Method and device for detecting botnet of Internet of Things, and storage medium
By using the feature vector of the TCP packet payload length value for detection, the problem of difficult to identify the IoT botnet in the prior art is solved, and effective detection of unknown and encrypted IoT botnets is achieved, which reduces detection cost and implementation difficulty.
Patent Information
- Application Number
- CN202411786303.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-05
- Publication Date
- 2025-02-28
AI Technical Summary
The prior art is difficult to effectively detect and identify IoT botnets, especially encrypted traffic and unknown IoT botnets, and the detection cost is high and the implementation is difficult.
By recording the payload length value of the TCP packet, it can effectively detect unknown IoT botnets and encrypted IoT botnets without relying on known malicious traffic characteristics and are not affected by encrypted traffic.
Effective detection of IoT botnets is realized, the detection cost and implementation difficulty is reduced, and unknown and encrypted IoT botnets can be identified without relying on known features and encrypted traffic.
Smart Images
Figure CN119544362A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security, and more particularly to a method, device and storage medium for detecting an Internet of Things botnet. Background Art
[0002] With the advent of the 5G era, the number of various IoT devices has increased dramatically. At the same time, since the Mirai source code was leaked in 2016, botnets targeting IoT devices have emerged one after another. IoT botnets refer to millions of non-cooperative IoT devices that are remotely controlled by attackers. Among them, the infected devices are called bots. The controller (botmaster) can conduct one-to-many control of the bots through the command and control (C&C, command and control, referred to as C2) channel, and control many bots to launch distributed denial of service (DDoS) attacks on designated targets. In this case, IoT devices become accomplices of attackers in launching large-scale DDoS attacks, which will greatly consume network bandwidth, paralyze the enterprise network, and affect the normal operation of the enterprise.
[0003] In the related technologies, the detection schemes for IoT botnets include C2 communication traffic feature detection, abnormal traffic detection, and machine learning traffic analysis. Among them, feature detection based on C2 communication traffic requires manual maintenance of a known precise matching rule base, which has high maintenance costs and cannot identify encrypted traffic and unknown IoT botnets. Anomaly detection must first establish an accurate normal traffic baseline, but IoT devices are highly heterogeneous and vary greatly in types, making it almost impossible to establish a unified normal traffic baseline, and the technical implementation is difficult. Machine learning algorithms rely on a large amount of high-quality data for training, and training still requires the extraction of a certain amount of feature data. To obtain feature data, it is necessary to collect a large amount of data for various IoT devices, which is a huge workload. Summary of the invention
[0004] Embodiments of the present application provide a method, device, and storage medium for detecting an Internet of Things botnet.
[0005] A method for detecting an Internet of Things botnet, comprising: Determine the device that initiates the DDoS attack in the IoT and obtain the device to be detected; Obtain the TCP data packets sent and received by each device to be detected before launching a DDoS attack to obtain sampling data; Obtain at least two groups of feature vectors of the sampled data; wherein the source address, destination address, source port and destination port of each group of feature vectors are different, and wherein each group of feature vectors records the length value of the payload of the TCP data packet corresponding to each in the sampled data in chronological order; Calculating the matching degree between each set of feature vectors and a preset reference feature vector, wherein the matching degree is used to indicate whether the TCP data packet corresponding to the feature vector is normal traffic; Selecting a feature vector indicating abnormal traffic with a matching degree to obtain a first screening vector; A botnet detection operation is performed on each device to be confirmed, wherein the IP address used by the device to be confirmed to access the Internet of Things is the source address corresponding to the first screening vector.
[0006] A device for detecting an Internet of Things botnet, comprising: A DDoS detection module is configured to determine a device initiating a DDoS attack in the Internet of Things, and obtain a device to be detected; The data collection module is configured to obtain the TCP data packets sent and received by each device to be detected before launching the DDoS attack, and obtain sampling data; A data screening module, configured to obtain at least two groups of feature vectors of the sampled data; wherein the source address, destination address, source port and destination port of each group of feature vectors are different, and wherein each group of feature vectors records the length value of the payload of the TCP data packet corresponding to each in the sampled data in chronological order; A calculation module, configured to calculate a matching degree between each set of feature vectors and a preset reference feature vector, wherein the matching degree is used to indicate whether a TCP data packet corresponding to the feature vector is a normal flow; A selection module is configured to select a feature vector indicating abnormal traffic with a matching degree to obtain a first screening vector; The detection module is configured to perform a botnet detection operation on each device to be confirmed, wherein the IP address used by the device to be confirmed to access the Internet of Things is the source address corresponding to the first screening vector.
[0007] A storage medium, characterized in that a computer program is stored in the storage medium, wherein the computer program is configured to execute the method described above when running.
[0008] The embodiment of the present application uses a feature vector that records the length value of the payload of a TCP data packet to detect an IoT botnet. This does not rely on known malicious traffic features and is not affected by encrypted traffic. It can effectively detect unknown IoT botnets and encrypted IoT botnets.
[0009] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by implementing the present application. Other advantages of the present application can be realized and obtained by the schemes described in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0010] The accompanying drawings are used to provide an understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.
[0011] Figure 1 A schematic diagram of a flow chart of a method for detecting an IoT botnet provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of an apparatus for detecting an IoT botnet provided in an embodiment of the present application. DETAILED DESCRIPTION
[0012] The present application describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present application. Although many possible feature combinations are shown in the drawings and discussed in the specific embodiments, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with any other feature or element in any other embodiment, or may replace any other feature or element in any other embodiment.
[0013] The present application includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The embodiments, features and elements disclosed in the present application may also be combined with any conventional features or elements to form a unique invention scheme. Any features or elements of any embodiment may also be combined with features or elements from other invention schemes to form another unique invention scheme. Therefore, it should be understood that any feature shown and / or discussed in the present application may be implemented individually or in any appropriate combination. Therefore, except for the limitations made according to the attached claims and their equivalents, the embodiments are not subject to other restrictions. In addition, various modifications and changes may be made within the scope of protection of the attached claims.
[0014] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps of the specific order described. As will be understood by those of ordinary skill in the art, other sequences of steps are also possible. Therefore, the specific sequence of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to the steps of performing them in the order written, and those skilled in the art can easily understand that these sequences can be changed and still remain within the spirit and scope of the embodiments of the present application.
[0015] Figure 1 A flow chart of a method for detecting an IoT botnet provided in an embodiment of the present application. Figure 1 As shown, the method includes:
[0016] Step 101: Determine the device that initiates the DDoS attack in the Internet of Things and obtain the device to be detected; Specifically, the traffic of one or more source IP addresses in the Internet of Things can be detected according to a preset DDoS attack detection time window, so as to determine the device that initiates the DDoS attack.
[0017] The size of the detection time window is usually a fixed value, expressed in minutes, and has a value range of (0,60]. In the embodiment of the present application, it can be set to 15 minutes.
[0018] The collected network traffic data is split according to the detection time window and tested one by one. In any detection time window, if the total number of UDP, ICMP, TCP SYN or TCP ACK packets sent by a source IP address to multiple non-internal reserved LAN IP addresses exceeds the sending number threshold, the source IP address is determined to have DDoS attack behavior. For example, the number can be 10,000.
[0019] After confirming that the source IP address has DDoS attack behavior, the device corresponding to the source IP address is recorded as the device to be detected, and the start time of the attack launched by the device to be detected is recorded for further processing.
[0020] Step 102: Obtain the TCP data packets sent and received by each device to be detected before launching the DDoS attack to obtain sample data; Specifically, all TCP protocol-based traffic data generated by the device to be detected earlier than the attack time is extracted from the collected network traffic data, and these traffic data are stored in the database as sampled data, wherein the traffic data includes data sent and received by the device to be detected.
[0021] Step 103: obtaining at least two groups of feature vectors of the sampled data; wherein the source address, destination address, source port and destination port of each group of feature vectors are different, and wherein each group of feature vectors records the length value of the payload of the TCP data packet corresponding to each in the sampled data in chronological order; Specifically, the TCP data packets in the sampled data are classified according to the four-tuple information (source IP address, source port, destination IP address and destination port) and split into at least two groups; from each group, the length value of the payload (Payload) in each TCP data packet in the group is extracted, and the extracted length values of the payload are arranged in sequence according to the sending time of each data packet to form a feature vector FV, and the feature vector FV of each TCP data packet block is obtained, where the feature vector FV can be expressed as FV =[ p 1 , p 2 ,…, p n ] , where n is an integer greater than or equal to 1.
[0022] Step 104: Calculate the matching degree between each set of feature vectors and a preset reference feature vector, wherein the matching degree is used to indicate whether the TCP data packet corresponding to the feature vector is normal traffic; The benchmark feature vector records the length value of the payload in the TCP data packet for covert communication with the C2 server.
[0023] Specifically, the Dynamic Time Warping (DTW) distance algorithm is used to identify C2 communications.
[0024] Specifically, calculate each eigenvector Compare with the baseline feature vectors of pre-defined IoT botnets The DTW distance between the two is used to evaluate the matching degree.
[0025] Eigenvector Contains n elements, the base eigenvector Contains m elements, where m is an integer greater than or equal to 1. Calculate the distance between any two elements in two feature vectors, and all distance values are constructed into a cost matrix D of size (n, m). The calculation expression of DTW distance D(i, j) is:
[0026] Where D(i,j) is The first i components of The accumulated distance value of the first j components of , d(i,j) is The i-th element and The distance value of the jth element. D(i,j-1), D(i-1,j) and D(i-1,j-1) respectively indicate that the last accumulated distance value is the accumulated distance value from the adjacent horizontal, vertical and diagonal directions, and min indicates the minimum value of the three, where 1 ≤ i ≤ n, 1 ≤ j ≤ m, and i and j are integers.
[0027] Among them, the eigenvector and the benchmark characteristic vector The DTW distance between them is the last element D(m,n) of the cost matrix D.
[0028] Step 105, selecting a feature vector whose matching degree indicates abnormal traffic to obtain a first screening vector; Specifically, the matching degree may be compared with a matching degree threshold ε to achieve the purpose of distinguishing normal traffic from potential malicious traffic.
[0029] When the DTW distance is used to represent the matching degree, if the DTW distance is less than the matching degree threshold ε, the subsequent analysis steps are continued. If the DTW distance is not less than the matching degree threshold ε, the feature vector does not enter the subsequent analysis process. Among them, the value of the matching degree threshold ε is 15.
[0030] It should be noted that the present application uses the DTW algorithm to calculate the matching degree of two feature vectors, but is not limited thereto, and other algorithms for calculating the matching degree of two feature vectors in the prior art are also applicable to the present application.
[0031] Step 106: Perform a botnet detection operation on each device to be confirmed, wherein the IP address used by the device to be confirmed to access the Internet of Things is the source address corresponding to the first screening vector.
[0032] The method provided in the embodiment of the present application detects IoT botnets by using a feature vector that records the length value of the payload of a TCP data packet. It does not rely on known malicious traffic features and is not affected by encrypted traffic. It can effectively detect unknown IoT botnets and encrypted IoT botnets.
[0033] Optionally, step 106 includes: Acquire a characteristic vector whose destination address is the C2 server from the first screening vector to obtain a second screening vector; According to the length value in each second screening vector, a target device for covert communication with the C2 server is determined from the devices to be confirmed.
[0034] Among them, the IP address of the C2 server can be obtained in advance.
[0035] In the above steps, the destination address of the C2 server is used as a screening condition, and a second screening vector can be obtained from the first screening vector, wherein each second screening vector records the length value of the payload in the TCP data packet communicated between the source address and the C2 server. By further analyzing the length value corresponding to the second screening vector, it is possible to further accurately determine whether the device to be confirmed is the target device.
[0036] Further, the step of determining, from the devices to be confirmed, a target device for covertly communicating with the C2 server according to the length value in each second screening vector, includes: The following operations are performed on each second screening vector, including: Determine whether each length value in the current second screening vector satisfies a preset first length condition, and obtain a first determination result; wherein the first length condition is determined according to the length value of the effective load in the message format of the C2 communication; If the first judgment result is not satisfied, determining that the device to be confirmed accessing the Internet of Things using the source address corresponding to the current second screening vector is not the target device; If the first judgment result is satisfied, then judging whether the last length value in the second screening vector satisfies a preset second length condition, and obtaining a second judgment result; wherein the second length condition is determined according to the length value of the control instruction issued by the C2 server, wherein the control instruction is used to instruct to launch a DDoS attack on a specified target; If the second judgment result is not satisfied, determining that the device to be confirmed accessing the Internet of Things using the source address corresponding to the current second screening vector is not the target device; If the second judgment result is satisfied, it is determined that the device to be confirmed that accesses the Internet of Things using the source address corresponding to the current second screening vector is the target device.
[0037] Specifically, whether to conduct secret communication with the C2 server is determined according to the communication timing determined by the second screening vector. The reason why it is possible to determine whether to conduct secret communication with the C2 server is that when the device communicates with the C2 server, the data packets between the device and the C2 server need to be transmitted in accordance with the standard message format. Therefore, if there is secret communication between the target device and the C2 server, each length value in the second screening vector meets the first length condition; after determining that there is continuous communication between the device and the C2 server, if the device is implanted with a botnet program, the last data packet between the device and the C2 server is an attack instruction issued by the C2 server to the botnet implanted in the device, and the content of the attack instruction is to instruct the device to launch a DDoS attack on the specified target device. Therefore, if the last length value in the second screening queue meets the second length condition, it is determined that secret communication is conducted with the C2 server.
[0038] Preferably, the first length condition is greater than or equal to 1 and less than or equal to 100; wherein the maximum value of the first length condition can be adjusted according to actual effects.
[0039] Preferably, the second length condition is greater than or equal to 20 and less than or equal to 65; wherein the maximum value of the second length condition can be adjusted according to actual effects.
[0040] Optionally, the method further includes: After determining the target device, obtain the behavior of each target device requesting to remotely log in to the external network device to obtain the access behavior; Determine whether the access behavior of each target device meets the preset illegal access conditions, wherein the illegal access conditions are used to determine whether the access behavior is a brute force attack on the external network device; If the access behavior of any target device meets the illegal access condition, the target device meeting the illegal access condition is identified as a device infected by a botnet.
[0041] In the above implementation, the access behavior of the target device is counted according to a preset time interval, where the time interval is in minutes and has a value range of (0,30], for example, set to 15 minutes.
[0042] The illegal access condition is determined based on the source port, the number of external network devices, and the total number of attempts to establish a TCP connection. For example, the source port is a port of a Telnet service, which can be at least one of port 23 and port 2323, the number of external network devices is 10, and the total number of attempts to establish a TCP connection is 500.
[0043] If the target device initiates more than 500 TCP connection attempts to port 23 or 2323 of more than 10 external IP addresses within 15 minutes, it means that the target device has Telnet weak password brute force cracking behavior, which means that the target device has been compromised and implanted into a botnet.
[0044] The above implementation method determines whether the target device has weak password brute force cracking behavior, determines that the target device has been implanted with a botnet, has received a DDoS command sent by the C2 server, is launching a DDoS attack, and is spreading itself through weak password brute force cracking.
[0045] Based on the above description, it can be seen that the embodiments of the present application have the following advantages, including: (1) It does not rely on the specific traffic characteristics of the IoT botnet when communicating with the C2, but calculates the matching degree based on the length value of the TCP data payload. It does not rely on known malicious traffic characteristics and is not affected by encrypted traffic. It can effectively detect unknown and encrypted IoT botnets. (2) By detecting C2 covert communications, DDoS attacks, and Telnet weak password brute force cracking, it is possible to perform overall detection at all stages of the botnet life cycle, which can greatly improve accuracy and reduce false positive rates; (3) After a DDoS attack is detected, a feature vector is generated based on the length value of the TCP data packet's payload. There is no need to establish a normal traffic baseline for various highly heterogeneous IoT devices in advance, and real-time analysis and detection can be performed directly, which can be better applied on IoT devices. Therefore, compared with the technology based on abnormal traffic detection, the method provided in the embodiment of the present application has stronger adaptability and real-time performance. (4) The detection of botnets is achieved without using machine learning algorithms or establishing new algorithm models. Compared with the traffic analysis technology solution based on machine learning, the method provided in the embodiment of the present application has better performance and is easier to implement. It can be quickly deployed and run efficiently in practical applications.
[0046] Figure 2 A schematic diagram of the structure of the device for detecting an IoT botnet provided in an embodiment of the present application. Figure 2 As shown, the device comprises:
[0047] A DDoS detection module 201 is configured to determine a device initiating a DDoS attack in the Internet of Things and obtain a device to be detected; The data collection module 202 is configured to obtain the TCP data packets sent and received by each device to be detected before launching the DDoS attack, and obtain sampled data; The data screening module 203 is configured to obtain at least two groups of feature vectors of the sampled data; wherein the source address, destination address, source port and destination port of each group of feature vectors are different, and wherein each group of feature vectors records the length value of the payload of the TCP data packet corresponding to each in the sampled data in chronological order; A calculation module 204 is configured to calculate a matching degree between each set of feature vectors and a preset reference feature vector, wherein the matching degree is used to indicate whether a TCP data packet corresponding to the feature vector is a normal flow; A selection module 205 is configured to select a feature vector indicating abnormal traffic with a matching degree to obtain a first screening vector; The detection module 206 is configured to perform a botnet detection operation on each device to be confirmed, wherein the IP address used by the device to be confirmed to access the Internet of Things is the source address corresponding to the first screening vector.
[0048] The device provided in the embodiment of the present application detects IoT botnets using a feature vector that records the length value of the payload of a TCP data packet. It does not rely on known malicious traffic features and is not affected by encrypted traffic. It can effectively detect unknown IoT botnets and encrypted IoT botnets.
[0049] An embodiment of the present application further provides a storage medium, characterized in that a computer program is stored in the storage medium, wherein the computer program is configured to execute the method described above when running.
[0050] An embodiment of the present application also provides an electronic device, including a memory and a processor, wherein the memory and the processor are connected; wherein the memory stores a program, and the processor calls the program in the memory to execute the method described above.
[0051] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transient medium). As is known to those skilled in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.
Claims
1. A method for detecting an Internet of Things botnet, characterized in that: include: Determine the device that initiates the DDoS attack in the IoT and obtain the device to be detected; Obtain the TCP data packets sent and received by each device to be detected before launching a DDoS attack to obtain sampling data; Obtain at least two groups of feature vectors of the sampled data; wherein the source address, destination address, source port and destination port of each group of feature vectors are different, and wherein each group of feature vectors records the length value of the payload of the TCP data packet corresponding to each in the sampled data in chronological order; Calculating the matching degree between each set of feature vectors and a preset reference feature vector, wherein the matching degree is used to indicate whether the TCP data packet corresponding to the feature vector is normal traffic; Selecting a feature vector indicating abnormal traffic with a matching degree to obtain a first screening vector; A botnet detection operation is performed on each device to be confirmed, wherein the IP address used by the device to be confirmed to access the Internet of Things is the source address corresponding to the first screening vector.
2. The method according to claim 1, characterized in that The performing of a botnet detection operation on each device to be confirmed includes: Acquire a characteristic vector whose destination address is the C2 server from the first screening vector to obtain a second screening vector; According to the length value in each second screening vector, a target device for covert communication with the C2 server is determined from the devices to be confirmed.
3. The method according to claim 2, characterized in that The step of determining, from the devices to be confirmed, a target device for covert communication with the C2 server according to the length value in each second screening vector, comprises: The following operations are performed on each second screening vector, including: Determine whether each length value in the current second screening vector satisfies a preset first length condition, and obtain a first determination result; wherein the first length condition is determined according to the length value of the effective load in the message format of the C2 communication; If the first judgment result is not satisfied, determining that the device to be confirmed accessing the Internet of Things using the source address corresponding to the current second screening vector is not the target device; If the first judgment result is satisfied, then judging whether the last length value in the second screening vector satisfies a preset second length condition, and obtaining a second judgment result; wherein the second length condition is determined according to the length value of the control instruction issued by the C2 server, wherein the control instruction is used to instruct to launch a DDoS attack on a specified target; If the second judgment result is not satisfied, determining that the device to be confirmed accessing the Internet of Things using the source address corresponding to the current second screening vector is not the target device; If the second judgment result is satisfied, it is determined that the device to be confirmed that accesses the Internet of Things using the source address corresponding to the current second screening vector is the target device.
4. The method according to claim 3, characterized in that The first length condition is greater than or equal to 1 and less than or equal to 100.
5. The method according to claim 3, characterized in that The second length condition is greater than or equal to 20 and less than or equal to 65.
6. The method according to claim 3, characterized in that The method further comprises: After determining the target device, obtain the behavior of each target device requesting to remotely log in to the external network device to obtain the access behavior; Determine whether the access behavior of each target device meets the preset illegal access conditions, wherein the illegal access conditions are used to determine whether the access behavior is a brute force attack on the external network device; If the access behavior of any target device meets the illegal access condition, the target device meeting the illegal access condition is identified as a device infected by a botnet.
7. The method according to claim 6, characterized in that The illegal access condition is determined based on the source port, the number of external network devices, and the total number of attempts to establish a TCP connection.
8. The method according to any one of claims 1 to 7, characterized in that: The dynamic time warping (DTW) algorithm is used to calculate the matching degree between each set of feature vectors and the preset benchmark feature vectors.
9. A device for detecting an Internet of Things botnet, characterized in that: include: A DDoS detection module is configured to determine a device initiating a DDoS attack in the Internet of Things, and obtain a device to be detected; The data collection module is configured to obtain the TCP data packets sent and received by each device to be detected before launching the DDoS attack, and obtain sampling data; A data screening module, configured to obtain at least two groups of feature vectors of the sampled data; wherein the source address, destination address, source port and destination port of each group of feature vectors are different, and wherein each group of feature vectors records the length value of the payload of the TCP data packet corresponding to each in the sampled data in chronological order; A calculation module, configured to calculate a matching degree between each set of feature vectors and a preset reference feature vector, wherein the matching degree is used to indicate whether a TCP data packet corresponding to the feature vector is a normal flow; A selection module is configured to select a feature vector indicating abnormal traffic with a matching degree to obtain a first screening vector; The detection module is configured to perform a botnet detection operation on each device to be confirmed, wherein the IP address used by the device to be confirmed to access the Internet of Things is the source address corresponding to the first screening vector.
10. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 8 when executed.