Unknown malicious encrypted traffic detection method and device, and electronic equipment

Abstract

The invention provides an unknown malicious encrypted traffic detection method and device. The method comprises the following steps: preprocessing original network traffic; extracting a protocol-independent numerical value feature vector and a protocol-related text feature vector from the current network flow; based on the protocol-independent numerical value feature vector and the protocol-related text feature vector, a fusion feature vector capable of comprehensively representing the traffic behavior is formed; a DBSCAN method based on genetic algorithm optimization is adopted, and potential malicious traffic is identified from current network traffic through adaptive parameter search and clustering analysis; and outputting an identification result. According to the method, multi-view flow characteristics are fused, an intelligent optimization algorithm is combined, efficient, accurate and unsupervised real-time detection of unknown malicious flow is realized, and a closed loop from detection to decision analysis can be realized.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of flow detection, and in particular to an unknown malicious encrypted flow detection method and device and electronic equipment. BACKGROUND

[0002] With the rapid development of new network paradigms such as the Internet of Things, the Internet of Vehicles, 5G and even 6G cellular networks, Internet traffic is growing exponentially. To protect the security of information transmission and user privacy, encryption protocols such as SSL / TLS and HTTPS have been widely used. However, encryption technology is a double-edged sword, and attackers also use its concealment to cover malicious behavior, such as command and control communication, data leakage and advanced persistent threat attacks. Therefore, under the premise of not decrypting, it is necessary to quickly and accurately identify malicious traffic, especially unknown types of malicious traffic, from a large amount of encrypted traffic, which has become a key link in building a robust network defense system.

[0003] Currently, the mainstream methods for encrypted malicious traffic detection can be divided into the following categories: 1. Knowledge-based detection methods: This method relies on pre-established knowledge base or rule base (such as feature signature, behavior rule), and identifies by matching known attack patterns. Although it has high interpretability, its detection ability is seriously dependent on the integrity and timeliness of the knowledge base, and needs continuous manual update, which is difficult to cope with unknown attacks or zero-day exploit. 2. Traditional machine learning-based detection methods: This kind of method uses shallow learning models such as support vector machine, random forest, XGBoost, etc. They usually need complex feature engineering, and the traffic features (such as flow duration, packet length statistics, packet arrival time interval, etc.) are manually designed and selected by domain experts. Although it can achieve high accuracy in some scenarios, the feature extraction process is tedious, and it often needs to collect long-term traffic data to obtain complete statistical characteristics, which limits its application in real-time detection scenarios. At the same time, the generalization ability of the model is limited by the attack types contained in the training data, and the recognition ability of unknown malicious traffic is insufficient. 3. Deep learning-based detection methods: Deep learning methods (such as CNN, GRU, Transformer and its variants) can automatically learn feature representation from raw traffic data or preliminary processed data, reducing the dependence on manual feature engineering. Some researches try to convert traffic data into images or sequences and use CNN or RNN for processing. However, this kind of method usually needs a large amount of high-quality labeled data for supervised learning, and in the field of network security, especially for unknown attacks, it is costly and unrealistic to obtain accurate labels. In addition, deep learning models are often regarded as "black box", and their decision-making process is not easy to explain, and in resource-constrained edge environments or real-time detection that requires extremely low delay, the model complexity and computational overhead may become a bottleneck. 4. Graph structure-based detection methods: In recent years, methods that construct traffic interaction graphs (such as taking IP address and port as node, and communication relationship as edge) to capture the spatial characteristics and interaction patterns of network traffic have gradually emerged. Graph algorithms can mine the association between nodes, and have certain advantages in discovering distributed attacks. However, constructing and maintaining large-scale traffic graph structure requires high time and computational resources, especially in high-bandwidth, high-traffic enterprise networks or backbone networks, it is difficult to meet the needs of real-time online detection.

[0004] In summary, existing technologies have significant shortcomings in real-time, unsupervised detection of unknown malicious encrypted traffic: they either rely on prior knowledge and labels, have high computational complexity, or struggle to capture the essential characteristics of unknown attacks. Therefore, a lightweight solution is needed that can effectively identify unknown malicious encrypted traffic without data labeling and with low latency. Furthermore, existing deep learning and unsupervised learning methods are often considered "black boxes," with opaque decision-making processes that make it difficult to understand "why a certain traffic was judged as abnormal," resulting in low decision reliability. Therefore, providing clear and quantifiable decision-making basis for detection results while ensuring detection accuracy and real-time performance has become an indispensable capability for next-generation intelligent security systems. Summary of the Invention

[0005] The technical solution adopted in this invention is to identify unknown malicious encrypted traffic in real time and accurately, while overcoming the reliance of traditional methods on manually labeled data and prior knowledge, and improving the interpretability of detection results. In view of this, this invention provides a method, apparatus, and electronic device for detecting unknown malicious encrypted traffic.

[0006] The present invention proposes a method for detecting unknown malicious encrypted traffic, comprising: Step 1: Preprocess the raw network traffic; Step 2: Extract protocol-independent numerical feature vectors and protocol-related text feature vectors from the current network traffic; Step 3: Based on the protocol-independent numerical feature vector and the protocol-related text feature vector, form a fusion feature vector that can comprehensively characterize traffic behavior; Step 4: The DBSCAN method, optimized based on genetic algorithm, is used to identify potential malicious traffic from the current network traffic through adaptive parameter search and cluster analysis. Step 5: Output the recognition results.

[0007] In one embodiment, step 1 includes: cleaning, slicing and purifying the original network.

[0008] In one embodiment, step 2 includes: Extracting protocol-independent numerical feature vectors using a two-dimensional convolutional neural network; The protocol-related text feature vectors are extracted using the term frequency-inverse document frequency algorithm.

[0009] In one implementation, step 3 includes: Based on the protocol-independent numerical feature vector and the protocol-related text feature vector, a cross-item fusion algorithm is used to generate cross features through multiplication and addition operations, forming a fusion feature vector that can comprehensively characterize traffic behavior.

[0010] In one implementation, step 4 includes: The DBSCAN method, optimized based on a genetic algorithm, identifies potential malicious traffic in the current network traffic through adaptive parameter search and cluster analysis.

[0011] In one implementation, step 5 includes: The contribution of features is quantified using SHAP technology to generate a visual report.

[0012] Another aspect of the present invention provides an unknown malicious encrypted traffic detection device, comprising: The preprocessing unit is configured to preprocess the raw network traffic; The extraction unit is configured to extract protocol-independent numerical feature vectors and protocol-related text feature vectors from the current network traffic; The fusion unit is configured to form a fusion feature vector that can comprehensively characterize traffic behavior based on the protocol-independent numerical feature vector and the protocol-related text feature vector; The identification unit is configured to use the DBSCAN method based on genetic algorithm optimization to identify potential malicious traffic from the current network traffic through adaptive parameter search and cluster analysis. The output unit is configured to output the recognition result.

[0013] Another aspect of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to implement the unknown malicious encrypted traffic detection method as described in any of the preceding claims.

[0014] Another aspect of the present invention provides a computer storage medium storing a computer program that is executed to implement the unknown malicious encrypted traffic detection method as described in any of the preceding claims.

[0015] By adopting the above technical solution, the present invention has at least the following advantages: The method provided by this invention integrates multi-perspective traffic features and combines them with intelligent optimization algorithms to achieve efficient, accurate, unsupervised real-time detection of unknown malicious traffic. Furthermore, it introduces an interpretability analysis module to achieve a closed loop from detection to decision analysis. Attached Figure Description

[0016] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a schematic diagram illustrating the overall architecture and workflow of the Unknown Malicious Encrypted Traffic Detection System (SecuFlow) according to an embodiment of the present invention; Figure 2 This is a detailed illustration of the numerical feature processing flow based on Conv2D and the text feature processing flow based on the text feature weight calculation method in the feature extraction module according to an embodiment of the present invention. Figure 3 A flowchart of the cross-item feature fusion algorithm designed according to an embodiment of the present invention; Figure 4 This is a flowchart illustrating the DBSCAN parameter optimization method (GA-DensityCluster) based on a genetic algorithm according to an embodiment of the present invention. Figure 5 This is a flowchart of the interpretability analysis module of the system according to an embodiment of the present invention. Detailed Implementation

[0017] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments.

[0018] While exemplary embodiments of the invention are shown in the accompanying drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the invention and to fully convey its scope to those skilled in the art. The invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0019] The first embodiment of the present invention provides a method for detecting unknown malicious encrypted traffic, such as... Figure 1 As shown, it includes the following steps: Step 1: Preprocess the raw network traffic; Step 2: Extract protocol-independent numerical feature vectors and protocol-related text feature vectors from the current network traffic; Step 3: Based on the protocol-independent numerical feature vector and the protocol-related text feature vector, form a fusion feature vector that can comprehensively characterize traffic behavior; Step 4: The DBSCAN method, optimized based on genetic algorithm, is used to identify potential malicious traffic from the current network traffic through adaptive parameter search and cluster analysis. Step 5: Output the recognition results.

[0020] The method provided in this embodiment will be described in detail below.

[0021] The technical solution adopted by this invention to solve its technical problem includes five core modules from the perspective of the implementing entity: data processing module, feature extraction module, feature fusion module, traffic clustering module, and interpretability analysis module.

[0022] First, the data processing module cleans, slices, and purifies the raw network traffic to ensure data quality.

[0023] Second, the feature extraction module extracts protocol-independent numerical feature vectors (cnn_feat) through a two-dimensional convolutional neural network (Conv2D) and extracts protocol-related text feature vectors (text_feat) through the term frequency–inverse document frequency (TF-IDF) method.

[0024] Third, the feature fusion module adopts a cross-term fusion algorithm, which generates cross features through multiplication and addition operations to form a fused feature vector that can comprehensively represent traffic behavior.

[0025] Fourth, the traffic clustering module adopts the DBSCAN method (GA-DensityCluster) based on genetic algorithm optimization, which identifies potential malicious traffic through adaptive parameter search and cluster analysis.

[0026] Finally, the interpretability analysis module utilizes SHAP technology to quantify feature contribution and generate a visual report, improving the transparency and credibility of the detection results. This system achieves unsupervised, high-precision, and interpretable real-time detection of unknown malicious encrypted traffic.

[0027] A preferred embodiment of the present invention will now be described in detail with reference to the accompanying drawings.

[0028] 1. System Deployment and Environment Configuration The system described in this invention can be deployed at network boundaries, in core switch bypass, or on cloud security platforms. The recommended hardware platform configuration is an Intel Xeon E5-2680 v4 or higher CPU and 64GB or more of memory. The software environment requires the installation of Python 3.8+, Scikit-learn, TensorFlow / PyTorch (for CNNs), Scapy (for traffic parsing), and the SHAP library (for interpretability analysis), among other libraries.

[0029] 2. Implementation of the data processing module Obtain raw pcap data using network packet capture tools (such as tcpdump) or traffic mirroring. Input the raw network traffic, remove incomplete, invalid, or irrelevant packets, and clean the data by removing infinity (Inf) and NaN values. Then, slice the network traffic session using fixed time windows (e.g., 5 minutes), treating the traffic within each time window as an independent processing unit. Further remove non-payload information such as protocol headers and data that may introduce noise from the sliced ​​data to ensure that the data input to subsequent modules is pure and consistent, thus completing traffic purification.

[0030] 3. Implementation of the feature extraction module Numerical feature processing: Feature selection: Gradient boosting feature selection (GBFS) algorithm is used to select the top 33 most discriminative protocol-independent numerical features (such as flow duration, forward and backward packet length statistics, mean and standard deviation of packet arrival time interval, etc.) from a large number of candidate features.

[0031] Image transformation: The selected 33-dimensional numerical feature vectors are rearranged, normalized, and reshaped into a 5x7 grayscale image (padding with zeros if necessary). Each numerical feature corresponds to a pixel value in the image. To reduce information loss, a hash function is used for mapping.

[0032] Feature learning: A high-level feature representation is automatically learned from the generated grayscale image using a Conv2D model. Conv2D consists of convolutional layers (3x3 kernel size), activation functions (such as ReLU), pooling layers (using max pooling to preserve key features, with a 2x2 pooling window), and dropout layers (to prevent overfitting). The convolution operation formula is as follows: in, It is the position in the output feature map of the convolutional layer. The value, It is an activation function. It is an input grayscale image. These are the convolution kernel weights. It's a bias. It is the kernel size. It is the number of input image channels. It is the step size. Finally, the learned high-dimensional features are converted into a 128-dimensional feature vector (denoted as cnn_feat) through flattening layers and fully connected layers.

[0033] Text feature processing: Feature selection: The GBFS algorithm was also used to select the top 25 protocol-related text features (such as TLS version type, number of certificates, existence of SNI field, public key length, etc.).

[0034] Vectorization: Since text features cannot be directly processed by machine learning models, a term frequency-inverse document frequency (IDF) method is used to convert these text features into numerical vector representations. The importance of a feature is measured by evaluating the frequency (TF) of a word in the current document and its inverse document frequency (IDF) across the entire corpus. TF calculation: ,in It is a word In the file The number of times it appears in the IDF. IDF calculation: ,in N It is the total number of documents in the corpus. It is a word containing The number of documents. Finally, the text feature vector (denoted as text_feat) for each traffic slice is obtained. 4. Implementation of the Feature Fusion Module To more comprehensively describe traffic behavior and capture the interaction information between different features, this invention designs a Cross-Term Fusion Algorithm, which uses the deep fusion of cnn_feat and text_feat as input.

[0035] The core of the algorithm is to generate new cross-feature terms through operations such as multiplication (capturing the interaction effect between features) and addition (preserving the original feature strength).

[0036] Brief description of the process: Iterate through the elements of the two feature vectors, perform combination operations, and then select representative statistics (such as maximum and minimum values) from the generated cross features and add them to the final fused feature vector.

[0037] Output: An enhanced fused feature vector (denoted as fused_vector) containing original feature information and cross-feature information is obtained. This vector can more comprehensively represent the behavior pattern of traffic.

[0038] 5. Implementation of the traffic clustering module This module employs an unsupervised clustering method to analyze the fused feature vectors, enabling the identification of unknown malicious traffic. To address the difficulty in selecting the parameters (neighborhood radius *i* and minimum number of core points *MinPts*) for the DBSCAN clustering algorithm, this invention designs a GA-DensityCluster method.

[0039] Population initialization: Randomly generate populations containing multiple individuals (each individual forms a group). The initial population of (MinPts) parameter combination. The initial range of MinPts is set based on the statistical characteristics of the dataset (such as the distribution of distances between points and the average density).

[0040] Fitness function design: Define a multi-objective fitness function To evaluate the merits of each parameter combination, this function comprehensively considers the following three metrics: intra-cluster density. Inter-cluster separation measures the density of samples within the same cluster. This measures the degree of separation between different cluster centers.

[0041] Profile coefficient The fitness function comprehensively measures both intra-cluster tightness and inter-cluster separation of the samples. ,in w 1, w 2, w 3 represents the weight of each indicator, and the sum is 1.

[0042] Genetic manipulation: Selection: Based on fitness scores, select superior individuals from the current population as parents using roulette wheel selection.

[0043] Crossover: Performs a single-point crossover operation on the selected parent individual to generate new child individuals. For example, parent... and Crossover may produce offspring. and .

[0044] Mutation: Applying small random perturbations (e.g., to offspring individuals) with a certain probability to the parameters of the offspring individuals. , This is to increase population diversity and avoid getting trapped in local optima.

[0045] Iteration and Output: Repeat the selection, crossover, mutation, and evaluation process until the maximum number of iterations is reached. The final output is the parameter combination with the highest fitness. The DBSCAN algorithm was then used to cluster the fused features. Clusters that significantly differed from normal traffic behavior patterns were identified as potentially malicious traffic.

[0046] GA-DensityCluster Implementation: Implement the genetic algorithm according to the pseudocode of Algorithm 2. Set the population size (e.g., 50), maximum number of iterations (e.g., 100), mutation rate (e.g., 0.1), and fitness function weights (e.g., ...). w 1 = 0.4, w 2 = 0.3, w 3 = 0.3). The range can be set to [0.1, 5.0]. The range can be set to [3, 20].

[0047] Clustering and Recognition: Running the Optimized DBSCAN Cluster the fused_vector. Preliminarily identify noise points (-1 labels) and / or small clusters identified by DBSCAN as potentially malicious traffic and report them to security operations personnel for further analysis or to trigger an automatic response mechanism.

[0048] 6. Implementation of the Interpretability Analysis Module To enhance the transparency and interpretability of the system, this invention introduces the SHapley Additive exPlanations (SHAP) algorithm to analyze the feature contribution of clustering decisions, building upon the GA-DensityCluster clustering results. This module aims to quantify the impact of each input feature on the clustering results, thereby revealing the key driving factors for the system's identification of malicious traffic and enhancing the credibility and traceability of the detection results.

[0049] This algorithm, based on game theory, interprets the model output by calculating the "marginal contribution" of each feature across all possible subsets of features. Its basic form is: in, This represents the baseline prediction of the model when there are no input features. For the first The SHAP value of each feature represents its contribution to the model output. The calculation formula is as follows: This method can fairly distribute the impact of each feature on the clustering decision. However, due to the high dimensionality of the features, and the fact that complete computation requires traversing all feature subsets (a number of subsets), this approach is challenging. This invention employs the Kernel SHAP approximation algorithm, utilizing the idea of ​​weighted linear regression to estimate the SHAP value: The regularization term Used to control the stability of feature contributions in different network scenarios.

[0050] The workflow for this module is as follows: Clustering mapping: The GA-DensityCluster results are converted into a label space, defining "abnormal clusters" as positive samples and "normal clusters" as negative samples; Model training: Use the labels above to train a lightweight surrogate classification model to fit the decision boundary of the clusterer; Interpretable computation: Contribution values ​​are calculated for the proxy model using an interpreter optimized for the tree model. For each traffic sample marked as "abnormal," the feature contribution value for each feature in its fused_vector is calculated. Visual Explanation: By analyzing the feature contribution values ​​of all abnormal samples, the core features driving the anomaly determination are identified, such as packet variance and traffic duration. These features are the key behavioral indicators of unknown malicious traffic. For any specific abnormal traffic alert, a personalized feature contribution map is generated, clearly showing which features worked together to lead to this anomaly determination, as well as the direction and magnitude of each feature's contribution. Anomaly mechanism identification: By combining feature contribution results, key traffic attributes that lead to anomaly clustering are identified to assist in network security analysis.

[0051] Through the collaborative work of the above modules, this invention achieves efficient, accurate, and unsupervised real-time detection of unknown malicious encrypted traffic, providing effective technical support for building a next-generation intelligent network security defense system.

[0052] Compared with the prior art, this embodiment has at least the following advantages: This invention, by deeply fusing protocol-independent and protocol-dependent multi-perspective features and combining them with unsupervised clustering technology, comprehensively captures the essence of network traffic behavior, significantly improving the detection accuracy and generalization ability of unknown malicious traffic, and effectively solving the practical problems of scarce malicious traffic samples and difficult labeling. It employs lightweight feature engineering and efficient GA-DensityCluster clustering optimization, utilizing a genetic algorithm to automatically find the optimal parameters of DBSCAN, overcoming the complexity and subjectivity of manual parameter tuning, and improving the stability and quality of clustering results. This invention utilizes traffic slicing technology, enabling the system to meet the real-time detection requirements in high-bandwidth network environments with low detection latency and good robustness when facing noisy data or malicious traffic evading detection.

[0053] In terms of model adaptation, this invention breaks the "black box" of unsupervised learning through interpretability analysis, providing quantitative decision-making basis for each abnormal alarm, greatly improving the trust in detection results and the efficiency of review, and realizing the leap from "what was detected" to "why it is it"; and can discover and confirm the core behavioral characteristics of unknown attacks, making defense measures more targeted.

[0054] In summary, this invention achieves high-precision and highly generalized detection of malicious traffic, and has significant advantages such as strong adaptability, excellent real-time performance, high robustness, lightweight nature, and wide applicability. It is suitable for resource-constrained edge computing environments, IoT scenarios, and large enterprise networks, providing a new technical approach for network security defense.

[0055] A second embodiment of the present invention provides an unknown malicious encrypted traffic detection device, which can be understood as a physical device for implementing the method provided in the first embodiment. The device includes: The preprocessing unit is configured to preprocess the raw network traffic; The extraction unit is configured to extract protocol-independent numerical feature vectors and protocol-related text feature vectors from the current network traffic; The fusion unit is configured to form a fusion feature vector that can comprehensively characterize traffic behavior based on the protocol-independent numerical feature vector and the protocol-related text feature vector; The identification unit is configured to use the DBSCAN method based on genetic algorithm optimization to identify potential malicious traffic from the current network traffic through adaptive parameter search and cluster analysis. The output unit is configured to output the recognition result.

[0056] According to a third embodiment of the present invention, an electronic device includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the unknown malicious encrypted traffic detection method as described in the first embodiment.

[0057] According to a fourth embodiment of the present invention, a computer storage medium is provided, wherein a computer program is stored on the medium, and the computer program is executed to implement the unknown malicious encrypted traffic detection method as described in the first embodiment.

[0058] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A method for detecting unknown malicious encrypted traffic, characterized in that, include: Step 1: Preprocess the raw network traffic; Step 2: Extract protocol-independent numerical feature vectors and protocol-related text feature vectors from the current network traffic; Step 3: Based on the protocol-independent numerical feature vector and the protocol-related text feature vector, form a fusion feature vector that can comprehensively characterize traffic behavior; Step 4: The DBSCAN method, optimized based on genetic algorithm, is used to identify potential malicious traffic from the current network traffic through adaptive parameter search and cluster analysis. Step 5: Output the recognition results.

2. The method for detecting unknown malicious encrypted traffic according to claim 1, characterized in that, Step 1 includes cleaning, slicing and purifying the original network.

3. The method for detecting unknown malicious encrypted traffic according to claim 2, characterized in that, Step 2 includes: Extracting protocol-independent numerical feature vectors using a two-dimensional convolutional neural network; The protocol-related text feature vectors are extracted using the term frequency-inverse document frequency algorithm.

4. The method for detecting unknown malicious encrypted traffic according to claim 3, characterized in that, Step 3 includes: Based on the protocol-independent numerical feature vector and the protocol-related text feature vector, a cross-item fusion algorithm is used to generate cross features through multiplication and addition operations, forming a fusion feature vector that can comprehensively characterize traffic behavior.

5. The method for detecting unknown malicious encrypted traffic according to claim 4, characterized in that, Step 4 includes: The DBSCAN method, optimized based on a genetic algorithm, identifies potential malicious traffic in the current network traffic through adaptive parameter search and cluster analysis.

6. The method for detecting unknown malicious encrypted traffic according to claim 5, characterized in that, Step 5 includes: The contribution of features is quantified using SHAP technology to generate a visual report.

7. A device for detecting unknown malicious encrypted traffic, characterized in that, include: The preprocessing unit is configured to preprocess the raw network traffic; The extraction unit is configured to extract protocol-independent numerical feature vectors and protocol-related text feature vectors from the current network traffic; The fusion unit is configured to form a fusion feature vector that can comprehensively characterize traffic behavior based on the protocol-independent numerical feature vector and the protocol-related text feature vector; The identification unit is configured to use the DBSCAN method based on genetic algorithm optimization to identify potential malicious traffic from the current network traffic through adaptive parameter search and cluster analysis. The output unit is configured to output the recognition result.

8. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program and the processor executes the computer program to implement the method for detecting unknown malicious encrypted traffic as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that, The medium stores a computer program that is executed to implement the method for detecting unknown malicious encrypted traffic as described in any one of claims 1 to 6.

Images