Methods and devices for determining the steady state of industrial control network equipment

Abstract

This disclosure belongs to the field of nuclear power technology, specifically relating to a method and apparatus for determining the steady state of industrial control network equipment. Based on actual operating equipment data, this disclosure determines multiple operation vectors to characterize the operated state of the equipment, and performs clustering processing on these operation vectors. The average value vector with the most clusters is selected, and the shortest duration corresponding to multiple continuously unchanged values ​​in the determined average value vector is used as the steady-state window of the target equipment. This allows for a comprehensive view of the industrial control network, filtering out the most common operations through the average value vector with the most clusters to obtain the steady-state window. This can more broadly represent the shortest time for equipment in the network to enter a steady state, facilitating rapid and accurate determination of the equipment's steady state.

Description

Technical Field

[0001] This invention belongs to the field of information technology, specifically relating to a method and apparatus for determining the steady state of industrial control network equipment. Background Technology

[0002] Compared to traditional internet, attacks targeting industrial control networks (ICS) of large industrial systems are more covert, focusing on disrupting and damaging the system's business logic. Therefore, understanding the semantic information of data packets within ICS networks is crucial for effectively improving network security. Setpoint attacks manipulate multiple nodes to launch large-amplitude attacks on individual devices, thereby compromising their stability and reliability. This necessitates a network-wide approach to rapidly monitor abnormal behavior across all devices within the ICS network. Typically, in actual nuclear power plant operations, device values ​​do not change continuously but remain in a steady state for extended periods. Directly analyzing device value fluctuation curves generates a large amount of irrelevant data. Therefore, it is essential to minimize computational errors and resource waste caused by irrelevant data and to quickly and accurately identify the steady state of the devices. Summary of the Invention

[0003] To overcome the problems existing in related technologies, a method and apparatus for determining the steady state of industrial control network equipment are provided.

[0004] According to one aspect of the present disclosure, a method for determining the steady state of an industrial control network device is provided, the method comprising:

[0005] Step 1: Based on the actual operating data of the target device during the preset time period, determine multiple operation vectors. Each operation vector includes multiple device values ​​arranged in chronological order to represent the state of the device being operated.

[0006] Step 2: Use a clustering model to cluster the determined multiple operation vectors to obtain multiple clusters, each cluster including one or more operation vectors;

[0007] Step 3: Determine the average vector of each operation vector in the cluster class containing the most operation vectors;

[0008] Step 4: The shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector is used as the steady-state window of the target device. The steady-state window is the shortest duration for the device to enter a steady state.

[0009] Step 5: If the device value is equal to v and remains unchanged for a continuous period of time greater than the steady-state window, then the device is determined to be in a steady state with a value of v.

[0010] In one possible implementation, step 1 includes:

[0011] Step 11: Acquire and process the actual operating data of the target device during the preset time period to form a total sequence. The values ​​of each device in the total sequence are arranged in chronological order according to the corresponding time.

[0012] Step 12: Determine all intervals in the total sequence where N consecutive device values ​​are the same, and mark the last device value of each interval as a reference point;

[0013] Step 13: In the overall sequence, traverse sequentially from each reference point until the first device value that is different from that reference point appears, and use the sequence of multiple device values ​​between that reference point and that device value as the operation vector.

[0014] In one possible implementation, step 2 further includes:

[0015] Step 21: Determine the mean-shift vector between each operation vector and other operation vectors;

[0016] Step 22: Converge the Mean-shift vectors into multiple operation vectors with the same operation vector as members of the same cluster class.

[0017] In one possible implementation, in step 121, the mean-shift vector M between each operation vector and other operation vectors is determined using the following formula. h (x).

[0018]

[0019] Where x is the operation vector, x i For S h Other operation vectors within, where i is an integer, 1≤i≤n, S h It is a high-dimensional spherical region centered at x with radius h. K is the kernel function, used to measure the contribution of each sample point.

[0020] According to another aspect of the embodiments of this disclosure, a steady-state determination device for industrial control network equipment is provided, the device comprising:

[0021] The acquisition and processing module is used to determine multiple operation vectors based on the actual operating data of the target device during a preset time period. Each operation vector includes multiple device values ​​arranged in chronological order to represent the state of the device being operated.

[0022] The clustering module is used to cluster multiple defined operation vectors using a clustering model to obtain multiple clusters, each of which includes one or more operation vectors.

[0023] The average value module is used to determine the average value vector of each operation vector in the cluster class containing the most operation vectors;

[0024] The steady-state window determination module is used to take the shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device. The steady-state window is the shortest duration for the device to enter a steady state.

[0025] The steady-state determination module is used to determine that the device is in a steady state with a value of v if the device value is equal to v and remains unchanged for a continuous period of time greater than the steady-state window.

[0026] In one possible implementation, the acquisition processing module includes:

[0027] The acquisition submodule is used to acquire and process the actual operating data of the target device during a preset time period to form a total sequence. The values ​​of each device in the total sequence are arranged in chronological order according to the corresponding time.

[0028] The marking submodule is used to determine all intervals in the total sequence where N consecutive device values ​​are the same, and to mark the last device value of each interval as a reference point;

[0029] The sub-module is used to sequentially traverse the entire sequence from each reference point until the first device value that is different from that reference point is encountered. The sequence of multiple device values ​​between that reference point and that device value is used as the operation vector.

[0030] In one possible implementation, the clustering module also includes:

[0031] The Mean-shift vector determination submodule is used to determine the Mean-shift vector between each operation vector and other operation vectors;

[0032] The cluster submodule is used to converge Mean-shift vectors to multiple operation vectors with the same operation vector as members of the same cluster class.

[0033] In one possible implementation, within the Mean-shift vector determination submodule, the Mean-shift vector M between each operation vector and other operation vectors is determined using the following formula. h (x).

[0034]

[0035] Where x is the operation vector, x i For S h Other operation vectors within, where i is an integer, 1≤i≤n, S h It is a high-dimensional spherical region centered at x with radius h. K is the kernel function, used to measure the contribution of each sample point.

[0036] According to another aspect of the embodiments of this disclosure, a steady-state determination device for industrial control network equipment is provided, the device comprising:

[0037] processor;

[0038] Memory used to store processor-executable instructions;

[0039] The processor is configured to execute the above-described method.

[0040] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, which, when executed by a processor, implement the above-described method.

[0041] The beneficial effects of this disclosure are as follows: Based on actual operating equipment data, this disclosure determines multiple operation vectors to characterize the operating state of the equipment, and performs clustering processing on the operation vectors. The average value vector with the most clusters is selected, and the shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector is used as the steady-state window of the target equipment. Thus, from the perspective of the overall industrial control network, the steady-state window corresponding to the most common operation can be obtained by filtering the average value vector with the most clusters. This can more broadly represent the shortest time for the equipment in the network to enter the steady state, which helps to quickly and accurately determine the steady state of the equipment. Attached Figure Description

[0042] Figure 1 This is a flowchart illustrating a method for determining the steady state of an industrial control network device according to an embodiment of this disclosure.

[0043] Figure 2 This is an example illustration of how device values ​​change over time in an industrial control network.

[0044] Figure 3 This is a block diagram of a steady-state determination device for industrial control network equipment, as shown in an embodiment of this disclosure. Detailed Implementation

[0045] The present disclosure will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0046] Unless otherwise defined, the technical and scientific terms used in this disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains; the terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure; the term "comprising" and any variations thereof in this disclosure are intended to cover non-exclusive inclusion. Clearly, the embodiments described in this disclosure are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0047] In this disclosure, the reference to "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this disclosure. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0048] Figure 1 This is a flowchart illustrating a method for determining the steady-state state of an industrial control network device according to an embodiment of this disclosure. This method can be executed by a terminal device, which can be a server, desktop computer, laptop computer, etc. This disclosure does not limit the type of terminal device. Figure 1 As shown, the method includes:

[0049] Step 1: Based on the actual operating data of the target device during a preset time period, determine multiple operation vectors. Each operation vector includes multiple device values ​​arranged in chronological order, which are used to represent the state of the device being operated.

[0050] As an example of this embodiment, step 1 may include steps 11 to 13.

[0051] Step 11: Acquire and process the actual operating data of the target device during the preset time period, forming a data structure as follows: Figure 2 The total sequence shown is arranged in chronological order according to the corresponding time points.

[0052] Step 12: Determine all intervals in the total sequence where N consecutive device values ​​are the same, and mark the last device value of each interval as a reference point. N can be, for example, 4, and the specific value of N can be adjusted according to expert experience; this disclosure does not limit this.

[0053] Step 13: In the overall sequence, traverse sequentially from each reference point until the first device value that is different from that reference point appears, and use the sequence of multiple device values ​​between that reference point and that device value as the operation vector.

[0054] In this way, this disclosure can quickly filter steady-state data in the sample using empirical values, which helps to accurately capture the fluctuating device values ​​from the time the device value changes until it enters a steady state as the operation vector. In addition, in step 1, the steady-state value of the device in a steady state can also be determined in advance based on experience, and multiple device values ​​that continuously exceed the steady-state value can be used as the operation vector.

[0055] Step 2 involves using a clustering model to cluster the determined multiple operation vectors, resulting in multiple clusters, each cluster comprising one or more operation vectors. As an example of this embodiment, step 2 further includes steps 21 to 23.

[0056] Step 21: Determine the mean-shift vector between each operation vector and other operation vectors;

[0057] Step 22: Converge the Mean-shift vectors into multiple operation vectors with the same operation vector as members of the same cluster class.

[0058] In one possible implementation, in step 121, the mean-shift vector M between each operation vector and other operation vectors is determined using the following formula. h (x).

[0059]

[0060] Where x is the operation vector, x i For S h Other operation vectors within, where i is an integer, 1≤i≤n, S h It is a high-dimensional spherical region centered at x with radius h. K is the kernel function, used to measure the contribution of each sample point. In this disclosure, the kernel function can be, for example, a Gaussian kernel or a flat kernel. It should be noted that the mean-shift vector can also be determined by methods such as basic calculations, and this disclosure does not limit this.

[0061] Step 3: Determine the average vector of each operation vector in the cluster with the largest number of operation vectors. This allows us to filter out the most common operations, making the determined steady-state window more representative.

[0062] Step 4: The shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector is taken as the steady-state window of the target device. The steady-state window is the shortest duration for the device to enter a steady state.

[0063] Step 5: If the device value is equal to v and remains unchanged for a continuous period of time greater than the steady-state window, then the device is determined to be in a steady state with a value of v.

[0064] This disclosure determines multiple operation vectors to characterize the operating state of the equipment based on actual operating equipment data, and performs clustering processing on the operation vectors. The average value vector with the most clusters is selected, and the shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector is used as the steady-state window of the target equipment. Thus, from the perspective of the overall industrial control network, the steady-state window corresponding to the most common operation can be obtained by filtering the average value vector with the most clusters. This can more broadly represent the shortest time for the equipment in the network to enter the steady state, which helps to quickly and accurately determine the steady state of the equipment.

[0065] According to another aspect of the embodiments of this disclosure, a steady-state determination device for industrial control network equipment is provided, the device comprising:

[0066] The acquisition and processing module is used to determine multiple operation vectors based on the actual operating data of the target device during a preset time period. Each operation vector includes multiple device values ​​arranged in chronological order to represent the state of the device being operated.

[0067] The clustering module is used to cluster multiple defined operation vectors using a clustering model to obtain multiple clusters, each of which includes one or more operation vectors.

[0068] The average value module is used to determine the average value vector of each operation vector in the cluster class containing the most operation vectors;

[0069] The steady-state window determination module is used to take the shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device. The steady-state window is the shortest duration for the device to enter a steady state.

[0070] The steady-state determination module is used to determine that the device is in a steady state with a value of v if the device value is equal to v and remains unchanged for a continuous period of time greater than the steady-state window.

[0071] In one possible implementation, the acquisition processing module includes:

[0072] The acquisition submodule is used to acquire and process the actual operating data of the target device during a preset time period to form a total sequence. The values ​​of each device in the total sequence are arranged in chronological order according to the corresponding time.

[0073] The marking submodule is used to determine all intervals in the total sequence where N consecutive device values ​​are the same, and to mark the last device value of each interval as a reference point;

[0074] The sub-module is used to sequentially traverse the entire sequence from each reference point until the first device value that is different from that reference point is encountered. The sequence of multiple device values ​​between that reference point and that device value is used as the operation vector.

[0075] In one possible implementation, the clustering module also includes:

[0076] The Mean-shift vector determination submodule is used to determine the Mean-shift vector between each operation vector and other operation vectors;

[0077] The cluster submodule is used to converge Mean-shift vectors to multiple operation vectors with the same operation vector as members of the same cluster class.

[0078] In one possible implementation, within the Mean-shift vector determination submodule, the Mean-shift vector M between each operation vector and other operation vectors is determined using the following formula. h (x).

[0079]

[0080] Where x is the operation vector, x i For S h Other operation vectors within, where i is an integer, 1≤i≤n, S h It is a high-dimensional spherical region centered at x with radius h. K is the kernel function, used to measure the contribution of each sample point.

[0081] The description of the above-mentioned apparatus has been elaborated in detail in the description of the above-mentioned method, and will not be repeated here.

[0082] Figure 3 This is a block diagram illustrating a steady-state determination device for an industrial control network device according to an embodiment of this disclosure. For example, device 1900 can be provided as a server. (Refer to...) Figure 3 The apparatus 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0083] Device 1900 may also include a power supply component 1926 configured to perform power management of device 1900, a wired or wireless network interface 1950 configured to connect device 1900 to a network, and an input / output (I / O) interface 1958. Device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or similar.

[0084] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of the device 1900 to perform the above-described method.

[0085] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0086] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0087] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0088] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0089] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0090] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0091] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0092] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0093] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for determining the steady state of industrial control network equipment, characterized in that, The method includes: Step 1: Based on the actual operating data of the target device during the preset time period, determine multiple operation vectors. Each operation vector includes multiple device values ​​arranged in chronological order to represent the state of the device being operated. Step 2: Use a clustering model to cluster the determined multiple operation vectors to obtain multiple clusters, each cluster including one or more operation vectors; Step 3: Determine the average vector of each operation vector in the cluster class containing the most operation vectors; Step 4: The shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector is used as the steady-state window of the target device. The steady-state window is the shortest duration for the device to enter a steady state. Step 5: If the device value is equal to v and remains unchanged for a continuous period of time greater than the steady-state window, then the device is determined to be in a steady state with a value of v. Step 1 includes: Step 11: Acquire and process the actual operating data of the target device during the preset time period to form a total sequence. The values ​​of each device in the total sequence are arranged in chronological order according to the corresponding time. Step 12: Determine all intervals in the total sequence where N consecutive device values ​​are the same, and mark the last device value of each interval as a reference point; Step 13: In the overall sequence, traverse sequentially from each reference point until the first device value that is different from that reference point appears, and use the sequence of multiple device values ​​between that reference point and that device value as the operation vector.

2. The method according to claim 1, characterized in that, Step 2 also includes: Step 21: Determine the mean-shift vector between each operation vector and other operation vectors; Step 22: Converge the Mean-shift vectors into multiple operation vectors with the same operation vector as members of the same cluster class.

3. The method according to claim 1, characterized in that, In step 121, the mean-shift vector M between each operation vector and other operation vectors is determined using the following formula. h (x); Where x is the operation vector, x i For S h Other operation vectors within, where i is an integer, 1≤i≤n, S h It is a high-dimensional spherical region with x as the center and a radius of h, and K is the kernel function used to measure the contribution of each sample point.

4. A steady-state determination device for industrial control network equipment, characterized in that, The device includes: The acquisition and processing module is used to determine multiple operation vectors based on the actual operating data of the target device during a preset time period. Each operation vector includes multiple device values ​​arranged in chronological order to represent the state of the device being operated. The clustering module is used to cluster multiple defined operation vectors using a clustering model to obtain multiple clusters, each of which includes one or more operation vectors. The average value module is used to determine the average value vector of each operation vector in the cluster class containing the most operation vectors; The steady-state window determination module is used to take the shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device. The steady-state window is the shortest duration for the device to enter a steady state. The steady-state determination module is used to determine that the device is in a steady state with a value of v if the device value is equal to v and remains unchanged for a continuous period of time greater than the steady-state window. The acquisition and processing module includes: The acquisition submodule is used to acquire and process the actual operating data of the target device during a preset time period to form a total sequence. The values ​​of each device in the total sequence are arranged in chronological order according to the corresponding time. The marking submodule is used to determine all intervals in the total sequence where N consecutive device values ​​are the same, and to mark the last device value of each interval as a reference point; The sub-module is used to sequentially traverse the entire sequence from each reference point until the first device value that is different from that reference point is encountered. The sequence of multiple device values ​​between that reference point and that device value is used as the operation vector.

5. The apparatus according to claim 4, characterized in that, The clustering module also includes: The Mean-shift vector determination submodule is used to determine the Mean-shift vector between each operation vector and other operation vectors; The cluster submodule is used to converge Mean-shift vectors to multiple operation vectors with the same operation vector as members of the same cluster class.

6. The apparatus according to claim 4, characterized in that, In the Mean-shift vector determination submodule, the Mean-shift vector M between each operation vector and other operation vectors is determined using the following formula. h (x); Where x is the operation vector, x i For S h Other operation vectors within, where i is an integer, 1≤i≤n, S h It is a high-dimensional spherical region with x as the center and a radius of h, and K is the kernel function used to measure the contribution of each sample point.

7. A steady-state determination device for industrial control network equipment, characterized in that, The device includes: processor; Memory used to store processor-executable instructions; The processor is configured to perform the method according to any one of claims 1 to 3.

8. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 3.

Images