A code detection method, apparatus, device, medium and product

Abstract

The application provides a code detection method, device, equipment, medium and product. The method comprises the following steps: obtaining a first code; performing word segmentation on the first code to obtain a plurality of word units; inputting the plurality of word units into a mixed expert model; and receiving a code detection result output by the mixed expert model. The mixed expert model comprises a first expert model for extracting features related to a first type of attack, a second expert model for extracting features related to obfuscated code, and a third expert model for extracting features related to language model generated code. The code detection result is used to represent whether the first code belongs to obfuscated code generated by a language model and used to perform a first type of attack. The method effectively and comprehensively identifies whether the code is attack obfuscated code generated by a language model, thereby improving the protection performance of a security protection product (such as a CWPP, a HIDS, and a CSPM) against attack behavior.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a code detection method, apparatus, electronic device, computer-readable storage medium, and computer program product. Background Technology

[0002] With the continuous development of computer technology, security protection products for security testing have emerged. These products can test physical computing devices such as computers and mainframes, or virtual computing devices such as containers, thereby ensuring operational security.

[0003] Security products can perform multi-faceted detection on computing devices. To evade detection by these products, attackers typically employ obfuscation techniques to process the code used to execute attacks, creating obfuscated attack code to carry out obfuscated attacks.

[0004] In related technologies, language models are used to generate batches of attack obfuscation code. How to detect the attack obfuscation code generated by language models and improve the protection capabilities of security products has become an urgent problem to be solved. Summary of the Invention

[0005] This application provides a code detection method. This method can effectively and comprehensively identify whether the code is obfuscated code generated by a language model, thereby improving the protection performance of security products against attack behaviors. This application also provides apparatus, electronic devices, computer-readable storage media, and computer program products corresponding to the above method.

[0006] Firstly, this application provides a code detection method, which includes:

[0007] Get the first code;

[0008] The first code is segmented into words to obtain multiple word units;

[0009] The plurality of lexical units are input into a hybrid expert model, and the code detection result output by the hybrid expert model is received. The hybrid expert model includes a first expert model for extracting features related to the first type of attack, a second expert model for extracting features related to obfuscated code, and a third expert model for extracting features related to code generated by a language model. The code detection result is determined based on one or more of the features related to the first type of attack, the features related to obfuscated code, and the features related to code generated by a language model. The code detection result is used to characterize whether the first code belongs to obfuscated code generated by a language model for performing the first type of attack.

[0010] In a second aspect, the present application provides a code detection apparatus, the apparatus comprising:

[0011] an acquisition module configured to acquire a first code;

[0012] a word segmentation module configured to segment the first code to obtain a plurality of word units;

[0013] a detection module configured to input the plurality of word units into a mixed expert model and receive a code detection result output by the mixed expert model, wherein the mixed expert model comprises a first expert model configured to extract features related to a first type of attack, a second expert model configured to extract features related to obfuscated code, and a third expert model configured to extract features related to language model generated code, the code detection result is determined based on one or more of the features related to the first type of attack, the features related to the obfuscated code, and the features related to the language model generated code, and the code detection result is used to represent whether the first code belongs to obfuscated code generated by a language model and used to perform the first type of attack.

[0014] In a third aspect, the present application provides an electronic device, the electronic device comprising a processor and a memory. The processor and the memory are in communication with each other. The processor is configured to execute instructions stored in the memory, so that the electronic device performs the code detection method of the first aspect or any of the implementation manners of the first aspect.

[0015] In a fourth aspect, the present application provides a computer readable storage medium, the computer readable storage medium storing instructions, the instructions instructing an electronic device to perform the code detection method of the first aspect or any of the implementation manners of the first aspect.

[0016] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, cause the electronic device to perform the code detection method of the first aspect or any of the implementation manners of the first aspect.

[0017] On the basis of the implementation manners of the above aspects, the present application can be further combined to provide more implementation manners.

[0018] As can be seen from the above technical solutions, the present application has the following advantages:

[0019] The application provides a code detection method. The method first acquires a first code, performs word segmentation on the first code to obtain a plurality of word units, then inputs the plurality of word units into a mixed expert model, and receives a code detection result output by the mixed expert model. The mixed expert model comprises a first expert model for extracting features related to a first type of attack, a second expert model for extracting features related to obfuscated code, and a third expert model for extracting features related to language model generated code. The code detection result is determined based on one or more of the features related to the first type of attack, the features related to the obfuscated code, and the features related to the language model generated code. The code detection result is used to represent whether the first code is language model generated obfuscated code for performing the first type of attack.

[0020] In the method, the mixed expert model is used for code detection. The three expert models in the mixed expert model respectively detect whether the code is used for performing the first type of attack, whether the code is obfuscated code, and whether the code is generated by a language model. Different features are comprehensively considered to effectively and comprehensively identify whether the code is language model generated attack obfuscated code, improve the protection performance of a security protection product on attack behavior, and reduce the risk of false positives and false negatives. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical method of the embodiments of the application, the drawings required to be used in the embodiments will be briefly introduced as follows.

[0022] Figure 1 A flowchart of a code detection method provided by the embodiments of the application is shown.

[0023] Figure 2 A structure diagram of a mixed expert model provided by the embodiments of the application is shown.

[0024] Figure 3 A diagram of a mixed expert model training process provided by the embodiments of the application is shown.

[0025] Figure 4 A structure diagram of a code detection device provided by the embodiments of the application is shown.

[0026] Figure 5 A structure diagram of an electronic device provided by the embodiments of the application is shown. DETAILED DESCRIPTION

[0027] The terms "first" and "second" in the embodiments of the application are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first" and "second" can explicitly or implicitly include one or more of the features.

[0028] Firstly, some technical terms and application scenarios involved in the embodiments of the present application are introduced.

[0029] With the continuous development of computer technology, security protection products for performing security detection and further ensuring the security of entity computing devices such as computers, hosts, and virtual computing devices such as containers have emerged. The security protection product can perform multi-faceted security detection for various running scenarios, for example, the security protection product can be a cloud workload protection platform (CWPP), which can detect host security and network security. For another example, the security protection product can be a host-based intrusion detection system (HIDS), which can perform security detection on the behavior and state of the computer system. For another example, the security protection product can be a cloud security posture management (CSPM), which can assess and manage cloud security risks, identify configuration errors and security vulnerabilities in the cloud environment.

[0030] In some examples, the security protection product can detect webshell attack. The webshell is a code execution environment in the form of asp, php, jsp, cgi, etc. web page files, which is used to perform website management, server management, and permission management operations.

[0031] In a webshell attack, the attacker executes commands on the target server through the webshell to obtain control of the target server. Specifically, the attacker uploads the code for performing the webshell attack to the target server, accesses the webshell page through the browser, inputs the command to be executed in the command input box of the webshell page, and controls the target server.

[0032] In related technologies, the security protection product usually detects the code for performing the webshell attack at the static file level. For example, the security protection product can match the webshell pattern such as specific strings, function calls, and code structures through yara rules. For another example, the security protection product can also match the webshell features such as specific keywords (eval, exec, system, etc.) through regular expressions.

[0033] In order to avoid the detection of security protection products on webshell attacks, the attacker usually uses obfuscation technology to process the code used to perform webshell attacks to obtain webshell attack obfuscated code and perform obfuscated webshell attacks. In addition, the attacker can also use a language model to generate a batch of webshell attack obfuscated code. The above webshell attack obfuscated code generated by the language model can achieve kill-free, that is, the above webshell attack obfuscated code generated by the language model can bypass the detection of security protection products.

[0034] Therefore, the present application provides a code detection method. The method first acquires a first code, performs word segmentation on the first code to obtain a plurality of word units, then inputs the plurality of word units into a mixed expert model, and receives a code detection result output by the mixed expert model. The mixed expert model includes a first expert model for extracting features related to a first type of attack, a second expert model for extracting features related to obfuscated code, and a third expert model for extracting features related to language model generated code. The code detection result is determined based on one or more of the features related to the first type of attack, the features related to the obfuscated code, and the features related to the language model generated code. The code detection result is used to represent whether the first code is obfuscated code generated by a language model for performing a first type of attack.

[0035] In this method, the mixed expert model is used for code detection. The three expert models in the mixed expert model detect whether the code is used to perform a first type of attack, whether it is obfuscated code, and whether it is generated by a language model. Different features are considered comprehensively to effectively and comprehensively identify whether the code is language model generated attack obfuscated code, improve the protection performance of security protection products on attack behavior, and reduce the risk of false positives and false negatives.

[0036] In order to facilitate understanding of the technical solutions provided by the embodiments of the present application, the following will be described with reference to the accompanying drawings. Referring to Figure 1 The flowchart of a code detection method is shown in FIG. 1. The method specifically includes the following steps.

[0037] S101: Acquire a first code.

[0038] The first code can be understood as a code to be detected, in other words, there is a detection requirement for whether the first code is language model generated obfuscated code for performing a certain type of attack (for example, a webshell attack). For example, the first code can be a code string in asp, php, jsp, cgi, etc.

[0039] S102: Perform word segmentation on the first code to obtain a plurality of word units.

[0040] In the embodiments of the present application, tokenization can be understood as a process of decomposing the first code into a series of meaningful units, and a meaningful unit can be referred to as a token. In the subsequent code detection process, detection is performed in units of tokens, which helps to improve detection efficiency and detection accuracy.

[0041] When implemented specifically, the process of tokenizing the first code can be implemented by any tokenizer. By inputting the first code into the tokenizer, a plurality of tokens output by the tokenizer can be obtained.

[0042] S103: inputting the plurality of tokens into a mixture of experts model, and receiving a code detection result output by the mixture of experts model.

[0043] The mixture of experts (MoE) model is a kind of efficient deep learning architecture. By decomposing an original task into a plurality of subtasks, different expert models are used to process different subtasks. In this way, each expert model can focus on a specific subtask, which helps to improve the generalization ability and reasoning performance of the mixture of experts model.

[0044] In the embodiments of the present application, the mixture of experts model includes a first expert model for extracting features related to the first type of attack, a second expert model for extracting features related to obfuscated code, and a third expert model for extracting features related to language model generated code.

[0045] It should be noted that the embodiments of the present application do not limit the first type of attack. For example, the first type of attack can be a webshell attack, or the first type of attack can also be any other type of attack.

[0046] The language model has natural language processing capability and can understand natural language meaning and process different types of natural language tasks. For example, the language model can be a deep learning model trained using code samples.

[0047] That is, in the embodiments of the present application, the original task is to "detect whether the first code is obfuscated code generated by a language model for executing a first type of attack". Since the code generated by the language model is different from the code written by humans, for example, the content generated by the language model often has consistent naming rules, annotation styles, and template code structures, therefore, the original task is decomposed into three subtasks: "detect whether the first code is used to execute the first type of attack", "detect whether the first code is obfuscated code", and "detect whether the first code is generated by a language model".

[0048] The three subtasks are respectively performed by three expert models to extract one or more of the features related to the first type of attack, the features related to the obfuscated code, and the features related to the language model generated code in each token. In other words, the mixed expert model processes multiple subtasks for each token to identify one or more of the features representing the execution of the first type of attack, the features representing the obfuscated code, and the language model generation traces in each token of the first code. Then, based on one or more of the features related to the first type of attack, the features related to the obfuscated code, and the features related to the language model generated code (such as consistent syntax, code structure, naming rules, comment style, etc.), the code detection result of the first code is determined, which can be used to represent whether the first code belongs to the language model generated obfuscated code for executing the first type of attack, thereby improving the accuracy and robustness of code detection. Through the collaborative processing of multiple expert models, the accuracy of code detection is improved.

[0049] The embodiments of the present application do not limit the types of the first expert model, the second expert model, and the third expert model. For example, the first expert model, the second expert model, and the third expert model can be language models with natural language processing capabilities. For another example, the first expert model, the second expert model, and the third expert model can also be other models with code recognition capabilities.

[0050] In the mixed expert model, each token can be processed by one or more expert models. Specifically, referring to Figure 2 a structure diagram of a mixed expert model, the mixed expert model can also include a gate router, and the outputs of the gate router are respectively the inputs of the first expert model, the second expert model, and the third expert model.

[0051] The gate router, which can also be called a gate network, a router, a gated network, etc., can be implemented based on a neural network. In the embodiments of the present application, the gate router can be used to receive each token of the first code and distribute each token to one or more expert models in the mixed expert model, that is, to determine the expert model to be activated for each token.

[0052] In specific implementation, for each token in the plurality of tokens, the following operations are performed: for each token in the plurality of tokens, the following operations are performed: inputting the token into the gate router, so that the gate router determines the expert model activation probability of the token, and sending the token to a target expert model corresponding to the expert model activation probability, to obtain a target sub-feature of the token returned by the target expert model. Then, the code detection result is determined according to the target sub-feature of each token.

[0053] The target expert model is one or more of the first expert model, the second expert model, and the third expert model, and the target sub-feature is one or more of a feature related to the first type of attack, a feature related to obfuscated code, and a feature related to language model generated code.

[0054] That is, the gate extracts the feature of the token, determines, based on the feature of the token, which expert model or which expert models should process the token, and generates an expert model activation probability (for example, a weight distribution) of the token. The expert model activation probability can be used to represent the probability of each expert model being activated. In this way, the gate determines, in combination with the expert model activation probability of the token, a target expert model for processing the token, and then sends the token to the target expert model, so that the target expert model extracts the feature of the token to obtain the target sub-feature of the token.

[0055] In some embodiments, the gate can activate all expert models whose activation probabilities indicated by the expert model activation probability are not 0, that is, the target expert model corresponding to the expert model activation probability is an expert model whose activation probability is not 0. For example, the activation probability of the first expert model is 0.5, the activation probability of the second expert model is 0.2, and the activation probability of the third expert model is 0.3. The target expert model corresponding to the expert model activation probability is the first expert model, the second expert model, and the third expert model. The activation probability of the first expert model is 0.7, the activation probability of the second expert model is 0, and the activation probability of the third expert model is 0.3. The target expert model corresponding to the expert model activation probability is the first expert model and the third expert model.

[0056] In some embodiments, the gate router can also perform sparse activation, only activating part of the expert models, to reduce the computational overhead. For example, the target expert model corresponding to the expert model activation probability is the expert model after Top-K selection or Top-P selection. For example, in Top-K selection, K = 2, the expert model activation probability of the first expert model is 0.5, the expert model activation probability of the second expert model is 0.2, and the expert model activation probability of the third expert model is 0.3. After sorting the activation probabilities from high to low, since the activation probability of the first expert model and the activation probability of the third expert model are in the top 2, the target expert model corresponding to the expert model activation probability is the first expert model and the third expert model. In Top-P selection, P = 0.6, the expert model activation probability of the first expert model is 0.55, the expert model activation probability of the second expert model is 0.25, and the expert model activation probability of the third expert model is 0.2. After sorting the activation probabilities from high to low, since the sum of the activation probability of the first expert model and the activation probability of the second expert model is greater than 0.6, the target expert model corresponding to the expert model activation probability is the first expert model and the second expert model.

[0057] In this way, the gate router in the hybrid expert model sends different parts (i.e., different tokens) in the first code to the expert model that fits the token for processing, obtains the target sub-feature of each token, and improves the efficiency and performance of the hybrid expert model.

[0058] Further, as shown in Figure 2 The hybrid expert model can also include a feedforward neural network and a classifier, the input of the feedforward neural network being the output of the first expert model, the second expert model and the third expert model, and the input of the classifier being the output of the feedforward neural network.

[0059] In the embodiments of the present application, the feedforward neural network can be used to fuse the target sub-features of each token, and the classifier can be used to classify the first code based on the fused features of each token, and output the code detection result of the first code.

[0060] In specific implementation, for the target sub-feature of each token, the following operations are performed: the target sub-feature of the token is sent to the feedforward neural network, so that the feedforward neural network fuses the target sub-feature of the token according to the expert model activation probability of the token, to obtain the target feature of the token. Then, the target feature of each token is sent to the classifier to obtain the code detection result output by the classifier.

[0061] Since the expert model activation probability of the word item can be used to represent the probability of each expert model being activated, in the process of feature fusion of the feedforward neural network, the target sub-features extracted by each target expert model can be fused according to the activation probability indicated by the expert model activation probability, to obtain the target feature of the word item. For example, the expert model activation probability is 0.5 for the first expert model, 0.2 for the second expert model, and 0.3 for the third expert model, the target expert model corresponding to the expert model activation probability is the first expert model and the third expert model, the target sub-features of the word item are the features related to the first type of attack extracted by the first expert model and the features related to the language model generated code extracted by the third expert model, and the feedforward neural network can fuse the features related to the first type of attack and the features related to the language model generated code according to a ratio of 5:3 to obtain the target feature of the word item.

[0062] After the feedforward neural network completes the feature fusion of each word item of the first code, the classifier can classify the first code in combination with the target features of each word item, to identify whether the first code belongs to the obfuscated code generated by the language model for performing the first type of attack.

[0063] After completing the detection on the first code, the code detection result can also be presented to the user. In some possible implementation manners, in response to the code detection result representing that the first code belongs to the obfuscated code generated by the language model for performing the first type of attack, a disposal suggestion for the first code is generated. The disposal suggestion can include at least one of the following: a code obfuscation manner of the first code and code content generated by the language model in the first code.

[0064] That is, when the first code is the obfuscated code generated by the language model for performing the first type of attack, the user is presented with the existence of the code obfuscation manner in the first code and the generation trace of the language model, to help the user understand the code detection result, so as to quickly and accurately respond.

[0065] In the method, the mixed expert model is used for code detection, and the three expert models in the mixed expert model detect whether the code is used for performing the first type of attack, whether the code belongs to the obfuscated code, and whether the code is generated by the language model, respectively. Different features are comprehensively considered, the code is effectively and comprehensively identified as the attack obfuscated code generated by the language model, the security protection product is improved in terms of protection performance for attack behavior, and the risk of false positives and false negatives is reduced.

[0066] The foregoing describes the code detection method provided by the embodiments of the present application. In the embodiments of the present application, the first code is detected by means of the mixed expert model, and the following describes the code detection method by means of the mixed expert model. Figure 3A schematic diagram of a hybrid expert model training process is shown to introduce the training process of the hybrid expert model.

[0067] In some possible implementation manners, the hybrid expert model can be trained by the following manner: obtaining non-attack code samples and first-type attack code samples, taking the non-attack code samples as negative samples and the first-type attack code samples as positive samples, training the first pre-training model to obtain the first expert model. Obtaining unobfuscated code samples and obfuscated code samples, taking the unobfuscated code samples as negative samples and the obfuscated code samples as positive samples, training the second pre-training model to obtain the second expert model. Obtaining artificially written code samples and code samples generated by a language model, taking the artificially written code samples as negative samples and the code samples generated by the language model as positive samples, training the third pre-training model to obtain the third expert model.

[0068] The first pre-training model, the second pre-training model and the third pre-training model can be pre-training language models, in other words, in the embodiment of the present application, the first pre-training model, the second pre-training model and the third pre-training model are fine-tuned, so that the fine-tuned first expert model has the ability to extract features related to the first-type attack and detect whether the first code is used for the first-type attack, the fine-tuned second expert model has the ability to extract features related to the obfuscated code and detect whether the first code is the obfuscated code, and the fine-tuned third expert model has the ability to extract features related to the language model generated code and detect whether the first code is generated by the language model.

[0069] In specific implementation, the first pre-training model, the second pre-training model and the third pre-training model are trained in a supervised training manner to generate the first expert model, the second expert model and the third expert model. In the supervised training, labeled training data is used for model training. In the embodiment of the present application, the label can be understood as a positive sample or a negative sample, that is, for the positive sample, the trained model should output a positive classification result, and for the negative sample, the trained model should output a negative classification result.

[0070] It should be noted that in the training stage of the hybrid expert model, in order to better enable the first expert model, the second expert model and the third expert model to focus on feature extraction and improve the generalization ability of the first expert model, the second expert model and the third expert model, a classifier can be externally connected to the first pre-training model, the second pre-training model and the third pre-training model.

[0071] Specifically, in the training phase of the first expert model, a first classifier is externally connected after the first pre-trained model, which can be used for classification on the features extracted by the first pre-trained model to obtain a first classification result representing whether it is used to perform the first type of attack, and then the cross-entropy loss is calculated combined with the label to train the first pre-trained model to obtain the first expert model. In the training phase of the second expert model, a second classifier is externally connected after the second pre-trained model, which can be used for classification on the features extracted by the second pre-trained model to obtain a second classification result representing whether it is a code obfuscation, and then the cross-entropy loss is calculated combined with the label to train the second pre-trained model to obtain the second expert model. In the training phase of the third expert model, a third classifier is externally connected after the third pre-trained model, which can be used for classification on the features extracted by the third pre-trained model to obtain a third classification result representing whether it is generated by a language model, and then the cross-entropy loss is calculated combined with the label to train the third pre-trained model to obtain the third expert model.

[0072] In the inference phase of the mixed expert model, the first expert model, the second expert model and the third expert model do not need to be externally connected with a classifier, and the first expert model, the second expert model and the third expert model only need to extract the features of the word pieces.

[0073] As shown in FIG. 1, the first type of attack code sample can be understood as code used to perform the first type of attack. In some embodiments, the first type of attack is a webshell attack, and the first type of attack code sample can be understood as code in asp, php, jsp, cgi, etc. format used to perform the webshell attack. The non-attack code sample can be understood as code not used to perform the first type of attack. In some embodiments, the first type of attack is a webshell attack, and the non-attack code sample can be understood as code in asp, php, jsp, cgi, etc. format not used to perform the webshell attack. The first type of attack code sample can include at least one of the following: a first type of attack code written by a human and a first type of attack obfuscated code generated by a language model. Figure 3 The unobfuscated code sample can be understood as code without code obfuscation, and the obfuscated code sample can be understood as code with code obfuscation. In some embodiments, the obfuscated code sample can include at least one of the following: obfuscated code written by a human and obfuscated code generated by a language model.

[0074] The human-written code sample can be understood as code written by a human (e.g., a developer), and the language model generated code sample can be understood as code automatically generated by a language model with language model generation traces. In some embodiments, the language model generated code sample can include at least one of the following: obfuscated code generated by a language model and code generated by a language model.

[0075]

[0076] ​In some possible implementations, the language model generated first type attack obfuscated code and the language model generated obfuscated code are generated by: obtaining first obfuscated code, second obfuscated code, first non-obfuscated code, and second non-obfuscated code; extracting at least one code obfuscation manner by using a first language model to obfuscate the first obfuscated code and the second obfuscated code; and then, based on the at least one code obfuscation manner, using a second language model to obfuscate the first non-obfuscated code and the second non-obfuscated code to obtain the language model generated first type attack obfuscated code and the language model generated obfuscated code.

[0077] The first obfuscated code is obfuscated code used for performing a first type attack, the second obfuscated code is obfuscated code irrelevant to the first type attack, the first non-obfuscated code is non-obfuscated code used for performing the first type attack, and the second non-obfuscated code is non-obfuscated code irrelevant to the first type attack.

[0078] That is, by extracting code obfuscation manners of the obfuscated code used for performing the first type attack and the obfuscated code irrelevant to the first type attack, using the extracted code obfuscation manners as templates, and obfuscating the non-obfuscated code used for performing the first type attack and the non-obfuscated code irrelevant to the first type attack, a large amount of obfuscated code generated by a language model is generated, data enhancement is achieved, and training effect is improved.

[0079] The code obfuscation manner can be understood as a manner for obfuscating code. In some embodiments, the code obfuscation manner can include at least one of the following: a manner of using a bit operator to operate on a string in code, a manner of splicing or splitting a string in code, a manner of using a random variable name in code, a manner of obfuscating an input parameter and an output parameter of a function call in code, and a manner of obfuscating a conditional judgment statement in code.

[0080] In the way of operating strings in the code using bit operators, the strings in the code are operated using bit operators (such as "&", "|", "^"), so that the code becomes difficult to understand, for example, the obfuscated code can be "<?php$var1='string1'&'string2';$var2='string3'|'string4';$var3='string5'^'string6';?>". In the way of splicing or splitting strings in the code, the string content in the code is hidden by splicing or splitting strings, for example, the obfuscated code can be "<?php$var4='part1'.'part2'.'part3';$var5='part4'&'part5';?>". In the way of using random variable names in the code, random and meaningless variable names are used, so that the code is difficult to read and understand, for example, the obfuscated code can be "<?php$complexVar1='value1';$complexVar2='value2';?>". In the way of obfuscating the parameters and return values of function calls in the code, the parameters and return values of function calls in the code are obfuscated, so that the code logic is difficult to identify, for example, the obfuscated code can be "<?phpif(function1($param1($param2))==$expectedValue){$result=function2($param3,param1($param4.$param5.$param6));$result($param7,$param8,$param9);}?>". In the way of obfuscating conditional judgment statements in the code, the execution path of the code is difficult to predict by complex condition judgment, for example, the obfuscated code can be "<?phpif($condition1($param1($param2))==$expectedValue){ / / execute code}?>".

[0081] In the embodiments of the present application, the code obfuscation manner is extracted and the code is obfuscated by means of the language model. The first language model can be understood as a language model for extracting the code obfuscation manner, and the second language model can be understood as a language model for performing code obfuscation. The first language model and the second language model have natural language processing capabilities and can understand natural language meanings and process different types of natural language tasks. For example, the first language model and the second language model can be deep learning models trained using text data.

[0082] The first language model can extract the code obfuscation manner from the first obfuscated code and the second obfuscated code based on the prompt learning manner. In a generative task (for example, a text generation task, a question and answer task, or a dialogue task), a prompt can be used to guide the language model to generate a specific output. By configuring the prompt, the language model can understand the background and requirements of the task, and can process different types of natural language processing tasks without retraining the language model, thereby increasing the scalability and flexibility of the language model.

[0083] In a specific implementation, a first prompt is generated, the first prompt is sent to the first language model, and at least one code obfuscation manner returned by the first language model is received.

[0084] The first prompt can include the first obfuscated code, the second obfuscated code, and information for indicating the extraction of the code obfuscation manner. By configuring the above information in the first prompt, the first language model can extract the code obfuscation manner from the first obfuscated code and the second obfuscated code based on the prompting capability of the first prompt.

[0085] For example, the first prompt can be as follows:

[0086] "You are a professional code analysis expert who is good at detecting obfuscation in code and can accurately analyze the code obfuscation manner and provide clear obfuscation templates.

[0087] When a user provides a piece of code, the code is carefully checked for obfuscation. If there is obfuscation, the specific code obfuscation manner is analyzed, each code obfuscation manner is described in detail, and an example of the code obfuscation manner is given.

[0088] The code is as follows: {first obfuscated code}, {second obfuscated code}"

[0089] After the code obfuscation manner is extracted, the first non-obfuscated code and the second non-obfuscated code are obfuscated by using one or more code obfuscation manners with the aid of the second language model, to obtain the language model generated first type attack obfuscated code and the language model generated obfuscated code.

[0090] Similarly, the second language model can obfuscate the first non-obfuscated code and the second non-obfuscated code based on the prompt learning manner. In a specific implementation, a second prompt is generated, the second prompt is sent to the second language model, and the code obfuscated, language model generated first type attack obfuscated code and language model generated obfuscated code returned by the second language model are received.

[0091] The second prompt word can include at least one code obfuscation method, a first non-obfuscated code, a second non-obfuscated code, and information indicating that code obfuscation is performed using the code obfuscation method. By configuring the above information in the second prompt word, the second language model can perform code obfuscation on the first non-obfuscated code and the second non-obfuscated code based on the prompting capability of the second prompt word.

[0092] For example, the second prompt word can be as follows:

[0093] "You are a professional code obfuscation expert who can accurately obfuscate the input code according to the given code obfuscation method while ensuring that the obfuscated code functions remain unchanged.

[0094] When the user inputs the code and the code obfuscation method, carefully analyze the code structure and the code obfuscation method, and strictly perform code obfuscation according to the code obfuscation method to ensure that the obfuscated code is completely identical in function to the original code.

[0095] The code obfuscation method is as follows: {at least one code obfuscation method}

[0096] The code is as follows: {first non-obfuscated code}, {second non-obfuscated code}"

[0097] For example, the first non-obfuscated code is "<?php eval(@$_POST['pass']);?> ", the code obfuscation method is "a method of operating strings in the code using bitwise operators", and the second language model returns a first type of attack obfuscated code generated by the language model as "<?php$var='e'^'E';$var2='v'^'V';$var3='a'^'A';$var4='l'^'L';$var5='(@'^'(@';$var6='_POST'^'_POSt';$var7='[\'pass\']'^'[\'pass\']';$code=($var1.$var2.$var3.$var4).$var5.$var6.$var7;eval($code);?> ".

[0098] In some possible implementations, the language model generated code is generated by: obtaining a third non-obfuscated code and a fourth non-obfuscated code, and rewriting the third non-obfuscated code and the fourth non-obfuscated code using a third language model to obtain the language model generated code.

[0099] The third non-obfuscated code is a non-obfuscated code for performing a first type of attack, and the second non-obfuscated code is a non-obfuscated code unrelated to the first type of attack.

[0100] That is, the third language model is used to rewrite the artificially written code to generate a large amount of code generated by the language model, realize data enhancement, and improve the training effect. The third language model can be understood as a language model for rewriting code. The third language model has natural language processing capabilities and can understand natural language meanings and process different types of natural language tasks. For example, the third language model can be a deep learning model trained using text data.

[0101] Similarly, the third language model can rewrite the third non-confusion code and the fourth non-confusion code based on the prompt learning manner. Specifically, a third prompt word is generated, the third prompt word is sent to the third language model, and the rewritten code generated by the language model returned by the third language model is received.

[0102] The third prompt word can include the third non-confusion code, the fourth non-confusion code, and information for indicating optimization of the code. By configuring the above information in the third prompt word, the third language model can rewrite the third non-confusion code and the fourth non-confusion code based on the prompting capability of the third prompt word, so that the rewritten code has the generation trace of the language model.

[0103] For example, the third prompt word can be as follows:

[0104] "You are a code optimization master who can accurately analyze and optimize the input code. Whether it is a code specification problem or an organizational structure problem, you can provide high-quality solutions.

[0105] When receiving a piece of code, carefully check whether it meets the common programming specifications. If there are specification problems, point out the problems and provide the specification code. If the code specification is correct, analyze whether the organizational structure can be optimized, and adjust the organizational structure of the code to make it more clear and readable while maintaining the function of the code.

[0106] The code is as follows: {third non-confusion code}, {fourth non-confusion code}"

[0107] In this way, a large amount of effective training data is generated for the first expert model, the second expert model, and the third expert model, the training data set is enriched, the training process of the mixed expert model is accelerated, and the recognition ability of the mixed expert model for the first type of attack in the real environment is improved. Moreover, it can quickly adapt to new first type of attacks, optimize the detection means for confusion first type of attacks, and maintain efficient detection ability.

[0108] Further, the mixed expert model can further include a gate router. Similarly, since the gate router is used to determine the expert model that needs to be activated for each word piece, during the training process of the gate router, the code samples for performing the first type of attack (including the artificially written code for performing the first type of attack and the language model generated code for performing the first type of attack) and the code samples irrelevant to the first type of attack are used to train the parameters of the gate router.

[0109] The above is described in combination with Figures 1 to 3 The code detection method provided by the embodiments of the present application is described in detail, and the device and equipment provided by the embodiments of the present application will be introduced below in combination with the drawings.

[0110] Referring to Figure 4 As shown in the structural schematic diagram of the code detection device, the device 40 includes:

[0111] The acquisition module 401 is configured to acquire a first code.

[0112] The word segmentation module 402 is configured to perform word segmentation on the first code to obtain a plurality of word pieces.

[0113] The detection module 403 is configured to input the plurality of word pieces into a mixed expert model and receive a code detection result output by the mixed expert model. The mixed expert model includes a first expert model for extracting features related to a first type of attack, a second expert model for extracting features related to obfuscated code, and a third expert model for extracting features related to language model generated code. The code detection result is determined based on one or more of the features related to the first type of attack, the features related to the obfuscated code, and the features related to the language model generated code. The code detection result is used to represent whether the first code belongs to the language model generated obfuscated code for performing the first type of attack.

[0114] In some possible implementation manners, the mixed expert model further includes a gate router, and outputs of the gate router are respectively inputs of the first expert model, the second expert model, and the third expert model. The detection module 403 is specifically configured to:

[0115] For each word unit in the plurality of word units, the following operations are performed: inputting the word unit into the gate router, so that the gate router determines the expert model activation probability of the word unit, and sending the word unit to a target expert model corresponding to the expert model activation probability of the word unit, to obtain a target sub-feature of the word unit returned by the target expert model; wherein the target expert model is one or more of the first expert model, the second expert model and the third expert model, and the target sub-feature is one or more of the feature related to the first type of attack, the feature related to the obfuscated code and the feature related to the language model generated code.

[0116] According to the target sub-feature of each word unit, a code detection result is determined.

[0117] In some possible implementation manners, the hybrid expert model further includes a feedforward neural network and a classifier, an input of the feedforward neural network is an output of the first expert model, the second expert model and the third expert model, and an input of the classifier is an output of the feedforward neural network; and the detection module 403 is specifically configured to:

[0118] For the target sub-feature of each word unit, the following operations are performed: sending the target sub-feature of the word unit to the feedforward neural network, so that the feedforward neural network fuses the target sub-feature of the word unit according to the expert model activation probability of the word unit, to obtain a target feature of the word unit.

[0119] The target feature of each word unit is sent to the classifier, and a code detection result output by the classifier is obtained.

[0120] In some possible implementation manners, the apparatus 40 further includes a handling module, and the handling module is configured to:

[0121] In response to the code detection result representing that the first code belongs to obfuscated code generated by a language model for performing a first type of attack, a handling suggestion for the first code is generated; wherein the handling suggestion includes at least one of the following: a code obfuscation manner of the first code and code content generated by the language model in the first code.

[0122] In some possible implementation manners, the hybrid expert model is trained in the following manner:

[0123] Obtaining non-attack code samples and first type of attack code samples, taking the non-attack code samples as negative samples and the first type of attack code samples as positive samples, training a first pre-trained model, and obtaining the first expert model;

[0124] obtain a second pre-training model, and train the second pre-training model by taking the unobfuscated code samples as negative samples and the obfuscated code samples as positive samples to obtain the second expert model;

[0125] obtain a third pre-training model, and train the third pre-training model by taking the manually written code samples as negative samples and the language model generated code samples as positive samples to obtain the third expert model.

[0126] In some possible implementation manners, the first type of attack code samples include at least one of the following: manually written first type of attack codes and language model generated first type of attack obfuscated codes; the obfuscated code samples include at least one of the following: manually written obfuscated codes and language model generated obfuscated codes; and the language model generated code samples include at least one of the following: language model generated obfuscated codes and language model generated codes.

[0127] In some possible implementation manners, the language model generated first type of attack obfuscated codes and the language model generated obfuscated codes are generated in the following manner:

[0128] obtain first obfuscated codes, second obfuscated codes, first non-obfuscated codes and second non-obfuscated codes; the first obfuscated codes are obfuscated codes used for performing a first type of attack, the second obfuscated codes are obfuscated codes irrelevant to the first type of attack, the first non-obfuscated codes are non-obfuscated codes used for performing the first type of attack, and the second non-obfuscated codes are non-obfuscated codes irrelevant to the first type of attack;

[0129] extract at least one code obfuscation manner from the first obfuscated codes and the second obfuscated codes by using a first language model;

[0130] obtain language model generated first type of attack obfuscated codes and language model generated obfuscated codes by using a second language model and based on the at least one code obfuscation manner.

[0131] In some possible implementation manners, the code obfuscation manner includes at least one of the following:

[0132] a manner of using a bit operator to operate on a string in code;

[0133] a manner of splicing or splitting a string in code;

[0134] a manner of using a random variable name in code;

[0135] Methods for obfuscating the input and output parameters of function calls in code;

[0136] Methods for obfuscating conditional statements in code.

[0137] In some possible implementations, the code generated by the language model is generated in the following way:

[0138] Obtain a third unobfuscated code and a fourth unobfuscated code; wherein, the third unobfuscated code is unobfuscated code used to perform a first type of attack, and the second unobfuscated code is unobfuscated code unrelated to the first type of attack;

[0139] The third unobfuscated code and the fourth unobfuscated code are rewritten using a third language model to obtain the code generated by the language model.

[0140] The code detection device 40 according to the embodiments of this application can correspondingly execute the method described in the embodiments of this application, and the above and other operations and / or functions of each module / unit of the code detection device 40 are respectively for implementing Figure 1 For the sake of brevity, the corresponding processes of each method in the illustrated embodiments will not be described in detail here.

[0141] This application also provides an electronic device. This electronic device is specifically used to implement, as described above. Figure 4 The code detection device 40 in the illustrated embodiment has the following functions.

[0142] Figure 5 A structural schematic diagram of an electronic device 500 is provided, such as... Figure 5 As shown, the electronic device 500 includes a bus 501, a processor 502, a communication interface 503, and a memory 504. The processor 502, the memory 504, and the communication interface 503 communicate with each other via the bus 501.

[0143] Bus 501 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0144] The processor 502 can be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP), etc.

[0145] The communication interface 503 is configured to communicate with an external device. For example, the communication interface 503 can be configured to communicate with a terminal.

[0146] The memory 504 can include a volatile memory, such as a random access memory (RAM) and / or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD).

[0147] The memory 504 stores executable code, and the processor 502 executes the executable code to perform the code detection method.

[0148] Specifically, in the case of implementing the code detection apparatus 40 as shown in the embodiments, and Figure 4 The modules or units of the code detection apparatus 40 described in the embodiments are implemented by software in the case of implementing the code detection apparatus 40 as shown in the embodiments, and Figure 4 In the case of implementing the modules or units of the code detection apparatus 40 described in the embodiments by software, the software or program code required to perform the functions of the modules / units in the above embodiments can be partially or entirely stored in the memory 504. The processor 502 executes the program code corresponding to each unit stored in the memory 504 to perform the code detection method. Figure 4

[0149] The embodiments of the present application also provide a computer readable storage medium. The computer readable storage medium can be any available medium or data storage device that can store data which can be accessed by a computing device, or a data center containing one or more available media or data storage devices. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk), etc. The computer readable storage medium includes instructions, which instruct the computing device to perform the code detection method applied to the code detection apparatus 40 described above.

[0150] ​The embodiments of the present application further provide a computer program product including one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in the embodiments of the present application are generated.

[0151] The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website site, computer or data center to another website site, computer or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.).

[0152] The computer program product is executed by a computer, and the computer executes any of the foregoing code detection methods. The computer program product can be a software installation package, and when any of the foregoing code detection methods is needed, the computer program product can be downloaded and executed on the computer.

[0153] The flowcharts and block diagrams in the drawings illustrate the possible implementation architecture, function and operation of the systems, methods and computer program products according to the embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment, or a part of code that includes one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order than that shown in the figures. For example, two blocks that are shown in succession can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the involved functions. It should also be noted that each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0154] The units involved in the embodiments of the present application can be implemented in software or in hardware. Among them, the name of the unit / module does not constitute a limitation on the unit itself in some cases.

[0155] The functions described above in the present application can be executed at least partially by one or more hardware logic components. For example, non-limiting exemplary types of hardware logic components that can be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system on a chip (SOCs), complex programmable logic devices (CPLDs), etc.

[0156] In the context of the embodiments of the present application, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0157] It should be noted that the various embodiments described in the specification are progressive, and each embodiment focuses on the differences from other embodiments. The same and similar parts between embodiments can be mutually referred to. For the system or device disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0158] It should be understood that in the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the association relationship between the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent: only A, only B, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally represents that the front and rear associated objects are a "or" relationship. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c, can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0159] It is also to be noted that, as used in the specification and the appended claims, the singular forms "a," "an" and "the" include plural referents unless otherwise indicated. Furthermore, to the extent that the terms "including," "includes," "having," "has," "with," or "contains" are used in either the detailed description and the claims, such terms are intended to be inclusive in a manner similar to the term "comprising" as an open transition term without precluding any additional or other elements.

[0160] The embodiments disclosed herein can each be implemented as a method, apparatus, or article of manufacture using programming instructions. The embodiments disclosed herein can be implemented using software, firmware, hardware, or a combination thereof. The various elements of the disclosed embodiments, as well as the procedural aspects of the disclosed embodiments, can be implemented using a variety of programming instructions, software, firmware, or the like. In one embodiment, the programming instructions are implemented using a high-level procedural or object-oriented programming language to

[0161] The above description of disclosed embodiments is intended to be illustrative and not restrictive. Many embodiments will be apparent to those of skill in the art upon reading and understanding the above description, and it is therefore contemplated to be within the scope of the claims to claim any such embodiments. The scope of the claims should not be limited to the foregoing description, and embodiments can be practiced in other than the exemplary embodiments which are implemented in the direction of the claims.

Claims

1. A code detection method, characterized in that, The method includes: Get the first code; The first code is segmented into words to obtain multiple word units; The multiple lexical units are input into a hybrid expert model, and the code detection result output by the hybrid expert model is received. The hybrid expert model includes a first expert model for extracting features related to the first type of attack, a second expert model for extracting features related to obfuscated code, and a third expert model for extracting features related to code generated by a language model. The code detection result is determined based on multiple features among the features related to the first type of attack, the features related to obfuscated code, and the features related to code generated by a language model. The code detection result is used to characterize whether the first code belongs to obfuscated code generated by a language model for performing the first type of attack.

2. The method according to claim 1, characterized in that, The hybrid expert model further includes a gate routing, the output of which is the input of the first expert model, the second expert model, and the third expert model, respectively. The step of inputting the multiple lexical units into the hybrid expert model and receiving the code detection results output by the hybrid expert model includes: For each of the plurality of lexical units, the following operations are performed: the lexical unit is input into the gate routing, such that the gate routing determines the expert model activation probability of the lexical unit, and the lexical unit is sent to the target expert model corresponding to the expert model activation probability to obtain the target sub-feature of the lexical unit returned by the target expert model; wherein, the target expert model is multiple of the first expert model, the second expert model, and the third expert model, and the target sub-feature is multiple of the features related to the first type of attack, the features related to obfuscated code, and the features related to language model generated code; The code detection result is determined based on the target sub-features of each lexical unit.

3. The method according to claim 2, characterized in that, The hybrid expert model further includes a feedforward neural network and a classifier. The input of the feedforward neural network is the output of the first expert model, the second expert model, and the third expert model. The input of the classifier is the output of the feedforward neural network. The step of determining the code detection result based on the target sub-features of each word includes: For each word element's target sub-feature, the following operations are performed: the target sub-feature of the word element is sent to the feedforward neural network, so that the feedforward neural network fuses the target sub-feature of the word element according to the activation probability of the expert model of the word element to obtain the target feature of the word element; The target features of each word are sent to the classifier to obtain the code detection results output by the classifier.

4. The method according to claim 1, characterized in that, The method further includes: In response to the code detection result indicating that the first code is obfuscated code generated by a language model for performing a first type of attack, a handling suggestion is generated for the first code; wherein, the handling suggestion includes at least one of the following: the code obfuscation method of the first code and the code content generated by the language model in the first code.

5. The method according to any one of claims 1 to 4, characterized in that, The hybrid expert model is trained in the following manner: Obtain non-attack code samples and first-type attack code samples, use the non-attack code samples as negative samples and the first-type attack code samples as positive samples, train the first pre-trained model to obtain the first expert model; Obtain unobfuscated code samples and obfuscated code samples, use the unobfuscated code samples as negative samples and the obfuscated code samples as positive samples, train the second pre-trained model to obtain the second expert model; Obtain manually written code samples and code samples generated by a language model. Use the manually written code samples as negative samples and the code samples generated by the language model as positive samples to train a third pre-trained model to obtain the third expert model.

6. The method according to claim 5, characterized in that, The first type of attack code sample includes at least one of the following: manually written first type of attack code and first type of attack obfuscation code generated by a language model; The obfuscated code sample includes at least one of the following: manually written obfuscated code and obfuscated code generated by a language model; The code samples generated by the language model include at least one of the following: obfuscated code generated by the language model and code generated by the language model.

7. The method according to claim 6, characterized in that, The first type of attack obfuscation code generated by the language model and the obfuscation code generated by the language model are generated in the following manner: Obtain first obfuscated code, second obfuscated code, first unobfuscated code, and second unobfuscated code; wherein, the first obfuscated code is obfuscated code used to perform a first type of attack, the second obfuscated code is obfuscated code unrelated to the first type of attack, the first unobfuscated code is unobfuscated code used to perform the first type of attack, and the second unobfuscated code is unobfuscated code unrelated to the first type of attack; Using a first language model, code obfuscation methods are extracted from the first obfuscated code and the second obfuscated code to obtain at least one code obfuscation method; Using a second language model, and based on the at least one code obfuscation method, the first unobfuscated code and the second unobfuscated code are obfuscated to obtain the first type of attack obfuscated code generated by the language model and the obfuscated code generated by the language model.

8. The method according to claim 7, characterized in that, The code obfuscation method includes at least one of the following: The way to manipulate strings in code using bitwise operators; Methods for concatenating or splitting strings in code; The way to use random variable names in code; Methods for obfuscating the input and output parameters of function calls in code; Methods for obfuscating conditional statements in code.

9. The method according to claim 6, characterized in that, The code generated by the language model is generated in the following manner: Obtain a third unobfuscated code and a fourth unobfuscated code; wherein, the third unobfuscated code is unobfuscated code used to perform a first type of attack, and the fourth unobfuscated code is unobfuscated code unrelated to the first type of attack; The third unobfuscated code and the fourth unobfuscated code are rewritten using a third language model to obtain the code generated by the language model.

10. A code detection device, characterized in that, The device includes: The acquisition module is used to acquire the first code; The word segmentation module is used to segment the first code into multiple word units; The detection module is used to input the multiple lexical units into a hybrid expert model and receive the code detection results output by the hybrid expert model. The hybrid expert model includes a first expert model for extracting features related to a first type of attack, a second expert model for extracting features related to obfuscated code, and a third expert model for extracting features related to code generated by a language model. The code detection results are determined based on multiple features among the features related to the first type of attack, the features related to obfuscated code, and the features related to code generated by the language model. The code detection results are used to characterize whether the first code belongs to obfuscated code generated by a language model for executing a first type of attack.

11. An electronic device, characterized in that, The electronic device includes a processor and a memory; The processor is configured to execute instructions stored in the memory, causing the electronic device to perform the method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, Includes instructions that instruct an electronic device to perform the method as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product includes computer-readable instructions for implementing the method according to any one of claims 1 to 9.

Images