Network attack chain construction method and system based on large language model

Abstract

The invention discloses a network attack chain construction method and system based on a large language model, and aims to improve the recognition precision and analysis efficiency of complex network security attacks. According to the method, alarms are captured in real time, and attributes are analyzed; and constructing an attack sub-graph according to alarm attributes, and then performing dynamic adjustment to complete construction of a plurality of attack chains. According to the method, a large language model is connected with MITREATTamp; according to the method and the system, the CK framework is combined, so that recognition and multi-dimensional analysis of complex network attacks are realized, the accuracy and effectiveness of network attack chain construction are improved, and the detection and analysis capability of network security events is improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a network attack chain construction method based on a large language model and a system thereof. Background Art

[0002] The attack chain (also known as the kill chain, cyber attack life cycle or attack life cycle) is a conceptual model used to describe the complete process of a cyber attack, a series of phased steps from the attacker's initial reconnaissance activities to the final achievement of its attack objectives. The core steps include: analyzing the attack behavior and identifying the target (tactics) of the attack; selecting and mapping appropriate techniques; and constructing the attack chain in the order of the attack process to help understand each stage of the attack.

[0003] The existing attack chain construction methods have the following challenges: First, most matching algorithms using the MITREATT&CK framework rely on existing text descriptions, which makes mapping more difficult when facing new attack methods; the MITREATT&CK framework is a knowledge base created and maintained by MITRE, and its full name is MITRE Adversarial Tactics, Techniques, and Common Knowledge. Second, modern attacks are usually not linear. Attackers may adjust strategies, switch paths, or backtrack attacks in previous stages at different stages. Traditional methods find it difficult to accurately capture the complex relationships and dynamic changes in the attack chain.

[0004] Based on the above problems, an attack chain construction method based on a large language model is proposed. This method first monitors network traffic in real time through packet capture technology, extracts potential abnormal information from it, and forms a preliminary raw data set; then, based on the raw data set, an attack subgraph is constructed; the attack graph nodes are analyzed using a large language model, natural language annotations of the nodes and their vector representations are generated, and an attack graph is constructed; then, the attack graph is intelligently matched and adjusted with the MITREATT&CK framework to complete the construction of the network attack chain. Summary of the invention

[0005] The purpose of the present invention is to provide a network attack chain construction method and system based on a large language model to meet the needs of the existing network security field. The method utilizes the powerful natural language processing and reasoning capabilities of the large language model, combined with anomaly detection and structured analysis of network traffic data packets, to achieve intelligent identification of complex network attack events, intelligent matching of attack tactics and technologies, and construction of attack chains.

[0006] To achieve the above objectives, in a first aspect, the present invention provides a method for constructing a network attack chain based on a large language model, the method comprising:

[0007] Step S1, capturing alarms from network traffic in real time through packet capture attack technology, and parsing the attributes of the alarms, wherein the attributes include timestamp, source IP, target IP, source port, target port, protocol name, description information, and alarm category;

[0008] Step S2: construct an attack subgraph of the same attack tactics and the same category within the same time window according to the alarm;

[0009] Step S3, associating several attack subgraphs that may belong to the next attack tactic in the same attack chain to form an attack graph;

[0010] Step S4: dynamically adjust the attack graph to complete the construction of multiple attack chains.

[0011] In a second aspect, the present invention provides a network attack chain construction system, comprising:

[0012] The data acquisition module is responsible for capturing alarms in real time and analyzing their attributes;

[0013] The attack subgraph construction module is responsible for constructing attack subgraphs of the same attack tactics and the same category within the same time window based on the alerts;

[0014] The attack graph construction module is responsible for associating several attack subgraphs that may belong to the next attack tactic in the same attack chain to form an attack graph;

[0015] The update module is responsible for dynamically adjusting the attack graph and completing the construction of multiple attack chains.

[0016] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described.

[0017] In a fourth aspect, the present invention provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the described method is implemented.

[0018] Compared with the prior art, the present invention has the following advantages:

[0019] The network attack chain construction method based on the large language model proposed in the present invention utilizes the powerful natural language processing and reasoning capabilities of the large language model to significantly improve the intelligent identification of network attack events and the accuracy of attack chain construction; by combining the anomaly detection and structured analysis technology of network traffic data packets, it realizes intelligent matching with the MITRE ATT&CK framework, accurately identifies attack tactics and attack techniques, and automatically constructs complex attack chains, with higher recognition accuracy than the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Flowchart of the method for building a cyber attack chain based on a large language model.

[0021] Figure 2 Schematic diagram of the method for building a network attack chain based on a large language model.

[0022] Figure 3 This is a specific flow chart of step S2 in the network attack chain construction method based on a large language model.

[0023] Figure 4 This is a specific flow chart of step S31 in the network attack chain construction method based on a large language model.

[0024] Figure 5 This is a specific flow chart of step S32 in the network attack chain construction method based on a large language model.

[0025] Figure 6 This is a specific flow chart of step S4 in the network attack chain construction method based on a large language model. DETAILED DESCRIPTION

[0026] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0027] In the description of this specification, the terms "include", "including", "have", "contain", etc. are all open terms, which mean including but not limited to. The descriptions with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", etc. mean that the specific features, structures or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0028] Combination Figure 1-2 This embodiment provides a network attack chain construction method based on a large language model. First, the network traffic is monitored in real time through packet capture technology to find potential abnormal information and form an original data set; the original data set is parsed, and the attack tactics are preliminarily determined in combination with a predefined mapping table to construct an attack subgraph; the attack graph nodes are analyzed using a large language model to generate node annotations and their vector representations to construct an attack graph; and the attack graph is intelligently matched with the MITREATT&CK framework to realize the construction of an attack chain. Specifically, the following steps are included:

[0029] Step S1, capturing alarms from network traffic in real time through packet capture attack technology, and analyzing the attributes of the alarms;

[0030] Step S2, constructing an attack subgraph of the same attack tactic and the same category within the same time window according to the alarm; Step S3, associating several attack subgraphs that may belong to the next attack tactic in the same attack chain to form an attack graph;

[0031] Step S4: dynamically adjust the attack graph to complete the construction of multiple attack chains.

[0032] Furthermore, in one embodiment, step S1 includes the following steps:

[0033] Use an intrusion detection system to capture alarms in real time, and parse the attributes of the alarms, including timestamp (time), source IP (src_ip), destination IP (dest_ip), source port (src_port), destination port (dest_port), protocol name (protocol), description information (description), category (classification), to form a preliminary original data set original_data_set. For example, use tools such as Snort and Suricata to extract traffic data packets.

[0034] Further, see Figure 3 In one embodiment, step S2 includes the following steps:

[0035] S21. A predefined mapping table, wherein the mapping table has two columns, one column is the attack tactics defined by the MITREATT&CK framework, and the other column is the alert category;

[0036] Table 1 Mapping table example

[0037]

[0038]

[0039] S22. Based on the mapping table, preliminarily determine the attack tactics of each alarm in the original data set original_data_set, insert the attack tactics into each alarm, and mark the unmatched attack tactics as empty;

[0040] For example, according to the table, PotentialCorporatePrivacyViolation corresponds to the Collection tactic, accesstoapotentiallyvulnerablewebapplication is not mentioned, and its tactic is marked as empty;

[0041] S23. For the alarms that are not matched to the attack tactics, the description information and the alarm category are input into the large language model for analysis to obtain the corresponding attack tactics;

[0042] For example, input “access to a potentially vulnerable web application” and “WEB-MISC robots.txtaccess” into the large language model, query their corresponding MITREATT&CK framework tactics, and obtain a preliminary judgment that they may correspond to InitialAccess;

[0043] S24. Generate graph node N based on the original data set original_data_set i ;

[0044] N i =(ID,time,src_ip,dest_ip,src_port,dest_port,protocol,description,classification,tactic,technique,comment,vector)

[0045] Where ID is the alarm number, time is the timestamp, src_ip is the source IP, dest_ip is the destination IP, src_port is the source port, dest_port is the destination port, protocol is the protocol name, description is the description information, classification is the category, technique is the technology, comment is the node comment, and vector is the vector representation of the comment;

[0046] S25. The graph nodes with the same attack tactics and the same category in the same time window are taken as nodes of the attack subgraph, and the temporal relationship of the graph nodes is taken as the edge relationship to form an attack subgraph AttackG' with the same attack tactics and the same category;

[0047] The temporal relationship of the graph nodes is based on the similarity R(Ni ,N j ) to calculate:

[0048]

[0049] Where δ is the attribute weight, n is the number of attributes; N i ,N j Represents any two graph nodes.

[0050] S(N ik ,N jk ) is the k-th attribute similarity, which is calculated as follows:

[0051]

[0052] If R(N i ,N j )>λ1, where λ1 is the similarity threshold, it is considered that there is a correlation between the two graph nodes; when N i .time≥N j .time to establish slave node N j To Node N i The directed connection of ji (N j ,N i ); when N i .time <N j .time, establish slave node N i To Node N j The directed connection of ij (N i ,N j );N i .time represents the attack graph node N i Timestamp attribute of N i .time and N j .time size comparison is a comparison of its timing relationship. If N i Occurs in N j Previously, it was believed that N i .time <N j .time;

[0053] If R(N i ,N j )≤λ1, it is considered that there is no association relationship between the two graph nodes.

[0054] Furthermore, the step S3 comprises:

[0055] S31. Correlate attack subgraphs of different alarm categories within the same attack tactic; see Figure 4 As shown, specifically:

[0056] For each attack subgraph of different alert categories within the same attack tactic, the large language model is used to analyze the graph node N i , generate corresponding natural language annotations according to MITREATT&CK, and update node N i The node comment comment attribute;

[0057] Perform word segmentation preprocessing on the node comment attribute of each graph node to obtain multiple word segmentation Tokens; input multiple word segmentation Tokens into the BERT model, and extract the vector of the [CLS] tag from the output of the BERT model as the vector representation of the entire comment N i .vector, i.e. key annotation vector;

[0058] The word segmentation preprocessing is expressed as follows:

[0059] Tokens = Tokenizer (N i .comment)

[0060] Use a large language model to perform semantic analysis on the key annotation vector and analyze the attack subgraph AttackG i 'The end node N i and other attack subgraphs AttackG j 'The first node N j If there is a logical relationship, the association is performed based on the timestamp attribute; if there is no logical relationship, no operation is performed; until all attack subgraphs of different alarm categories in the same attack tactic are associated.

[0061] The above logical relationship refers to the association between different nodes or attack subgraphs in the attack chain. For example, the attack subgraph AttackG i 'The end node N i Input it into the large language model to obtain the attack intention text, convert the intention text into a vector form, namely the intention vector; and compare the intention vector with other attack subgraphs AttackG j 'The first node N j The key annotation vector N j .vector performs cosine similarity calculation, and if the similarity is higher than the threshold, it is determined that there is a logical relationship.

[0062] If the association is based on the timestamp attribute, i .time <N j .time, then establish slave node N i To Node N j A directed connection is established from node N.j To Node N i Directed connections of

[0063] S32. After processing the attack subgraphs in step S31 for different attack tactics, the attack subgraphs are associated; see Figure 5 As shown, specifically:

[0064] For each attack subgraph with different attack tactics, the large language model is used to analyze the graph node N i , generate corresponding natural language annotations according to MITREATT&CK, and update node N i The node comment comment attribute;

[0065] Perform word segmentation preprocessing on the node comment attribute of each graph node to obtain multiple word segmentation Tokens; input multiple word segmentation Tokens into the BERT model, and extract the vector of the [CLS] tag from the output of the BERT model as the vector representation of the entire comment N i .vector, i.e. key annotation vector;

[0066] Use a large language model to perform semantic analysis on the key annotation vector and analyze the attack subgraph AttackG i 'The graph nodes with out-degree 0 and other attack subgraphs AttackG j 'The logical relationship between the graph nodes with in-degree 0; if there is a logical relationship, the association is performed based on the timestamp attribute; if there is no logical relationship, no operation is performed; until all attack subgraphs located in different attack tactics are associated to form an attack graph AttackG = (N, E).

[0067] The above logical relationship refers to the association between different nodes or subgraphs in the attack chain. For example, the attack subgraph AttackG i 'The graph nodes with out-degree 0 are input into the large language model to obtain the attack intention text, and the intention text is converted into a vector form, namely the intention vector; the intention vector and other attack subgraphs AttackG j 'The key annotation vector N of the graph node with in-degree 0 j .vector performs cosine similarity calculation, and if the similarity is higher than the threshold, it is determined that there is a logical relationship.

[0068] If N is associated based on the timestamp attribute i .time <N j .time, then establish slave node N i To Node N j A directed connection is established from node N. j To Node N i Directed connections of

[0069] Further, see Figure 3 In a specific embodiment, step S4 includes the following steps:

[0070] S41. Perform word segmentation preprocessing on the natural language description of each attack tactic and attack technique in the MITRE ATT&CK framework, and then input it into the BERT model to extract the vector of the [CLS] tag as the vector representation of the entire annotation, that is, the key attack tactic vector V tactic 、Key attack technology vector V technique The generated vector is stored in an array. The tactical vector array is TacticVectors = [V tactic1 ,V tactic2 ,...,V tacticn ], the array of technology vectors is TechniqueVectors = [V technique1 ,V technique2 ,...,V technique n ];

[0071] S42. For each graph node in the attack graph, the first node similarity is calculated according to the key annotation vector and the key attack tactic vector; if the first node similarity is greater than or equal to the threshold λ2, the attack tactic attribute of the current graph node remains unchanged, otherwise the attack graph is updated;

[0072] The calculation formula for the first node similarity is:

[0073]

[0074] The attack graph update process is as follows:

[0075] Disconnect node N i With node N i-1 Node N i+1 The connection and directed connection node N i-1 With node N i+1 , computing nodes N i The similarity between the annotation vector of and other tactical vectors:

[0076]

[0077] Update the tactic with the greatest similarity to the current node N i Attack tactic attribute N i .tactic;

[0078] Other nodes in the same attack strategy Nodes_tratic = {N j |N j .tactic=N i .tactic ans N j≠N i} Filter out the two nodes before and after as candidate points, and then calculate the first context similarity between the current node and the candidate points; then insert the current node between the candidate points with the highest first context similarity;

[0079] P valid ={(N j ,N j+1 )|N j .time≤N i .time <N j+1 .timeand N j ,N j+1 ∈Nodes}

[0080] The first context similarity between the current node and the candidate point is calculated as follows:

[0081] S context =S(N i .vector,N j .vector)+S(N i .vector,N j+1 .vector)

[0082] Insert the node into the first context cosine similarity S context The highest candidate point (N j , N j+1 ), if N i .time is less than the node with the smallest timestamp in Nodes_tratic, then N i Before inserting the node with the smallest timestamp, if N i .time is greater than the node with the largest timestamp in the same Nodes_tratic, then N i Insert after the node with the largest timestamp;

[0083] S43. Use a large language model to infer each node N i The corresponding MITREATT&CK framework attack technique. If a technique in the MITREATT&CK framework has multiple sub-techniques, continue to reason about the node to determine whether it is associated with a sub-technique, and update the most relevant attack technique to the attack technique attribute of the node;

[0084] For example, the inference result of node N1 is attack technology T1020: Automated Exfiltration. After further analysis, it matches the sub-technology T1020.003: Exfiltration Over Unencrypted / Obfuscated Channels, so N1.technique=T1020.003 is recorded. The inference result of node N2 is attack technology T1595: Active Scanning. Since there is no sub-technology association, N2.technique=T1595 is directly updated.

[0085] S44. For each graph node in the attack graph, according to the key annotation vector N i .comment.vector and the key attack technique vector TechniqueVectors calculate the similarity of the second node; if the similarity of the second node is greater than or equal to the threshold λ3, the attack technique attribute of the current graph node remains unchanged, otherwise the attack graph is updated;

[0086] The second node similarity calculation formula is:

[0087]

[0088] The attack graph update process is as follows:

[0089] Disconnect the current graph node N i With the previous and next nodes N i-1 、N i+1 The connection and directed connection node N i-1 With node N i+1 , computing nodes N i The similarity between the key annotation vector and other key attack technology vectors; select the attack technology with the largest similarity and update it as the current node N i The attack technology attributes;

[0090] Node N i The similarity between the key annotation vector of and other key attack technique vectors is calculated as follows:

[0091]

[0092] Other nodes in the same attack technique Nodes_technique = {N j |N j .technique=N i .technique, N j ≠N i}, the two nodes before and after are selected as candidate points, and then the second context similarity between the current node and the candidate points is calculated; then the current node is inserted between the candidate points with the highest second context similarity;

[0093] P valid ={(N j ,N j+1 )|N j .time≤N i .time <N j+1 .time}

[0094] Insert the node into the second context cosine similarity S context The highest candidate point (N j , N j+1 ), if N i .time is less than the node with the smallest timestamp in Nodes_technique, then N i Before inserting the node with the smallest timestamp, if N i .time is greater than the node with the largest timestamp in Nodes_technique, then N i Insert after the node with the largest timestamp;

[0095] S45. Globally calculate the third context similarity between each node based on the key annotation vector:

[0096]

[0097] Traverse all outgoing edges of each node and retain the outgoing edge with the largest third context similarity;

[0098] S46. Delete isolated nodes, treat each subgraph as an independent network attack chain, extract tactics and their corresponding technology or sub-technology IDs in the subgraph, and output a network attack chain detection report based on the MITRE ATT&CK framework. The specific content includes tactics, technology, sub-technology, and description information.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network attack chain construction method based on a large language model, characterized in that: The method comprises: Step S1, capturing alarms from network traffic in real time through packet capture attack technology, and parsing the attributes of the alarms, wherein the attributes include timestamp, source IP, target IP, source port, target port, protocol name, description information, and alarm category; Step S2: construct an attack subgraph of the same attack tactic and the same category according to the alarm; Step S3, associating several attack subgraphs that may belong to the next attack tactic in the same attack chain to form an attack graph; Step S4: dynamically adjust the attack graph to complete the construction of multiple attack chains.

2. The method according to claim 1, characterized in that: Step S2 specifically includes: Pre-built mapping table of attack tactics and alert categories; Based on the mapping table, the attack tactics are initially determined for each alarm, and then the attack tactics are re-determined for the alarms that do not match the attack tactics; Generate graph nodes based on the attributes of the alert and the attack tactics; The graph nodes with the same attack tactics and the same category in the same time window are taken as nodes of the attack subgraph, and the temporal relationship of the graph nodes is taken as the edge relationship to form an attack subgraph AttackG' with the same attack tactics and the same category.

3. The method according to claim 2, characterized in that: In step S2, the secondary determination of the attack tactics is to input the description information and category of the alarm that is not matched with the attack tactics into the large language model for analysis to obtain the corresponding attack tactics.

4. The method according to claim 1, characterized in that: Step S3 specifically includes: Correlate attack subgraphs of different alert categories within the same attack tactic; Correlate the attack subgraphs of different attack tactics.

5. The method according to claim 4, characterized in that: As described in step S3, the attack subgraphs of different alarm categories within the same attack tactic are associated; Specifically: For each attack subgraph of different alert categories within the same attack tactic, a large language model is used to analyze the graph nodes to generate corresponding natural language annotations, which are used as node annotation attributes of the graph nodes. Perform word segmentation preprocessing on the node annotation attribute of each graph node to obtain multiple word segments; input multiple word segments into the BERT model to obtain the key annotation vector; Use a large language model to perform semantic analysis on the key annotation vector and analyze the attack subgraph AttackG i 'The end node N i and other attack subgraphs AttackG j 'The first node N j If there is a logical relationship, the association is performed based on the timestamp attribute; if there is no logical relationship, no operation is performed; until all attack subgraphs of different alarm categories in the same attack tactic are associated.

6. The method according to claim 4, characterized in that: Step S3 associates the attack subgraphs of different attack tactics; specifically: For each attack subgraph of different attack tactics, a large language model is used to analyze the graph nodes to generate corresponding natural language annotations, which are used as node annotation attributes of the graph nodes. Perform word segmentation preprocessing on the node annotation attribute of each graph node to obtain multiple word segments; input multiple word segments into the BERT model to obtain the key annotation vector; Use a large language model to perform semantic analysis on the key annotation vector and analyze the attack subgraph AttackG i 'The graph nodes with out-degree 0 and other attack subgraphs AttackG j 'The logical relationship between the graph nodes with in-degree 0; if there is a logical relationship, it is associated according to the timestamp attribute; if there is no logical relationship, no operation is performed; until all attack subgraphs located in different attack tactics are associated to form an attack graph.

7. The method according to claim 1, characterized in that: Step S4 specifically includes: S41 performs word segmentation preprocessing on the natural language descriptions of all attack tactics and attack techniques, and then inputs them into the BERT model to extract key attack tactic vectors and key attack technique vectors; S42, for each graph node in the attack graph, calculates the first node similarity according to the key annotation vector and the key attack tactic vector; if the first node similarity is greater than or equal to a threshold, the attack tactic attribute of the current graph node remains unchanged, otherwise the attack graph is updated; The attack graph update process is as follows: Disconnect the current graph node N i With the previous and next nodes N i-1 、N i+1 The connection and directed connection node N i-1 With node N i+1 , computing nodes N i The similarity between the key annotation vector and other key attack tactics vectors; select the attack tactics with the largest similarity and update it as the current node N i The attacking tactical attributes; Select the two nodes before and after from other nodes of the same attack tactic as candidate points, and then calculate the first context similarity between the current node and the candidate points; Then the current node is inserted between the candidate points with the highest first context similarity; S43 uses a large language model to infer the attack technology corresponding to each graph node. If the attack technology of a node has multiple sub-attack technologies, the node is continued to be inferred to determine whether it is associated with the sub-attack technology, and the most relevant attack technology is added to the attack technology attribute of the node; S44, for each graph node in the attack graph, calculate the second node similarity according to the key annotation vector and the key attack technique vector; if the second node similarity is greater than or equal to a threshold, the attack technique attribute of the current graph node remains unchanged, otherwise the attack graph is updated; The attack graph update process is as follows: Disconnect the current graph node N i With the previous and next nodes N i-1 、N i+1 The connection and directed connection node N i-1 With node N i+1 , computing nodes N i The similarity between the key annotation vector and other key attack technique vectors; Select the attack technology with the greatest similarity and update it to the current node N i The attack technology attributes; Select the previous and next two nodes from other nodes of the same attack technique as candidate points, and then calculate the second context similarity between the current node and the candidate points; Then the current node is inserted between the candidate points with the highest second context similarity; S45 globally calculates the contextual similarity between each node based on the key annotation vector; Traverse all outgoing edges of each node and retain the outgoing edge with the greatest context similarity; S46 deletes isolated nodes, treats each attack subgraph as an independent network attack chain, extracts attack tactics and their corresponding attack techniques or sub-attack technique IDs in the attack subgraph, and obtains a network attack chain detection report.

8. A network attack chain construction system implementing the method described in any one of claims 1 to 7, characterized in that: include: The data acquisition module is responsible for capturing alarms in real time and analyzing their attributes; The attack subgraph construction module is responsible for constructing attack subgraphs of the same attack tactics and the same category within the same time window based on the alerts; The attack graph construction module is responsible for associating several attack subgraphs that may belong to the next attack tactic in the same attack chain to form an attack graph; The update module is responsible for dynamically adjusting the attack graph and completing the construction of multiple attack chains.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 7.

10. A computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 7 is implemented.

Images