A network security threat event report generation method and system

Abstract

The application discloses a network security threat event report generation method and system, and belongs to the network security field.The method comprises the following steps: acquiring a network security threat event log, pre-processing the log, extracting key information by using a pre-trained ERNIE-Gram model, and generating structured knowledge points; integrating the knowledge points into a feature vector, inputting the feature vector into a KAN model for nonlinear feature extraction and multi-level feature fusion, and generating fusion feature data; inputting the fusion feature data into an OverLoCK model, performing multi-stage feature extraction and aggregation through a dynamic context guiding mechanism of the model, and generating summary semantic analysis information; standardizing the semantic analysis information, inputting the semantic analysis information into a pre-trained federal decision tree model, matching a decision path of the federal decision tree model according to a global split rule, and outputting an interpretable security event report containing a confidence distribution.The application can improve the accuracy and interpretability of threat event report generation.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method and system for generating network security threat incident reports. Background Technology

[0002] As cyberattack methods continue to evolve, the cybersecurity environment faces severe challenges. Firewalls, intrusion detection systems, and other security devices generate massive amounts of threat logs and monitoring data daily. Traditional threat event analysis methods primarily rely on manual investigation by security experts or matching against pre-defined rule bases. However, this approach is extremely inefficient when dealing with millions or even higher volumes of log data daily, and it struggles to effectively identify emerging and covert threats such as zero-day attacks and advanced persistent threats that require multi-step correlation analysis.

[0003] While existing technologies have developed methods for extracting threat features using machine learning algorithms, they still suffer from the following technical limitations: First, their ability to fuse and process multi-source heterogeneous data is limited, resulting in single-dimensional threat features and a lack of in-depth correlation analysis of the complete attack chain. Second, the models have poor interpretability, with outputs often consisting of risk scores or labels, failing to directly generate readable natural language reports that security operations personnel can respond to quickly. Third, traditional machine learning models are poorly adaptable to mutated attack patterns, easily leading to missed and false positives. Therefore, how to efficiently and accurately generate interpretable cybersecurity threat event reports automatically from massive amounts of heterogeneous security data has become a pressing technical challenge. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for generating network security threat incident reports, which can solve the problems existing in the prior art and improve the accuracy and interpretability of threat incident report generation.

[0005] In a first aspect, the present invention provides a method for generating a network security threat incident report, comprising the following steps: S1: Obtain network security threat event logs, preprocess the logs, and use a pre-trained ERNIE-Gram model to extract key information and generate structured knowledge points. S2: Integrate the key knowledge points into feature vectors, input them into the KAN model for non-linear feature extraction and multi-level feature fusion, and generate fused feature data; S3: Input the fused feature data into the OverLoCK model, and use the model's dynamic context guidance mechanism to perform multi-stage feature extraction and aggregation to generate summary semantic parsing information; S4: Standardize the semantic parsing information and input it into the pre-trained federated decision tree model. The federated decision tree model performs decision path matching according to global splitting rules and outputs an interpretable security incident report containing confidence distribution.

[0006] As an alternative implementation, step S1 further includes: segmenting and position encoding through the embedding layer of the ERNIE-Gram model, and modeling in an explicit n-gram identifier manner to maintain the semantic integrity of n-gram words.

[0007] As an alternative implementation, in step S2, the KAN model performs nonlinear activation on the input features using B-spline functions with different numbers of control points, and constructs a function matrix mapping relationship from input to output by stacking multiple KAN layers.

[0008] As an alternative implementation, the OverLoCK model performs the following operations in step S3: The input information is downsampled to the first scale through the built-in basic network layer to generate a mid-level feature map. The mid-level feature maps are further downsampled to the second scale by the overview network layer to generate semantic overview feature maps. By focusing on the network layers and using semantic overview feature mapping as a feedback signal, the refinement of mid-level features is dynamically guided to obtain high-level feature representations. These high-level feature representations are then processed to generate summary semantic parsing information.

[0009] As an alternative implementation, a gated dynamic spatial aggregator is provided within the focused network layer, which performs feature aggregation by calculating a similarity matrix and utilizing a learnable dynamic kernel.

[0010] As an alternative implementation, the training method of the federated decision tree in step S4 includes: initializing the decision tree structure, pre-training the split gain locally on each participant, and updating the global decision tree model by collaboratively aggregating the global split gain; during the execution of step S4, the feature vector does not leave the local node.

[0011] Secondly, this invention provides a network security threat incident reporting generation system, comprising: The data acquisition and preprocessing module is configured to: acquire network security threat event logs, preprocess the logs, and extract key information using a pre-trained ERNIE-Gram model to generate structured knowledge points; The feature fusion module is configured to integrate key knowledge points into feature vectors, input them into the KAN model for nonlinear feature extraction and multi-level feature fusion, and generate fused feature data. The semantic parsing module is configured to: input the fused feature data into the OverLoCK model, and perform multi-stage feature extraction and aggregation through the dynamic context guidance mechanism of the model to generate summary semantic parsing information; The report generation module is configured to: standardize the semantic parsing information, input it into a pre-trained federated decision tree model, and the federated decision tree model performs decision path matching according to global splitting rules, outputting an interpretable security incident report containing confidence distribution.

[0012] Thirdly, the present invention provides an electronic device including a memory and a processor, and computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the method described in the first aspect.

[0013] Fourthly, the present invention provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the method described in the first aspect.

[0014] Fifthly, the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention proposes a method and system for generating cybersecurity threat incident reports. By constructing a three-level model architecture—ERNIE-Gram-KAN-OverLoCK—it achieves deep feature extraction and fusion from raw logs to high-level semantics. Specifically, the ERNIE-Gram model ensures the integrity of n-gram semantics in the original text information; the KAN model enhances the model's ability to fit complex attack patterns through nonlinear activation; and the OverLoCK model utilizes its dynamic context guidance mechanism, using an overview network to guide the focusing network, achieving top-down synchronization and refined aggregation of features, significantly improving the accuracy of security incident report generation. Furthermore, this invention dynamically couples the high-level features output by the model with a federated decision tree. This not only leverages the interpretability of the decision tree to output an analytical report containing confidence distributions, making threat analysis results transparent and reliable, but also ensures that the original feature vectors do not leave the local node, effectively protecting user data privacy and solving the data silo problem. Therefore, this invention achieves significant technical advancements in improving report accuracy, model interpretability, and data security. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the structure of the ERNIE-Gram-KAN-OverLoCK model disclosed in the embodiments of the present invention; Figure 2 This is a flowchart of a method for generating network security threat incident reports disclosed in an embodiment of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0018] Example 1 This embodiment provides a method for generating network security threat incident reports, including the following steps: S1: Obtain network security threat event logs, preprocess the logs, and use a pre-trained ERNIE-Gram model to extract key information and generate structured knowledge points. S2: Integrate the key knowledge points into feature vectors, input them into the KAN model for non-linear feature extraction and multi-level feature fusion, and generate fused feature data; S3: Input the fused feature data into the OverLoCK model, and use the model's dynamic context guidance mechanism to perform multi-stage feature extraction and aggregation to generate summary semantic parsing information; S4: Standardize the semantic parsing information and input it into the pre-trained federated decision tree model. The federated decision tree model performs decision path matching according to global splitting rules and outputs an interpretable security incident report containing confidence distribution.

[0019] To make the objectives, technical solutions, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0020] like Figure 2 As shown, this method mainly includes four steps: data preprocessing and key information extraction, KAN model feature fusion, OverLoCK model semantic parsing, and federated decision tree report generation.

[0021] Step S1: Obtain network security threat event logs, preprocess the logs, and use a pre-trained ERNIE-Gram model to extract key information and generate structured knowledge points.

[0022] First, obtain network security threat event logs or security monitoring data monitored by the user's firewall. In this step, the initially obtained raw data undergoes data fusion and preprocessing. Specifically, as described in step S1.1, the security report is deconstructed into a file structure, extracting text blocks, table data, image data, etc., and simultaneously recording the physical location metadata of each content for subsequent traceability.

[0023] Subsequently, the preprocessed structured text is used as input and fed into the pre-trained ERNIE-Gram model for training. As described in step S1.2, the ERNIE-Gram model first cleans up the training data, removing interference such as special symbols. Then, as described in step S1.2.1, the processed data is input into the model's embedding layer for segmentation and positional encoding to obtain the embedding vector. Unlike the traditional method of predicting a series of tokens, this model uses explicit n-gram identifiers to ensure the semantic integrity of n-gram words and reduce the prediction space. Part of its loss function is expressed as the log-likelihood of predicting the masked statement. The loss function is as follows: ;in, This indicates the statement following the masking operation. Represents the character that is being masked.

[0024] Furthermore, prediction is performed by coarse-grainedly covering n-gram entities with a single identifier, linking internal information to ensure more comprehensive feature and semantic extraction of key information. The loss function is as follows: ; Finally, as described in step S1.3, the data processed in the above manner is linearly mapped multiple times, normalized, and then subjected to residual connection operations to obtain the preliminary output vector data of the ERNIE-Gram model, which generates key knowledge points.

[0025] Step S2: Integrate the key knowledge points into feature vectors, input them into the KAN model for nonlinear feature extraction and multi-level feature fusion, and generate fused feature data.

[0026] like Figure 1 As shown, the key points output by the ERNIE-Gram model are integrated into a vector form and input into the KAN model. The KAN model is used for feature extraction and feature fusion to achieve secondary prediction through model integration.

[0027] In this step, as described in step S2.1, the KAN model directly performs nonlinear activation on the input feature data. In the activation layer of the model, functions of different shapes are fitted using B-spline functions with different numbers of control points. Specifically, the general form of a KAN network can be represented as a nested structure of function matrices. [The text then abruptly shifts to a seemingly unrelated topic:] There are functions... , , The general form of a KAN network is: ; As described in step S2.2, each KAN layer is represented as a function matrix. By stacking each KAN layer multiple times, a matrix mapping relationship is constructed from the input layer to the output layer, i.e., a matrix is ​​constructed from the input layer to the output layer. Let It is the first The function matrix of layer KAN is then: ; ; Finally, as described in step S2.3, the output data of the KAN model is obtained to complete the secondary prediction. Let the input... The output is: ; The sequence-space reshaping layer aligns the dimensionality of the one-dimensional sequence features output by KAN with the two-dimensional spatial features input by OverLoCK, without altering the output dimension of KAN or the backbone network structure of OverLoCK, thus ensuring the independence and portability of the two models. Details are as follows: Let the batch size be... The length of the sequence output by ERNIE-Gram is... (i.e., the number of key information tokens extracted from a single security event log); the output feature dimension of the KAN model is... The final output tensor of the KAN model is:

[0028] in, Indicates the first The sample, the first The token, the Numerical eigenvalues ​​of a dimension.

[0029] The one-dimensional sequence features output by KAN are split into a two-dimensional grid structure along the token dimension to obtain a spatial feature map adapted to the OverLoCK convolution input:

[0030] in, (The total number of pixels in the grid is equal to the sequence length, usually taken as...) ,like (For non-perfect squares, pad with zeros to make them perfect). The number of input channels in the OverLoCK backbone network is exactly the same as the output feature dimension of KAN. The input to the OverLoCK Base-Net layer requires a four-dimensional tensor format. .

[0031] Among them, the number of input channels (Matching the output feature dimension of KAN); Input feature map size (Matches the reshaped mesh size).

[0032] Therefore, the tensor after sequence-space reshaping It can be directly input into the Base-Net layer of OverLock without additional dimensionality transformation or feature pruning, achieving a seamless serial connection between the two models. (The output of the KAN model is a discrete, context-independent set of numerical features, retaining only the discriminative power of a single feature and not including global semantic association information across tokens).

[0033] Step S3: Input the fused feature data into the OverLoCK model, and use the model's dynamic context guidance mechanism to perform multi-stage feature extraction and aggregation to generate summary semantic parsing information.

[0034] The OverLoCK model uses a dynamic contextual attention mechanism to achieve global semantic aggregation across tokens and feature dimensions, mining the correlation between discrete threat features output by the KAN model, and outputting a semantic feature vector containing global threat situation information, which can be directly mapped to summary threat analysis content.

[0035] Specifically, such as Figure 1 As shown, the OverLoCK model receives the data output by the KAN model, and uses the dynamic context of the data to guide multi-stage feature extraction, generating summary analytical information.

[0036] This step combines Figure 1 The model structure will be described in detail. As described in step S3.1, the model extracts features from top to bottom through three built-in networks. The backbone network formed by the cross-combination of the built-in networks generates a dynamic context attention mechanism, and outputs preprocessed feature information based on dynamic convolution technology. First, as in step S3.1.1, the input information is processed through the base network layer (Base-Net), and the three embedding layers are used to progressively downsample the input information to... This generates intermediate-layer feature maps. Then, as in step S3.1.2, the obtained intermediate-layer feature maps are input into the Overview Network layer and downsampled to... This yields an overview feature map with high-level semantics.

[0037] In step S3.1.3, the obtained features are input into a residual 3x3 depthwise separable convolution (DWConv) for local perception. The output is then passed to a module consisting of layer normalization, extended residual convolutional layers and ConvFFN for processing, thereby obtaining the context representation and similarity matrix.

[0038] The resulting similarity matrix is ​​represented as follows: and This represents the two parts of the feature map. and Indicates 1 One convolutional layer, where Re(·) represents the reshaping operation, and K represents the aggregation of I into S through adaptive average pooling. The operation at the center of region S is performed by uniformly mapping parts Q and K to group G. Represented as a similarity matrix, .

[0039] As described in step S3.2, the obtained overview feature map is used as a feedback signal and fused into the Focus-Net layer. This layer consists of a residual 3x3 DWConv, a gated dynamic spatial aggregator, and a ConvFFN dynamic layer. Figure 1 As shown, the third stage of the backbone network is formed by combining the outputs of the focused network layer with those of the base network layer. Based on the obtained... and Feature information is used to output overall contextual information and related guidance, thereby obtaining progressively refined mid-level feature maps. Focusing on the network layer will expand the receiving domain, thus obtaining a more accurate and informative high-level representation.

[0040] Specifically, as in step S3.2.1, the context information of the overview network layer is used to guide the focus on features and kernel weight levels within the network layer, updating the state within the dynamic module of the forward transmission. In a variant example, the context information I at the nth block entry point... n ( ) and feature J n ( First, a connection operation is performed to fuse the inputs into the dynamic building block. After convolution, the outputs of the dynamic gate and its parallel branches are multiplied element-wise. Then, the fused feature map is split into... and , will the initial context Add to ,Right now ,in and It is a learnable scalar. Wherein, K varies in the defined G space. The dynamic kernel of K. The function that normalizes the aggregation similarity is: ; Finally, as described in step S3.3, the OverLoCK model processes the obtained multimodal features through semantic text mapping, cleaning, and standardization, and outputs the final summary parsing information.

[0041] Step S4: Standardize the semantic parsing information and input it into the pre-trained federated decision tree model. The federated decision tree model performs decision path matching according to the global splitting rules and outputs an interpretable security event report containing the confidence distribution.

[0042] During the inference phase of the federated decision tree, all participating nodes hold the same global decision tree structure. When threat event determination is required, each participant inputs locally extracted semantic parsing information features into its local decision tree model. Through a secure multi-party computation protocol, each node collaboratively computes the splitting path of each node without disclosing its original feature values. Ultimately, each node independently obtains the leaf node index of the decision path and outputs the corresponding preset parsing result accordingly.

[0043] Specifically, the features output by the OverLoCK model are standardized and normalized, and used as input features for the federated decision tree samples, thus converting the feature information into interpretable network threat analysis results.

[0044] As described in step S4.1, the federated decision tree structure needs to be initialized first. Each participant pre-trains the split gain using local data, and then the global split gain is aggregated collaboratively through a central server or a secure aggregation protocol to train a global decision tree model. After training, in the practical application phase, as described in steps S4.2 and S4.3, the privacy protection principle of completing all operations locally and ensuring that feature vectors do not leave the local node is followed. The system uses the semantic parsing information generated in step S3 as input features, performs standardization, normalization, and feature filtering locally, and completes decision path matching according to the synchronized global splitting rules. Each leaf node of the decision tree is pre-associated with standardized parsing text. Finally, the system outputs the preset parsing result of the leaf node according to the matching result, such as "[C2 communication] behavior detected, confidence level [95%], recommendation [immediate blocking]", thereby generating an interpretable security incident report containing the confidence level distribution.

[0045] Example 2 This embodiment provides a network security threat incident report generation system, including: The data acquisition and preprocessing module is configured to: acquire network security threat event logs, preprocess the logs, and extract key information using a pre-trained ERNIE-Gram model to generate structured knowledge points; The feature fusion module is configured to integrate key knowledge points into feature vectors, input them into the KAN model for nonlinear feature extraction and multi-level feature fusion, and generate fused feature data. The semantic parsing module is configured to: input the fused feature data into the OverLoCK model, and perform multi-stage feature extraction and aggregation through the dynamic context guidance mechanism of the model to generate summary semantic parsing information; The report generation module is configured to: standardize the semantic parsing information, input it into a pre-trained federated decision tree model, and the federated decision tree model performs decision path matching according to global splitting rules, outputting an interpretable security incident report containing confidence distribution.

[0046] It should be noted that the above modules correspond to the steps in Embodiment 1, and the examples and application scenarios implemented by the above modules and their corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the above modules can be executed in a computer system as part of the system.

[0047] In further embodiments, the following is also provided: An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method described in Embodiment 1. For brevity, further details are omitted here.

[0048] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0049] A computer-readable storage medium for storing computer instructions that, when executed by a processor, perform the method of Embodiment 1.

[0050] The method in Example 1 can be directly executed by a hardware processor, or it can be executed by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0051] A computer program product includes a computer program that, when executed by a processor, implements the method in Embodiment 1.

[0052] The present invention also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, which execute in a device on a target real or virtual processor to perform the processes / methods described above. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc., that perform specific tasks or implement specific abstract data types. In various embodiments, the functionality of program modules can be combined or divided among program modules as needed. The machine-executable instructions for the program modules can execute within a local or distributed device. In a distributed device, the program modules can reside in both local and remote storage media.

[0053] The computer program code used to implement the methods of the present invention may be written in one or more programming languages. This computer program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the computer or other programmable data processing device, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a computer, partially on a computer, as a stand-alone software package, partially on a computer and partially on a remote computer, or entirely on a remote computer or server.

[0054] In the context of this invention, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like. Examples of signals may include electrical, optical, radio, sound, or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0055] Those skilled in the art will recognize that the units and algorithm steps described in conjunction with the embodiments herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0056] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for generating network security threat incident reports, characterized in that, Includes the following steps: S1: Obtain network security threat event logs, preprocess the logs, and use a pre-trained ERNIE-Gram model to extract key information and generate structured knowledge points. S2: Integrate the knowledge points into feature vectors, input them into the KAN model for nonlinear feature extraction and multi-level feature fusion, and generate fused feature data; S3: Input the fused feature data into the OverLoCK model, and use the model's dynamic context guidance mechanism to perform multi-stage feature extraction and aggregation to generate summary semantic parsing information; S4: The semantic parsing information is standardized and input into a pre-trained federated decision tree model. The federated decision tree model performs decision path matching according to global splitting rules and outputs an interpretable security event report containing confidence distribution.

2. The method for generating network security threat incident reports as described in claim 1, characterized in that, Step S1 further includes: segmenting and position encoding through the embedding layer of the ERNIE-Gram model, and modeling in an explicit n-gram identifier manner to maintain the semantic integrity of n-gram words.

3. The method for generating network security threat incident reports as described in claim 1, characterized in that, The KAN model described in step S2 uses a B-spline function with different numbers of control points to perform nonlinear activation on the input features, and constructs a function matrix mapping relationship from input to output by stacking multiple KAN layers.

4. The method for generating network security threat incident reports as described in claim 1, characterized in that, The OverLoCK model described in step S3 specifically performs the following operations: The input information is downsampled to the first scale through the built-in basic network layer to generate a mid-level feature map. The mid-layer feature maps are further downsampled to a second scale by an overview network layer to generate semantic overview feature maps. By focusing on the network layer and using the semantic overview feature mapping as a feedback signal, the refinement of the mid-level features is dynamically guided to obtain high-level feature representations. These high-level feature representations are then processed to generate summary semantic parsing information.

5. The method for generating a network security threat incident report as described in claim 4, characterized in that, The focused network layer includes a gated dynamic spatial aggregator that performs feature aggregation by calculating a similarity matrix and utilizing a learnable dynamic kernel.

6. The method for generating a network security threat incident report as described in claim 1, characterized in that, The training method of the federated decision tree in step S4 includes: initializing the decision tree structure, pre-training the split gain locally on each participant, and updating the global decision tree model by collaboratively aggregating the global split gain; during the execution of step S4, the feature vector does not leave the local node.

7. A network security threat incident reporting generation system, characterized in that, include: The data acquisition and preprocessing module is configured to: acquire network security threat event logs, preprocess the logs, and extract key information using a pre-trained ERNIE-Gram model to generate structured knowledge points; The feature fusion module is configured to integrate the knowledge points into feature vectors, input them into the KAN model for nonlinear feature extraction and multi-level feature fusion, and generate fused feature data. The semantic parsing module is configured to: input the fused feature data into the OverLoCK model, and perform multi-stage feature extraction and aggregation through the dynamic context guidance mechanism of the model to generate summary semantic parsing information; The report generation module is configured to: standardize the semantic parsing information and input it into a pre-trained federated decision tree model, which performs decision path matching based on global splitting rules and outputs an interpretable security incident report containing confidence distribution.

8. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the method described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the method described in any one of claims 1-6.

Images