data is determined based on different time dimensions;

[0023] Matching each second behavior prediction result with the corresponding second behavior label, and determining the accuracy of the optimized network prediction model based on the matching results;

[0024] Based on the accuracy, the target network prediction model is obtained.

[0025] In a possible implementation, obtaining a target network prediction model based on accuracy includes:

[0026] When the accuracy is greater than or equal to a preset accuracy threshold, the optimized network prediction model is used as the target network prediction model; or

[0027] When the accuracy is less than the accuracy threshold and the loop iteration period is greater than the set period threshold, the finally obtained optimized network prediction model is used as the target network prediction model.

[0028] In a possible implementation, after predicting the network attack based on the attack prediction data using the target network prediction model, the following is further included:

[0029] If the prediction result obtained indicates the existence of network attack behavior, all monitoring data associated with the attack prediction data will be forwarded to the cleaning equipment for cleaning processing through the scheduling system.

[0030] In a second aspect, an embodiment of the present application provides a network attack prediction device, the device comprising:

[0031] An acquisition unit, used to acquire real-time monitoring data reported by a network monitoring device;

[0032] A generating unit, used for generating aggregated data sets of different time dimensions based on the data volume of the real-time monitoring data, and generating attack prediction data based on the aggregated data sets;

[0033] The prediction unit is used to predict network attacks based on attack prediction data through a target network prediction model; wherein the target network prediction model is obtained by training based on the attack training data through an optimal follow-up method.

[0034] In a possible implementation, the generating unit is specifically used for:

[0035] According to the set data volume threshold, the real-time monitoring data is aggregated in the time dimension to generate aggregated data sets of different time dimensions;

[0036] The amount of data in the aggregated data set of each time dimension is consistent with the data amount threshold.

[0037] In a possible implementation, the generating unit is specifically used for:

[0038] According to the set data space, data sampling is performed on the aggregated data set to obtain sampled data;

[0039] The obtained sampling data is preprocessed by range normalization to generate attack prediction data.

[0040] In a possible implementation, the device further includes a training unit, the target network prediction model is obtained by performing cyclic iterative training on the network prediction model to be trained, and the training unit performs the following operations in the first cyclic iterative training:

[0041] Attack training data is selected from the attack training data set; the attack training data at least includes: a first behavior label for characterizing whether there is a network attack behavior; the attack training data is determined based on different time dimensions;

[0042] Input the attack training data into the prediction model of the network to be trained, and obtain the corresponding first line prediction result;

[0043] Based on the difference between the prediction result of the first behavior and the label of the first behavior, the parameters of the training network prediction model are optimized through the optimal follow-up method to obtain the corresponding optimized network prediction model.

[0044] In a possible implementation, after performing parameter optimization processing on the network prediction model to be trained and obtaining the corresponding optimized network prediction model, the training unit is further used to:

[0045] Input each attack test data in the attack test data set into the optimized network prediction model, and obtain the corresponding second behavior prediction result; wherein the attack test data at least includes: a second behavior label for characterizing whether there is a network attack behavior; the attack test data is determined based on different time dimensions;

[0046] Matching each second behavior prediction result with the corresponding second behavior label, and determining the accuracy of the optimized network prediction model based on the matching results;

[0047] Based on the accuracy, the target network prediction model is obtained.

[0048] In a possible implementation, the training unit is specifically used for:

[0049] When the accuracy is greater than or equal to a preset accuracy threshold, the optimized network prediction model is used as the target network prediction model; or

[0050] When the accuracy is less than the accuracy threshold and the loop iteration period is greater than the set period threshold, the finally obtained optimized network prediction model is used as the target network prediction model.

[0051] In a possible implementation, after performing network attack prediction based on attack prediction data using a target network prediction model, the prediction unit is further configured to:

[0052] If the prediction result obtained indicates the existence of network attack behavior, all monitoring data associated with the attack prediction data will be forwarded to the cleaning equipment for cleaning processing through the scheduling system.

[0053] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to execute the computer program to implement the steps of the network attack prediction method provided in the embodiment of the present application.

[0054] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the network attack prediction method provided in the embodiment of the present application are implemented.

[0055] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device executes the steps of the network attack prediction method provided in the embodiment of the present application.

[0056] The above solution of the present application has at least the following beneficial effects:

[0057] The network attack prediction method, device, electronic device and storage medium provided in the embodiments of the present application relate to the field of network security technology. In the embodiments of the present application:

[0058] First, the real-time monitoring data reported by the network monitoring equipment is obtained, and based on the data volume of the real-time monitoring data, aggregated data sets of different time dimensions are generated, and attack prediction data is generated based on the aggregated data sets. Finally, network attack prediction is performed based on the attack prediction data through the target network prediction model. The target network prediction model is obtained by training based on the attack training data through the optimal follow-up method. The target network prediction model obtained by training using the optimal follow-up method has a faster prediction speed and higher prediction accuracy. Therefore, when predicting network attacks based on the target network prediction model, the prediction results can be obtained quickly and accurately.

[0059] At the same time, after obtaining real-time monitoring data with timeliness, based on the data volume of the real-time monitoring data, aggregated data sets of different time dimensions are generated, and attack prediction data is generated based on the aggregated data sets, that is, based on the real-time monitoring data, aggregated data sets of different time dimensions are dynamically generated according to the data volume in a specific time period, and attack prediction data is generated based on the aggregated data sets. While reducing the data volume, the attack prediction data of the target network prediction model is ensured to be maintained within a certain range, and problems such as excessive data peaks in a certain period of time and data glitches caused by data interference are avoided. That is, the data quality of the attack prediction data is ensured while reducing the data volume of the attack prediction data. Further, through the target network prediction model, when predicting network attacks based on the attack prediction data, the running time of the target network prediction model can be reduced due to the reduction in data volume, thereby improving the prediction timeliness, and the accuracy of the output results of the target network prediction model can be improved due to the improvement in data quality.

[0060] In summary, the network attack prediction method, device, electronic device and storage medium provided in the embodiments of the present application are used to improve the accuracy and timeliness of network attack prediction.

[0061] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0063] Figure 1 A structural diagram of a network prediction model to be trained provided in an embodiment of the present application;

[0064] Figure 2 A flow chart of a training method for a network prediction model to be trained provided in an embodiment of the present application;

[0065] Figure 3 A schematic diagram of a TSO algorithm provided in an embodiment of the present application combined with an LSTM network for model training;

[0066] Figure 4 A flow chart of a network attack prediction method provided in an embodiment of the present application;

[0067] Figure 5 A structural diagram of a network attack prediction device provided in an embodiment of the present application;

[0068] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0070] Some of the terms used in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0071] Tuna swarm optimization (TSO) is a meta-heuristic algorithm based on finding the optimal solution in a group. It starts the optimization process by uniformly randomly generating an initial population in the search space. During the entire optimization process, all individuals of TSO are continuously updated and calculated until the final condition is met, and then the optimal individual and the corresponding fitness value are returned.

[0072] Long Short-Term Memory (LSTM): A time-recurrent neural network suitable for processing and predicting important events with relatively long intervals and delays in time series.

[0073] Dynamic Multi-Dimensional Time Sample (DMDTS): The sample space originates from the original data and is an aggregated sample in different time dimensions dynamically formed based on the relationship between the data volume and the maximum threshold of the number of samples per unit time.

[0074] The term “exemplary” hereafter means “serving as an example, example, or illustration.” Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0075] The terms "first" and "second" in the following text are used for descriptive purposes only and should not be understood as explicitly or implicitly indicating relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, unless otherwise specified, the meaning of "plurality" is two or more.

[0076] The term "and / or" in the following text describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0077] Hereinafter, the term "at least one" means one or more, and "plurality" means two or more; the term "at least one" means one or more, and "multiple" means two or more.

[0078] The terms "comprises," "comprising," and "having," and their variations, hereinbelow, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or apparatus.

[0079] The following is a brief introduction to the design concept of the embodiment of the present application:

[0080] With the development of technology, the types and complexity of cyber attacks are increasing. From traditional viruses and Trojans to more advanced ransomware and zero-day vulnerability exploits, threats are becoming increasingly diverse. At the same time, cyber attacks are not restricted by geography, and organizations around the world may become targets. This global feature increases the complexity of preventing cyber attacks.

[0081] Therefore, the prior art proposes network attack prediction technology, which can predict in advance whether there is a potential risk of network attack. When the prediction result indicates the existence of network attack, it can help organizations take preventive measures to prevent network attack in time before the network attack occurs, thereby ensuring network security. In addition, when predicting network attacks, by analyzing attack patterns and trends, it is possible to predict the targets and methods that may be attacked in the future, and strengthen protection in advance, update security policies and reinforce systems in real time to deal with data loss, system paralysis, data asset loss and other problems caused by network attacks, effectively reduce the losses caused by network attacks, and avoid or mitigate the impact of network attacks. It can be seen that through network attack prediction technology, organizations can respond to potential network attacks more quickly and take quick action to reduce losses and restore services.

[0082] At present, network attack prediction is carried out by using models on network traffic data. Since the network traffic data is large and complex, the prediction is time-consuming. At the same time, the network traffic data will be disturbed, which affects the data quality and further affects the accuracy of the prediction results.

[0083] Therefore, how to improve the accuracy and timeliness of network attack predictions is a technical problem that needs to be solved at present.

[0084] In view of this, the embodiments of the present application provide a network attack prediction method, device, equipment and storage medium, which are applied to the field of network security technology, involving the field of artificial intelligence (AI) technology, to improve the accuracy and timeliness of network attack prediction.

[0085] Considering that network attack prediction is achieved through a network prediction model, in order to improve the accuracy and timeliness of network attack prediction in the embodiments of the present application, improvements are made in terms of network prediction model training and network prediction model application. Below, the network model training and network prediction model application involved in the embodiments of the present application are specifically described in conjunction with the accompanying drawings of the specification.

[0086] Implementation 1: Network prediction model training

[0087] The model training process is the process of cyclically iteratively training the network prediction model to be trained. It can mainly include: model design stage, training sample preparation stage and iterative training stage. The following is a detailed introduction to network model training through these three stages.

[0088] 1) Model design stage:

[0089] See also Figure 1 , Figure 1 A structural diagram of a network prediction model to be trained provided in an embodiment of the present application, wherein the network prediction model to be trained includes: an input layer, a hidden layer, and an output layer, each layer has corresponding neurons connected to the next layer; wherein:

[0090] The input layer is used to obtain data before feature extraction; for example, the attack training data proposed in the embodiment of the present application;

[0091] The hidden layer is used to extract features from the input data and adjust the model parameters to make the neurons in the hidden layer respond to a certain pattern; for example, the weights and biases corresponding to the neurons are adjusted to achieve feature extraction through the control of the neurons. The weights affect the sensitivity of the neurons to the input information. For example, the neurons in the hidden layer form feature extraction bias by controlling the weights, and the neurons in the output layer adjust the weights of the neurons in the hidden layer to form the output results. The bias is sensitivity. If the appropriate bias is not set, some noise will affect the feature extraction results, or some features that should have been extracted will be blocked during the transmission process.

[0092] The output layer is used to connect to the hidden layer and output the final result, that is, the output layer is used to output the extracted features or the final prediction results.

[0093] Continue to see Figure 1 , the network prediction model to be trained includes three hidden layers, and the input layer, hidden layer, and output layer each include at least one neuron; wherein: the input layer includes N neurons, N corresponds to the vector dimension (also known as vector length) of the one-dimensional vector of the data input to the network prediction model to be trained, illustratively, the vector dimension of the one-dimensional vector of the data is 128, then the input layer includes 128 neurons; the first hidden layer includes 128 neurons; the second hidden layer includes 256 neurons, and the third hidden layer includes 100 neurons.

[0094] It should be noted that Figure 1 The network prediction model to be trained shown includes three hidden layers, and the number of neurons included in the input layer, hidden layer, and output layer is only an example, and can be adjusted and set according to actual conditions during specific application implementation.

[0095] Considering that the attack prediction data used in network attack prediction has obvious time series, the LSTM network can be selected as the network prediction model to be trained in the embodiment of the present application.

[0096] 2) Training sample preparation stage:

[0097] Training sample collection is a major step in the model training process. The training sample preparation stage of the training process of the network prediction model to be trained is to determine the attack training data set, which mainly includes: the process of obtaining attack training data and the process of labeling the attack training data. The following describes these two processes separately.

[0098] 21) The process of obtaining attack training data:

[0099] Considering that the attack training data greatly affects the model training results, that is, it has an impact on the target network prediction model obtained through training; and the network attack prediction in the embodiment of the present application mainly solves the accuracy and timeliness of the prediction results, and the accuracy and timeliness of the prediction results are greatly affected by the target network prediction model obtained through training. Therefore, the use of attack training data is very important for the model training process.

[0100] However, the attack training data used in the related art has peak unpredictability and strong burr phenomenon caused by data interference, that is, the data quality of the attack training data used in the related art is poor, affecting the accuracy; at the same time, the amount of attack training data used in the related art is huge and complex, which makes the network prediction model processing time-consuming and affects the timeliness. Therefore, in the embodiment of the present application, a relatively large innovation is made in the acquisition of attack training data to improve the data quality of attack training data and reduce the amount of attack training data.

[0101] In an embodiment of the present application, historical monitoring data is first obtained, and then based on the data volume of the historical monitoring data, historical aggregated data sets of different time dimensions are generated, and finally attack training data is generated based on the historical aggregated data sets; this is described in detail below through steps A1 to A3.

[0102] Step A1: Obtain historical monitoring data.

[0103] In one possible implementation, the network monitoring device reports the historical monitoring data and whether there is any network attack behavior in the historical monitoring data to the network prediction system; the historical monitoring data is obtained by the network monitoring device through real-time monitoring at historical times, and the network attack behavior associated with the historical monitoring data is generated after the network monitoring device obtains the historical monitoring data.

[0104] Exemplarily, the network monitoring device uses the real-time monitoring data obtained from 12:00-24:00 on December 1, 2000 as historical monitoring data, and associates whether there is a network attack behavior from 00:00 to 02:00 on December 2, 2000 with the historical monitoring data obtained from 12:00-24:00 on December 1, 2000, to determine that the first behavior of the historical monitoring data obtained from 12:00-24:00 on December 1, 2000 is a label.

[0105] Step A2: Based on the data volume of historical monitoring data, generate historical aggregated data sets of different time dimensions.

[0106] In one possible implementation, when generating historical aggregated data sets of different time dimensions based on the data volume of historical monitoring data, the historical monitoring data is aggregated in time dimensions according to a set sample quantity threshold to generate historical aggregated data sets of different time dimensions; wherein the data volume in the historical aggregated data set of each time dimension is consistent with the sample quantity threshold.

[0107] For example, the sample number threshold per unit time is set to N th(Usually the value set in the system is in the millions). After receiving the historical monitoring data reported by the network monitoring device, the acquired historical monitoring data is aggregated in different time dimensions according to the sample quantity threshold. The current network monitoring device collects data at a time interval of 30 seconds per point. The aggregated data of different time dimensions such as 5 minutes, 10 minutes, and 20 minutes will be dynamically completed according to the sample quantity threshold per unit time to generate historical aggregated data sets of different time dimensions.

[0108] Step A3: Generate attack training data based on the historical aggregated dataset.

[0109] In one possible implementation, when generating attack training data based on a historical aggregate data set, data sampling is performed on the historical aggregate data set according to a set data space to obtain historical sampling data, and the amount of data of the sampled historical sampling data is consistent with the size of the data space; the obtained historical sampling data is preprocessed with range normalization to generate attack training data so that the attack training data is between [0, 1].

[0110] Exemplarily, the obtained historical sampling data is preprocessed by range normalization using the following formula.

[0111] x nor =xx min

[0112] Formula 1: x max -x m i n ;

[0113] Among them, x max , x min They represent the maximum and minimum values ​​in the historical sampling data, respectively. x represents a historical sampling data. nor Represents the value after range standardization preprocessing.

[0114] In another possible implementation, after the obtained historical sampling data is preprocessed by range normalization, the data after range normalization preprocessing is divided into attack training data and attack test data according to a simple cross-validation method; for example, the first 90% group of data is used as attack training data for training the LSTM network, and the remaining 10% group of data is used as attack test data.

[0115] In this application, it is proposed to dynamically generate a time-based multi-level sample space based on the historical monitoring data of network monitoring equipment. By dynamically generating samples of different time granularities according to the amount of data samples in a specific time period. In this way, while ensuring the quality of sample data, the number of samples of the prediction model is always maintained within a certain range, avoiding the problem that the running time of the prediction model is too long due to the excessive data peaks in a certain period of time, and then the timeliness of the prediction results cannot be guaranteed.

[0116] 22) The process of signing:

[0117] In the embodiment of the present application, a manual labeling method may be used to label the attack training data with a first behavior label that characterizes whether there is a network attack behavior.

[0118] After the attack training data is determined and the first line of the attack training data is labeled, the preparation of the attack training data set for training is completed. Further, the prediction model of the network to be trained can be trained based on the attack training data set.

[0119] 3) Iterative training phase:

[0120] In the training process of the network prediction model to be trained, all samples in the attack training data set are iterated N times (e.g., 100 times), wherein all samples are trained once in the network prediction model to be trained, which is called an iteration. In each iteration, due to the limited video memory resources of the training machine, all samples cannot be input into the model for training at one time, so all samples need to be trained in batches, and each batch of samples is generated by random division, and each batch of samples is input into the model separately. According to the processing results of the model on the samples, the model parameters are updated and other operations are performed.

[0121] Before the first training, the parameters of the network prediction model to be trained are initialized. Exemplarily, the parameter initialization includes: setting hyperparameters such as batch, number of iterations (epoch) and learning rate.

[0122] Since the training operation is the same for each iteration, the following takes the I-th iteration training as an example to illustrate the training process of the network prediction model to be trained. Figure 2 , is a flow chart of a training method for a network prediction model to be trained provided in an embodiment of the present application, comprising the following steps:

[0123] Step S200, selecting attack training data from the attack training data set; the attack training data at least includes: a first behavior label for characterizing whether there is a network attack behavior; the attack training data is determined based on different time dimensions.

[0124] Exemplarily, attack training data is randomly selected from the attack training data set. The method for determining the attack training data can refer to the above content and will not be repeated here.

[0125] Step S201: input the attack training data into the network prediction model to be trained, and obtain the corresponding first behavior as the prediction result.

[0126] Step S202, based on the difference between the first behavior prediction result and the first behavior label, the parameters of the training network prediction model are optimized by an optimal follow-up method to obtain a corresponding optimized network prediction model.

[0127] In the embodiment of the present application, considering that the network prediction model to be trained requires more parameters and calculations due to its high computational complexity, a method of training the model by optimal following method is proposed, wherein the optimal following method includes but is not limited to: TSO algorithm.

[0128] For example, when the network prediction model to be trained is determined by the TSO algorithm in an optimal follow-up manner, the LSTM network is used as an example. When the parameters of the network prediction model to be trained are optimized, the LSTM parameters are optimized by the TSO algorithm; wherein the LSTM parameters include but are not limited to: the number of neurons in the hidden layer, the learning rate, and the number of training times. In this way, the network prediction model converges to the global optimum, and at the same time, the network prediction model can still have a very high prediction result accuracy on the basis of greatly shortening the training time.

[0129] It should be noted that the TSO algorithm randomly generates a population in the search space. In each iteration, each individual randomly selects one of the foraging strategies (i.e., spiral foraging, parabolic foraging) to execute, or chooses to regenerate the position in the search space based on probability.

[0130] In one possible implementation, after the parameters of the network prediction model to be trained are optimized and the corresponding optimized network prediction model is obtained, it is further determined whether the optimized network prediction model can be used as a target network prediction model for network attack prediction. When it is determined that the optimized network prediction model cannot be used as a target network prediction model for network attack prediction, it is necessary to adjust the parameters of the optimized network prediction model; or, when it is determined that the optimized network prediction model can be used as a target network prediction model for network attack prediction, the optimized network prediction model is deployed and applied as a target network prediction model.

[0131] Next, whether the optimized network prediction model can be deployed and applied as the target network prediction model is described in detail through steps B1 to B3.

[0132] Step B1: Input each attack test data in the attack test data set into the optimized network prediction model respectively, and obtain the corresponding second behavior prediction result; wherein the attack test data at least includes: a second behavior label for characterizing whether there is a network attack behavior; the attack test data is determined based on different time dimensions.

[0133] It should be noted that the method for determining the attack test data can refer to the above embodiment, which will not be repeated here.

[0134] Step B2: Match each second behavior prediction result with the corresponding second behavior label, and determine the accuracy of the optimized network prediction model based on the matching results.

[0135] When the accuracy of the optimized network prediction model is determined based on the matching results, it can be determined by a root mean square error (RMSE) or a mean relative error (MRE).

[0136] The root mean square error is expressed as: y i The second line is a label. The second line is the prediction result, and n is the total number of attack test data in the attack test data set;

[0137] The average relative error is expressed as: y i The second line is a label. The second line is the prediction result, and n is the total number of attack test data in the attack test data set.

[0138] Step B3: Based on the accuracy, obtain the target network prediction model.

[0139] In a possible implementation, when the accuracy is greater than or equal to a preset accuracy threshold, the optimized network prediction model is used as the target network prediction model.

[0140] In a possible implementation, when the accuracy is less than the accuracy threshold and the loop iteration period is greater than the set period threshold, the finally obtained optimized network prediction model is used as the target network prediction model.

[0141] In an embodiment of the present application, in order to ensure that the target network prediction model of the deployed application always has higher prediction accuracy and prediction timeliness, the target network prediction model will be continuously tested and updated during the process of deploying the target network prediction model to determine whether the target network prediction model needs a new round of adaptive training adjustment.

[0142] Whether a new round of adaptive training adjustment is needed for the target network prediction model of the deployed application depends on the accuracy of the target network prediction model in the prediction results. When the accuracy of the prediction results of the target network prediction model is within an acceptable range, that is, greater than or equal to the preset accuracy threshold, the target network prediction model will continue to use the previously converged parameters in the next prediction cycle, that is, the currently deployed target network prediction model will not be updated. Once the accuracy of the prediction results of the target network prediction model is lower than the preset accuracy threshold or the period of the target network prediction model deployment application has exceeded the preset maximum period value, the model will start a new round of training and deploy the target network prediction model obtained by the new round of training. Through this mechanism, the target network prediction model of the deployed application is always in adaptive adjustment.

[0143] In order to more conveniently understand the training process of the network prediction model provided in the embodiment of the present application, a schematic diagram of combining a TSO algorithm with an LSTM network for model training is proposed in the embodiment of the present application, see Figure 3 ,from Figure 3 It can be seen that it mainly includes three major modules, namely data extraction module (extraction), data sampling module (sample) and model prediction module (TSO-LSTM based prediction).

[0144] The data extraction module is used to extract historical monitoring data reported by network monitoring equipment, and based on the data volume of historical monitoring data, generates historical aggregated data sets of different time dimensions.

[0145] The data sampling module is used to perform data sampling processing on the historical aggregate data set according to the set data space to obtain historical sampling data, and perform range normalization preprocessing on the obtained historical sampling data to obtain attack training data and attack test data.

[0146] The model prediction module is used to train the prediction model of the training network based on the attack training data to obtain the target network prediction model; it includes: input layer, hidden layer, embedding layer, LSTM network with TSO algorithm, encoder (DecoderLinear) and output layer. The input layer is used to obtain the input attack training data; the hidden layer is used to perform complex feature extraction and transformation on the attack training data input by the input layer, so that the model can learn more abstract and high-order features from the input data; the embedding layer is used to map the high-dimensional data of high-order features to low-dimensional space to reduce data complexity; the LSTM network with TSO algorithm is used to predict based on the features input by the embedding layer to obtain prediction features; the encoder is used to encode the prediction features to obtain the prediction results, and output the prediction results through the output layer.

[0147] exist Figure 3 The schematic diagram shown also includes a judgment module connected to the model prediction module. The judgment module compares the accuracy of the prediction result output by the LSTM network introducing the TSO algorithm with the preset accuracy threshold. When the accuracy of the prediction result is lower than the preset accuracy threshold, the LSTM network introducing the TSO algorithm is re-converged and trained in the next prediction cycle. If it is always higher than the preset accuracy threshold, it will be used until the next cycle. Through this mechanism, the timeliness of the prediction results caused by the training convergence of the network prediction model is maximized. At the same time, in order to capture the data characteristics in any cycle of the data. After the maximum allowable cycle threshold of the network prediction model has passed, even if the accuracy of the prediction result of the network prediction model is still higher than the preset accuracy threshold, the data within the maximum allowable cycle threshold will be used for specific sampling, and the model training will be performed based on the attack training data obtained by sampling.

[0148] In this application, by dynamically generating aggregated data of different time dimensions, the quality of training data is within a controllable quantity range while having very high data quality; the LSTM network is improved by the TSO algorithm, and the convergence speed of model training is greatly reduced while maintaining high prediction accuracy; by setting thresholds and the maximum allowed cycle, and the TSO-LSTM adaptive training adjustment mechanism, the timeliness of prediction is guaranteed while ensuring that the model has the characteristics of the entire life cycle of the data, so that the model can be implemented in scenarios with high real-time requirements.

[0149] Implementation 2: Application of Network Prediction Model

[0150] After a trained target network prediction model is obtained through implementation, the target network prediction model will be used to predict whether there is a malicious network attack in the network traffic data, so that when a network attack is predicted, preventive measures can be taken in time to avoid or reduce losses.

[0151] See also Figure 4 , Figure 4 A flowchart of a network attack prediction method provided in an embodiment of the present application is applied to a network prediction system, comprising the following steps:

[0152] Step S400: acquiring real-time monitoring data reported by a network monitoring device.

[0153] In an embodiment of the present application, a network monitoring device monitors network traffic data in real time, obtains real-time monitoring data, and periodically or in real time reports the obtained real-time monitoring data to a network prediction system, so that the network prediction system makes network attack predictions based on the obtained real-time monitoring data.

[0154] Step S401, based on the data volume of real-time monitoring data, generating aggregated data sets of different time dimensions, and generating attack prediction data based on the aggregated data sets.

[0155] In a possible implementation, based on the data volume of real-time monitoring data, aggregated data of different time dimensions are generated, including:

[0156] According to the set data volume threshold, the real-time monitoring data is aggregated in the time dimension to generate aggregated data sets of different time dimensions; wherein the data volume in the aggregated data set of each time dimension is consistent with the data volume threshold.

[0157] In a possible implementation, generating attack prediction data based on the aggregated data set includes:

[0158] According to the set data space, data sampling is performed on the aggregated data set to obtain sampled data;

[0159] The obtained sampling data is preprocessed by range normalization to generate attack prediction data.

[0160] It should be noted that the specific implementation process of generating attack prediction data can refer to the relevant content of generating attack training data in the above-mentioned implementation one, and will not be repeated here.

[0161] Step S402, network attack prediction is performed based on attack prediction data through a target network prediction model; wherein the target network prediction model is obtained by training based on the attack training data through an optimal follow-up method.

[0162] It should be noted that the specific training process of the target network prediction model can be found in the relevant content of the above-mentioned implementation one, and will not be repeated here.

[0163] In an embodiment of the present application, when the prediction result obtained by performing network attack prediction based on attack prediction data indicates the existence of network attack behavior, the prediction result indicating the existence of network attack behavior is sent to the scheduling system, and through the scheduling system, all monitoring data associated with the attack prediction data are forwarded to the cleaning equipment for cleaning processing.

[0164] In the present application, after obtaining real-time monitoring data with timeliness, based on the data volume of the real-time monitoring data, aggregated data sets of different time dimensions are generated, and attack prediction data is generated based on the aggregated data sets, that is, based on the real-time monitoring data, by dynamically generating aggregated data sets of different time dimensions according to the data volume in a specific time period, attack prediction data is generated based on the aggregated data sets, and the attack prediction data of the target network prediction model is guaranteed to be maintained within a certain range while reducing the data volume, and avoid problems such as excessive data peaks and data glitches caused by data interference during a certain period of time, that is, the data quality of the attack prediction data is guaranteed while reducing the data volume of the attack prediction data, and further, the target network prediction model obtained by training in an optimal follow-up manner, when predicting network attacks based on the attack prediction data, the running time of the target network prediction model can be reduced due to the reduction in data volume, and the prediction timeliness can be improved, and the accuracy of the output results of the target network prediction model can be improved due to the improvement in data quality; at the same time, the target network prediction model obtained by training in an optimal follow-up manner has a faster prediction speed and higher prediction accuracy. In summary, the network attack prediction method provided in the embodiment of the present application can improve the timeliness and accuracy of network attack prediction.

[0165] It should be noted that the embodiments described above are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0166] Based on the same inventive concept, the embodiment of the present application also provides a network attack prediction device. The principle of solving the problem by the device is similar to the method of the above embodiment. Therefore, the implementation of the device can refer to the implementation of the above network attack prediction method, and the repeated parts will not be repeated.

[0167] See also Figure 5 , Figure 5 A network attack prediction device structure diagram provided in an embodiment of the present application, the network attack prediction device 500 includes:

[0168] An acquisition unit 501 is used to acquire real-time monitoring data reported by a network monitoring device;

[0169] A generating unit 502, configured to generate aggregated data sets of different time dimensions based on the data volume of the real-time monitoring data, and to generate attack prediction data based on the aggregated data sets;

[0170] The prediction unit 503 is used to perform network attack prediction based on the attack prediction data through a target network prediction model; wherein the target network prediction model is obtained by training based on the attack training data through an optimal follow-up method.

[0171] In a possible implementation, the generating unit 502 is specifically configured to:

[0172] According to the set data volume threshold, the real-time monitoring data is aggregated in the time dimension to generate aggregated data sets of different time dimensions;

[0173] The amount of data in the aggregated data set of each time dimension is consistent with the data amount threshold.

[0174] In a possible implementation, the generating unit 502 is specifically configured to:

[0175] According to the set data space, data sampling is performed on the aggregated data set to obtain sampled data;

[0176] The obtained sampling data is preprocessed by range normalization to generate attack prediction data.

[0177] In a possible implementation, the device further includes a training unit 504, the target network prediction model is obtained by performing cyclic iterative training on the network prediction model to be trained, and the training unit 504 performs the following operations in the first cyclic iterative training:

[0178] Attack training data is selected from the attack training data set; the attack training data at least includes: a first behavior label for characterizing whether there is a network attack behavior; the attack training data is determined based on different time dimensions;

[0179] Input the attack training data into the prediction model of the network to be trained, and obtain the corresponding first line prediction result;

[0180] Based on the difference between the prediction result of the first behavior and the label of the first behavior, the parameters of the training network prediction model are optimized through the optimal follow-up method to obtain the corresponding optimized network prediction model.

[0181] In a possible implementation, after performing parameter optimization processing on the network prediction model to be trained and obtaining the corresponding optimized network prediction model, the training unit 504 is further used to:

[0182] Input each attack test data in the attack test data set into the optimized network prediction model, and obtain the corresponding second behavior prediction result; wherein the attack test data at least includes: a second behavior label for characterizing whether there is a network attack behavior; the attack test data is determined based on different time dimensions;

[0183] Matching each second behavior prediction result with the corresponding second behavior label, and determining the accuracy of the optimized network prediction model based on the matching results;

[0184] Based on the accuracy, the target network prediction model is obtained.

[0185] In a possible implementation, the training unit 504 is specifically configured to:

[0186] When the accuracy is greater than or equal to a preset accuracy threshold, the optimized network prediction model is used as the target network prediction model; or

[0187] When the accuracy is less than the accuracy threshold and the loop iteration period is greater than the set period threshold, the finally obtained optimized network prediction model is used as the target network prediction model.

[0188] In a possible implementation, after performing network attack prediction based on attack prediction data through the target network prediction model, the prediction unit 503 is further configured to:

[0189] If the prediction result obtained indicates the existence of network attack behavior, all monitoring data associated with the attack prediction data will be forwarded to the cleaning equipment for cleaning processing through the scheduling system.

[0190] It should be noted that although several units (or modules) of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units (or modules) described above can be concretized in one unit (or module). Conversely, the features and functions of one unit (or module) described above can be further divided into multiple units (or modules) for concretization. Of course, when implementing the present application, the functions of each unit (or module) can also be implemented in the same one or more software or hardware.

[0191] In the embodiments of the present application, the term unit (or module) refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the function of the module or unit.

[0192] After introducing the network attack prediction method and device according to an exemplary embodiment of the present application, another exemplary embodiment of the present application, an electronic device, is introduced next.

[0193] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0194] In a possible implementation, the electronic device provided in the embodiment of the present application may include at least a processor and a memory. The memory stores a computer program, and when the computer program is executed by the processor, the processor executes any step of the network attack prediction method of various exemplary embodiments of the present application.

[0195] In this embodiment, the structure of the electronic device can be as follows Figure 6 As shown, it includes a memory 601 , a communication module 603 and one or more processors 602 .

[0196] The memory 601 is used to store computer programs executed by the processor 602. The memory 601 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0197] The memory 601 may be a volatile memory, such as a random-access memory (RAM); the memory 601 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 601 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 601 may be a combination of the above memories.

[0198] The processor 602 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 602 is used to implement the above network attack prediction method when calling the computer program stored in the memory 601.

[0199] The communication module 603 is used to communicate with the target device and other servers.

[0200] The specific connection medium between the memory 601, the communication module 603 and the processor 602 is not limited in the embodiment of the present application. Figure 6 In the embodiment, the memory 601 and the processor 602 are connected via a bus 604. The bus 604 is connected to the processor 602 via a bus 604. Figure 6 The connections between the other components are only for illustration and are not intended to be limiting. The bus 604 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Figure 6 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0201] The memory 601 stores a computer storage medium, which stores computer executable instructions, and the computer executable instructions are used to implement the network attack prediction method of the embodiment of the present application. The processor 602 is used to execute the above network attack prediction method.

[0202] In some possible implementations, various aspects of the network attack prediction method provided by the present application can also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of the network attack prediction method according to various exemplary embodiments of the present application described above in this specification.

[0203] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0204] The program product of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on a computing device. However, the program product of the present application is not limited to this. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, device or device.

[0205] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0206] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0207] Computer programs for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer program may be executed entirely on the user computing device, partially on the user equipment, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any variety of models including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0208] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0209] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the commands executed by the processor of the computer or other programmable device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that specifies functions in one or more boxes.

[0210] These computer program commands may also be stored in a computer-readable memory capable of directing a computer or other programmable device to operate in a specific manner, so that the commands stored in the computer-readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 Specify the function in one or more boxes.

[0211] These computer program commands can also be loaded onto a computer or other programmable device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0212] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0213] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network attack prediction method, characterized in that: The method comprises: Obtain real-time monitoring data reported by network monitoring equipment; Based on the data volume of the real-time monitoring data, generating aggregated data sets of different time dimensions, and generating attack prediction data based on the aggregated data sets; The target network prediction model is used to predict network attacks based on the attack prediction data; wherein the target network prediction model is obtained by training based on the attack training data through an optimal follow-up method.

2. The method according to claim 1, characterized in that The generating of aggregated data sets of different time dimensions based on the data volume of the real-time monitoring data includes: According to the set data volume threshold, the real-time monitoring data is aggregated in time dimension to generate aggregated data sets of different time dimensions; The amount of data in the aggregated data set of each time dimension is consistent with the data amount threshold.

3. The method according to claim 1, characterized in that Generating attack prediction data based on the aggregated data set includes: According to the set data space, data sampling processing is performed on the aggregated data set to obtain sampled data; The obtained sampling data is preprocessed by range normalization to generate the attack prediction data.

4. The method according to claim 1, characterized in that The target network prediction model is obtained by performing cyclic iterative training on the training network prediction model, and the following operations are performed in the first cyclic iterative training: Select attack training data from the attack training data set; The attack training data at least includes: a first behavior label for characterizing whether there is a network attack behavior; the attack training data is determined based on different time dimensions; Inputting the attack training data into the network prediction model to be trained, and obtaining the corresponding first behavior prediction result; Based on the difference value between the first behavior prediction result and the first behavior label, the parameters of the network prediction model to be trained are optimized through an optimal follow-up method to obtain a corresponding optimized network prediction model.

5. The method according to claim 4, characterized in that After performing parameter optimization processing on the network prediction model to be trained to obtain a corresponding optimized network prediction model, the method further includes: Input each attack test data in the attack test data set into the optimized network prediction model, and obtain the corresponding second behavior prediction result; wherein the attack test data at least includes: a second behavior label for characterizing whether there is a network attack behavior; the attack test data is determined based on different time dimensions; Matching each second behavior prediction result with the corresponding second behavior label respectively, and determining the accuracy of the optimized network prediction model based on the matching results; Based on the accuracy, the target network prediction model is obtained.

6. The method according to claim 5, characterized in that The obtaining the target network prediction model based on the accuracy includes: When the accuracy is greater than or equal to a preset accuracy threshold, the optimized network prediction model is used as the target network prediction model; or When the accuracy is less than the accuracy threshold and the loop iteration period is greater than the set period threshold, the finally obtained optimized network prediction model is used as the target network prediction model.

7. The method according to claim 1, characterized in that After performing network attack prediction based on the attack prediction data by using the target network prediction model, the method further includes: If the obtained prediction result indicates the existence of network attack behavior, all monitoring data associated with the attack prediction data are forwarded to the cleaning device for cleaning processing through the scheduling system.

8. A network attack prediction device, characterized in that: The device comprises: An acquisition unit, used to acquire real-time monitoring data reported by a network monitoring device; A generating unit, configured to generate aggregated data sets of different time dimensions based on the data volume of the real-time monitoring data, and to generate attack prediction data based on the aggregated data sets; The prediction unit is used to perform network attack prediction based on the attack prediction data through a target network prediction model; wherein the target network prediction model is obtained by training based on the attack training data through an optimal follow-up method.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1-7.

10. A computer-readable storage medium, characterized in that: It comprises a computer program. When the computer program is run on an electronic device, the computer program is used to make the electronic device execute the steps of any one of the methods of claims 1-7.

11. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the steps of any one of the methods as claimed in claims 1 to 7.

Images