Network threat detection method and system, storage medium and electronic equipment

Abstract

The invention discloses a network threat detection method and system, a storage medium and electronic equipment, and relates to the technical field of network security, and the method comprises the steps: collecting multi-modal cross-domain heterogeneous data, extracting the multi-modal features of the multi-modal cross-domain heterogeneous data, carrying out the cross-modal feature fusion of the multi-modal features, obtaining the fusion features, and carrying out the detection of the network threat. And inputting the fusion feature into a network threat detection model, and carrying out network threat detection to obtain a detection result. And updating hyper-parameters of the network threat detection model and weight parameters related to the fusion features according to the fusion features and the detection result. By introducing multi-modal cross-domain heterogeneous data, the accuracy and coverage of threat detection are enhanced. And a self-adaptive model updating mechanism is set, so that real-time local adjustment of model parameters and automatic optimization of hyper-parameters are realized, and novel threats are quickly responded.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network threat detection method, system, storage medium, and electronic device. Background Technology

[0002] In the modern network environment, the core objective of a network security protection system is to protect information assets from unauthorized access, tampering, damage, or disclosure—a well-known fact in the field of network security. To achieve this goal, a network security protection system must possess the capabilities of real-time detection, rapid response, prevention, and recovery, with network threat detection being a crucial component.

[0003] In existing network threat detection methods, traditional rule-based protection methods are no longer sufficient to deal with new types of attacks. Currently, most methods rely on the fusion of multi-source heterogeneous data, such as network traffic and logs, and combine machine learning and artificial intelligence technologies to identify unknown threats in order to improve detection accuracy and adaptability.

[0004] However, existing network threat detection methods primarily rely on single or overly broad data types, failing to effectively integrate multimodal data from different domains. This makes it difficult for detection models to accurately capture complex threat characteristics, limiting the comprehensiveness and accuracy of threat detection. Furthermore, updating detection models typically requires manual adjustment or retraining, resulting in lag and an inability to respond promptly to rapidly changing threat environments. Summary of the Invention

[0005] In view of this, this application provides a network threat detection method, system, storage medium, and electronic device to improve the accuracy and coverage of network threat detection.

[0006] Firstly, this application provides a method for detecting network threats, including:

[0007] Collect multimodal, cross-domain heterogeneous data;

[0008] Extract the multimodal features from the multimodal cross-domain heterogeneous data;

[0009] Perform cross-modal feature fusion on the multimodal features to obtain fused features;

[0010] The fused features are input into the network threat detection model to perform network threat detection and obtain the detection results;

[0011] The hyperparameters of the network threat detection model and the weight parameters related to the fusion features are updated based on the fusion features and the detection results.

[0012] In some embodiments of this disclosure, the acquisition of multimodal cross-domain heterogeneous data includes:

[0013] Detect the risk level of the data source corresponding to the multimodal cross-domain heterogeneous data;

[0014] The sampling frequency is adjusted according to the risk level, and the sampling frequency is positively correlated with the risk level.

[0015] In some embodiments of this disclosure, the step of acquiring multimodal cross-domain heterogeneous data includes:

[0016] Metadata is attached to the multimodal cross-domain heterogeneous data, and the metadata is used to record the descriptive information of the multimodal cross-domain heterogeneous data.

[0017] In some embodiments of this disclosure, the method includes:

[0018] Encryption processing is performed on the multimodal cross-domain heterogeneous data;

[0019] Encryption processing is performed on the multimodal features;

[0020] Encryption processing is performed on the fusion feature.

[0021] In some embodiments of this disclosure, the encryption process includes at least one of anonymization, differential privacy, feature desensitization, and homomorphic encryption.

[0022] In some embodiments of this disclosure, the step of performing encryption processing on the multimodal cross-domain heterogeneous data includes:

[0023] Detect the first encryption state of the multimodal cross-domain heterogeneous data;

[0024] In response to the first encryption state being unqualified, the multimodal cross-domain heterogeneous data is removed.

[0025] In some embodiments of this disclosure, the step of performing encryption processing on the multimodal cross-domain heterogeneous data includes:

[0026] The first risk level of the multimodal cross-domain heterogeneous data is detected, and the first risk level is used to characterize the risk level of obtaining privacy information based on the multimodal cross-domain heterogeneous data;

[0027] In response to the first risk level being greater than the first threshold, the multimodal cross-domain heterogeneous data is removed.

[0028] In some embodiments of this disclosure, the step of performing encryption processing on the multimodal features includes:

[0029] The second risk level of the multimodal features is detected, and the second risk level is used to characterize the risk of obtaining privacy information based on the multimodal features;

[0030] If the second risk level is greater than the second threshold, the multimodal feature is removed.

[0031] In some embodiments of this disclosure, the step of performing encryption processing on the fused feature includes:

[0032] A third risk level is detected for the fused features, the third risk level being used to characterize the risk of obtaining privacy information based on the fused features;

[0033] If the third risk level is greater than the third threshold, the fusion feature is removed.

[0034] In some embodiments of this disclosure, cross-modal feature fusion is performed based on at least one of weighted average, principal component analysis, and graph neural network to obtain fused features.

[0035] In some embodiments of this disclosure, the step of inputting the fused features into a network threat detection model to perform network threat detection and obtain detection results includes:

[0036] An alarm message is generated based on the detection results;

[0037] Detect the privacy information in the alarm message;

[0038] The privacy information is filtered out from the alarm information.

[0039] In some embodiments of this disclosure, updating the weight parameters of the network threat detection model related to the fusion features based on the fusion features and the detection results includes:

[0040] False positives and false negatives are obtained based on the detection results. False positives are data that the network threat detection model misclassifies as abnormal, and false negatives are data that the network threat detection model misclassifies as normal.

[0041] The weight bias of the fusion feature is calculated based on the correlation between the false positive cases, the false negative cases, and the fusion feature;

[0042] The weight parameters of the network threat detection model related to the fusion features are updated based on the weight bias.

[0043] In some embodiments of this disclosure, updating the hyperparameters of the network threat detection model based on the detection results includes:

[0044] Based on the detection results, the historical detection performance indicators of the network threat detection model are obtained, and the historical detection performance indicators include at least one of accuracy, false positive rate, false negative rate, and efficiency.

[0045] The hyperparameters of the network threat detection model are optimized based on the historical detection performance indicators.

[0046] Secondly, this application provides a network threat detection system, comprising:

[0047] The data acquisition module is used to collect multimodal, cross-domain heterogeneous data;

[0048] The feature extraction module is used to extract the multimodal features of the multimodal cross-domain heterogeneous data;

[0049] The feature fusion module is used to perform cross-modal feature fusion on the multimodal features to obtain fused features;

[0050] The network threat detection module is used to input the fused features into the network threat detection model to perform network threat detection and obtain detection results;

[0051] An adaptive model update module is used to update the hyperparameters of the network threat detection model and the weight parameters related to the fusion features based on the fused features and the detection results.

[0052] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0053] Fourthly, this application provides an electronic device including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect.

[0054] Fifthly, this application provides a computer program product having a computer program stored thereon, wherein the computer program product, when executed by a processor, implements the method described in the first aspect.

[0055] Based on the above technical solutions, this application provides a network threat detection method, system, storage medium, and electronic device, relating to the field of network security technology. The method includes: collecting multimodal cross-domain heterogeneous data; extracting multimodal features from the multimodal cross-domain heterogeneous data; performing cross-modal feature fusion on the multimodal features to obtain fused features; inputting the fused features into a network threat detection model to perform network threat detection and obtain detection results. The hyperparameters of the network threat detection model and the weight parameters related to the fused features are updated based on the fused features and the detection results. By introducing multimodal cross-domain heterogeneous data, the accuracy and coverage of threat detection are enhanced. An adaptive model update mechanism is also set up to achieve real-time local adjustment of model parameters and automatic optimization of hyperparameters, enabling rapid response to new threats.

[0056] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0057] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0058] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 A flowchart illustrating the network threat detection method provided in an embodiment of this application is shown;

[0060] Figure 2 A schematic diagram of the system architecture for network threat detection provided in an embodiment of this application is shown;

[0061] Figure 3 A flowchart illustrating the network threat detection method provided in an embodiment of this application is shown;

[0062] Figure 4 A schematic diagram of the data acquisition process provided in an embodiment of this application is shown;

[0063] Figure 5 This paper illustrates a schematic diagram of the data preprocessing process provided in an embodiment of this application.

[0064] Figure 6 A schematic diagram of the feature extraction process provided in an embodiment of this application is shown;

[0065] Figure 7 A schematic diagram of the feature fusion process provided in an embodiment of this application is shown;

[0066] Figure 8 A schematic diagram of the network threat detection process provided in an embodiment of this application is shown;

[0067] Figure 9 A schematic diagram of the model update process provided in an embodiment of this application is shown;

[0068] Figure 10 A schematic diagram of the modules of the network threat detection system provided in an embodiment of this application is shown. Detailed Implementation

[0069] The embodiments of this application will now be described in more detail with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0070] The core objective of a modern cybersecurity protection system is to protect information assets in the network environment from unauthorized access, tampering, damage, or disclosure. To achieve this goal, a cybersecurity protection system must possess the capabilities for real-time detection, rapid response, prevention, and recovery. Among these, network threat detection is a crucial element, especially when facing complex and ever-changing new attacks, where traditional rule-based protection methods are insufficient. Therefore, network protection systems need to rely on the fusion of multi-source heterogeneous data to enhance the accuracy and comprehensiveness of threat detection.

[0071] In a cybersecurity environment, data sources are diverse, including network traffic, logs, endpoint devices, and IoT sensors. A single type of data cannot provide sufficient information to identify complex threat patterns, while multi-source heterogeneous data fusion can integrate data from different sources to form a richer and more comprehensive threat view. For example, combining network traffic data with endpoint behavior logs can detect potential malicious activities earlier; introducing multimodal data such as text, images, and videos can further enhance the detection capabilities for advanced threats (such as social engineering attacks and insider threats). Furthermore, as attack methods continue to evolve, cybersecurity threat detection systems, through machine learning and artificial intelligence technologies, can automatically identify unknown threats and make predictions and warnings based on historical data, improving the system's adaptability. Therefore, cybersecurity threat detection based on multi-source heterogeneous data fusion not only improves the accuracy of threat detection but also copes with the ever-changing threat environment, ensuring cybersecurity.

[0072] In some embodiments, a data fusion model can be constructed to perform calculations and processing on network security detection data, generate optimal estimates, improve data effectiveness, and reduce network energy consumption.

[0073] In some embodiments, the priority of vulnerability remediation is dynamically adjusted by performing operations such as deduplication, confidence scoring, and reachability scoring on vulnerability data from multiple security detection tools. The system can intelligently determine the remediation level based on short-term fluctuations and long-term trend analysis, and generate a priority ranking list.

[0074] In some embodiments, by collecting heterogeneous data sources such as telecommunications, user behavior, social media, and financial data, factor features are extracted and factor feature libraries, multi-factor models, and detection models are constructed. The system can accurately extract feature factors from different data sources, construct multi-factor models of cybersecurity behavior, achieve security detection of cybersecurity behavior, and provide targeted security protection measures accordingly.

[0075] The aforementioned security data analysis based on multi-source heterogeneous data fusion has the following shortcomings:

[0076] 1. Limited or overly broad data types: Existing technologies primarily rely on traditional network traffic and log data, failing to fully utilize the advantages of multimodal data (such as text, images, and videos), thus limiting the comprehensiveness and accuracy of threat detection. While some methods introduce multiple heterogeneous data sources, they do not address how to handle the differences between different data types, potentially leading to noise and redundant information during data fusion, affecting detection accuracy.

[0077] 2. Lack of cross-domain data fusion: Existing technologies usually only focus on specific types of data and fail to effectively integrate data from different domains, which limits their application scope and makes it difficult to cope with complex industrial control systems, Internet of Things and other scenarios.

[0078] 3. Insufficient real-time performance: When processing large-scale heterogeneous data, existing technologies consume a lot of computing resources, resulting in poor real-time performance and an inability to respond promptly to rapidly changing threat environments.

[0079] 4. Imperfect model update mechanism: In existing technologies, model updates usually require manual adjustment or retraining, which leads to lag and makes it impossible to respond to new threats in a timely manner.

[0080] 5. Insufficient privacy protection: Existing technologies lack effective privacy protection mechanisms during data fusion and threat detection, which affects the credibility of the system.

[0081] Therefore, to address the aforementioned issues, this embodiment provides a network threat detection method aimed at achieving real-time, comprehensive, and accurate threat detection by efficiently processing large-scale heterogeneous data. This method not only covers traditional network traffic and log data but also incorporates multimodal data, such as text, images, and video data, enhancing the accuracy and coverage of threat detection. Furthermore, it establishes an adaptive model update mechanism, employing incremental learning and hyperparameter optimization techniques to achieve real-time local adjustment of model parameters and automatic hyperparameter optimization, enabling rapid response to emerging threats.

[0082] like Figure 1The diagram shown is a schematic of the system architecture for network threat detection provided in this embodiment. According to the hierarchy, the system includes 6 layers, namely the business layer, the multi-source data processing engine, the management layer, the decision layer, the resource layer, and the security control module.

[0083] The business layer is used to provide heterogeneous data from different fields, data sources, and modalities, such as network traffic, system logs, and terminal data.

[0084] The multi-source data processing engine includes a data acquisition module, a data preprocessing module, a feature extraction module, and a feature fusion module, which are used to collect network data from the business layer and perform preprocessing, feature extraction, cross-modal fusion, and other steps.

[0085] The management layer includes a security management engine, which is responsible for process scheduling, log auditing, and policy control to ensure the system operates in compliance with regulations.

[0086] The decision-making layer includes an intelligent decision-making engine, an adaptive model update module, and an intelligent orchestration engine. The intelligent decision-making engine includes a network threat detection module, which deploys a network threat detection model to perform real-time inference based on the multimodal fusion features of the multi-source data processing engine and the management layer's policies, to assess security risks in real time and output detection results.

[0087] The adaptive model update module is used to continuously learn from new threat data and optimize the network threat detection model, enabling the system to quickly adapt to new attacks or business changes.

[0088] The intelligent orchestration engine is used to dynamically schedule security tools at the resource layer based on the detection results, thereby achieving on-demand matching of security responses.

[0089] The resource layer is divided into two technical lines: AI and traditional security. The AI ​​security technical line includes the AI ​​security tool engine and the full AI tool suite, which rely on artificial intelligence technology to handle complex and unknown threats. The traditional security technical line includes the traditional security tool engine and traditional security tools, which are based on traditional technologies such as firewalls and antivirus software to handle known risks and conventional attacks.

[0090] The privacy protection and security audit engine can function across multiple layers, connecting multi-source data processing engines, management layers, decision-making layers, and resource layers. During data collection, fusion, and decision-making processes, it protects data privacy through technologies such as anonymization and differential privacy. Simultaneously, it records full-process operation logs to support security audits and compliance checks.

[0091] Users access the business system through their user terminals. All accesses must be checked by security tools at the resource layer to ensure secure access.

[0092] like Figure 1The diagram shown is a flowchart of the network threat detection method in this embodiment, including the following steps:

[0093] S101: Collect multimodal cross-domain heterogeneous data.

[0094] Multimodal cross-domain heterogeneous data refers to heterogeneous data from different fields, data sources, and modalities to ensure comprehensive coverage of all types of cybersecurity incidents. Examples include network traffic, logs, terminal device data, Internet of Things (IoT) sensor data, camera data, social media data, and external threat intelligence data.

[0095] S102: Extract multimodal features from multimodal cross-domain heterogeneous data.

[0096] The collected multimodal, cross-domain heterogeneous data includes text, images, videos, network traffic, logs, etc. To ensure that the extracted features accurately reflect the essence of the data, different methods are used to process different types of data.

[0097] For text data processing, Natural Language Processing (NLP) techniques, such as the Bag of Words model, Term Frequency-Inverse Document Frequency (TF-IDF), and Word to Vector (Word2Vec), can be used to segment, vectorize, and semantically analyze the text data, extracting semantic features such as keywords and sentiment.

[0098] For image and video data processing, computer vision algorithms, such as convolutional neural networks (CNNs) and object detection algorithms, are applied to perform object recognition, behavior analysis, and scene classification on images and videos, and to extract visual features.

[0099] For network traffic data processing, network traffic analysis tools, such as Zeek and Suricata, are used to parse network packets and extract network characteristics such as traffic patterns, protocol types, session durations, and packet sizes.

[0100] For log data processing, log files are parsed to extract structured information such as event type, operation description, user ID, and timestamp to form log features.

[0101] S103: Perform cross-modal feature fusion on multimodal features to obtain fused features.

[0102] Cross-modal feature fusion can be performed based on at least one of weighted average, principal component analysis, and graph neural networks.

[0103] For example, during feature fusion, weights can be assigned based on the importance of different feature types. Weighted averaging ensures the fused data is more representative and avoids certain features excessively influencing the final result. Principal Component Analysis (PCA) is used to reduce the dimensionality of high-dimensional features, retaining the most important feature dimensions, reducing redundant information, and improving the efficiency and interpretability of subsequent analysis. Autoencoders are used to perform nonlinear mapping on multimodal features, mapping different types of features to a unified low-dimensional space. By capturing complex relationships between data, this ensures that features from different modalities can be effectively combined. For data involving multiple entities and their relationships, Graph Neural Networks (GNNs) are used for modeling, capturing dependencies between entities and facilitating the detection of complex coordinated attacks or internal threats. The fused multimodal features are then used for network threat detection. By combining features from different sources, a more comprehensive understanding of threat behavior can be achieved, complex threat patterns can be identified, and the accuracy and coverage of threat detection can be improved.

[0104] S104: Input the fused features into the network threat detection model to perform network threat detection and obtain the detection results.

[0105] The detection results are used to characterize whether multimodal cross-domain heterogeneous data is anomalous. The detection results can include various information, such as threat type, confidence level, and threat level.

[0106] S105: Update the hyperparameters of the network threat detection model and the weight parameters related to the fusion features based on the fusion features and detection results.

[0107] In this embodiment, in addition to traditional network traffic and log data, multimodal data such as text, images, and video data are introduced to enhance the accuracy and coverage of threat detection. An adaptive model update mechanism is also implemented, employing incremental learning and hyperparameter optimization techniques to achieve real-time local adjustment of model parameters and automatic hyperparameter optimization, enabling rapid response to emerging threats.

[0108] The network threat detection method in this embodiment mainly involves Figure 1 The system comprises a multi-source data processing engine, a network threat detection module, an adaptive model update module, and a security management module within the intelligent decision engine. The network detection method provided in this embodiment is described below based on the above system architecture. Figure 3 The diagram shown illustrates the module interaction of network threat detection provided in this embodiment, including the following steps:

[0109] The data acquisition module collects multimodal cross-domain heterogeneous data and sends the multimodal cross-domain heterogeneous data to the feature extraction module.

[0110] The feature extraction module extracts multimodal features from multimodal cross-domain heterogeneous data and sends the multimodal features to the feature fusion module.

[0111] The feature fusion module performs cross-modal feature fusion on multimodal features to obtain fused features. These fused features are then sent to the network threat detection module and the adaptive model update module, respectively.

[0112] The network threat detection module integrates feature inputs into the network threat detection model to perform network threat detection and obtain detection results. These results are then sent to the adaptive model update module.

[0113] The adaptive model update module updates the hyperparameters of the network threat detection model and the weight parameters related to the fusion features based on the fused features and detection results.

[0114] In some embodiments, the collection frequency can be dynamically adjusted based on the importance and risk level of the data source. This allows for the detection of the risk level of the data source corresponding to multimodal cross-domain heterogeneous data, and the adjustment of the collection frequency accordingly, with the collection frequency being positively correlated with the risk level. For example, a higher collection frequency is used for high-risk data, such as abnormal logins or high-volume data transmissions; while a lower collection frequency is used for low-frequency data, such as stable logs, to optimize resource utilization.

[0115] In some embodiments, an event-triggered acquisition mode can be used. When a specific event is detected, such as the access of an unknown device or abnormal behavior, a high-frequency acquisition mode is activated to collect more contextual information and improve response speed.

[0116] In some embodiments, a distributed data collection architecture can be adopted, using message queues such as Kafka and RabbitMQ to send the collected data, ensuring the reliability and efficiency of data transmission, and automatically adjusting the distribution of collection nodes according to the network topology.

[0117] In some embodiments, a privacy protection mechanism is introduced during the network threat detection process to protect privacy and security throughout the entire stages of data collection, processing, and detection, thereby ensuring the security of user data.

[0118] The security management module can encrypt and perform privacy analysis on data at each stage of the network threat detection process. Encryption includes at least one of the following: anonymization, differential privacy processing, feature desensitization, and homomorphic encryption. Anonymization replaces sensitive fields (such as names and IP addresses) with unique identifiers or hash values ​​to prevent direct association with specific user information and protect user privacy. Differential privacy processing adds appropriate noise to the data to ensure that individual user privacy information cannot be accurately identified without affecting the effectiveness of the overall data analysis. Feature desensitization modifies the data's feature structure, making privacy information unidentifiable or unrecoverable while preserving the feature's usability for the model. Homomorphic encryption encrypts data that requires computation but cannot be decrypted, allowing specific operations on encrypted data without decryption, ensuring data privacy is not compromised.

[0119] The security management module can also set access control policies to ensure that only authorized personnel or components can access and process private information. Each access request requires authentication and permission checks to ensure data security and compliance.

[0120] The security management module can also record all threat detection and response operations during the network threat detection process, forming a detailed audit log. The audit log records the timestamp, content, and executor of each operation in detail, ensuring that every step is traceable.

[0121] The security control module can also record all user or component access to sensitive data, including access time, content, and results. This helps track potential security incidents and ensures that every access is authorized and logged.

[0122] The security control module can also encrypt and store all audit logs, ensuring that even if the log files are stolen, attackers cannot read their contents. The encryption keys can be managed by a dedicated Key Management System (KMS) to ensure key security.

[0123] The security management module can also be equipped with automated log analysis tools to monitor abnormal behavior in logs in real time and generate alerts. When suspicious activity is detected, an anomaly alert will be issued immediately to help users promptly discover and respond to potential security threats.

[0124] In response, during the data collection phase, such as Figure 4As shown, the data acquisition module collects multimodal cross-domain heterogeneous data and attaches metadata to it. The multimodal cross-domain heterogeneous data and metadata are then sent to the security management module. The metadata records descriptive information about the multimodal cross-domain heterogeneous data, such as data source type, quality score, timestamp, and event trigger markers. The metadata is dynamically updated; its content is continuously supplemented, corrected, or replaced as the data flows (throughout its entire lifecycle from acquisition to processing, fusion, and detection) to accurately reflect the data's state changes at each stage.

[0125] The security management module performs encryption processing on multimodal cross-domain heterogeneous data. After encryption, the security management module can detect the first encryption state and the first risk level of the multimodal cross-domain heterogeneous data, and send the first encryption state, the first risk level, and the encrypted multimodal cross-domain heterogeneous data to the data acquisition module. The first encryption state is used to characterize whether the encryption processing meets the standards. The first risk level is used to characterize the degree of risk of obtaining privacy information from the multimodal cross-domain heterogeneous data, i.e., the risk of privacy information leakage.

[0126] The data acquisition module receives the first encryption status and the first risk level from the security control module. Based on the first encryption status, it removes multimodal cross-domain heterogeneous data that does not meet the encryption standards. Based on the first risk level, it removes high-risk multimodal cross-domain heterogeneous data.

[0127] In other words, if the first encryption state is not met, multimodal cross-domain heterogeneous data is discarded. If the first encryption state is met, multimodal cross-domain heterogeneous data is retained. If the first risk level is greater than the first threshold, indicating a high risk of privacy information leakage, multimodal cross-domain heterogeneous data is discarded. If the first risk level is less than or equal to the first threshold, indicating a low risk of privacy information leakage, multimodal cross-domain heterogeneous data is retained.

[0128] In addition to encryption status and risk level, the security control module can also detect access control compliance (whether it is authorized), audit log integrity (whether it is complete), and regulatory compliance (whether it complies with the General Data Protection Regulation (GDPR)), and feed the detection results back to the data acquisition module.

[0129] In some embodiments, the security management module can dynamically adjust its strategies based on the detection results, for example, by enhancing security measures (such as upgrading encryption algorithms). The data acquisition module can also dynamically adjust its strategies based on the information fed back by the security management module, for example, by adjusting the acquisition frequency, such as reducing the acquisition interval for data sources that pose a risk of privacy information leakage.

[0130] The security control module records the above operations, forming detailed audit logs, which are then stored in encrypted form. It can also trigger anomaly alerts when anomalies are detected, providing privacy and compliance protection for the data collection process.

[0131] Through the aforementioned privacy protection mechanisms, the data acquisition module updates the metadata of the multimodal cross-domain heterogeneous data, adding encryption compliance tags, compliance tags, and risk level markers. The multimodal cross-domain heterogeneous data and metadata are then sent to the data preprocessing module in a unified format (such as JSON) to ensure the security and structure of subsequent process inputs.

[0132] In the data preprocessing stage, such as Figure 5 As shown, the data preprocessing module receives multimodal cross-domain heterogeneous data and metadata sent by the data acquisition module, and performs cleaning and structuring operations on the multimodal cross-domain heterogeneous data.

[0133] The cleaning operations include, but are not limited to, deduplication, noise filtering, and formatting to eliminate duplicate records and irrelevant information, ensuring data accuracy and consistency. Structured processing includes, but is not limited to, numerical normalization, categorical encoding, timestamp alignment, and missing value handling. Numerical normalization normalizes numerical data to a uniform range (e.g., [0,1]). Categorical encoding encodes categorical data (e.g., one-hot encoding) to eliminate dimensional differences between different data sources and improve the model's generalization ability. Missing value handling uses mean imputation, median imputation, or interpolation to ensure data integrity. For missing values ​​that cannot be reasonably imputed, the record can be deleted or marked as a special value. Timestamp alignment uses a global clock synchronization mechanism (e.g., Network Time Protocol, NTP) to align timestamps and convert data in different units into a unified representation, ensuring temporal consistency and comparability of the data.

[0134] The data preprocessing module sends the preprocessed multimodal cross-domain heterogeneous data and metadata to the security control module. The security control module performs encryption on the preprocessed multimodal cross-domain heterogeneous data. After encryption, the security control module can detect the fourth encryption state and fourth risk level of the preprocessed multimodal cross-domain heterogeneous data, and send the fourth encryption state, fourth risk level, and encrypted multimodal cross-domain heterogeneous data back to the data preprocessing module. The fourth encryption state is used to characterize whether the encryption process meets the standards. The fourth risk level is used to characterize the risk of obtaining privacy information based on the preprocessed multimodal cross-domain heterogeneous data, i.e., the risk of privacy information leakage.

[0135] The data preprocessing module receives the fourth encryption status and fourth risk level from the security control module. Based on the fourth encryption status, it removes multimodal cross-domain heterogeneous data that does not meet the encryption standards. Based on the fourth risk level, it removes high-risk multimodal cross-domain heterogeneous data.

[0136] In other words, if the fourth encryption state is not met, multimodal cross-domain heterogeneous data will be removed. If the fourth encryption state is met, multimodal cross-domain heterogeneous data will be retained. If the fourth risk level is greater than the fourth threshold, indicating a high risk of privacy information leakage, multimodal cross-domain heterogeneous data will be removed. If the fourth risk level is less than or equal to the fourth threshold, indicating a low risk of privacy information leakage, multimodal cross-domain heterogeneous data will be retained.

[0137] In addition to encryption status and risk level, the security control module can also detect access control compliance (whether it is authorized), audit log integrity (whether it is complete), and regulatory compliance (whether it complies with the General Data Protection Regulation (GDPR)), and feed the detection results back to the data acquisition module.

[0138] The data preprocessing module can dynamically adjust its strategies based on information from the security control module. For example, it can adjust cleaning strategies to avoid privacy leaks when filling in missing values.

[0139] The security control module records the above operations, forming detailed audit logs, which are then stored in encrypted form. It can also trigger anomaly alerts when anomalies are detected (such as anonymous failure events), providing privacy and compliance protection for the data preprocessing stage.

[0140] Through the aforementioned privacy protection mechanisms, the data preprocessing module updates the metadata of the multimodal cross-domain heterogeneous data, adding encryption compliance tags, compliance tags, and risk level markers. The preprocessed multimodal cross-domain heterogeneous data and metadata are then sent to the feature extraction module in a unified format.

[0141] In the feature extraction stage, such as Figure 6 As shown, the feature extraction module receives multimodal cross-domain heterogeneous data and metadata sent by the data preprocessing module, performs feature extraction on the multimodal cross-domain heterogeneous data, and extracts multimodal features.

[0142] The feature extraction module sends the extracted multimodal features and metadata to the security control module, which then encrypts the multimodal features. After encryption, the security control module checks the second encryption state and second risk level of the multimodal features and sends the second encryption state, second risk level, and encrypted multimodal features back to the feature extraction module. The second encryption state indicates whether the encryption process meets the requirements. The second risk level indicates the degree of risk of obtaining privacy information based on the multimodal features, such as the risk of privacy feature leakage related to sensitive keywords or image features associated with user identity.

[0143] The feature extraction module receives feedback from the security control module regarding the second encryption status and the second risk level. Based on the second encryption status, it removes multimodal features that fail to meet encryption standards, and based on the second risk level, it removes high-risk multimodal features.

[0144] In other words, if the second encryption state is not met, the multimodal feature is removed. If the second encryption state is met, the multimodal feature is retained. If the second risk level is greater than the second threshold, indicating a high risk of privacy information leakage, the multimodal feature is removed. If the second risk level is less than or equal to the second threshold, indicating a low risk of privacy information leakage, the multimodal feature is retained.

[0145] In addition to encryption status and risk level, the security management module can also detect access control compliance (whether it is authorized), audit log integrity (whether it is complete), regulatory compliance (whether it complies with GDPR), and send the detection results to the feature extraction module.

[0146] The security management module can adjust corresponding strategies based on the detection results, such as generalizing the numerical range for encryption processing.

[0147] The security control module records the above operations, forming detailed audit logs, which are then stored in encrypted form. It can also trigger anomaly alerts when anomalies are detected, providing privacy and compliance protection for the feature extraction stage.

[0148] Through the aforementioned privacy protection mechanisms, the feature extraction module updates the metadata, adding encryption compliance tags, standardization tags, etc., and then sends the multimodal features and metadata to the feature fusion module in a unified format (such as Parquet).

[0149] In the feature fusion stage, such as Figure 7 As shown, the feature fusion module receives multimodal features and metadata sent by the feature extraction module, performs cross-modal fusion on the multimodal features, and constructs a comprehensive threat view, i.e., fused features.

[0150] The feature fusion module sends the fused features and metadata to the security control module, which then encrypts the fused features. After encryption, the security control module detects the third encryption state and third risk level of the fused features, and sends the third encryption state, third risk level, and the encrypted fused features to the feature extraction module. The third encryption state indicates whether the encryption process meets the requirements. The third risk level indicates the degree of risk of obtaining private information based on the fused features, such as the risk of feature correlation leakage.

[0151] The feature fusion module receives the third encryption status and third risk level from the security control module. Based on the third encryption status, it removes fusion features that fail to meet encryption standards, and based on the third risk level, it removes high-risk fusion features.

[0152] In other words, if the third encryption state is not met, the fusion feature is removed. If the third encryption state is met, the fusion feature is retained. If the third risk level is greater than the third threshold, indicating a high risk of privacy information leakage, the fusion feature is removed. If the third risk level is less than or equal to the third threshold, indicating a low risk of privacy information leakage, the fusion feature is retained.

[0153] In addition to encryption status and risk level, the security management module can also detect access control compliance (whether it is authorized), audit log integrity (whether it is complete), regulatory compliance (whether it complies with GDPR), and send the detection results to the feature fusion module.

[0154] In some embodiments, the feature fusion module adjusts the corresponding strategy based on the detection results, such as adjusting feature weights or adjusting the fusion algorithm, such as differential privacy aggregation.

[0155] The security control module records the above operations, forming detailed audit logs, which are then stored in encrypted form. It can also trigger anomaly alerts when anomalies are detected, providing privacy and compliance protection for the feature fusion stage.

[0156] Through the aforementioned privacy protection mechanisms, the feature fusion module updates metadata, adding privacy compliance tags, etc., and then sends the fused features and metadata to the network threat detection module in a unified format.

[0157] During the network threat detection phase, such as Figure 8 As shown, the network threat detection module receives the fused features and metadata sent by the feature fusion module, inputs the fused features into the network threat detection model, analyzes the data stream through the network threat detection model, performs network threat detection, identifies threat types (such as DDoS, zero-day attacks) and calculates confidence levels to obtain detection results.

[0158] The network threat detection module responds to the abnormal data represented by the detection results and can generate alarm information based on the detection results. The alarm information includes the timestamp of the event, its source, type, and suggested response measures.

[0159] The network threat detection module can send alert information and metadata to the security management module. The security management module checks the privacy compliance of the alert information, such as whether the anonymization results leak user identity, and sends the risk alerts to the network threat detection module. Based on the feedback risk alerts, the network threat detection module filters out privacy information from the alert information, such as hiding IP address details, and adjusts alert policies, such as suppressing non-compliant high-risk alerts.

[0160] Meanwhile, the network threat detection module can trigger automated response actions, such as blocking malicious IP traffic and isolating infected terminals. It also updates the threat knowledge base, recording new attack characteristics and pushing alert reports (filtered to remove privacy information) to the security operations platform for user analysis.

[0161] The security control module records the above operations, forming detailed audit logs, including alarm trigger times and handling measures, which are then encrypted and stored. It supports compliance traceability and anomaly investigation, ultimately achieving closed-loop management of threat detection, response, and privacy protection.

[0162] To improve the real-time performance of detection, distributed computing technology can be employed to distribute data processing tasks across multiple computing nodes, ensuring efficient parallel processing. Simultaneously, edge computing can be introduced, offloading some computing tasks to edge nodes for execution, reducing data transmission latency and improving response speed.

[0163] In the model optimization stage, such as Figure 9 As shown, the adaptive model update module includes an online learning submodule and a model optimization submodule. The feature fusion module sends fused features (such as zero-day attack features and modal association rules) to the online learning submodule. The network threat detection module obtains the historical detection performance indicators, false positives, and false negatives of the network threat detection model based on the detection results, sends the false positives and false negatives to the online learning submodule, and sends the historical detection performance indicators to the model optimization submodule. False positives are data that the network threat detection model mistakenly classifies as abnormal, while false negatives are data that the network threat detection model mistakenly classifies as normal.

[0164] The online learning submodule receives fused features, false positives, and false negatives from the feature fusion module. Based on the correlation between false positives, false negatives, and the fused features, it calculates the weight deviation of the fused features and then calculates the weight parameters of the fused features based on this weight deviation. The calculated weight parameters are synchronized to the network threat detection module in real time, enabling the network threat detection module to update the weight parameters related to the fused features in the network threat detection model according to the weight parameters.

[0165] The online learning submodule can utilize incremental learning techniques to fine-tune the network threat detection model parameters and generate dynamic weights, gradually incorporating new data into the model without retraining the entire model. This approach ensures the model can quickly adapt to new threat patterns while maintaining existing performance. Specifically, gradient accumulation and mini-batch gradient descent can be used to optimize the model update process.

[0166] The model optimization submodule receives historical detection performance metrics from the network threat detection module and optimizes the hyperparameters of the network threat detection model based on these metrics, such as the learning rate and detection threshold. Historical performance metrics include at least one of accuracy, false positive rate, false negative rate, and efficiency. The calculated hyperparameters are then synchronized to the network threat detection module in real time, enabling the module to update the hyperparameters of the network threat detection model according to the weight parameters and hyperparameters.

[0167] The model optimization submodule uses cross-validation and hyperparameter tuning techniques, such as random search and Bayesian optimization, to evaluate the model's performance using metrics such as precision, recall, and F1 score. Based on the evaluation results, it automatically adjusts the model's hyperparameters to further improve the model's accuracy and robustness.

[0168] The security control module monitors the entire model update process, verifies the privacy of incremental data (such as whether attack features are anonymized) and the compliance of algorithms (such as whether differential privacy aggregation meets the standards), records details of model version changes and parameter adjustments, generates audit logs, and stores the audit logs in encrypted form.

[0169] Ultimately, the updated network threat detection model can improve threat identification accuracy and optimize response strategies. At the same time, it feeds back key threat patterns and defense rules from the iteration process to the business system, forming a closed-loop optimization that ensures the system evolves dynamically with the threat environment and continuously meets privacy and security compliance requirements.

[0170] Understandably, the optimized network threat detection model is deployed to the network environment, and its performance is continuously monitored to ensure high accuracy and stability in practical applications. During the online learning phase, incremental and active learning techniques are used to automatically adjust model parameters, quickly adapting to new threat patterns and ensuring efficient and real-time model updates, enabling the system to cope with the ever-changing threat environment. In the model optimization phase, regular evaluation, cross-validation, and hyperparameter tuning ensure the model's stability and high performance in different scenarios, continuously improving its accuracy and robustness.

[0171] In some embodiments, model update tasks can be distributed to multiple nodes for execution using a distributed computing framework (such as Apache Spark or TensorFlowDistributed) and edge computing nodes. Each node independently processes a portion of the data and updates its local model, then merges the update results into the global model through parameter aggregation. This distributed update mechanism ensures that the model update process is efficient and does not affect the system's real-time responsiveness. Through these steps, the model can be continuously optimized, quickly adapting to new threat environments and ensuring it is always in optimal condition.

[0172] This embodiment employs a multimodal cross-domain data fusion method, utilizing natural language processing, computer vision, and graph neural network technologies to fuse multimodal data such as text, images, and network traffic. Combined with a cross-domain heterogeneous data association model, a comprehensive threat view is constructed. A dynamic adaptive model update mechanism is introduced, employing incremental learning and hyperparameter optimization techniques to achieve local real-time adjustment of model parameters and automatic hyperparameter optimization. Furthermore, expert annotations can be integrated using an active learning strategy to enhance the agile response capability to emerging threats. A full-process privacy protection strategy is implemented, integrating differential privacy, homomorphic encryption, and dynamic auditing modules. Anonymization and encrypted verification are implemented throughout the entire stages of data collection, processing, fusion, and detection to ensure privacy compliance and operational traceability.

[0173] The network detection method provided in this embodiment offers more comprehensive threat detection, encompassing not only traditional network traffic and log data but also incorporating multimodal data (such as text, images, and videos), making threat detection more comprehensive and accurate. Existing technologies focus only on specific types of data, limiting their application scope, while this invention can comprehensively utilize multiple data types to discover more hidden threat patterns. For example, combining network traffic data with terminal behavior logs can detect potential malicious activities earlier, and introducing multimodal data such as text, images, and videos can further enhance the detection capability for advanced threats (such as social engineering attacks and insider threats). This cross-domain data fusion capability enables this invention to address more complex network security challenges.

[0174] The model is updated more promptly. By introducing an online learning mechanism, it can quickly adapt to new threat environments, ensuring the model is always in optimal condition. In existing technologies, model updates require manual adjustment or retraining, leading to lag. This invention, however, can automatically adjust model parameters to respond promptly to emerging threats. Through incremental learning and active learning techniques, it can quickly adapt to new threat patterns without affecting the performance of existing models. Furthermore, the model is regularly evaluated and optimized to ensure its performance remains stable across different scenarios, further improving the system's robustness and accuracy.

[0175] With stricter privacy protection, this invention employs a robust privacy protection mechanism to ensure security during data processing. While privacy is a crucial consideration in data fusion, existing technologies often lack effective safeguards. This invention utilizes differential privacy and homomorphic encryption to ensure privacy information is not leaked. Furthermore, a strict data access control policy ensures that only authorized personnel can access and process privacy information. The introduction of a security audit function records all threat detection and response operations, creating detailed audit logs that enhance system transparency and trustworthiness.

[0176] Based on the above method, this embodiment also provides a network threat detection system, such as... Figure 10 As shown, it includes a data acquisition module, a feature extraction module, a feature fusion module, a network threat detection module, and an adaptive model update module.

[0177] The data acquisition module is used to collect multimodal, cross-domain heterogeneous data.

[0178] The feature extraction module is used to extract multimodal features from multimodal cross-domain heterogeneous data.

[0179] The feature fusion module is used to perform cross-modal feature fusion on multimodal features to obtain fused features.

[0180] The network threat detection module is used to input fused features into the network threat detection model to perform network threat detection and obtain detection results.

[0181] The adaptive model update module is used to update the hyperparameters and weight parameters related to the fusion features of the network threat detection model based on the fused features and detection results.

[0182] In some embodiments, such as Figure 10 As shown, the network threat detection system also includes data preprocessing and security control modules. The adaptive model update module includes an online learning submodule and a model optimization submodule. Other corresponding descriptions of the functional units involved in the network threat detection system provided in this embodiment can be found in the corresponding descriptions in the network threat detection method, and will not be repeated here.

[0183] It should be noted that the system architecture provided in this embodiment does not constitute a limitation on the system, and may include more or fewer component modules, or combine certain modules, or have different module arrangements.

[0184] Based on the above method, this embodiment also provides a computer-readable storage medium storing a computer program thereon, which implements the above method when executed by a processor.

[0185] Based on the above method, this embodiment also provides a computer program product on which a computer program is stored, and which implements the above method when executed by a processor.

[0186] Based on this understanding, the technical solution of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause a computer device (such as personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of this application.

[0187] Based on the above method, this application embodiment also provides an electronic device, such as a terminal device, which includes a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to implement the above method.

[0188] Optionally, the aforementioned physical devices may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.

[0189] Those skilled in the art will understand that the physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0190] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device, supporting the operation of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0191] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented using software plus necessary general-purpose hardware platforms, or it can be implemented through hardware. Compared with current related technologies, the technical solution of this embodiment enhances the accuracy and coverage of threat detection by introducing multimodal cross-domain heterogeneous data. Furthermore, it sets up an adaptive model update mechanism to achieve real-time local adjustment of model parameters and automatic optimization of hyperparameters, enabling rapid response to new threats.

[0192] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0193] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for detecting network threats, characterized in that, include: Collect multimodal, cross-domain heterogeneous data; Extract the multimodal features from the multimodal cross-domain heterogeneous data; Perform cross-modal feature fusion on the multimodal features to obtain fused features; The fused features are input into the network threat detection model to perform network threat detection and obtain the detection results; The hyperparameters of the network threat detection model and the weight parameters related to the fusion features are updated based on the fusion features and the detection results.

2. The method according to claim 1, characterized in that, The collection of multimodal cross-domain heterogeneous data includes: Detect the risk level of the data source corresponding to the multimodal cross-domain heterogeneous data; The sampling frequency is adjusted according to the risk level, and the sampling frequency is positively correlated with the risk level.

3. The method according to claim 1, characterized in that, After the step of collecting multimodal cross-domain heterogeneous data, the following steps are included: Metadata is attached to the multimodal cross-domain heterogeneous data, and the metadata is used to record the descriptive information of the multimodal cross-domain heterogeneous data.

4. The method according to claim 1, characterized in that, The method includes: Encryption processing is performed on the multimodal cross-domain heterogeneous data; Encryption processing is performed on the multimodal features; Encryption processing is performed on the fusion feature.

5. The method according to claim 4, characterized in that, The encryption process includes at least one of anonymization, differential privacy, feature desensitization, and homomorphic encryption.

6. The method according to claim 4, characterized in that, After performing encryption processing on the multimodal cross-domain heterogeneous data, the following steps are included: Detect the first encryption state of the multimodal cross-domain heterogeneous data; In response to the first encryption state being unqualified, the multimodal cross-domain heterogeneous data is removed.

7. The method according to claim 4, characterized in that, After performing encryption processing on the multimodal cross-domain heterogeneous data, the following steps are included: The first risk level of the multimodal cross-domain heterogeneous data is detected, and the first risk level is used to characterize the risk level of obtaining privacy information based on the multimodal cross-domain heterogeneous data; In response to the first risk level being greater than the first threshold, the multimodal cross-domain heterogeneous data is removed.

8. The method according to claim 4, characterized in that, After performing encryption processing on the multimodal features, the following steps are included: The second risk level of the multimodal features is detected, and the second risk level is used to characterize the risk of obtaining privacy information based on the multimodal features; If the second risk level is greater than the second threshold, the multimodal feature is removed.

9. The method according to claim 4, characterized in that, After performing encryption processing on the fused features, the following steps are included: A third risk level is detected for the fused features, the third risk level being used to characterize the risk of obtaining privacy information based on the fused features; If the third risk level is greater than the third threshold, the fusion feature is removed.

10. The method according to claim 1, characterized in that, Cross-modal feature fusion is performed based on at least one of weighted average, principal component analysis, and graph neural network to obtain fused features.

11. The method according to claim 1, characterized in that, The step of inputting the fused features into the network threat detection model to perform network threat detection and obtain the detection result includes: An alarm message is generated based on the detection results; Detect the privacy information in the alarm message; The privacy information is filtered out from the alarm information.

12. The method according to claim 1, characterized in that, The step of updating the weight parameters of the network threat detection model related to the fusion features based on the fusion features and the detection results includes: False positives and false negatives are obtained based on the detection results. False positives are data that the network threat detection model misclassifies as abnormal, and false negatives are data that the network threat detection model misclassifies as normal. The weight bias of the fusion feature is calculated based on the correlation between the false positive cases, the false negative cases, and the fusion feature; The weight parameters of the network threat detection model related to the fusion features are updated based on the weight bias.

13. The method according to claim 1, characterized in that, The step of updating the hyperparameters of the network threat detection model based on the detection results includes: Based on the detection results, the historical detection performance indicators of the network threat detection model are obtained, and the historical detection performance indicators include at least one of accuracy, false positive rate, false negative rate, and efficiency. The hyperparameters of the network threat detection model are optimized based on the historical detection performance indicators.

14. A network threat detection system, characterized in that, include: The data acquisition module is used to collect multimodal, cross-domain heterogeneous data; The feature extraction module is used to extract the multimodal features of the multimodal cross-domain heterogeneous data; The feature fusion module is used to perform cross-modal feature fusion on the multimodal features to obtain fused features; The network threat detection module is used to input the fused features into the network threat detection model to perform network threat detection and obtain detection results; An adaptive model update module is used to update the hyperparameters of the network threat detection model and the weight parameters related to the fusion features based on the fused features and the detection results.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 13.

16. An electronic device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 13.

17. A computer program product having a computer program stored thereon, characterized in that, When the computer program product is executed by a processor, it implements the method of any one of claims 1 to 13.

Images