Intelligent judgment method, system and equipment for security event, and medium

Abstract

The invention belongs to the technical field of network security, and particularly relates to an intelligent judgment method, system and device for a security event and a medium, and the method comprises the steps: collecting and analyzing a security log of a product object; classifying and aggregating the analyzed security logs to generate a security event with multi-dimensional information; and for each security event, calculating a true and effective judgment value of the security event according to the historical judgment success rate of the security events of the same kind so as to judge whether the security event is a true event or not. According to the method, the event judgment efficiency and accuracy are improved by using manual feedback during initial deployment, then the state of self-evolution learning and manual participation assistance is entered, the method can be suitable for different scenes and assist safety management personnel in working, the task load of working is greatly reduced, and the working efficiency is correspondingly improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an intelligent determination method, system, device, and medium for security events. Background Art

[0002] Security events are related records, alarms and data associated with security risks when they occur. However, in actual applications, various security products, such as firewalls, application firewalls, IDS / IPS and other devices, often generate corresponding logs for alarms based on their own security functions. Therefore, security managers often face the problem of large security logs, unclear data and scattered data. This seriously affects the efficiency of security managers in early warning, handling and tracing when real security events occur, and they are unable to truly perceive the actual threats to the security management objects.

[0003] In this regard, security managers usually redefine security events according to their own understanding, and aggregate the logs of various security products into records with higher dimensions and richer information according to established rules. For this multi-dimensional information body, how to intelligently identify its authenticity and validity as a security event is an urgent problem to be solved. Summary of the invention In view of the shortcomings of the prior art mentioned above, the purpose of the present invention is to use the AI ​​big model to intelligently identify the authenticity and effectiveness of security incidents, thereby assisting the work of security managers, greatly reducing the workload and correspondingly improving work efficiency.

[0004] To achieve the above-mentioned purpose and other related purposes, the present invention provides an intelligent determination method for security incidents, comprising: collecting and parsing the security logs of product objects; classifying and aggregating the parsed security logs to generate security incidents with multi-dimensional information; for each security incident, calculating the true and effective determination value of the security incident based on the historical determination success rate of similar security incidents to determine whether the security incident is a real incident.

[0005] According to a specific embodiment of the present invention, the step of calculating the authenticity and validity judgment value of the security event based on the historical judgment success rate of similar security events to determine whether the security event is a real event includes: using an AI big model to calculate the authenticity and validity judgment value of the security event based on the historical judgment success rate of similar security events: if the authenticity and validity judgment value exceeds a preset threshold, the security event is preliminarily judged to be a real event; otherwise, the security event is preliminarily judged to be a false event; and the preliminary judgment result of the AI ​​big model is fed back to the user for further confirmation to obtain the final judgment result.

[0006] According to a specific embodiment of the present invention, the step of feeding back the preliminary judgment result of the AI ​​large model to the user for further confirmation to obtain the final judgment result includes: when the judgment result fed back by the user is not received within the preset time, taking the preliminary judgment result as the final judgment result; when the modification suggestions of the user are received within the preset time, taking the judgment result fed back by the user as the final judgment result.

[0007] According to a specific embodiment of the present invention, it also includes: optimizing the AI ​​big model based on the security event and the corresponding final judgment result.

[0008] According to a specific embodiment of the present invention, the step of calculating the determination value of the authenticity of the security event based on the historical determination success rate of similar security events includes: calculating the historical determination success rate of the security event with respect to similar security events as a first weight parameter based on the number of historical occurrences of similar security events of the security event and the correct number of times the AI ​​big model is used to determine whether each security event is a real event; and calculating the determination value of the authenticity of the security event based on the first weight parameter.

[0009] According to a specific embodiment of the present invention, the step of calculating the determination value of whether the security event is true or valid based on the first weight parameter includes: calculating the importance index of the security event according to the severity level of the security event as the second weight parameter; and calculating the determination value of whether the security event is true or valid based on the first weight parameter and the second weight parameter.

[0010] According to a specific embodiment of the present invention, the step of calculating the determination value of whether the security event is true and valid based on the first weight parameter and the second weight parameter includes: calculating the frequency index of the security event as a third weight parameter based on the number of times the security event occurs within a preset time and a preset maximum number threshold; and calculating the determination value of whether the security event is true and valid based on the first weight parameter, the second weight parameter, and the third weight parameter.

[0011] According to a specific embodiment of the present invention, the step of calculating the true and valid judgment value of the security event based on the first weight parameter, the second weight parameter, and the third weight parameter includes: identifying whether the security event is high risk according to whether the target field of each security log in the security event hits the corresponding field value in the preset threat intelligence library: when the security event is high risk, the true and valid judgment value of the security event is greater than the preset threshold; when the security event is not high risk, the true and valid judgment value of the security event is calculated based on the first weight parameter, the second weight parameter, and the third weight parameter.

[0012] An intelligent determination system for security events, comprising: a log parsing module for collecting and parsing security logs of product objects; a log aggregation module for classifying and aggregating the parsed security logs to generate security events with multi-dimensional information; a security event determination module for calculating, for each security event, a true and effective determination value of the security event based on the historical determination success rate of similar security events, so as to determine whether the security event is a real event.

[0013] An electronic device includes a processor, wherein the processor is coupled to a memory, and the memory stores program instructions. When the program instructions stored in the memory are executed by the processor, the above-mentioned method is implemented.

[0014] A computer-readable storage medium includes a program. When the program is run on a computer, the computer executes the method described above.

[0015] The present invention provides an intelligent determination method for security incidents. The method uses manual feedback during initial deployment to improve the efficiency and accuracy of event determination, and then enters a self-evolutionary learning and manual participation auxiliary state. The method can be applied to different scenarios to assist security management personnel in their work, greatly reducing the workload and correspondingly improving work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a specific embodiment of an intelligent determination method for security events provided by the present invention; Figure 2 A schematic diagram of a structure of a specific embodiment of an intelligent determination system for security events provided by the present invention; Figure 3 The present invention provides a structural block diagram of a specific embodiment of an electronic device. DETAILED DESCRIPTION

[0017] In order to facilitate understanding of the present application, the present application will be described more fully below with reference to the relevant drawings. Embodiments of the present application are provided in the drawings. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0019] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0020] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0021] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0022] Example 1 See also Figure 1 The intelligent determination method of a security event shown includes: Step S100, collecting and parsing the security log of the product object.

[0023] Step S200, classifying and aggregating the parsed security logs to generate security events with multi-dimensional information.

[0024] Step S300, for each security event, a determination value of the authenticity and validity of the security event is calculated based on the historical determination success rate of similar security events, so as to determine whether the security event is a real event.

[0025] First, the security logs of product objects need to be collected and parsed. It is understandable that since the network security monitoring platform manages security products of different categories from different manufacturers, the security logs generated by the product objects are collected and obtained accordingly. After that, the AI ​​big model in the network security monitoring platform can be used to intelligently parse the security logs, or the security manager can assist the network security monitoring platform in log parsing. For example, the security manager inputs the corresponding regular expression according to the corresponding type of security log, so that the network security monitoring platform can rely on the regular expression to parse the security log and generate the corresponding parsing results, or the security manager matches the fields in the security log with the preset field template, so that the network security monitoring platform can perform field mapping based on the matching results, etc. There are no excessive restrictions on the log parsing method, including but not limited to the above, for example, it can also be combined with the above two parsing methods, that is, using the AI ​​big model for intelligent parsing, and feedback to the security manager for review and confirmation. The modifications and embellishments made to the embodiments of the present invention by the technicians in this field without departing from the spirit of the present invention still fall within the scope of the invention application of the present invention. Finally, the successfully parsed security log is stored in the database.

[0026] Furthermore, in order to avoid the problems of large data volume, data dispersion, data duplication, etc. caused by massive logs, it is also necessary to classify and aggregate the successfully parsed security logs to superimpose the related security logs, thereby forming a security event that aggregates multi-dimensional information, and finally sends it to the security management personnel for processing. The classification and aggregation of security logs can be customized according to actual needs. For example, for some simple events, security logs containing the same target field can be classified into one category. For some frequency events, security logs generated by the same IP with high frequency can be classified into one category. For some diverse events, security logs of the same type can be classified into one category, etc., or security logs can be aggregated according to other established rules. Without making too many restrictions on this, the modifications and embellishments made to the embodiments of the present invention by those skilled in the art without departing from the spirit of the present invention still fall within the scope of the invention application of the present invention.

[0027] Based on the above, the authenticity and effectiveness of the generated security events need to be identified to ensure that the measures taken by the subsequent security managers can solve the problems of the corresponding product objects. In this regard, this embodiment comprehensively evaluates whether the security event is a real event based on the severity of the security event, the number of occurrences within a specific period of time, and the query and judgment results of the threat intelligence system on the attack source, as well as the handling feedback of similar security events in the past.

[0028] Specifically, for a security incident, the historical judgment success rate of similar security incidents is calculated, that is, the handling feedback of the above-mentioned historical similar security incidents is used as the first weight parameter, the importance index is calculated, that is, the severity is calculated as the second weight parameter, the frequency index is calculated, that is, the number of occurrences within the above-mentioned specific time is used as the third weight parameter, and whether the target field of each security log hits the corresponding field value in the preset threat intelligence library to identify whether the security incident is high-risk, that is, the query judgment result of the above-mentioned threat intelligence system on the attack source is used as the fourth weight parameter, so as to comprehensively calculate the judgment value of the security incident by combining the first weight parameter, the second weight parameter, the third weight parameter, and the fourth weight parameter, and then identify whether the security incident is a real incident.

[0029] In one embodiment, the calculation formula of the determination value is as follows: , in, Indicates the true and effective judgment value of a security event x, Indicates the importance of security events. Represents the frequency index of security events, Indicates the threat intelligence query index of the security event, that is, whether the target field of each security log in the security event hits the corresponding field value in the preset threat intelligence library. It represents the feedback index of similar security incidents in history, that is, it refers to the historical judgment success rate of similar security incidents.

[0030] For important indexes It can be further expressed as: , Indicates the severity of the current security incident, which can be divided into multiple severity levels in advance, corresponding to arrive (For example, it can be set to 5 levels: normal, low risk, medium risk, high risk, and severe risk). It indicates the weight parameter of the severity level corresponding to the current security incident. For example, the lower the level, the smaller the weight parameter can be set, and the higher the level, the larger the weight parameter can be set. As a result, when the severity of the security incident is higher, the corresponding importance index will also be larger. There are no excessive restrictions on how to set the weight parameters, and they can be customized according to actual needs.

[0031] As for how to identify the severity of a security incident, there are no excessive restrictions. For example, whether the security incident needs to be focused on can be determined by the label carried by the security incident, or the type of the security incident, etc. In this regard, the severity levels of different security incidents can be pre-set according to actual needs or the operating conditions that need to be focused on for different product objects, or rules for identifying the severity of security incidents. Without departing from the spirit of the present invention, modifications and improvements made to the embodiments of the present invention by those skilled in the art still fall within the scope of the invention application of the present invention.

[0032] For frequency index It can be further expressed as: , Indicates the number of times the current security event occurs within the preset time T. It indicates the maximum number of times the security event occurs within the preset time T. In this regard, the more times the security event occurs within the preset time T, the larger the corresponding frequency index will be.

[0033] For threat intelligence query index It can be further expressed as: , Specifically, it is to query whether the field value corresponding to the target field of each security log in a security event hits the field value set for the target field in the threat intelligence library. If it hits, it means that the security event has a high risk, and the corresponding threat intelligence query index That is, 1. If no hit occurs, it means that the security incident has a low risk. The corresponding threat intelligence query index is That is 0. Of course, the target fields to be queried for different security events will be different. For example, for security events with different flows, the corresponding entry IP or exit IP can be queried. Therefore, the target fields to be queried can be pre-set for different types of security events to identify their corresponding threat intelligence query index. In addition, if the target field to be queried does not exist in the security incident, it is also considered to be low risk, that is, the threat intelligence query index is 0.

[0034] For the feedback index It can be further expressed as: , Indicates the number of correct judgments of whether the same type of security event as the current security event is a real event. Indicates the number of times the same security event as the current security event has occurred in history. For the same security event, you can refer to the following: security events of attack type (such as WEB attack, DDoS attack, virus attack, etc.), security events with the same attack source, security events with the same attack target, etc.

[0035] It should be noted here that in this embodiment, the above method is executed by using the AI ​​big model, that is, the security event is input into the AI ​​big model to output the corresponding result of whether it is a real event, and then the result output by the AI ​​big model is fed back to the security manager for manual confirmation to confirm whether the result output by the AI ​​big model is wrong, that is, the result output by the AI ​​big model of whether the AI ​​big model is a real event is the preliminary judgment result, and the result of whether the AI ​​big model is a real event after confirmation or modification by the security manager is the final result. Therefore, when the security manager changes the result output by the AI ​​big model, it means that the result of whether the security event is a real event determined by the AI ​​big model is wrong, that is, the judgment fails, and it cannot be counted in the number of correct judgments.

[0036] It can be seen that through the feedback index It can show the accuracy of the AI ​​big model's judgment. When the AI ​​big model is used to determine whether a security incident is a real incident, the more successful the number of times, the corresponding feedback index The larger the value, the higher the judgment value corresponding to the security event. When the number of successful times of using the AI ​​big model to determine whether a security event is a real event is small, the corresponding feedback index The smaller it is, the smaller the judgment value corresponding to the security incident is. Through the feedback loop, the accuracy of the AI ​​big model in identifying whether the security incident is a real incident is continuously optimized, and the self-learning evolution of the AI ​​big model is realized.

[0037] Finally, based on the judgment value of the security event, it is confirmed whether it is a real event. There are two specific situations: When threat intelligence query index When it is 1, it will be judged automatically directly. , that is, the judgment value exceeds the preset threshold. It can be understood that when the threat intelligence query index of a security event If it is 1, the AI ​​model will directly identify the security incident as a real event.

[0038] When threat intelligence query index When it is 0, the corresponding calculation and identify Whether it exceeds the threshold , that is, only when Only when the security incident is detected is it considered a real incident, otherwise it is a false incident (with a high probability of false alarm, or the urgency is not high and can be ignored).

[0039] Furthermore, the results output by the AI ​​big model are fed back to the security manager for confirmation. If the judgment result fed back by the security manager is not received within the preset time, the preliminary judgment result output by the AI ​​big model is directly used as the final judgment result, which is deemed to be a successful judgment by the AI ​​big model. If the modification opinions fed back by the security manager are received within the preset time, the judgment result fed back by the user, that is, when the security manager confirms that the result output by the AI ​​big model is correct, is regarded as a successful judgment by the AI ​​big model, and the preliminary judgment result output by the AI ​​big model can be directly used as the final judgment result. When the security manager modifies the result output by the AI ​​big model, it is regarded as a failure of the AI ​​big model judgment, and the result fed back by the security manager is used as the final judgment result. Accordingly, the AI ​​big model can be learned and optimized based on the security incident and its corresponding final judgment result.

[0040] It can be seen that the intelligent judgment method provided in this embodiment improves the efficiency and accuracy of event judgment through manual feedback during the initial deployment, and then enters self-evolutionary learning and manual participation auxiliary state, thereby realizing intelligent judgment of security incidents, reducing the workload of security management personnel, greatly improving event handling efficiency, and being applicable to different scenarios.

[0041] It can also be understood that the security event mentioned in this embodiment is a collection of multiple security logs. Therefore, the above method can also be applied to identify and judge a single security log. The specific settings can be customized according to actual needs. The modifications and improvements made to the embodiments of the present invention by those skilled in the art without departing from the spirit of the present invention still fall within the scope of the invention application of the present invention.

[0042] It should be noted that the step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they contain the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0043] Example 2 See also Figure 2 As shown, this embodiment also provides an intelligent determination system for security events, which is characterized by comprising: The log parsing module 10 is used to collect and parse the security logs of the product objects.

[0044] The log aggregation module 20 is used to classify and aggregate the parsed security logs to generate security events with multi-dimensional information.

[0045] The security event determination module 30 is used to calculate the authenticity and validity determination value of each security event based on the historical determination success rate of similar security events, so as to determine whether the security event is a real event.

[0046] It should be noted that the intelligent determination system for security events provided in the above embodiment and the intelligent determination method for security events provided in the above embodiment 1 belong to the same concept, wherein the specific manner in which each module and unit performs operations has been described in detail in the method embodiment and will not be repeated here. In practical applications, the intelligent determination method for security events provided in the above embodiment 1 can allocate the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0047] Example 3 See also Figure 3 As shown, an embodiment of the present application further provides an electronic device, comprising a memory 2, a processor 1, and a program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above methods when executing the program.

[0048] Among them, the memory includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory can be an internal storage unit of the electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the memory can also be an external storage device of the electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory can also include both an internal storage unit of the electronic device and an external storage device. The memory can not only be used to store application software and various types of data installed in the electronic device, but also can be used to temporarily store data that has been output or is to be output.

[0049] In some embodiments, the processor may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and a combination of various control chips. The processor is the control core (Control Unit) of the electronic device, which connects the various components of the entire electronic device using various interfaces and lines, and executes various functions of the electronic device and processes data by running or executing programs or modules stored in the memory, and calling data stored in the memory.

[0050] The processor executes the operating system of the electronic device and various installed application programs. The processor executes the application programs to implement the steps in the above method embodiment.

[0051] Exemplarily, the program may be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of program instruction segments capable of completing specific functions, which are used to describe the execution process of the program in the electronic device.

[0052] The above-mentioned integrated unit implemented in the form of software function modules can be stored in a computer-readable storage medium. The above-mentioned software function modules are stored in a storage medium and include several instructions for enabling a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to perform part of the functions of various embodiments of the present invention.

[0053] In summary, the present invention provides an intelligent judgment method for security incidents. This method uses manual feedback during initial deployment to improve the efficiency and accuracy of event judgment, and then enters a self-evolutionary learning and manual participation auxiliary state. This method can be applied to different scenarios to assist security management personnel in their work, greatly reducing the workload and correspondingly improving work efficiency.

[0054] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. An intelligent method for determining security events, characterized in that: include: Collect and parse security logs of product objects; Categorize and aggregate the parsed security logs to generate security events with multi-dimensional information; For each security event, a determination value of the authenticity and validity of the security event is calculated based on the historical determination success rate of similar security events to determine whether the security event is a real event.

2. The intelligent determination method for security events according to claim 1, characterized in that: The step of calculating the authenticity and validity determination value of the security event based on the historical determination success rate of similar security events to determine whether the security event is a real event includes: The AI ​​big model is used to calculate the true and effective judgment value of the security incident based on the historical judgment success rate of similar security incidents: If the true and effective determination value exceeds the preset threshold, the security event is preliminarily determined to be a true event; otherwise, the security event is preliminarily determined to be a false event; The preliminary judgment result of the AI ​​large model is fed back to the user for further confirmation to obtain the final judgment result.

3. The intelligent determination method for security events according to claim 2, characterized in that: The steps of feeding back the preliminary determination result of the AI ​​big model to the user for further confirmation to obtain the final determination result include: If no judgment result is received from the user within the preset time, the preliminary judgment result will be used as the final judgment result; When the modification opinions fed back by the user are received within the preset time, the determination result fed back by the user is taken as the final determination result.

4. The intelligent determination method for security events according to claim 2, characterized in that: Also includes: The AI ​​big model is optimized based on the security incident and the corresponding final judgment result.

5. The intelligent determination method of security events according to claim 2, characterized in that: The step of calculating the true and effective determination value of the security event based on the historical determination success rate of similar security events includes: According to the number of similar security events of the security event that have occurred in history, and the number of correct determinations of whether each security event is a real event using the AI ​​big model, the historical determination success rate of the security event with respect to similar security events is calculated as the first weight parameter; A determination value of the authenticity and validity of the security event is calculated based on the first weight parameter.

6. The intelligent determination method of security events according to claim 5, characterized in that: The step of calculating the determination value of the security event being true and valid based on the first weight parameter comprises: Calculating an importance index of the security event according to the severity level of the security event as a second weight parameter; A determination value of the authenticity and validity of the security event is calculated based on the first weight parameter and the second weight parameter.

7. The intelligent determination method of security events according to claim 6, characterized in that: The step of calculating the determination value of the security event being true and valid based on the first weight parameter and the second weight parameter comprises: Calculate the frequency index of the security event according to the number of times the security event occurs within a preset time and a preset maximum number threshold, as a third weight parameter; A determination value of whether the security event is real and valid is calculated based on the first weight parameter, the second weight parameter, and the third weight parameter.

8. The intelligent determination method of security events according to claim 7, characterized in that: The step of calculating the true and effective determination value of the security event based on the first weight parameter, the second weight parameter, and the third weight parameter comprises: Identify whether the security event is high risk based on whether the target field of each security log in the security event hits the corresponding field value in the preset threat intelligence library: When the security event is of high risk, the determination value of the security event being true and valid is greater than a preset threshold; When the security event is not a high risk, a determination value of whether the security event is real and effective is calculated based on the first weight parameter, the second weight parameter, and the third weight parameter.

9. An intelligent security event determination system, characterized in that: include: Log parsing module, used to collect and parse security logs of product objects; The log aggregation module is used to classify and aggregate the parsed security logs to generate security events with multi-dimensional information; The security event determination module is used to calculate the authenticity and validity determination value of each security event based on the historical determination success rate of similar security events, so as to determine whether the security event is a real event.

10. An electronic device, characterized in that: The method comprises a processor, wherein the processor is coupled to a memory, wherein the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium, characterized in that: The invention comprises a program, which, when being executed on a computer, causes the computer to execute the method according to any one of claims 1 to 8.

Images