File violation positioning and monitoring method and system based on non-content transmission

Abstract

The invention provides a file violation positioning and monitoring method and system based on non-content transmission, and relates to the technical field of information security, and the method comprises the steps: continuously capturing non-content transmission operation behaviors of a computer terminal through an incremental monitoring technology, and collecting behavior data streams including local file movement, USB flash disk copying and network external issuing behaviors; analyzing the behavior data flow to generate a dynamic event sequence, and extracting a space-time vector feature and an operation target attribute set of each event; and dividing the dynamic event sequence into three types of risk feature domains, namely a local storage domain, a movable medium domain and a network transmission domain, based on the event space-time distribution intensity and the operation target relevance matrix, and associating each event to the corresponding feature domain. According to the invention, the discovery and traceability of the leakage risk is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security technology, in particular to a file violation position monitoring method and system based on non-content transmission. BACKGROUND

[0002] The prior art relies on periodic static inspection, lacks continuous monitoring capability for the incremental data (such as real-time generated and transmitted files) of computer terminals, and thus it is difficult to discover the newly generated violation storage and transmission behaviors in time. For example, for dynamic operations such as local file movement, real-time copying of U disk, and instant network export, there is often a monitoring delay of several hours or even several days, which cannot block the risk of loss of confidentiality in the first time. At the same time, the monitoring scene coverage is limited, and most technologies only support a few operation behaviors (such as single network transmission or local storage), which are difficult to cover multi-dimensional scenes such as local operation, mobile medium interaction, and network export, forming a monitoring blind area.

[0003] The identification of sensitive information relies on simple keyword matching, and lacks industry and scene-based accurate judgment mechanism. On the one hand, the keyword library has strong universality but poor industry adaptability, and cannot be customized for specific sensitive information in different fields (such as government affairs, finance, and military industry); on the other hand, there is a lack of false alarm filtering mechanism, and the normal appearance of keywords in non-sensitive scenes (such as the sensitive keywords in the cited public policy documents in the document) cannot be effectively distinguished, resulting in a large number of false alarms and increasing the workload of manual research and judgment. In addition, the file confidentiality analysis relies on manual judgment, lacks intelligent analysis capability based on file fingerprint library and historical operation data, and is difficult to automatically identify variants of sensitive files (such as modified and renamed sensitive documents). SUMMARY

[0004] The technical problem to be solved by the present application is to provide a file violation position monitoring method and system based on non-content transmission, which improves the discovery and tracing capability of loss of confidentiality risk.

[0005] To solve the above technical problems, the technical solution of the present application is as follows: In a first aspect, a file violation position monitoring method based on non-content transmission, the method comprising: Step 1: continuously capturing non-content transmission operation behaviors of computer terminals by incremental monitoring technology, and collecting behavior data streams containing local file movement, U disk copying and network export behaviors; Step 2: analyzing the behavior data stream to generate a dynamic event sequence, extracting the spatio-temporal vector features and operation target attribute set of each event; based on the event spatio-temporal distribution density and operation target correlation matrix, dividing the dynamic event sequence into three risk feature domains of local storage domain, removable medium domain and network transmission domain, and associating each event to the corresponding feature domain; Step 3, extract the clustering density parameter and time sequence diffusion rate parameter of the associated events in each feature domain, dynamically calculate the deviation weight of the parameter based on the statistical law of historical samples, and generate the violation risk correction coefficient; simultaneously call the file sensitive feature fingerprint library for feature matching to generate sensitive feature matching quantitative value; combine the violation risk correction coefficient and sensitive feature matching quantitative value, and judge the file violation storage or transmission behavior through the negative feedback filtering mechanism of the false alarm knowledge base; Step 4, when judging the violation, generate the structured alarm information containing the file full path, operation type identification, violation judgment basis and risk correction coefficient, and push it to the terminal interaction interface in real time and trigger the user handling instruction; Step 5, for the violation event triggered by the alarm, record the file operation full link metadata and feature domain associated information, verify the file cleaning result through incremental monitoring, and form the closed loop evidence chain integrating the space-time evolution characteristics.

[0006] Further, the non-content transmission operation behavior of the computer terminal is continuously captured through the incremental monitoring technology, and the behavior data stream containing the local file movement, U disk copy and network export behavior is collected, including: Step 1.1, capture the local file movement and U disk copy operation by using the file system filter driver, extract the operation type, source path, target path, device serial number and timestamp; Step 1.2, capture the network export behavior through the network protocol stack hook, extract the target address, protocol type, transmission byte feature fingerprint and session start and end time; Step 1.3, sort and encapsulate the above operations according to the timestamp into an event marked data stream, including the local file movement event associated with the disk volume serial number, the U disk copy event associated with the storage device physical identifier and the network export event associated with the process certificate hash value.

[0007] Further, the dynamic event sequence is generated by analyzing the behavior data stream, and the space-time vector features and operation target attribute set of each event are extracted; based on the space-time distribution density and operation target association matrix, the dynamic event sequence is divided into three risk feature domains of local storage domain, removable medium domain and network transmission domain, and each event is associated with the corresponding feature domain, including: Step 2.1, analyze the behavior data stream, and construct the dynamic event sequence in the order of timestamp; Step 2.2, for each event in the dynamic event sequence, extract the space-time vector feature and operation target attribute set, wherein the space-time vector feature is composed of event timestamp and physical location coordinates; the operation target attribute set includes file type, size and path hash value; Step 2.3, based on the space-time vector feature, calculate the space-time distribution density parameter of the event cluster; at the same time, based on the operation target attribute set, construct the operation target association matrix across events; Step 2.4, inputting the time-space distribution density parameter and the operation target relevance matrix into the coupling analysis to divide the dynamic event sequence into three mutually exclusive risk feature domains, a local storage domain, a removable medium domain, and a network transmission domain, and marking the divided risk feature domains into the dynamic event sequence to generate the event sequence with domain markers.

[0008] Further, the aggregation density parameter and the time sequence diffusion rate parameter of the correlated events in each feature domain are extracted, and the deviation weight of the parameters is dynamically calculated based on the statistical law of the historical samples to generate the violation risk correction coefficient, including: Step 3.1, receiving the event sequence with domain markers, and extracting the correlated event subsets according to the local storage domain, the removable medium domain, and the network transmission domain; Step 3.2, for each event subset of the feature domain, the following operations are performed: based on the physical location coordinates in the time-space vector feature, the aggregation density parameter of the event distribution in the unit time window is calculated; based on the time stamp sequence, the time sequence diffusion rate parameter of the adjacent event interval is calculated; Step 3.3, inputting the aggregation density parameter and the time sequence diffusion rate parameter into the historical sample library to match the historical statistical benchmark value of the same type of feature domain, and dynamically generating two types of deviation weights, the aggregation density deviation weight and the diffusion rate deviation weight; Step 3.4, fusing the deviation weights to generate the violation risk correction coefficient, multiplying the aggregation density deviation weight by the feature domain type weight factor, multiplying the diffusion rate deviation weight by the diffusion sensitivity factor, and adding the two to output the violation risk correction coefficient.

[0009] Further, the file sensitive feature fingerprint library is called synchronously for feature matching to generate a sensitive feature matching quantitative value; the violation risk correction coefficient and the sensitive feature matching quantitative value are combined, and the file violation storage or transmission behavior is determined through the false positive knowledge base negative feedback filtering mechanism, including: Step 3.5, receiving the event sequence with domain markers, calling the file sensitive feature fingerprint library for hierarchical feature matching for each event operation target attribute set in the event sequence, and outputting the sensitive feature matching quantitative value; Step 3.6, weighting and fusing the violation risk correction coefficient and the sensitive feature matching quantitative value to generate a comprehensive violation probability value; Step 3.7, inputting the comprehensive violation probability value into the false positive knowledge base to compare the historical false positive rules and the confidence threshold through the negative feedback filtering mechanism to determine whether the current event constitutes a file violation storage or transmission behavior.

[0010] Further, when the violation is determined, the structured alarm information including the file full path, the operation type identifier, the violation determination basis, and the risk correction coefficient is generated, and is pushed to the terminal interaction interface in real time and triggers the user handling instruction, including: Step 4.1, receive file violation storage or transmission behavior judgment result; Step 4.2, for the event of judgment violation, extract its file full path, operation type identification, violation judgment basis and violation risk correction coefficient; Step 4.3, based on the extracted information, generate structured alarm information, and push it to the interactive interface of the target computer terminal in real time through the communication protocol; Step 4.4, trigger user handling instruction capture mechanism in terminal interactive interface, and start violation operation blocking process synchronously.

[0011] Further, for the violation event triggered by the alarm, record the file operation full link metadata and feature domain association information, verify the file cleaning result through incremental monitoring, and form a closed loop evidence chain integrating space-time evolution characteristics, including: Step 5.1, receive user handling instruction execution result, extract file operation full link metadata and risk feature domain association information for the violation event corresponding to the alarm; wherein the full link metadata includes operation type, target path, timestamp sequence and device identifier, and the feature domain association information references the divided domain mark; Step 5.2, according to the target path in the file full link metadata, call the incremental monitor to scan the file storage state again, and output the file cleaning result verification report; Step 5.3, fuse full link metadata, file cleaning result verification report and risk feature domain mark, generate closed loop evidence chain according to space-time evolution dimension and store it in audit database.

[0012] The second aspect is a file violation monitoring system based on non-content transmission, including: The acquisition module is used to continuously capture the non-content transmission operation behavior of the computer terminal through the incremental monitoring technology, and collect the behavior data stream containing the local file movement, U disk copy and network export behavior; The calculation module is used to analyze the behavior data stream to generate dynamic event sequence, extract the space-time vector features and operation target attribute set of each event; based on the event space-time distribution density and operation target correlation matrix, the dynamic event sequence is divided into three risk feature domains of local storage domain, removable medium domain and network transmission domain, and each event is associated with the corresponding feature domain; extract the aggregation density parameter and time sequence diffusion rate parameter of the associated events in each feature domain, based on the statistical law of historical samples, dynamically calculate the deviation weight of the parameters and generate the violation risk correction coefficient; synchronously call the file sensitive feature fingerprint library for feature matching, and generate sensitive feature matching quantitative value; combine the violation risk correction coefficient and the sensitive feature matching quantitative value, and judge the file violation storage or transmission behavior through the negative feedback filtering mechanism of the false alarm knowledge base; The processing module is used for generating structured alarm information containing a file full path, an operation type identification, a violation judgment basis and a risk correction coefficient when judging a violation, and pushing the alarm information to a terminal interaction interface in real time and triggering a user handling instruction; for a violation event triggered by the alarm, file operation full link metadata and feature field association information are recorded, and file cleaning results are verified through incremental monitoring to form a closed loop evidence chain integrating space-time evolution characteristics.

[0013] In a third aspect, a computing device includes: one or more processors; a storage device storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method.

[0014] In a fourth aspect, a computer readable storage medium stores a program, when the program is executed by a processor, the method is implemented.

[0015] The above scheme of the present application at least includes the following beneficial effects: Through the incremental real-time monitoring technology, 32 kinds of operation behaviors such as local file movement, U disk copy and network export are comprehensively captured, the risk is accurately positioned by combining space-time feature analysis and multi-domain division, the violation judgment accuracy is improved by means of dynamic risk correction coefficient, sensitive feature fingerprint library matching and false alarm knowledge base negative feedback filtering mechanism, and the false alarm rate is effectively reduced; at the same time, through the structured alarm pushing, the user handling instruction triggering and the file cleaning result verification, a full-process closed loop management from risk discovery to cleaning is formed, the full link metadata recording and the closed loop evidence chain integrating space-time evolution characteristics are matched, complete traceability basis is provided for the loss of classified information, and finally the risk distribution and situation analysis are presented in a centralized manner, which helps the government and units to master the risk status of sensitive information in real time, improves the monitoring discovery, risk warning, research and judgment, disposal and tracing ability of the loss of classified information, and effectively safeguards the security of sensitive information. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a flowchart of a file violation positioning method based on non-content transmission provided by an embodiment of the present application.

[0017] Figure 2 is a schematic diagram of a file violation positioning system based on non-content transmission provided by an embodiment of the present application. DETAILED DESCRIPTION

[0018] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure can be more thoroughly understood, and so that the scope of the present disclosure can be completely conveyed to those skilled in the art.

[0019] As Figure 1 shown, an embodiment of the present application proposes a file violation monitoring method based on non-content transmission, which comprises the following steps: Step 1, continuously capture the non-content transmission operation behavior of the computer terminal by the incremental monitoring technology, collect the behavior data stream containing local file movement, U disk copy and network sending behavior; Step 2, parse the behavior data stream to generate a dynamic event sequence, extract the spatio-temporal vector features and operation target attribute set of each event; based on the event spatio-temporal distribution density and operation target correlation matrix, divide the dynamic event sequence into three risk characteristic domains of local storage domain, removable medium domain and network transmission domain, and associate each event to the corresponding characteristic domain; Step 3, extract the aggregation density parameter and time sequence diffusion rate parameter of the associated events in each characteristic domain, dynamically calculate the deviation weight of the parameters based on the statistical law of historical samples and generate a violation risk correction coefficient; simultaneously call the file sensitive feature fingerprint library for feature matching to generate a sensitive feature matching quantization value; combine the violation risk correction coefficient and the sensitive feature matching quantization value, and judge the file violation storage or transmission behavior through the false alarm knowledge base negative feedback filtering mechanism; Step 4, when the violation is determined, generate structured alarm information containing file full path, operation type identification, violation judgment basis and risk correction coefficient, and push it to the terminal interaction interface in real time and trigger the user handling instruction; Step 5, for the violation event triggered by the alarm, record the file operation full link metadata and feature domain associated information, verify the file cleaning result through the incremental monitoring, and form a closed loop evidence chain integrating the spatio-temporal evolution characteristics.

[0020] In the embodiment of the present application, by means of incremental monitoring technology, local file movement, U disk copying, network sending and other operation behaviors are continuously captured, combined with dynamic event sequence analysis and three types of risk feature domain division, the terminal sensitive information operation scene can be covered in real time and comprehensively, and the demand for real-time monitoring of 32 behaviors can be met; with the help of aggregation density and time sequence diffusion parameter analysis, file sensitive feature fingerprint library matching and false alarm knowledge base negative feedback filtering, the violation behavior can be accurately identified, the false alarm can be reduced, and the sensitive information judgment efficiency can be improved; through structured alarm pushing, user disposal instruction triggering and file cleaning result verification, a full-process closed-loop management from risk discovery to cleaning is formed, remote inspection by security personnel and terminal self-checking are supported; at the same time, file operation full-link metadata is recorded and closed-loop evidence chain integrating space-time evolution characteristics is formed, which is presented in a centralized manner through data merging and deduplication, helping to master the overall risk distribution and situation of the unit, and improving the monitoring discovery, risk warning, research and disposal and tracing ability of the unit to the loss of confidential information.

[0021] In a preferred embodiment of the present application, step 1 can include: Step 1.1, capturing local file movement and U disk copying operations by using a file system filter driver, and extracting operation type, source path, target path, device serial number and timestamp; Step 1.2, capturing network sending behavior by using a network protocol stack hook, and extracting target address, protocol type, transmission byte feature fingerprint and session start and end time; Step 1.3, sorting and packaging the above operations according to timestamp to form a data stream with event markers, including local file movement event associated with disk volume serial number, U disk copying event associated with storage device physical identifier, and network sending event associated with process certificate hash value.

[0022] In the embodiment of the present application, by means of targeted technical means, three types of core operations of local file movement, U disk copying and network sending are accurately captured, key feature information such as operation type, path, device identifier and network address is comprehensively extracted, and through timestamp sorting and event marking, the behavior data is structured and time-sequenced packaged, and at the same time, unique identifiers such as disk volume serial number, storage device physical identifier and process certificate hash value are associated, thereby improving the comprehensiveness, accuracy and traceability of non-content transmission operation behavior monitoring.

[0023] In the embodiment of the present application, the specific steps include: Step 1.1, using file system filter driver technology to capture local file movement operations and U disk copying operations in real time, and in the process, extracting the specific type of operation (such as moving, copying), the source path of the file (the original storage location), the target path (the storage location after operation), the serial number of the related device (such as the serial number of the U disk) and the timestamp of the operation.

[0024] Step 1.2, capture the network outgoing behavior of the file by means of network protocol stack hook technology, extract the target address of the behavior (the receiving address of the file transmission), the protocol type used (such as TCP, UDP, etc.), the characteristic identification of the transmission byte sequence, and the start time and end time of the network session.

[0025] Step 1.3, arrange all the operations captured in step 1.1 and step 1.2 in chronological order according to the respective time stamps, and encapsulate them as a data stream with event markers; wherein the local file movement event is associated with the corresponding disk volume serial number, the U disk copy event is associated with the corresponding storage device physical identifier, and the network outgoing event is associated with the corresponding process certificate hash value.

[0026] In a preferred embodiment of the present application, the above-mentioned step 2 can include: Step 2.1, parse the behavior data stream and construct a dynamic event sequence in chronological order; Step 2.2, for each event in the dynamic event sequence, extract the spatio-temporal vector feature and the operation target attribute set, wherein the spatio-temporal vector feature is composed of the event occurrence timestamp and the physical location coordinates; the operation target attribute set includes file type, size and path hash value; Step 2.3, based on the spatio-temporal vector feature, calculate the spatio-temporal distribution density parameter of the event cluster; at the same time, based on the operation target attribute set, construct the operation target correlation matrix across events; Step 2.4, take the spatio-temporal distribution density parameter and the operation target correlation matrix as input, divide the dynamic event sequence into three mutually exclusive risk feature domains, local storage domain, removable medium domain and network transmission domain, by coupling analysis, mark the divided risk feature domain into the dynamic event sequence, and generate the event sequence with domain markers.

[0027] In the embodiment of the present application, by parsing the behavior data stream to construct a dynamic event sequence, structured information containing spatio-temporal vector features (timestamp and physical location) and operation target attribute sets (file type, size, path hash value) is extracted to provide precise feature support for event analysis; further, by calculating the spatio-temporal distribution density parameter (reflecting the event aggregation rule) and constructing the operation target correlation matrix (reflecting the cross-event target association), the local storage domain, the removable medium domain and the network transmission domain are divided into three mutually exclusive risk feature domains by coupling analysis, which realizes the scene-based precise classification of file operation events.

[0028] In the embodiment of the present application, the specific steps include: Step 2.1, parse the collected event-labeled behavior data stream, and extract the core information of each independent operation event (such as operation type, timestamp, associated device identifier, etc.). Then, according to the timestamp of the event occurrence (accurate to the specific moment of operation execution), sort the discrete events in ascending order of time, and concatenate them into a dynamic event sequence in chronological order. Arrange all file operations (local move, U disk copy, network transmission) in a continuous event chain according to the actual occurrence order.

[0029] Step 2.2, for each event in the dynamic event sequence, extract two types of key information: Spacetime vector feature: composed of two parts, one is the accurate timestamp of event occurrence (records the specific moment of operation execution), the other is the physical location coordinates of event occurrence (can be understood as the physical location of the terminal device performing the operation, or the node location involved in network transmission), the combination of the two forms the spacetime feature describing when and where the event occurs.

[0030] Operation target attribute set: focusing on the file being operated, extract its core attributes, including: file type (such as document, picture, program, etc.), file size (storage space occupied), file path hash value, convert the file path to be calculated (string form) into binary data (according to UTF-8 or ASCII encoding rules) as the input message of the algorithm.

[0031] First, add a 1 bit at the end of the binary message, and then add several 0 bits, so that the total length of the filled message is less than 512 bits by 64 bits (ensure that the message length information can be added later). Add a 64-bit binary number at the end of the filled message to record the length of the original message (unit: bit), and finally make the total message length an integer multiple of 512 bits.

[0032] Initialize the hash value: preset 8 32-bit initial hash values (fixed constants defined by algorithm standards, such as 0x6a09e667, 0xbb67ae85, etc.), as the initial state for subsequent operations.

[0033] Divide the filled message into several groups (such as M1, M2, …, Mn) with a unit of 512 bits. For each 512-bit group, first expand it into 64 32-bit words (generate an expansion word through a specific logical operation), and then perform a compression function operation with the current hash value.

[0034] The compression function contains 64 rounds of iteration, each round uses different constants and expansion words, and updates the intermediate state of the hash value through logical operations (such as cyclic shift, XOR, AND, OR, etc.). After each iteration, the intermediate state is accumulated with the initial hash value to obtain the temporary hash value after processing the packet.

[0035] After processing all 512-bit packets, the final 8 32-bit hash values are spliced in order to form a 256-bit binary number, which is then converted into a 64-bit hexadecimal string, which is the hash value of the file path.

[0036] Step 2.3, based on the extracted features, further quantifying the distribution and correlation of events: Temporal and spatial distribution density parameter: combined with the temporal and spatial vector features, the aggregation degree of events within a certain time window (such as 10 minutes) and a certain spatial range (such as the same terminal or adjacent network nodes) is calculated. For example, multiple file moves occur on the same terminal within a short period of time, and the density parameter will be higher, reflecting the concentration of operations.

[0037] Operation target correlation matrix: based on the operation target attribute set, the correlation degree of the files operated by different events is analyzed. For example, the file path hash values of two events are similar (may come from the same folder), and the file types are the same, indicating that the two are strongly correlated. The correlation between events is intuitively presented in the form of a matrix (rows / columns represent different events, and matrix elements represent correlation strength).

[0038] Step 2.4, taking the obtained temporal and spatial distribution density parameter and operation target correlation matrix as input, through coupling analysis (i.e. integrating the correlation logic of the two types of parameters), the events in the dynamic event sequence are divided into three mutually exclusive risk feature domains: Local storage domain: the temporal and spatial distribution of events is concentrated on the local terminal, and the operation target is mostly the file under the local disk path, and the correlation matrix shows that the files between events mostly come from local storage (such as file move events in the C disk folder).

[0039] Removable media domain: events are associated with removable device identifiers (such as U disk serial numbers), and the temporal and spatial distribution is strongly related to the time and location of the removable device access / plug, and the operation target is mostly the file stored in the U disk and other mobile media (such as U disk and local file transfer events).

[0040] Network transmission domain: events involve network addresses, transmission protocols, etc. The temporal and spatial distribution matches the start and end time of the network session and the node location, and the operation target is mostly the file sent / received through the network (such as file sending events through email).

[0041] In a preferred embodiment of the present application, the above step 3 can include: Step 3.1: Receive the event sequence with domain tags, and extract the associated event subsets according to local storage domain, removable media domain, and network transmission domain; Step 3.2: For each subset of events in the feature domain, perform the following operations: calculate the cluster density parameter of the event distribution within a unit time window based on the physical location coordinates in the spatiotemporal vector features; calculate the temporal diffusion rate parameter of the interval between adjacent events based on the timestamp sequence. Step 3.3: Input the cluster density parameter and the time-series diffusion rate parameter into the historical sample library, match the historical statistical benchmark values ​​of the same type of feature domain, and dynamically generate two types of deviation weights: cluster density deviation weight and diffusion rate deviation weight. Step 3.4: Generate violation risk correction coefficient by fusing deviation weights. Multiply the cluster density deviation weight by the feature domain type weight factor and the diffusion rate deviation weight by the diffusion sensitivity factor. Add the two together to output the violation risk correction coefficient.

[0042] In this embodiment of the invention, by classifying and analyzing events according to risk feature domains, the risk of file operations in different scenarios (local storage, removable media, network transmission) is accurately focused, avoiding cross-domain interference. By calculating the cluster density (reflecting the degree of event concentration) and the temporal diffusion rate (reflecting changes in the rhythm of operations), abstract behaviors are transformed into quantifiable risk parameters. By dynamically generating deviation weights based on historical samples, the risk assessment can adapt to the temporal evolution of normal behaviors, avoiding the limitations of fixed thresholds. Finally, by integrating the differences in feature domain types (such as higher risk weights in the network transmission domain) and diffusion sensitivity, the generated violation risk correction coefficient can more accurately characterize the actual degree of risk.

[0043] In this embodiment of the invention, the specific steps include: Step 3.1, Event Sequence with Domain Labels The domain tag for each event It belongs to one of the following domains: local storage domain, removable media domain, or network transmission domain.

[0044] Event sequence The events are divided into three mutually exclusive subsets based on their domain labels: Local storage domain event set : Contains all events that are marked as local storage domains; Removable Media Domain Event Set : Contains all events that are marked as removable media fields; Network Transport Domain Event Set : Contains all events that are marked as network transport domains.

[0045] Step 3.2, for the event set of each feature domain , and The following operations are performed respectively: The physical location coordinates in the event set (such as device identifiers, area identifiers) are grouped by device or area (such as local disk partitions, U disk serial numbers, IP address segments, etc.) first; A sliding time window (such as 5 minutes) is set; The calculation method of the aggregation density parameter is: the number of events in the time window is counted for each location group, the number of events of each location group is multiplied by the weight of the group (such as higher weight for sensitive areas), then the products are added, and the sum of the weights of all location groups is divided to obtain the aggregation density parameter of the feature domain.

[0046] The time sequence diffusion rate parameter: The time stamps in the event set are arranged in ascending order; The time interval between two adjacent events (i.e. the time stamp of the latter event minus the time stamp of the former event) is calculated; The calculation method of the time sequence diffusion rate parameter is: the number of events minus one (i.e. the total number of time intervals) is divided by the sum of all adjacent time intervals (i.e. the total interval time) to obtain the time sequence diffusion rate parameter of the feature domain.

[0047] Step 3.3, history sample library preparation: the aggregation density historical statistical baseline value and the time sequence diffusion rate historical statistical baseline value of each feature domain (local storage domain, removable medium domain, network transmission domain) in the normal state are pre-stored in the history sample library, and these baseline values are obtained by historical data statistics (such as values within 95% confidence interval).

[0048] Calculate the deviation: The calculation method of the aggregation density deviation is: the aggregation density parameter of the current feature domain is subtracted from the aggregation density historical statistical baseline value of the domain, the absolute value of the difference is taken, and then divided by the historical statistical baseline value to obtain the aggregation density deviation.

[0049] The calculation method of the time sequence diffusion rate deviation is: the time sequence diffusion rate parameter of the current feature domain is subtracted from the time sequence diffusion rate historical statistical baseline value of the domain, the absolute value of the difference is taken, and then divided by the historical statistical baseline value to obtain the time sequence diffusion rate deviation.

[0050] Generate deviation weight: The aggregation density deviation weight is input into a nonlinear function (such as sigmoid function or threshold function) to obtain a value between 0 and 1 as the aggregation density deviation weight.

[0051] The diffusion rate deviation weight is input into a nonlinear function (such as sigmoid function or threshold function) to obtain a value between 0 and 1 as the diffusion rate deviation weight.

[0052] Step 3.4, feature domain type weight factor: assign a fixed type weight factor to different feature domains to reflect the inherent risk level of each domain (e.g. the risk of network transmission domain is generally higher), for example: the type weight factor of local storage domain can be set to 0.4, the removable medium domain can be set to 0.6, and the network transmission domain can be set to 0.8.

[0053] Diffusion sensitivity factor: assign a diffusion sensitivity factor to different feature domains to reflect the sensitivity of each domain to timing anomalies (e.g. sudden operation in network transmission needs more attention), and the feature domain type weight factor is a fixed weight value set in advance according to the inherent risk attribute of different risk feature domains. Its core role is to quantify the risk level difference of different domains, and to adjust the influence degree of the aggregation density deviation weight on the final violation risk correction coefficient, for example: the diffusion sensitivity factor of local storage domain can be set to 0.5, the removable medium domain can be set to 0.7, and the network transmission domain can be set to 0.9.

[0054] Calculation of violation risk correction coefficient: the calculation method of violation risk correction coefficient is: multiply the aggregation density deviation weight by the type weight factor of the feature domain, multiply the diffusion rate deviation weight by the diffusion sensitivity factor of the feature domain, and finally add the two results to obtain the value of the violation risk correction coefficient. The larger the coefficient, the higher the violation risk of the current event.

[0055] In a preferred embodiment of the present application, step 3 described above can include: Step 3.5, receiving an event sequence with domain markers, for each event's operation target attribute set in the event sequence, calling the file sensitive feature fingerprint library to perform hierarchical feature matching, and outputting a sensitive feature matching quantitative value; Step 3.6, weighting and fusing the violation risk correction coefficient and the sensitive feature matching quantitative value to generate a comprehensive violation probability value; Step 3.7, inputting the comprehensive violation probability value into the false positive knowledge base, comparing historical false positive rules and confidence threshold through a negative feedback filtering mechanism, and determining whether the current event constitutes a file violation storage or transmission behavior.

[0056] In the embodiment of the present application, the correlation degree between the file and the sensitive feature is accurately quantified through hierarchical feature matching, which realizes efficient identification of the sensitive attributes of the file. The behavior risk (violation risk correction coefficient) and the content risk (sensitive feature matching degree) are weighted and fused to avoid the one-sidedness of single-dimensional evaluation, so that the comprehensive violation probability value is more in line with the actual risk scenario. Combined with the negative feedback filtering mechanism of the false positive knowledge base, the historical false positive rules and the confidence threshold are compared to eliminate the false positives caused by differences in normal operation mode, reduce the false positive rate, and finally realize accurate judgment of the file violation behavior.

[0057] In embodiments of the present application, the specific steps include: Step 3.5, according to the event sequence marked by the domain (each event contains the operation target attribute set, such as file type, size, path hash, etc.).

[0058] Call the preset file sensitive feature fingerprint library, which contains multiple levels of sensitive features (such as the basic layer: sensitive file types such as encrypted files, classified document formats; content layer: sensitive keywords, feature code fingerprints; path layer: sensitive directory path hash, etc.).

[0059] Match the operation target attribute set of each event with the hierarchical features: first match the basic layer features (such as whether the file type belongs to the sensitive type), then match the content layer features (such as whether the file content fingerprint matches the sensitive feature code), and finally match the path layer features (such as whether the file path is in the sensitive directory).

[0060] Quantify the matching results of each layer (such as 1.0 for complete match, 0-1.0 for partial match according to the matching ratio, and 0 for no match), and then weighted sum according to the hierarchical weight (such as the content layer weight is the highest), to get the sensitive feature matching quantization value of the event (range 0-1.0, the higher the value, the closer the association with sensitive features).

[0061] Step 3.6, according to the obtained violation risk correction coefficient (reflecting the degree of abnormality of the behavior pattern), and the sensitive feature matching quantization value obtained in step 3.5 (reflecting the sensitivity of the file itself).

[0062] According to the type of feature domain, set the weight of the two types of parameters (such as in the network transmission domain, the weight of the sensitive feature matching degree is higher; in the local storage domain, the weight of the violation risk correction coefficient is higher).

[0063] Weighted fusion calculation: comprehensive violation probability value = (violation risk correction coefficient x behavior risk weight) + (sensitive feature matching quantization value x sensitive feature weight), result range 0-1.0 (the higher the value, the higher the comprehensive violation risk).

[0064] Step 3.7, the obtained comprehensive violation probability value, the preset false alarm knowledge base (store historical false alarm cases, misjudgment rules, such as normal sensitive file transmission records in specific scenarios).

[0065] Call the negative feedback filtering mechanism of the false alarm knowledge base: first compare the comprehensive violation probability value with the preset confidence threshold (such as 0.7, which is higher than the preliminary judgment of high risk); then retrieve the historical false alarm rules to determine whether the current event belongs to the known normal high-risk scene (such as daily fixed period of compliance sensitive file backup).

[0066] Final decision: if the comprehensive violation probability value exceeds the confidence threshold and no historical false positive rules are hit, the file violation storage or transmission behavior is determined; otherwise, it is determined to be normal behavior.

[0067] In a preferred embodiment of the present application, step 4 above can include: Step 4.1, receiving the file violation storage or transmission behavior determination result; Step 4.2, extracting the file full path, operation type identification, violation determination basis and violation risk correction coefficient for the event determined to be in violation; Step 4.3, generating structured alert information based on the extracted information and pushing it to the target computer terminal's interactive interface in real time through the communication protocol; Step 4.4, triggering the user handling instruction capture mechanism in the terminal interactive interface and synchronously starting the violation operation blocking process.

[0068] In the embodiment of the present application, after receiving the violation determination result, the key information such as file full path and operation type is accurately extracted to generate structured alerts, ensuring that the user can clearly understand the violation details and determination basis, improving the understanding efficiency of the violation event; real-time pushing to the terminal interactive interface ensures the immediacy of the alert, avoiding the continuous spread of violation behavior; at the same time, triggering the user handling instruction capture mechanism and synchronously starting the violation operation blocking process, giving the user the space to intervene actively, containing the risk of spreading through automatic blocking, realizing the cooperation of manual handling and automatic prevention and control, ensuring the flexibility of handling and strengthening the timeliness of risk control.

[0069] In the embodiment of the present application, the specific steps include: Step 4.1, the system receives the determination result of the output file violation storage or transmission behavior, and determines which events are determined to be in violation.

[0070] Step 4.2, for the events determined to be in violation, core information is extracted from the event record: File full path: the complete location of the file in the storage system involved in the operation (such as "C:\Documents\Sensitive File.docx"); Operation type identification: indicating whether the violation behavior belongs to local movement, U disk copying or network export; Violation determination basis: including sensitive feature matching quantitative value, comprehensive violation probability value and other core reasons for determining violation; Violation risk correction coefficient: the quantitative value reflecting the risk degree of the event calculated in step 3.4.

[0071] Step 4.3, organizing the extracted key information into structured alert information in a fixed format (such as showing the file path, operation type, risk level, determination basis, etc. in separate fields); The structured alarm information is sent in real time to the interactive interface (such as a pop-up window or a system notification bar) of the computer terminal where the violation occurs through a local communication protocol (such as inter-process communication) or a network protocol, so as to ensure that the user can perceive the violation in a timely manner.

[0072] Step 4.4: While the alarm information is displayed on the terminal interactive interface, the user handling instruction capturing function (such as the interface providing options for immediate deletion, file isolation, and ignoring) is activated, and the user is asked to manually select a processing method. The violation operation blocking process is started synchronously, and the current ongoing violation is automatically terminated (such as interrupting network transmission connection, prohibiting file copying to a U disk, and limiting access permission to the violation file), so as to prevent the risk from spreading.

[0073] In a preferred embodiment of the present application, the above-mentioned step 5 can include: Step 5.1: The user handling instruction execution result is received, the file operation full-link metadata and risk feature domain association information are extracted for the alarm corresponding violation event, wherein the full-link metadata includes operation type, target path, timestamp sequence, and device identifier, and the feature domain association information references the divided domain label. Step 5.2: According to the target path in the file full-link metadata, the incremental monitor is called to scan the file storage state again, and a file cleaning result verification report is output. Step 5.3: The full-link metadata, the file cleaning result verification report, and the risk feature domain label are fused, a closed-loop evidence chain is generated according to the time-space evolution dimension, and is stored in an audit database.

[0074] In the embodiment of the present application, the file operation full-link metadata (such as operation type, timestamp, and device identifier) and risk feature domain information are extracted, the whole process details of the violation event are recorded completely, and the event is traceable; the incremental monitor is used to scan and verify the file cleaning result again, the actual execution effect of the user handling instruction is confirmed effectively, and the risk residual caused by improper handling is avoided; finally, the full-link data, the verification report, and the domain label are fused, a closed-loop evidence chain is generated according to the time-space evolution dimension and is stored, a complete evidence closed loop from event occurrence, handling to result verification is formed, the compliance audit demand is met, and the iteration ability and the closed-loop effectiveness of risk management and control of the system are improved.

[0075] In the embodiment of the present application, the specific steps include: Step 5.1: User handling instruction execution result (such as file deletion, file isolation, etc.), and violation event record corresponding to the alarm in step 4.

[0076] Full-link metadata is extracted: Operation type: such as local movement, U disk copying, network transmission, etc. Target path: The location where the file is finally stored or transmitted (e.g., USB path, external server address); Timestamp sequence: Contains key time points such as event occurrence time and user handling time; Device identifier: Unique identifier of the device initiating the operation (e.g., IP address, MAC address hash).

[0077] Extract risk feature domain association information: Refer to the domain labels divided in step 2.4 (such as local storage domain, removable media domain, and network transmission domain), and clearly indicate the risk scenario to which the violation event belongs.

[0078] Step 5.2, Extract the target path in the file full link metadata.

[0079] Call incremental monitor: Based on the target path, perform secondary scanning on the file storage system (such as local disk, USB, network storage) to check if the file has been correctly removed or isolated.

[0080] Generate verification report: Output file removal results (such as file deleted, residual copy exists in path X, and file encrypted cannot be verified), including scanning time, residual file information (if any), etc.

[0081] Step 5.3, Extract the file operation full link metadata (including operation type, target path, timestamp sequence, device identifier), file removal result verification report of step 5.2 (including whether the file is residual, residual location, etc.), and risk feature domain labels divided in step 2.4 (such as local storage domain, removable media domain, and network transmission domain).

[0082] Integrate the three parts of information in chronological order to form a complete timeline. The timeline starts from the event occurrence and includes: Event occurrence stage: Record the spatiotemporal characteristics (such as occurrence time, physical location) and the risk feature domain label to which the event belongs; User handling stage: Record the handling operations (such as deletion, isolation) performed by the user and the operation time; Result verification stage: Record the time of secondary scanning and the file removal result (such as complete removal and residual in a certain path).

[0083] Sort the above information in chronological order to form a traceable evidence chain, including: Time sequence: Clearly mark the specific time points of event occurrence, system alarm, user handling, and result verification to ensure the coherence of the process; Risk association: Associate the corresponding risk feature domain (such as network transmission domain) and violation judgment basis (such as 85% matching degree of sensitive features + abnormal operation frequency) at each time point; Disposal result: According to the verification report, mark whether the disposal is complete (such as scanned, the target path file is deleted, no residual or 1 copy is found in the U disk root directory).

[0084] The above evidence chain is archived separately according to events, and the storage content includes: Basic information: file full path, operation type, involved device identifier; Timeline details: event occurrence time, alarm time, disposal time, verification time and key information of corresponding stage; Risk attribute: belonging risk characteristic domain, core parameter (such as aggregation density, sensitive feature matching degree) when judging violation; Disposal conclusion: the core conclusion of the clearance result verification report, residual file information (if any).

[0085] When stored, it is classified according to the event occurrence time, which facilitates retrieval according to the time range, risk domain, disposal result and other dimensions, and is used for compliance audit (providing complete operation record), risk analysis (summarizing high-frequency risk scenarios) and system optimization (adjusting judgment rules based on historical cases).

[0086] As shown in Figure 2 The embodiments of the application also provide a file violation monitoring system based on non-content transmission, comprising: An acquisition module is configured to continuously capture non-content transmission operation behaviors of a computer terminal by using an incremental monitoring technology, and collect behavior data streams containing local file movement, U disk copying and network sending behaviors; A calculation module is configured to analyze the behavior data streams to generate dynamic event sequences, extract time-space vector features and operation target attribute sets of each event, divide the dynamic event sequences into three risk characteristic domains of local storage domain, removable medium domain and network transmission domain based on event time-space distribution density and operation target correlation matrix, associate each event to the corresponding characteristic domain, extract aggregation density parameters and time sequence diffusion rate parameters of the associated events in each characteristic domain, dynamically calculate deviation weights of the parameters and generate violation risk correction coefficients based on historical sample statistical rules, synchronously call a file sensitive feature fingerprint library for feature matching to generate sensitive feature matching quantitative values, combine the violation risk correction coefficients and the sensitive feature matching quantitative values, and determine file violation storage or transmission behaviors through a false alarm knowledge base negative feedback filtering mechanism; A processing module is configured to, when determining a violation, generate structured alarm information containing a file full path, an operation type identifier, a violation judgment basis and a risk correction coefficient, push the alarm information to a terminal interactive interface in real time, and trigger a user disposal instruction; for the violation event triggered by the alarm, record file operation full link metadata and feature domain association information, verify file clearance results through incremental monitoring, and form a closed-loop evidence chain integrating time-space evolution features.

[0087] The above describes the preferred embodiments of the present application. It should be noted that, for those skilled in the art, several improvements and refinements can be made without departing from the principles of the present application, and these improvements and refinements should also be considered as falling within the scope of the present application.

Claims

1. A method for detecting and locating file violations based on non-content transmission, characterized in that, The method includes: Step 1: Continuously capture non-content transfer operations of computer terminals through incremental monitoring technology, and collect behavioral data streams including local file movement, USB flash drive copying, and network outbound behavior; Step 2: Analyze the behavioral data stream to generate a dynamic event sequence, extract the spatiotemporal vector features and operation target attribute set of each event; based on the spatiotemporal distribution density of events and the correlation matrix of operation targets, divide the dynamic event sequence into three risk feature domains: local storage domain, removable media domain, and network transmission domain, and associate each event with the corresponding feature domain. Step 3: Extract the cluster density parameter and time-series diffusion rate parameter of the associated events in each feature domain. Based on the statistical regularity of historical samples, dynamically calculate the deviation weight of the parameters and generate the violation risk correction coefficient. Simultaneously call the file sensitive feature fingerprint database for feature matching and generate sensitive feature matching metric values. Combine the violation risk correction coefficient and the sensitive feature matching metric values, and determine the file violation storage or transmission behavior through the negative feedback filtering mechanism of the false alarm knowledge base. Step 4: When a violation is detected, generate a structured alarm message containing the full file path, operation type identifier, violation judgment basis, and risk correction coefficient, and push it to the terminal interface in real time to trigger user handling instructions. Step 5: For violations triggered by alarms, record the full-link metadata and feature domain association information of file operations, verify the file clearing results through incremental monitoring, and form a closed-loop evidence chain that integrates spatiotemporal evolution features.

2. The method for detecting and locating file violations based on non-content transmission according to claim 1, characterized in that, Incremental monitoring technology is used to continuously capture non-content transfer operations on computer terminals, collecting behavioral data streams including local file movement, USB flash drive copying, and network outbound activities, including: Step 1.1: Use the file system filter driver to capture local file movement and USB flash drive copy operations, and extract the operation type, source path, destination path, device serial number and timestamp; Step 1.2: Capture outbound network behavior through network protocol stack hooks, and extract target address, protocol type, transmitted byte feature fingerprint, and session start and end time; Step 1.3: Encapsulate the above operations into a data stream with event tags, sorted by timestamps, including the disk volume serial number associated with the local file move event, the storage device physical identifier associated with the USB flash drive copy event, and the process certificate hash value associated with the network outbound event.

3. The method for detecting and locating file violations based on non-content transmission according to claim 2, characterized in that, The process involves parsing behavioral data streams to generate dynamic event sequences, extracting the spatiotemporal vector features and operational target attribute sets for each event, and classifying the dynamic event sequences into three risk feature domains based on the spatiotemporal distribution density of events and the correlation matrix with operational targets. Each event is then associated with its corresponding feature domain, including: Step 2.1: Parse the behavioral data stream and construct a dynamic event sequence in timestamp order; Step 2.2: For each event in the dynamic event sequence, extract the spatiotemporal vector features and the operation target attribute set. The spatiotemporal vector features consist of the event occurrence timestamp and physical location coordinates. The operation target attribute set includes file type, size, and path hash value. Step 2.3: Based on the spatiotemporal vector characteristics, calculate the spatiotemporal distribution density parameters of the event cluster; simultaneously, based on the operation target attribute set, construct the cross-event operation target correlation matrix; Step 2.4: Using the spatiotemporal distribution density parameter and the correlation matrix of the operation target as input, the dynamic event sequence is divided into three mutually exclusive risk feature domains through coupling analysis: local storage domain, removable medium domain, and network transmission domain. The risk feature domain labels are injected into the dynamic event sequence to generate an event sequence with domain labels.

4. The method for detecting and locating file violations based on non-content transmission according to claim 3, characterized in that, The cluster density parameter and time-series diffusion rate parameter of associated events within each feature domain are extracted. Based on the statistical regularity of historical samples, the deviation weights of the parameters are dynamically calculated, and a violation risk correction coefficient is generated, including: Step 3.1: Receive the event sequence with domain tags, and extract the associated event subsets according to local storage domain, removable media domain, and network transmission domain; Step 3.2: For each subset of events in the feature domain, perform the following operations: calculate the cluster density parameter of the event distribution within a unit time window based on the physical location coordinates in the spatiotemporal vector features; calculate the temporal diffusion rate parameter of the interval between adjacent events based on the timestamp sequence. Step 3.3: Input the cluster density parameter and the time-series diffusion rate parameter into the historical sample library, match the historical statistical benchmark values ​​of the same type of feature domain, and dynamically generate two types of deviation weights: cluster density deviation weight and diffusion rate deviation weight. Step 3.4: Generate violation risk correction coefficient by fusing deviation weights. Multiply the cluster density deviation weight by the feature domain type weight factor and the diffusion rate deviation weight by the diffusion sensitivity factor. Add the two together to output the violation risk correction coefficient.

5. The method for detecting and locating file violations based on non-content transmission according to claim 4, characterized in that, Synchronously call the file sensitive feature fingerprint database to perform feature matching and generate sensitive feature matching quantification values; Combining the violation risk correction coefficient with the quantified value of sensitive feature matching, the negative feedback filtering mechanism of the false alarm knowledge base determines the illegal storage or transmission behavior of files, including: Step 3.5: Receive the event sequence with domain labels, and for each event in the event sequence, call the file sensitive feature fingerprint library to perform hierarchical feature matching, and output the sensitive feature matching metric value. Step 3.6: Weight and fuse the violation risk correction coefficient with the sensitive feature matching quantification value to generate a comprehensive violation probability value; Step 3.7: Input the comprehensive violation probability value into the false alarm knowledge base, and compare it with historical false alarm rules and confidence thresholds through a negative feedback filtering mechanism to determine whether the current event constitutes a violation of file storage or transmission behavior.

6. The method for detecting and locating file violations based on non-content transmission according to claim 5, characterized in that, When a violation is detected, a structured alarm message is generated, containing the full file path, operation type identifier, violation determination criteria, and risk correction coefficient. This message is pushed to the terminal interface in real time and triggers user intervention commands, including: Step 4.1: Receive the results of the judgment on illegal file storage or transmission; Step 4.2: For events deemed to have violated regulations, extract their full file path, operation type identifier, violation determination criteria, and violation risk correction coefficient. Step 4.3: Generate structured alarm information based on the extracted information and push it to the interactive interface of the target computer terminal in real time through the communication protocol; Step 4.4: Trigger the user handling command capture mechanism on the terminal interaction interface and simultaneously start the process to block illegal operations.

7. The method for detecting and locating file violations based on non-content transmission according to claim 6, characterized in that, For violations triggered by alarms, record the entire file operation metadata and feature domain association information, verify the file deletion results through incremental monitoring, and form a closed-loop evidence chain that integrates spatiotemporal evolution characteristics, including: Step 5.1: Receive the execution result of the user's handling instruction. For the violation event corresponding to the alarm, extract the full-link metadata of the file operation and the risk feature domain association information. The full-link metadata includes the operation type, target path, timestamp sequence and device identifier. The feature domain association information refers to the domain markers of the division. Step 5.2: Based on the target path in the file's end-to-end metadata, call the incremental monitor to perform a second scan of the file storage status and output a file cleanup result verification report; Step 5.3: Integrate full-link metadata, file cleanup result verification report and risk feature domain markers to generate a closed-loop evidence chain according to the spatiotemporal evolution dimension and store it in the audit database.

8. A file violation location and monitoring system based on non-content transfer, the system implementing the method as described in any one of claims 1 to 7, characterized in that, include: The acquisition module is used to continuously capture non-content transfer operations of computer terminals through incremental monitoring technology, and collect behavioral data streams including local file movement, USB flash drive copying and network outbound behavior; The calculation module is used to parse behavioral data streams to generate dynamic event sequences, extract the spatiotemporal vector features of each event and the set of operational target attributes; based on the spatiotemporal distribution density of events and the correlation matrix of operational targets, the dynamic event sequences are divided into three risk feature domains: local storage domain, removable media domain, and network transmission domain, and each event is associated with the corresponding feature domain; extract The cluster density parameter and time-series diffusion rate parameter of related events in each feature domain are dynamically calculated based on the statistical regularity of historical samples, and the deviation weight of the parameters is generated to generate the violation risk correction coefficient. Synchronously call the file sensitive feature fingerprint database to perform feature matching and generate sensitive feature matching quantification values; Combining the violation risk correction coefficient with the sensitive feature matching quantification value, the file violation storage or transmission behavior is determined by the negative feedback filtering mechanism of the false alarm knowledge base; The processing module is used to generate structured alarm information containing the full file path, operation type identifier, violation judgment basis and risk correction coefficient when a violation is determined. This information is pushed to the terminal interface in real time and triggers user handling instructions. For violation events triggered by alarms, the module records the full-link metadata of file operations and feature domain association information. The module verifies the file clearing results through incremental monitoring and forms a closed-loop evidence chain that integrates spatiotemporal evolution characteristics.

9. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images