Alarm data classification processing method and device for low-frequency high-risk attack alarm identification

Abstract

The invention provides an alarm data classification processing method and device for low-frequency high-risk attack alarm identification, and the method comprises the steps: determining the importance degree of each alarm set based on the attack frequency and the alarm danger level, circularly traversing the first attack service attribute of each alarm set in an attack set, obtaining a target alarm set with the highest importance degree, and obtaining a target alarm set with the highest importance degree; taking the first attack service attribute of the target alarm set as a second attack service attribute of the attack set; progressively sequencing the attack sets of the same source IP address and destination IP address according to starting time attributes to obtain an attack sequence; sorting target attack subsequences with lengths greater than a preset length in the attack sequence according to attack stage attributes and second attack service attributes of the intrusion alarm to obtain the target attack subsequences, performing classification processing on the target attack subsequences by using a suffix-based probability deterministic finite automaton to obtain importance of different attack sets, and determining the attack sequence of the intrusion alarm according to the importance of the attack set. And the accuracy and reliability of attack identification are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data classification processing, and in particular to an alarm data classification processing method and device for low-frequency high-risk attack alarm identification. Background Art

[0002] With the continuous development of information technology, network security has become the focus of attention of various organizations and individuals. Advanced Persistent Threats (APT) attacks pose a huge challenge to network security defense. APT attacks are usually hidden and persistent, and can bypass normal defense mechanisms to monitor and penetrate the target system for a long time, resulting in serious information leakage and system paralysis. Therefore, how to detect and respond to APT attacks in a timely and effective manner has become an important topic in today's network security field. When facing APT attacks, timely and accurate detection of intrusion behavior is crucial to network security.

[0003] However, intrusion detection systems (IDS) often generate a large amount of alarm data, which contains a lot of noise and redundant information. Applying statistical methods to process and analyze such alarm data has the risk of filtering low-frequency but high-risk attack alarm data to a certain extent, resulting in insufficient attack identification accuracy, which brings huge challenges to security operation and maintenance personnel. Summary of the invention

[0004] The present invention provides an alarm data classification processing method and device for low-frequency high-risk attack alarm identification, which is used to solve the defect that the low-frequency but high-risk attack alarm data is easily filtered out to a certain extent when the statistical method is used in the prior art to process and analyze such alarm data, resulting in insufficient attack identification accuracy.

[0005] The present invention provides an alarm data classification processing method for low-frequency high-risk attack alarm identification, comprising the following steps: Processing the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data includes source IP address, source port number, destination IP address, destination port number, intrusion alarm time and alarm signature attributes; Based on the standard intrusion alarm data, determine the attack frequency of each alarm set, and based on the attack frequency and the alarm danger level, determine the importance of each alarm set, loop through the first attack service attribute of each alarm set in the attack set, obtain the target alarm set with the highest importance, and use the first attack service attribute of the target alarm set as the second attack service attribute of the attack set; The attack sets with the same source IP address and destination IP address are sorted in ascending order according to the start time attribute to obtain an attack sequence, and based on the attack sequence, an attack subsequence is determined; The target attack subsequences in the attack sequence whose length is greater than a preset length are sorted according to the attack phase attribute and the second attack service attribute of the intrusion alarm to obtain the target attack subsequences, and the target attack subsequences are classified using a suffix-based probabilistic deterministic finite automaton to obtain the importance of different attack sets.

[0006] According to an alarm data classification processing method for low-frequency high-risk attack alarm identification provided by the present invention, the importance of each alarm set is determined based on the attack frequency and the alarm danger level, including: The importance of each alarm set is determined based on the following formula:

[0007] in, Indicates the importance of each alarm set, Indicates the attack frequency, Indicates the alarm danger level.

[0008] According to an alarm data classification processing method for low-frequency high-risk attack alarm identification provided by the present invention, the attack frequency of each alarm set is determined based on the standard intrusion alarm data, including: Performing repeated alarm filtering on the standard intrusion alarm data to obtain filtered intrusion alarm data; Dividing the filtered intrusion alarm data according to the attack stage of the intrusion alarm to obtain candidate intrusion alarm data; The candidate intrusion alarm data are grouped based on the source IP address and the destination IP address to obtain grouped intrusion alarm data, and the attack frequency of each alarm set is determined based on the grouped intrusion alarm data and a first preset duration.

[0009] According to an alarm data classification processing method for low-frequency high-risk attack alarm identification provided by the present invention, the standard intrusion alarm data is subjected to repeated alarm filtering to obtain filtered intrusion alarm data, including: Query the alarm data having the same source IP address, source port number, destination IP address, destination port number, alarm signature attribute and attack service attribute as those in the standard intrusion alarm data, and whose intrusion alarm time is within the second preset time period; Based on the alarm data, the filtered intrusion alarm data is determined.

[0010] According to an alarm data classification processing method for low-frequency high-risk attack alarm identification provided by the present invention, the alarm danger level is obtained based on the attack stage attribute and the first attack service attribute mapping of the intrusion alarm; the attack stage attribute is obtained based on the alarm signature attribute mapping.

[0011] According to an alarm data classification processing method for low-frequency high-risk attack alarm identification provided by the present invention, the original intrusion alarm data includes the original source IP address, the original destination IP address, the original source port number, the original destination port number, the timestamp, the descriptive signature and the protocol specific field; The processing of the raw intrusion alarm data into standard intrusion alarm data comprises: Determining the source IP address of the standard intrusion alarm data based on the original source IP address; Determining the destination IP address of the standard intrusion alarm data based on the original destination IP address; Based on the original source port number, determining the source port number of the standard intrusion alarm data; Determining the destination port number of the standard intrusion alarm data based on the original destination port number; determining a time of the intrusion alarm of the standard intrusion alarm data based on the timestamp; Based on the descriptive signature, the alarm signature attributes of the standard intrusion alarm data are determined.

[0012] The present invention also provides an alarm data classification processing device for low-frequency high-risk attack alarm identification, comprising the following units: A processing unit, used to process the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data includes a source IP address, a source port number, a destination IP address, a destination port number, a time of the intrusion alarm and an alarm signature attribute; A traversal unit is used to determine the attack frequency of each alarm set based on the standard intrusion alarm data, and determine the importance of each alarm set based on the attack frequency and the alarm danger level, cyclically traverse the attack service attributes of each alarm set in the attack set, obtain the target alarm set with the highest importance, and use the attack service attributes of the target alarm set as the attack service attributes of the attack set; A determination unit, used to sort the attack sets with the same source IP address and destination IP address in ascending order according to the start time attribute to obtain an attack sequence, and determine an attack subsequence based on the attack sequence; The classification processing unit is used to sort the target attack subsequences in the attack sequence whose length is greater than a preset length according to the attack phase attribute and the attack service attribute of the intrusion alarm to obtain the target attack subsequences, and use a suffix-based probabilistic deterministic finite automaton to classify the target attack subsequences to obtain the importance of different attack sets.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an alarm data classification and processing method for identifying low-frequency and high-risk attack alarms as described in any one of the above-mentioned methods is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the alarm data classification processing method for low-frequency high-risk attack alarm identification as described in any one of the above is implemented.

[0015] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned alarm data classification processing methods for low-frequency high-risk attack alarm identification.

[0016] The alarm data classification processing method and device for low-frequency high-risk attack alarm identification provided by the present invention, on the one hand, determine the attack frequency of each alarm set based on standard intrusion alarm data, and determine the importance of each alarm set based on the attack frequency and the alarm danger level, which is different from the statistical method that uses importance to classify and process alarms, ensuring that low-frequency high-risk level alarms are not screened out, thereby improving the accuracy and effect of attack identification and detection; on the other hand, a suffix-based probabilistic finite state automaton model is used to extract the contextual time relationship between attack sequences, optimize the attack sequence classification, and use the high-severity attack stage to be at the end of the attack subsequence (ESS) to reversely learn a suffix model to determine which attacks ultimately lead to the high-severity attack stage, identify the importance of different attack sets, and further improve the accuracy and reliability of attack identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is one of the flow charts of the alarm data classification processing method for low-frequency high-risk attack alarm identification provided by the present invention.

[0019] Figure 2 It is a schematic diagram of the change of attack frequency over time provided by the present invention.

[0020] Figure 3 It is a schematic diagram of the S-PDFA main model of attack identification for alarm classification provided by the present invention.

[0021] Figure 4 It is a schematic diagram of the S-PDFA receiver model for attack identification oriented to alarm classification provided by the present invention.

[0022] Figure 5 It is a schematic diagram of the success rate of attack service identification of the CCDC data set provided by the present invention.

[0023] Figure 6 It is a schematic diagram of the CPTC 2018 data attack service identification success rate provided by the present invention.

[0024] Figure 7 This is the second flow chart of the alarm data classification processing for low-frequency high-risk attack alarm identification provided by the present invention.

[0025] Figure 8 It is a structural schematic diagram of an alarm data classification processing device for low-frequency high-risk attack alarm identification provided by the present invention.

[0026] Fig. 9 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] At present, many data mining and machine learning technologies have emerged in the field of intrusion detection, such as cluster analysis, anomaly detection, deep learning, etc. These technologies have achieved certain results in the field of intrusion detection, but there are still some challenges in the analysis of intrusion alarm data for APT attacks.

[0029] Figure 1 This is one of the flow charts of the alarm data classification processing method for low-frequency high-risk attack alarm identification provided by the present invention, such as Figure 1 As shown, the method includes step 110, step 120, step 130 and step 140.

[0030] Step 110, processing the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data includes source IP address, source port number, destination IP address, destination port number, intrusion alarm time and alarm signature attributes.

[0031] Specifically, the original intrusion alarm data can be obtained and then processed into standard intrusion alarm data. It can be understood that the original intrusion alarm data generally includes attributes such as the original source IP address src_ip, the original destination IP address dst_ip, the original source port number src_port and the original destination port number dst_port, timestamp timestamp, descriptive signature signature and some protocol specific fields, which are not specifically limited in the embodiments of the present invention.

[0032] Considering that different intrusion alarms have different formats, in order to facilitate subsequent processing, the first step is to process the complex intrusion alarm data into a unified format. , which is standard intrusion alarm data.

[0033] Furthermore, the source IP address of the standard intrusion alarm data can be determined based on the original source IP address; the destination IP address of the standard intrusion alarm data can be determined based on the original destination IP address; the source port number of the standard intrusion alarm data can be determined based on the original source port number; the destination port number of the standard intrusion alarm data can be determined based on the original destination port number; the time of the intrusion alarm of the standard intrusion alarm data can be determined based on the timestamp; finally, the alarm signature attributes of the standard intrusion alarm data can be determined based on the descriptive signature.

[0034] That is, loop through each alarm and read the required information. src_ip is the source IP address, src_port is the source port number, dst_ip is the destination IP address, and dst_port is the destination port number. These four attributes can be directly read from the original intrusion alarm data. dt is the time of the intrusion alarm, which can be directly obtained from the timestamp attribute of the original intrusion alarm data. sign is the alarm signature attribute, which is read from the descriptive signature attribute of the original intrusion alarm data.

[0035] After the first step of processing, the format of the original intrusion alarm data is simplified, the processed alarm format is unified, and a large number of useless attributes are deleted. The remaining information is the information required for subsequent processing. The above process belongs to the original alarm label generation method for APT attacks.

[0036] Step 120, based on the standard intrusion alarm data, determine the attack frequency of each alarm set, and based on the attack frequency and the alarm danger level, determine the importance of each alarm set, loop through the first attack service attribute of each alarm set in the attack set, obtain the target alarm set with the highest importance, and use the first attack service attribute of the target alarm set as the second attack service attribute of the attack set.

[0037] Specifically, after the standard intrusion alarm data is obtained, the attack frequency of each alarm set may be determined based on the standard intrusion alarm data.

[0038] Since the importance of each alarm set is related to the attack frequency and alarm danger level of the alarm set, the importance of the alarm set can be calculated based on the attack frequency and alarm danger level of each alarm set in the attack set.

[0039] The importance of each alarm set is determined based on the following formula:

[0040] in, Indicates the importance of each alarm set, Indicates the attack frequency, Indicates the alarm danger level.

[0041] Then, after obtaining the imp attributes of different types of alarm sets in an attack set, the first attack service attribute tServe of each alarm set in the attack set is traversed in a loop to obtain the target alarm set with the highest imp importance, and the first attack service attribute tServe of the target alarm set is used as the second attack service attribute mServe of the attack set. The above process belongs to a classification optimization method for identifying low-frequency and high-risk alarms.

[0042] Step 130, sorting the attack sets with the same source IP address and destination IP address in ascending order according to the start time attribute to obtain an attack sequence, and determining an attack subsequence based on the attack sequence.

[0043] Specifically, different attack sets are obtained through the previous steps. The attack sets with the same source IP address src_ip and destination IP address dst_ip are sorted in ascending order according to the start time attribute st to obtain the attack sequence EpisodeSequence, i.e. ES.

[0044] Then, ES is partitioned into alarm subsequences. First, find the attack set whose mcat attribute of each attack set in ES is more serious than the mcat attribute of the attack set behind it (the attack stage attribute of the intrusion alarm), and represent the former with A and the latter with B. Then, A is regarded as the end of an attack sequence and B is regarded as the beginning of a new attack set. After such splitting, the original ES is divided into multiple subsets, namely EpisodeSubSequence, referred to as ESS. The multiple ESSs obtained by repeated splitting ensure that the alarm start time st attribute and the attack stage mcat attribute of each element are increasing.

[0045] Step 140, sorting the target attack subsequences in the attack sequence whose length is greater than a preset length according to the attack phase attribute and the second attack service attribute of the intrusion alarm to obtain the target attack subsequences, and classifying the target attack subsequences using a suffix-based probabilistic deterministic finite automaton to obtain the importance of different attack sets.

[0046] Specifically, in order to identify the importance of different attack sets, the embodiment of the present invention chooses to use a suffix-based probabilistic finite state automaton for classification. Based on the suffix-based probabilistic deterministic finite automaton (S-PDFA), a suffix model is reversely learned to determine which attack sets ultimately lead to a high-severity attack stage. Take the attack sequence with a length greater than a preset length (the preset length can be 3) from the ESS obtained by the previous operation, arrange the mcat (attack stage attribute of the intrusion alarm) and mService (second attack service attribute) of each different ESS in the original order, and then generate the S-PDFA model according to the following steps: (1) First, use a red box to represent the same root node for all S-PDFAs.

[0047] (2) Loop through the paths derived from the first different (mcat, mServe) in the trace to obtain different states. Each identical (mcat, mServe) is the same path that leads to the same state, represented by a circle. Add two numbers to each square and circle and separate them with #. The number to the left of # is the state number, and the number to the right of # is the number of states.

[0048] (3) Mark the child node with the largest number of states in the same parent node in red, and mark the other nodes in blue. Each path is a (mcat, mServe) pair.

[0049] (4) Loop through the first, second, third, ... (mcat, mServe) pairs of the trace, generate child nodes, and obtain the complete S-PDFA.

[0050] In the generated S-PDFA, all paths with only one or no parent node and one or no child node are collected to obtain the receiver model, and the remaining nodes form the main model. In the S-PDFA model generated by this method, the red state is the state with a relatively high probability, and the blue state is the state with a relatively low probability. In this way, different attack sets are classified, and the attack sets represented by the red state are important, and the attack sets represented by the blue state are not so important. The above process belongs to the attack identification S-PDFA model generation method for alarm classification.

[0051] It can be understood that the embodiments of the present invention, through in-depth analysis of the behavior patterns and attack paths of APT attacks, effectively cluster the alarms based on attack stage extraction, and classify the attack stages based on the S-PDFA model, improve the accuracy and efficiency of intelligent detection of APT intrusions, reduce the workload of security operation and maintenance personnel, and provide an important reference for formulating more effective network security defense strategies.

[0052] The method provided by the embodiment of the present invention, on the one hand, determines the attack frequency of each alarm set based on standard intrusion alarm data, and determines the importance of each alarm set based on the attack frequency and the alarm danger level. This is different from the statistical method that uses importance to classify and process alarms, ensuring that low-frequency and high-danger level alarms are not screened out, thereby improving the accuracy and effect of attack identification and detection; on the other hand, a suffix-based probabilistic finite state automaton model is used to extract the contextual time relationship between attack sequences, optimize the attack sequence classification, and use the fact that the high-severity attack stage is at the end of the ESS to reversely learn a suffix model to determine which attacks ultimately lead to the high-severity attack stage, identify the importance of different attack sets, and further improve the accuracy and reliability of attack identification.

[0053] Based on the above embodiment, the step 120 of determining the attack frequency of each alarm set based on the standard intrusion alarm data includes: Step 121, performing duplicate alarm filtering on the standard intrusion alarm data to obtain filtered intrusion alarm data; Step 122, dividing the filtered intrusion alarm data according to the attack stage of the intrusion alarm to obtain candidate intrusion alarm data; Step 123: grouping the candidate intrusion alarm data based on the source IP address and the destination IP address to obtain grouped intrusion alarm data, and determining the attack frequency of each alarm set based on the grouped intrusion alarm data and a first preset duration.

[0054] Specifically, after the standard intrusion alarm data is obtained, the standard intrusion alarm data may be subjected to repeated alarm filtering to obtain filtered intrusion alarm data.

[0055] Then, the filtered intrusion alarm data is divided according to the attack stage of the intrusion alarm to obtain candidate intrusion alarm data.

[0056] That is, the alarm data after deduplication in the previous step needs further processing. Here, the attack stages of the intrusion alarm are divided, and it is considered that the attack stage of the alarm develops step by step from the low-severity attack stage to the high-severity attack stage. mcat is used to represent the attack stage attribute of the intrusion alarm. The mcat attack stage can be obtained by mapping the sign alarm signature. There is a mapping table from sign to mcat.

[0057] The attacked service can be inferred based on the attacked port of the victim's computer, that is, the specific service attacked by the attacker is mapped from the destination port number dst_port, and the dst_port attribute is mapped to the attack service attribute, which is represented by tserve.

[0058] After the above operation, the alarm label sign and the victim port dst_port are mapped to the attributes required for subsequent processing. At this time, the attributes of each alarm are: The above process belongs to the alert data preprocessing method based on attack stage and label mapping.

[0059] In this step, the contextual correlation between intrusion alarm data needs to be extracted, and the intrusion alarm data needs to be processed into the form of attack sequence.

[0060] Here, we choose the perspective of source IP address and target IP address aggregation to process discrete candidate intrusion alert data into attack sequences: this perspective can show the individual interactions between unique attackers and victims. An alert sequence is a list of alert windows between unique attackers and victims. On this basis, the properties of an attack episode are defined as: , where st and et are the start time and end time of an attack activity, mcat is the attack stage of the attack, and mServe is the main attacked service in the attack.

[0061] The intrusion alarm data obtained in the previous step are grouped according to the source IP address, target IP address and attack stage. The intrusion alarm data in the group have the same src_ip, dst_ip, and mcat attributes, but different dt and tServe attributes. The attack frequency of the alarm in the unit time is calculated based on the first preset time (the first preset time is 2.5 minutes), and the attack frequency attribute of the alarm is obtained. At this time, the alarm set with the same src_ip, dst_ip, tServe, and mcat attributes but different dt in the unit time has the following attributes: .

[0062] Here, it is considered that the rise in attack frequency is the beginning of an attack activity, and the drop in attack frequency to the lowest point is the end of an attack activity. The alarms obtained in the previous step are grouped and traversed through each group. According to the rise and fall of the attack frequency, they are divided into multiple attack episodes. At this time, the properties of each attack episode are: , st is the time when the attack frequency starts to rise, et is the time when the attack frequency drops to the lowest point, mcat is the common attack stage, and mServe represents the second attack service attribute of the attack set. The above process belongs to the alarm data classification method for matching the low-frequency and high-risk alarm attack stage.

[0063] Based on the above embodiment, step 121 includes: Step 1211, querying the alarm data having the same source IP address, source port number, destination IP address, destination port number, alarm signature attribute and attack service attribute as those in the standard intrusion alarm data, and whose intrusion alarm time is within the second preset time period; Step 1212, determining the filtered intrusion alarm data based on the alarm data.

[0064] Specifically, the data processed in the previous step also needs to filter all repeated alarm data that occurs within a 1-second interval, that is, traverse all alarm data, find out the alarms with the same source IP address sIP, source port number dIP, destination IP address sPort, destination port number dPort, alarm signature attribute sign and attack service attribute mcat, and the difference of the time dt attribute of the intrusion alarm is within the second preset time length (the second preset time length is 1 second), and only retain the alarm that occurs for the first time, which is expressed as follows:

[0065] Among them, sIP, dIP, sPort, dPort, sign and mcat represent the Chinese translations of source IP address, source port number, destination IP address, destination port number, alarm signature attributes and attack service attributes respectively.

[0066] Based on the above embodiment, the alarm danger level is obtained based on the attack stage attribute of the intrusion alarm and the first attack service attribute mapping; the attack stage attribute is obtained based on the alarm signature attribute mapping.

[0067] Specifically, the alarm danger level danger is obtained based on the attack stage attribute mcat and the first attack service attribute tServe of the intrusion alarm. The attack stage attribute mcat is obtained based on the alarm signature attribute sign. There is a mapping table from sign to mcat.

[0068] Based on any of the above embodiments, the intrusion alarm data generated by the IDS in the dataset CPTC-2018 is roughly in the following format: {'preview': False, 'offset': 486, 'result': {'_raw': '{"timestamp":"2017-11-04T22:22:53.083381+0000","flow_id":2204912691514208,"in_iface":"eth0","e vent_type":"alert","src_ip":"10.0.254.32","src_port":42083,"dest_ip":"10.0.0.224","dest_port":44

[0069] 5,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2102465,"rev":9,"signature":"GPL NETBIOS SMB-DS IPC$ share access","category":"Generic Protocol Command Decode","severity":3},"app_proto":"smb","payload":"AAAARP9TTUJ1AAAAABgBKA

[0070] AAAAAAAAAAAAAAAAAA1z0CCKhUBP8AAAAAAAEAGQAAXFwxMC4wLjAuMjI0XElQQyQAPz8\\ / Pz8A","stream":0,"packet":"CkM93FziCvjIXXn2CABFAAB8xelAAEAGYZIKAP4gCgAA4KRjAb1wC0htGoHRKYAYAPUTbwAAAQEICuA8j\\ / ICD1okAAAARP9TTUJ1AAAAABgBKAAAAAAAAAAAAAAAAAAA1z0CCKhUBP8AAAA

[0071] AAAEAGQAAXFwxMC4wLjAuMjI0XElQQyQAPz8\\ / Pz8A","packet_info":{"linktype":1}}', '_time': '2017-11-04T18:22:53.083-0400', 'alert.action': 'allowed', 'alert.category': 'Generic Protocol Command Decode', 'alert.gid': '1', 'alert.rev': '9', 'alert.sev

[0072] erity': '3', 'alert.signature': 'GPL NETBIOS SMB-DS IPC$ shareaccess', 'alert.signature_id': '2102465', 'app_proto': 'smb', 'date_hour': '22', 'date_mday': '4', 'date_minute': '22', 'date_month': 'november', 'date_second': '53', 'date_wday': '

[0073] saturday', 'date_year': '2017', 'date_zone': '0', 'dest_ip': '10.0.0.224', 'dest_port': '445', 'event_type': 'alert', 'eventtype': 'nix-all-logs', 'flow_id': '2204912691514208', 'host': 'kalivdi02-n9.nationals.vdi.gothamelections.com', 'in_ifac

[0074] e': 'eth0', 'index': 'ids', 'linecount': '1', 'packet': 'CkM93FziCvjIXXn2CABFAAB8xelAAEAGYZIKAP4gCgAA4KRjAb1wC0htGoHRKYAYAPUTbwAAAQEICuA8j / ICD1okAAAARP9TTUJ1AAAAABgBKAAAAAAAAAAAAAAAAAAA1z0CCKhUBP8AAAAAAAEAGQAAXFwxMC4wLjAuMjI0XElQQyQAPz8 / Pz8A',

[0075] 'packet_info.linktype': '1', 'payload': 'AAAARP9TTUJ1AAAAABgBKAAAAAAAAAAAAAAAAAAA1z0CCKhUBP8AAAAAAAEAGQAAXFwxMC4wLjAuMjI0XElQQyQAPz8 / Pz8A', 'proto': 'TCP', 'punct': '{"":"--::.+","":,"":"","":"","":"...","":,"":"..."','region': 'National', 'sc

[0076] hool': 'Stanford University', 'source': ' / var / log / suricata / alert-json.log', 'sourcetype': 'suricata:alert', 'splunk_server': 'splidx1', 'src_ip': '10.0.254.32', 'src_port': '42083', 'stream': '0', 'team': 'NationalTeam 9', 'timeendpos': '45',

[0077] 'timestamp': '2017-11-04T22:22:53.083381+0000', 'timestartpos': '14'}}

[0078] The alerts in the dataset are uniformly processed into this format

[0079] The data obtained from the previous step has many duplicate alarms. Except for the dt attribute, which is within 1 second, the other attributes src_ip, src_port, dst_ip, dst_port, and sign are the same. In this step, we need to filter all duplicate alarms that occur within 1 second intervals and only keep the first alarm. Next, we get the mcat attribute, which can be mapped from sign, for example: ('10.0.254.30',59481,'10.0.0.23',3306,'ETPOLICYSuspiciousinboundtomySQLport3306',datetime.datetime(2017,11,4,12,47,44,63121,tzinfo=datetime.timezone.utc),6)

[0080] From the previous analysis, we can see that intrusion alarms are uniformly processed into the same format The sIP and sPort are '10.0.254.30', 59481. The dst_ip, dst_port are '10.0.0.23', 3306sign is 'ETPOLICYSuspiciousinboundtomySQLport3306'.

[0081] Table 1.sign to mcat mapping table

[0082] Put the sign attribute into Table 1 for search, and you can get the corresponding attack stage mcat as MicroAttackStage.VULN_DISC.

[0083] According to Table 2, the attack stage ID corresponding to MicroAttackStage.VULN_DISC is 6, and the last attribute of the example is obtained.

[0084] Table 2. Attack phases

[0085] Here, the service that the attacker specifically attacks can be mapped from dst_port and represented by tServe.

[0086] Figure 2 Schematic diagram of the attack frequency variation over time provided by the present invention, such as Figure 2 As shown in the figure, the alarms are grouped according to the source IP, target IP and attack stage, and the frequency of these alarms is shown in the figure. The horizontal axis represents the alarm time in units of 2.5 minutes, and the vertical axis represents the alarm frequency. For example, Figure 2 As shown, Figure 2 It shows the change of intrusion alarm data frequency over time for attacks from source IP 10.0.254.206 on victim IP 10.0.0.20. At the beginning of an attack sequence, there are attacks such as scanning, which have low severity but very frequent attack phases, i.e., mcat attributes. After that, attacks with high severity are carried out, and the frequency begins to decrease. An attack will cause the intrusion alarm frequency to rise first and then fall. From this, we can reversely infer that the intrusion alarm frequency changes with time. The rise is the beginning of an attack activity, and the decrease of the alarm frequency to the bottom is the end of an attack activity. Figure 2 The alarm frequency of the part with time from 0.0 to 7.0 starts to rise from 0.0, which indicates the beginning of an attack set. The alarm frequency drops to the bottom at 7.0, which indicates the end of an attack set. The intrusion alarm data from 0.0 to 7.0 is an attack set. Similarly, the part from 9.0 to 13.0 is also an attack set.

[0087] Then the attack set ES is divided into ESS and modeled using S-PDFA: Take the attack sequences with a length greater than 3 from the ESS obtained by the previous operation, study the mcat and mService attributes of each element, and arrange the mcat and mService of each different ESS in the original order, for example: hostD|httpserD|unknownvulnD|mysql

[0088] hostD|remoteware-clserD|unknownvulnD|mysql

[0089] hostD|wap-wspserD|unknownvulnD|mysql

[0090] hostD|httpserD|unknownvulnD|mysql

[0091] hostD|unknownserD|unknownvulnD|mysql

[0092] bfCred|pop3sserD|unknownvulnD|mysql

[0093] hostD|httpserD|unknownvulnD|mysql

[0094] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0095] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0096] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0097] serD|unknownvulnD|mysqlhostD|us-cliserD|unknownvulnD|mysql

[0098] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0099] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0100] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0101] bfCred|pop3sserD|ag-swimvulnD|mysql

[0102] serD|unknownvulnD|mysqlhostD|http

[0103] serD|unknownvulnD|mysqlhostD|unknownserD|unknownvulnD|mysql

[0104] serD|unknownvulnD|mysqlhostD|httpserD|unknownvulnD|mysql

[0105] vulnD|mysqlhostD|remoteware-clserD|unknownvulnD|mysql

[0106] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0107] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0108] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0109] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0110] serD|unknownvulnD|mysqlhostD|etlservicemgrserD|unknownvulnD|mysql

[0111] serD|unknownvulnD|mysqlhostD|httpserD|unknownvulnD|mysql

[0112] serD|unknownvulnD|mysqlserD|unknownvulnD|mysql

[0113] exfil|httpinfoD|httpvulnD|httphostD|http

[0114] dManip|httprPrivEsc|httpACE|http

[0115] exfil|httpinfoD|httpvulnD|httphostD|http

[0116] dManip|httprPrivEsc|httpACE|http|httpACE|http

[0117] Each line in the example represents an ESS. The elements between ESSs are separated by spaces. Then the mcat attribute in the element is placed on the left side of the | symbol, and the mService attribute is placed on the right side of the | symbol, and then the S-PDFA model is generated.

[0118] Figure 3 is a schematic diagram of the main S-PDFA model for attack identification for alarm classification provided by the present invention, Figure 4 is a schematic diagram of the S-PDFA receiver model for attack identification oriented to alarm classification provided by the present invention, such as Figure 3 , Figure 4 As shown in the figure, the main model generated by the above ESS is as follows Figure 3 , the receiver model is as follows Figure 4 .

[0119] In order to demonstrate the advantages of the APT attack-oriented intrusion alarm data classification processing method proposed in the present invention in generating attack model accuracy, an experiment is proposed to conduct comparative observations on algorithm convergence and algorithm effect. The comparative experimental groups are as follows: a statistical intrusion alarm processing method, that is, the alarms with the highest frequency are screened after alarm classification to generate an alarm set, and a random intrusion alarm processing method, that is, the alarms are randomly screened after alarm classification to generate an alarm set. Experiments are conducted according to the above different selection strategies.

[0120] Figure 5 is a schematic diagram of the success rate of attack service identification of the CCDC data set provided by the present invention, Figure 6 This is a schematic diagram of the CPTC 2018 data attack service identification success rate provided by the present invention, such as Figure 5 , Figure 6 As shown in the figure, the comparison of the attack service identification success rate between the intrusion alarm processing method for low-frequency and high-risk level alarms and the other two methods is shown. After analyzing multiple experimental results, it is not difficult to find that the intrusion alarm processing method for low-frequency and high-risk level has a higher attack service identification success rate than the randomly selected intrusion alarm processing method and the statistical-based intrusion alarm processing method.

[0121] The method provided by the embodiment of the present invention is an intrusion alarm data analysis method based on cluster analysis to improve the detection and response efficiency of APT attacks. By clustering the intrusion alarm data, potential APT attack patterns and behavior characteristics can be discovered, thereby more accurately identifying and locating potential threats.

[0122] Figure 7This is the second flow chart of the alarm data classification process for low-frequency high-risk attack alarm identification provided by the present invention. Figure 7 As shown, the embodiment of the present invention designs an intrusion alarm data classification and processing method, which is mainly divided into four steps: an original alarm label generation method for APT attacks, an alarm data preprocessing method based on attack stages and label mapping, an alarm data classification method for low-frequency and high-risk level alarm attack stage matching, and an attack identification S-PDFA model generation method for alarm classification.

[0123] The alarm data classification and processing device for low-frequency high-risk attack alarm identification provided by the present invention is described below. The alarm data classification and processing device for low-frequency high-risk attack alarm identification described below and the alarm data classification and processing method for low-frequency high-risk attack alarm identification described above can be referenced to each other.

[0124] Based on any of the above embodiments, Figure 8 : is a schematic diagram of the structure of the alarm data classification processing device for low-frequency high-risk attack alarm identification provided by the present invention, such as Figure 8 As shown, the device comprises: The processing unit 810 is used to process the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data includes a source IP address, a source port number, a destination IP address, a destination port number, a time of the intrusion alarm and an alarm signature attribute; The traversal unit 820 is used to determine the attack frequency of each alarm set based on the standard intrusion alarm data, and determine the importance of each alarm set based on the attack frequency and the alarm danger level, cyclically traverse the attack service attributes of each alarm set in the attack set, obtain the target alarm set with the highest importance, and use the attack service attributes of the target alarm set as the attack service attributes of the attack set; A determination unit 830, configured to sort the attack sets with the same source IP address and destination IP address in ascending order according to the start time attribute to obtain an attack sequence, and determine an attack subsequence based on the attack sequence; The classification processing unit 840 is used to sort the target attack subsequences in the attack sequence whose length is greater than a preset length according to the attack phase attribute and the attack service attribute of the intrusion alarm to obtain the target attack subsequences, and use a suffix-based probabilistic deterministic finite automaton to classify the target attack subsequences to obtain the importance of different attack sets.

[0125] The device provided by the embodiment of the present invention, on the one hand, determines the attack frequency of each alarm set based on standard intrusion alarm data, and determines the importance of each alarm set based on the attack frequency and the alarm danger level, which is different from the statistical method that classifies and processes alarms by importance, ensuring that low-frequency and high-danger level alarms are not screened out, thereby improving the accuracy and effect of attack identification and detection; on the other hand, a suffix-based probabilistic finite state automaton model is used to extract the contextual time relationship between attack sequences, optimize the attack sequence classification, and use the fact that the high-severity attack stage is at the end of the ESS to reversely learn a suffix model to determine which attacks ultimately lead to the high-severity attack stage, identify the importance of different attack sets, and further improve the accuracy and reliability of attack identification.

[0126] Based on any of the above embodiments, the traversal unit 820 is specifically configured to: The importance of each alarm set is determined based on the following formula:

[0127] in, Indicates the importance of each alarm set, Indicates the attack frequency, Indicates the alarm danger level.

[0128] Based on any of the above embodiments, the traversal unit 820 is specifically configured to: A duplicate alarm filtering unit, used for performing duplicate alarm filtering on the standard intrusion alarm data to obtain filtered intrusion alarm data; A division unit, used for dividing the filtered intrusion alarm data according to the attack stage of the intrusion alarm to obtain candidate intrusion alarm data; The attack frequency determination unit is used to group the candidate intrusion alarm data based on the source IP address and the destination IP address to obtain grouped intrusion alarm data, and determine the attack frequency of each alarm set based on the grouped intrusion alarm data and a first preset duration.

[0129] Based on any of the above embodiments, the duplicate alarm filtering unit is specifically used for: Query the alarm data having the same source IP address, source port number, destination IP address, destination port number, alarm signature attribute and attack service attribute as those in the standard intrusion alarm data, and whose intrusion alarm time is within the second preset time period; Based on the alarm data, the filtered intrusion alarm data is determined.

[0130] Based on any of the above embodiments, the alarm danger level is obtained based on the attack stage attribute of the intrusion alarm and the first attack service attribute mapping; the attack stage attribute is obtained based on the alarm signature attribute mapping.

[0131] Based on any of the above embodiments, the original intrusion alarm data includes the original source IP address, the original destination IP address, the original source port number, the original destination port number, the timestamp, the descriptive signature and the protocol specific field; The processing unit 810 is specifically configured to: Determining the source IP address of the standard intrusion alarm data based on the original source IP address; Determining the destination IP address of the standard intrusion alarm data based on the original destination IP address; Based on the original source port number, determining the source port number of the standard intrusion alarm data; Determining the destination port number of the standard intrusion alarm data based on the original destination port number; determining a time of the intrusion alarm of the standard intrusion alarm data based on the timestamp; Based on the descriptive signature, the alarm signature attributes of the standard intrusion alarm data are determined.

[0132] Fig. 9 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Fig. 9As shown, the electronic device may include: a processor (processor) 910 , a communication interface (Communications Interface) 920 , a memory (memory) 930 and a communication bus 940 , wherein the processor 910 , the communication interface 920 , and the memory 930 communicate with each other through the communication bus 940 . The processor 910 can call the logic instructions in the memory 930 to execute the alarm data classification processing method for low-frequency high-risk attack alarm identification, the method comprising: processing the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data includes a source IP address, a source port number, a destination IP address, a destination port number, the time of the intrusion alarm and an alarm signature attribute; based on the standard intrusion alarm data, determining the attack frequency of each alarm set, and based on the attack frequency and the alarm danger level, determining the importance of each alarm set, looping through the first attack service attribute of each alarm set in the attack set, obtaining the target alarm set with the highest importance, and using the first attack service attribute of the target alarm set as the second attack service attribute of the attack set; sorting the attack sets with the same source IP address and destination IP address in ascending order according to the start time attribute to obtain an attack sequence, and determining an attack subsequence based on the attack sequence; sorting the target attack subsequence in the attack sequence whose length is greater than a preset length according to the attack stage attribute and the second attack service attribute of the intrusion alarm to obtain a target attack subsequence, and using a probabilistic deterministic finite automaton based on suffixes to classify the target attack subsequences to obtain the importance of different attack sets.

[0133] In addition, the logic instructions in the above-mentioned memory 930 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0134] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the alarm data classification processing method for low-frequency and high-risk attack alarm identification provided by the above methods, the method including: processing the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data includes a source IP address, a source port number, a destination IP address, a destination port number, the time of the intrusion alarm and an alarm signature attribute; based on the standard intrusion alarm data, determining the attack frequency of each alarm set, and based on the attack frequency and the alarm danger level, determining the importance of each alarm set, looping through the first attack service attribute of each alarm set in the attack set to obtain the target alarm set with the highest importance, and using the first attack service attribute of the target alarm set as the second attack service attribute of the attack set; for the same source IP The attack sets of the address and the destination IP address are sorted in ascending order according to the start time attribute to obtain an attack sequence, and based on the attack sequence, an attack subsequence is determined; the target attack subsequences in the attack sequence whose length is greater than a preset length are sorted according to the attack phase attribute and the second attack service attribute of the intrusion alarm to obtain a target attack subsequence, and a probabilistic deterministic finite automaton based on suffixes is used to classify the target attack subsequences to obtain the importance of different attack sets.

[0135] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the alarm data classification processing method for low-frequency and high-risk attack alarm identification provided by the above-mentioned methods, the method comprising: processing the original intrusion alarm data into standard intrusion alarm data; the standard intrusion alarm data comprises a source IP address, a source port number, a destination IP address, a destination port number, the time of the intrusion alarm and an alarm signature attribute; based on the standard intrusion alarm data, determining the attack frequency of each alarm set, and based on the attack frequency and the alarm danger level, determining the importance of each alarm set, looping through the first attack service attribute of each alarm set in the attack set to obtain a target alarm set with the highest importance, and using the first attack service attribute of the target alarm set as the second attack service attribute of the attack set; for the same source IP The attack sets of the address and the destination IP address are sorted in ascending order according to the start time attribute to obtain an attack sequence, and based on the attack sequence, an attack subsequence is determined; the target attack subsequences in the attack sequence whose length is greater than a preset length are sorted according to the attack phase attribute and the second attack service attribute of the intrusion alarm to obtain a target attack subsequence, and a probabilistic deterministic finite automaton based on suffixes is used to classify the target attack subsequences to obtain the importance of different attack sets.

[0136] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0137] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for classifying and processing alarm data for identifying low-frequency high-risk attack alarms, characterized in that: include: Processing raw intrusion alarm data into standard intrusion alarm data; The standard intrusion alarm data includes source IP address, source port number, destination IP address, destination port number, time of intrusion alarm and alarm signature attributes; Based on the standard intrusion alarm data, determine the attack frequency of each alarm set, and based on the attack frequency and the alarm danger level, determine the importance of each alarm set, loop through the first attack service attribute of each alarm set in the attack set, obtain the target alarm set with the highest importance, and use the first attack service attribute of the target alarm set as the second attack service attribute of the attack set; The attack sets with the same source IP address and destination IP address are sorted in ascending order according to the start time attribute to obtain an attack sequence, and based on the attack sequence, an attack subsequence is determined; The target attack subsequences in the attack sequence whose length is greater than a preset length are sorted according to the attack phase attribute and the second attack service attribute of the intrusion alarm to obtain the target attack subsequences, and the target attack subsequences are classified using a suffix-based probabilistic deterministic finite automaton to obtain the importance of different attack sets.

2. The alarm data classification processing method for low-frequency high-risk attack alarm identification according to claim 1 is characterized in that: The determining the importance of each alarm set based on the attack frequency and the alarm danger level includes: The importance of each alarm set is determined based on the following formula: in, Indicates the importance of each alarm set, Indicates the attack frequency, Indicates the alarm danger level.

3. The alarm data classification processing method for low-frequency high-risk attack alarm identification according to claim 1 is characterized in that: The determining the attack frequency of each alarm set based on the standard intrusion alarm data includes: Performing repeated alarm filtering on the standard intrusion alarm data to obtain filtered intrusion alarm data; Dividing the filtered intrusion alarm data according to the attack stage of the intrusion alarm to obtain candidate intrusion alarm data; The candidate intrusion alarm data are grouped based on the source IP address and the destination IP address to obtain grouped intrusion alarm data, and the attack frequency of each alarm set is determined based on the grouped intrusion alarm data and a first preset duration.

4. The alarm data classification processing method for low-frequency high-risk attack alarm identification according to claim 3 is characterized in that: The step of performing repeated alarm filtering on the standard intrusion alarm data to obtain filtered intrusion alarm data includes: Query the alarm data having the same source IP address, source port number, destination IP address, destination port number, alarm signature attribute and attack service attribute as those in the standard intrusion alarm data, and whose intrusion alarm time is within the second preset time period; Based on the alarm data, the filtered intrusion alarm data is determined.

5. The alarm data classification processing method for low-frequency high-risk attack alarm identification according to any one of claims 1 to 4, characterized in that: The alarm danger level is obtained based on the attack phase attribute of the intrusion alarm and the first attack service attribute mapping; the attack phase attribute is obtained based on the alarm signature attribute mapping.

6. The alarm data classification processing method for low-frequency high-risk attack alarm identification according to any one of claims 1 to 4, characterized in that: The original intrusion alert data includes the original source IP address, the original destination IP address, the original source port number, the original destination port number, the timestamp, the descriptive signature, and the protocol specific fields; The processing of the raw intrusion alarm data into standard intrusion alarm data comprises: Determining the source IP address of the standard intrusion alarm data based on the original source IP address; Determining the destination IP address of the standard intrusion alarm data based on the original destination IP address; Based on the original source port number, determining the source port number of the standard intrusion alarm data; Determining the destination port number of the standard intrusion alarm data based on the original destination port number; determining a time of the intrusion alarm of the standard intrusion alarm data based on the timestamp; Based on the descriptive signature, the alarm signature attributes of the standard intrusion alarm data are determined.

7. An alarm data classification and processing device for low-frequency high-risk attack alarm identification, characterized in that: include: A processing unit, used for processing raw intrusion alarm data into standard intrusion alarm data; The standard intrusion alarm data includes source IP address, source port number, destination IP address, destination port number, time of intrusion alarm and alarm signature attributes; A traversal unit is used to determine the attack frequency of each alarm set based on the standard intrusion alarm data, and determine the importance of each alarm set based on the attack frequency and the alarm danger level, cyclically traverse the attack service attributes of each alarm set in the attack set, obtain the target alarm set with the highest importance, and use the attack service attributes of the target alarm set as the attack service attributes of the attack set; A determination unit, configured to sort the attack sets with the same source IP address and destination IP address in ascending order according to the start time attribute to obtain an attack sequence, and determine an attack subsequence based on the attack sequence; The classification processing unit is used to sort the target attack subsequences in the attack sequence whose length is greater than a preset length according to the attack phase attribute and the attack service attribute of the intrusion alarm to obtain the target attack subsequences, and use a suffix-based probabilistic deterministic finite automaton to classify the target attack subsequences to obtain the importance of different attack sets.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the alarm data classification processing method for low-frequency high-risk attack alarm identification as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the alarm data classification processing method for low-frequency high-risk attack alarm identification as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the alarm data classification processing method for low-frequency high-risk attack alarm identification as described in any one of claims 1 to 6 is implemented.

Images