An emergency event processing method, device and equipment across a physically isolated network

Abstract

The application provides an emergency event processing method, device and equipment across a physically isolated network, the method comprising: receiving an emergency event processing request sent by an Internet-side cooperative processing terminal through a secure cross-network interaction gateway; classifying events in the emergency event processing request, generating a processing work order; matching the processing work order with a capability label of a resource provider in a preset emergency processing resource pool to determine a target resource provider; sending the processing work order to the Internet-side cooperative processing terminal through the secure cross-network interaction gateway, so that the target resource provider receives the processing work order and processes it to obtain a work order processing result; receiving the work order processing result sent by the target resource provider through the cooperative processing terminal through the secure cross-network interaction gateway; and auditing and storing the work order processing result. The scheme of the application can form a multi-role cross-network architecture, and the parties to an emergency event cooperatively process and quickly respond.

Description

Technical Field

[0001] This invention relates to the field of computer information technology processing, and in particular to an emergency event handling method, apparatus, and equipment for cross-physically isolated networks. Background Technology

[0002] The existing cybersecurity emergency response model has many drawbacks. Incident response is slow, and overall efficiency is low; there is a lack of cross-departmental and cross-entity collaboration mechanisms, resulting in poor communication and coordination. At the same time, there is a widespread shortage of professional talent in the industry, making it difficult to guarantee the quality of emergency response. Furthermore, the response process lacks standardized control, making it difficult to trace and verify operational actions, and compliance cannot be effectively guaranteed. These combined problems further amplify the impact of security incidents and fail to meet the practical needs of current cybersecurity emergency response. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide an emergency event handling method, apparatus and equipment that crosses physically isolated networks, which can form a multi-role cross-network architecture, enabling all parties involved in the emergency event to coordinate and respond quickly.

[0004] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: An emergency incident handling method across physically isolated networks, applied to the monitoring and dispatch center on the business private network side, includes: Receive emergency event handling requests sent by Internet-side collaborative handling terminals through a secure cross-network interactive gateway, wherein the emergency event handling requests include event descriptions and evidence data; By using parallel reasoning through rule channels and machine learning channels, events in the emergency event handling request are classified and graded to generate a handling work order. The processing work order is matched with the capability tags of resource providers in the preset emergency response resource pool to determine the target resource provider; The processing work order is sent to the Internet-side collaborative processing terminal through a secure cross-network interaction gateway, and then sent to the target resource provider through the Internet-side collaborative processing terminal, so that the target resource provider receives the processing work order and processes it to obtain the work order processing result; The secure cross-network interaction gateway receives the work order processing results sent by the target resource provider through the collaborative processing terminal. The results of the work order processing are reviewed and stored.

[0005] Optionally, by using parallel reasoning through rule channels and machine learning channels, the events in the emergency response request are classified and categorized to generate a response work order, including: The data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway are obtained, and after verifying the data packets, structured and unstructured features are extracted to obtain a feature vector; The feature vector is input into a preset decision tree model, and the event classification, subclass identification and event grading are performed in sequence to obtain the first judgment result; The feature vector is input into a preset machine learning model to obtain a second determination result; Determine the first confidence factor of the first judgment result and the second confidence factor of the second judgment result respectively; Based on the first confidence factor and the first judgment result, the second confidence factor and the second judgment result, the event classification result in the emergency event handling request is obtained, and a handling work order is generated.

[0006] Optionally, the data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway are obtained, and after verifying the data packets, structured and unstructured features are extracted to obtain a feature vector, including: The system acquires data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway and performs integrity verification on the data packets. The numerical and categorical features in the data packet are encoded to obtain a structured feature vector; The unstructured text in the data packet is semantically encoded to obtain a semantic vector; Based on the cross-network transmission quality information of the data packet, a transmission quality vector is obtained; The feature vector is obtained based on the structured feature vector, semantic vector, and transmission quality vector.

[0007] Optionally, determining the first confidence factor of the first determination result and the second confidence factor of the second determination result respectively includes: The first confidence factor of the first determination result is determined based on the completeness of the feature vector, the matching specificity between the feature vector and the preset decision tree model, and the completeness of the data packet. The second confidence factor of the second determination result is determined based on the predicted entropy value of the machine learning model and the sample distribution density of the feature vector.

[0008] Optionally, the disposal work order is matched with the capability tags of resource providers in a preset emergency response resource pool to determine the target resource provider, including: Obtain the event subclass, event level, and responsible unit area information from the handling work order, and the capability tags, area coverage information, and level qualification information of each resource provider in the emergency handling resource pool; The event subclass is matched with the capability tags of the resource provider to obtain a first matching result; The event classification is matched with the resource provider's qualification information to obtain a second matching result; The regional information of the responsible unit is matched with the regional coverage information of the resource provider to obtain a third matching result; The target resource provider is determined based on the first matching result, the second matching result, and the third matching result.

[0009] Optionally, emergency response methods across physically isolated networks also include: Receive network security early warnings output by the situation prediction model; The network security warning is sent to the Internet-side collaborative processing terminal through the secure cross-network interaction gateway; The secure cross-network interactive gateway receives the early warning response results sent by the collaborative processing terminal.

[0010] Optionally, emergency response methods across physically isolated networks also include: Obtain the work orders, work order processing results, and early warning response results within the target historical time range; Extract structured time-series feature vectors based on the work orders, work order processing results, and early warning response results within the target's historical time range; The structured time-series feature vector is input into the situation prediction model, and a network security early warning is output. The network security early warning includes the risk level for a future period of time and the risk value of each event subclass.

[0011] Optionally, emergency response methods across physically isolated networks also include: Based on the actual handling work orders, work order handling results, and warning response results received within a future target time range after the network security warning is issued, the actual handling work orders, work order handling results, and warning response results are taken as the truth values. The aforementioned network security warning will be used as a predicted value. The situation prediction model is trained based on the true values ​​and predicted values.

[0012] The present invention also provides an emergency event handling device across physically isolated networks, comprising: The acquisition module is used to receive emergency event processing requests sent by the Internet-side collaborative handling terminal through a secure cross-network interactive gateway. The emergency event processing request includes an event description and evidence data. The processing module is used to classify and categorize events in the emergency event handling request through parallel reasoning via rule channels and machine learning channels, generating a handling work order; matching the handling work order with the capability tags of resource providers in a preset emergency handling resource pool to determine the target resource provider; sending the handling work order to the Internet-side collaborative handling terminal through a secure cross-network interaction gateway, and then sending the handling work order to the target resource provider through the Internet-side collaborative handling terminal, so that the target resource provider receives the handling work order and handles it to obtain the work order handling result; receiving the work order handling result sent by the target resource provider through the collaborative handling terminal through the secure cross-network interaction gateway; and reviewing and storing the work order handling result.

[0013] The present invention also provides a computing device, comprising: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described above.

[0014] The above-described solution of the present invention has at least the following beneficial effects: The above-described solution of the present invention receives an emergency event handling request sent by an internet-side collaborative handling terminal through a secure cross-network interaction gateway. The emergency event handling request includes an event description and evidence data. Through parallel reasoning via rule channels and machine learning channels, the events in the emergency event handling request are classified and categorized to generate a handling work order. The handling work order is matched with the capability tags of resource providers in a preset emergency handling resource pool to determine the target resource provider. The handling work order is sent to the internet-side collaborative handling terminal through the secure cross-network interaction gateway, and then sent to the target resource provider through the internet-side collaborative handling terminal, enabling the target resource provider to receive and handle the handling work order, obtaining a work order handling result. The work order handling result sent by the target resource provider through the collaborative handling terminal is received through the secure cross-network interaction gateway. The work order handling result is reviewed and stored, forming a multi-role cross-network architecture that enables collaborative handling by all parties involved in an emergency event for rapid response. Attached Figure Description

[0015] Figure 1 This is a flowchart of an emergency event handling method across physically isolated networks according to an embodiment of the present invention; Figure 2 This is a system architecture diagram corresponding to the emergency event handling method across physically isolated networks according to an embodiment of the present invention; Figure 3 This is a flowchart of the work order request processing method for emergency event handling across physically isolated networks according to an embodiment of the present invention; Figure 4This is a flowchart illustrating the notification, early warning, and response process of an emergency event handling method across physically isolated networks according to an embodiment of the present invention. Figure 5 This is a structural diagram of an emergency event handling device across physically isolated networks according to an embodiment of the present invention. Detailed Implementation

[0016] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0017] like Figure 1 As shown, an embodiment of the present invention proposes an emergency event handling method across physically isolated networks, applied to the monitoring and scheduling center on the business private network side, including: Step 11: Receive an emergency event handling request sent by the Internet-side collaborative handling terminal through the secure cross-network interaction gateway. The emergency event handling request includes an event description and evidence data. The emergency event handling request is initiated by the collaborative handling terminal. Here, as Figure 2 As shown, the regulatory dispatch center is deployed on the business network side of the regulatory unit and is physically isolated from the Internet. The collaborative handling terminal is deployed on the Internet side and is directed to the responsible unit and resource providers in the emergency response resource pool.

[0018] The collaborative handling terminal supports online submission of emergency event handling requests, receiving early warning notifications, performing on-site handling, and providing online feedback on handling results. It automatically retains the entire process operation log and form materials, and has the functions of process review and document archiving, supporting front-end on-site handling work.

[0019] The secure cross-network interaction gateway is deployed at the network boundary between the business private network and the Internet, serving as a secure relay node for data interaction between the two networks. It employs an isolation forwarding mechanism to achieve secure one-way or two-way data synchronization, filtering unauthorized access and malicious data; it forwards private network commands and early warning information to the Internet side, while simultaneously transmitting back handling results, process records, and other data, ensuring secure and controllable cross-network data transmission.

[0020] When a cybersecurity incident occurs at the responsible unit, it reports the incident through the collaborative handling terminal and submits an emergency incident handling request online. The emergency incident handling request includes a detailed description of the cybersecurity incident and corresponding evidence data.

[0021] Step 12: Through parallel reasoning via rule channel and machine learning channel, classify and categorize the events in the emergency event handling request, and generate a handling work order; Here, as Figure 3 As shown, after receiving an emergency event handling request, the regulatory dispatch center classifies and categorizes the events reported in the emergency event handling request through two paths: a rule channel and a machine learning channel, and generates a handling work order.

[0022] Step 13: Match the disposal work order with the capability tags of each resource provider in the preset emergency response resource pool to determine the target resource provider; Here, the generated disposal work order is matched with each resource provider in the emergency response resource pool using a tag matching method, thereby achieving matching and scheduling based on capability tags, and determining the resource provider with the highest matching degree as the target resource provider.

[0023] Step 14: The processing work order is sent to the Internet-side collaborative processing terminal through the secure cross-network interaction gateway, and then sent to the target resource provider through the Internet-side collaborative processing terminal, so that the target resource provider receives the processing work order and processes it to obtain the work order processing result; Here, the secure cross-network interactive gateway securely transfers the work order to the collaborative processing terminal on the Internet side. The target resource provider receives the work order through the collaborative processing terminal, confirms the response, processes the event in the emergency event processing request, and obtains the work order processing result.

[0024] Step 15: Receive the work order processing result sent by the target resource provider through the collaborative processing terminal via the secure cross-network interaction gateway; Here, after the resource provider completes the on-site handling of the event, it submits the work order handling result through the collaborative handling terminal, and the result is transferred to the regulatory dispatch center by the secure cross-network interaction gateway. The regulatory unit reviews and stores the work order handling result in the regulatory dispatch center.

[0025] Step 16: Review and store the work order processing results.

[0026] In this embodiment, the monitoring and dispatching center operates on the dedicated business network, and is physically and logically connected to the secure cross-network interaction gateway. The secure cross-network interaction gateway acts as a boundary relay unit, connecting the dedicated business network on one side and the collaborative processing terminal in the Internet environment on the other. The three form a hierarchical serial architecture of dedicated network control, boundary secure forwarding, and Internet-end execution. All business data is transferred between the two networks through the secure cross-network interaction gateway, achieving interconnection and interoperability among the three parts.

[0027] In an optional embodiment of the present invention, step 12 involves classifying and categorizing events in the emergency response request through parallel reasoning via rule channels and machine learning channels to generate a response work order, including: Step 121: Obtain the data packet sent by the collaborative processing terminal through the secure cross-network interaction gateway, and after verifying the data packet, extract structured and unstructured features to obtain a feature vector; Here, when a cybersecurity incident occurs at the responsible unit, the collaborative handling terminal extracts raw data about the cybersecurity incident through the built-in front-end probe submodule, such as traffic metadata, alarm log summaries, asset snapshots, and manual text descriptions in emergency incident handling requests. The terminal packages the traffic metadata, alarm log summaries, asset snapshots, and manual text descriptions in emergency incident handling requests into standard structured data packets and then transfers the data packets to the monitoring and dispatch center via a secure cross-network interaction gateway.

[0028] The traffic metadata mentioned therein is a real-time traffic mirror of the responsible unit's Internet egress, including: a five-tuple (source IP, destination IP, source port, destination port, protocol), upstream and downstream traffic byte counts, TCP flag statistics, TLS / SSL certificate fingerprints, HTTP request methods, and DNS query domain names.

[0029] The alarm log summary consists of alarm information generated by the responsible unit's local firewall, IDS / IPS, EDR (Endpoint Detection Response), and other security devices, including: alarm ID, alarm name, source IP, destination IP, alarm timestamp, original alarm level (high / medium / low risk), and alarm deduplication count (frequency of triggering from the same attack source within 5 minutes).

[0030] The asset snapshot is an asset ledger of the responsible unit's own servers and terminals, used to assess the importance of the attacked assets, including: the attacked asset's IP address, operating system type, business importance level (core / important / general), and whether it carries sensitive data. The handwritten text description is the content of an emergency incident handling request filled out by personnel of the responsible unit.

[0031] Step 122: Input the feature vector into the preset decision tree model, and perform event classification, subclass identification and event grading judgment in sequence to obtain the first judgment result; Here, the rule channel adopts a decision tree model. The first layer of the decision tree model makes judgments on event classification. The event classification is divided into two categories: security events and vulnerability risks. Security events are malicious behaviors actively initiated by the attack source, while vulnerability risks are the exploitation of vulnerabilities in the system itself, which are characterized by passive vulnerability.

[0032] After the first layer of event classification and judgment, the second layer of sub-class identification and judgment is entered. The specific sub-classes of security events include: viruses and Trojans, ransomware, backdoor exploitation, phishing, website tampering, website hidden links, network vulnerabilities, weak passwords, denial of service and data security. The specific sub-classes of vulnerability risks include: directory traversal, hard-coded vulnerabilities, SQL injection, XSS, code execution, configuration errors, weak passwords, file uploads, information leakage, parsing vulnerabilities, logic vulnerabilities, backdoors and command execution.

[0033] After subclass identification, the event classification is determined. There are four levels of event classification, with level one being the highest and level four being the lowest. A comprehensive hazard score is calculated based on a weighted scoring model, and the score is then mapped to one of the four levels.

[0034] The comprehensive hazard score is calculated as follows: α˙ Asset Importance Score + β˙ Scope of Impact Score + γ˙ Business Interruption Score + δ˙ Data Loss Score + ε˙ Propagation Risk Score; where α, β, γ, δ, and ε are weighting coefficients, respectively.

[0035] The final determination is the first result, which is the event category, subcategory, and event level to which the event belongs.

[0036] Step 123: Input the feature vector into a preset machine learning model to obtain a second determination result; Here, based on the rule-based determination, machine learning is further used for uncertainty reasoning. The machine learning model adopts a multi-task deep neural network architecture and receives the feature vector. Let the feature vector be X and its dimension be d.

[0037] The feature vector X first passes through an L-layer fully connected shared network to extract common high-order features applicable to the three prediction tasks. The transformation of each layer is as follows: ,in For the input layer, For nonlinear activation functions, The weight matrix of the l-th layer, This is the bias term for layer l. The output of the last fully connected shared network layer, denoted as H, serves as the common input to the output headers of the three tasks.

[0038] Above the shared feature H, three independent output heads are connected in parallel to perform three prediction tasks, each consisting of a single-layer fully connected network with Softmax normalization. Taking event classification as an example, to determine whether the current event is a security event or a vulnerability, the unnormalized category score vector is calculated: ,in Linear score vector for event classification task, For event classification task weight matrix, This is a bias term. The Softmax function is used to... The probability distribution mapped to two categories: , This represents the predicted event classification probability distribution. The final event classification result is the category with the highest probability, i.e., ,in For the final predicted event classification results, Let be the predicted probability of the i-th category.

[0039] To prevent logical conflicts arising from independent predictions by the three output heads—for example, an event might be classified as a vulnerability or a ransomware event, while the event subclass is classified as a security event—a hierarchical constraint checker is added at the end of the model inference process to correct the output.

[0040] The correction method is to first check the predicted event subclass. Does it belong to the predicted event category? The corresponding classification category. If If it is a security incident, then It must be one of the subcategories included in the aforementioned security events; if If it is a potential vulnerability, then It must be one of the subclasses included in the vulnerability / risk list. If the validation passes, output directly. , and (Event level prediction). If the validation fails, subclass probability masking renormalization is performed, based on... Determine the event category and predict the probability distribution of the event subclasses. The probabilities of events not belonging to this category are all set to zero. The remaining valid subclass probabilities are renormalized so that the sum of the probabilities equals 1 again. The maximum value among the renormalized subclass probabilities is then selected as the corrected value. .

[0041] After the above hierarchical constraint verification, the final output event classification, event subclass, and event level are logically consistent. This results in a second judgment result that meets the requirements. , and .

[0042] Step 124: Determine the first confidence factor of the first judgment result and the second confidence factor of the second judgment result, respectively; Here, based on the context-aware confidence level, the confidence assessment submodule dynamically determines the weight allocation of the rule channel and the machine learning channel according to the event context, and the confidence factor assesses the credibility of the judgment results output by the rule channel and the machine learning channel.

[0043] Step 125: Based on the first confidence factor and the first judgment result, the second confidence factor and the second judgment result, the event classification result in the emergency event handling request is obtained, and a handling work order is generated.

[0044]

[0045] in, Classify and categorize the results of the events. The first confidence factor, The first judgment result For the second confidence factor, This is the second determination result.

[0046] In an optional embodiment of the present invention, step 121, obtaining the data packet sent by the collaborative processing terminal through the secure cross-network interaction gateway, verifying the data packet, and extracting structured and unstructured features to obtain a feature vector, may include: Step 1211: Obtain the data packet sent by the collaborative processing terminal through the secure cross-network interaction gateway and perform integrity verification on the data packet; Here, after receiving the data packet from the gateway, the monitoring and dispatch center first deconstructs the data packet, parses the data format, and restores it to structured data. Then, it verifies the data integrity. If data truncation or tampering is detected, it generates a "data credibility feature" which is directly input into the subsequent model.

[0047] Step 1212: Encode the numerical and categorical features in the data packet to obtain a structured feature vector; Here, the numerical and categorical features include the following from the traffic metadata: Protocol type, and the protocol type shall be encoded using one-hot encoding; The destination port number is mapped to a common port range using a segmented mapping method. Uplink / downlink flow ratio, the uplink / downlink flow ratio is numerically normalized; TLS fingerprint; based on the TLS fingerprint, query the threat intelligence database and output a four-category probability of "malicious, suspicious, unknown, and legitimate"; DNS query domain entropy value to calculate domain randomness entropy.

[0048] The numerical and categorical features include alarm types in the alarm log summary, which are encoded using a hierarchical categorical encoding method; the alarm frequency in the alarm log summary is encoded using a sliding window, extracting the number of alarm triggers from the same source IP within the sliding window and compressing it logarithmically; the original alarm levels in the alarm log summary are mapped to numerical values, with high risk mapped to 0.9, medium risk to 0.5, and low risk to 0.2.

[0049] The numerical and categorical features also include the business importance level in the asset snapshot, mapping core business to 0.9, important business to 0.6, and general business to 0.3; and mapping data sensitivity, mapping classified data to 0.9, internal data to 0.5, and public data to 0.1.

[0050] Step 1213: Semantically encode the unstructured text in the data packet to obtain a semantic vector; The unstructured text is information filled in by the responsible unit in the emergency response request. It is encoded using the lightweight network security BERT model, which takes corpus information as input and outputs a 128-dimensional semantic vector.

[0051] Step 1214: Obtain the transmission quality vector based on the cross-network transmission quality information of the data packet; In this application, because the data packets are ferried through a secure cross-network interaction gateway, the transmission process itself carries unique information that does not exist in the traditional network environment. This information reflects the "urgency" and "data quality" of the event.

[0052] The cross-network transmission quality information includes data packet transfer delay, data packet retransmission count, data truncation flag, and cross-network transfer sequence number continuity.

[0053] The data packet transfer delay is the time difference between the data packet being sent from the Internet side and received from the private network side. Normalized, this delay is considered a continuous feature. A shorter delay indicates a more urgent report from the responsible unit, potentially signaling a critical Level 1 event. The number of data packet retransmissions is taken as an integer value and logarithmically compressed. A higher number of retransmissions indicates network instability, a large data volume, and a wide-ranging impact of the event.

[0054] The data truncation flag is a binary feature of 0 or 1. Data truncation indicates a large amount of original evidence, requiring manual intervention and reducing the model's confidence. In the cross-network ferry sequence number continuity feature, continuity is 1, and packet loss is 0. If a sequence number jump is detected, it indicates a possible malfunction in the internet-side data collection probe, requiring a reduction in the overall confidence of that packet. Based on the above four dimensions of information, a 4-dimensional transmission quality vector is finally obtained.

[0055] Step 1215: Obtain the feature vector based on the structured feature vector, semantic vector, and transmission quality vector.

[0056] Here, the structured feature vector, semantic vector, and transmission quality vector are concatenated and deeply fused. The deep fusion uses a two-layer fully connected network to compress the vector into a 256-dimensional embedding vector, which is the feature vector.

[0057] In an optional embodiment of the present invention, step 124, determining the first confidence factor of the first determination result and the second confidence factor of the second determination result, may include: Step 1241: Determine the first confidence factor of the first determination result based on the completeness of the feature vector, the matching specificity between the feature vector and the preset decision tree model, and the completeness of the data packet; Here, since the essence of a rule channel is "table lookup" or "condition matching," its confidence level depends on "whether the input data allows the rule to make a clear judgment." Therefore, the first confidence factor of the rule channel consists of three parts: the completeness of the feature vector, the matching specificity between the feature vector and the preset decision tree model, and the completeness of the data packet. ,in For the first confidence level, For the completeness of the feature vector, To match specificity, For data packet integrity, , , These are the weighting coefficients.

[0058] The completeness of the feature vector = Actual number of features obtained / 10, where 10 represents the 10 core features that the decision tree model must obtain, such as source IP, destination IP, alarm type, attack port, asset importance, etc. If only "alarm type" and "destination IP" are extracted, and "attack payload features" are missing, the completeness = 0.2, then the rule will have difficulty accurately determining whether it is SQL injection or XSS, and the first confidence factor will be lowered.

[0059] The matching specificity between the feature vector and the preset decision tree model represents the granularity of the triggering rule. The finer the granularity, the more reliable the judgment. If only broad category rules can be matched, the reliability is low. The integrity of the data packet indicates whether data truncation or verification failure occurred during gateway traversal. If data truncation or verification failure occurs, it means that the features input to the rule may be defective.

[0060] Step 1242: Determine the second confidence factor of the second judgment result based on the predicted entropy value of the machine learning model and the sample distribution density of the feature vector.

[0061] Here, the prediction entropy value represents the degree of hesitation in the model's output. If the model determines it to be ransomware with a 90% probability, it means the model is very confident; if the probability distribution is across four levels or more subclasses, it means the model is hesitant. The second confidence level = 1 - normalized prediction entropy value. The sample distribution density represents the familiarity of the current input feature vector with historical training samples. Since machine learning models predict more accurately in areas with dense training data and are prone to guessing in sparse or unfamiliar areas, the confidence level should be reduced when the current input feature vector is rare in historical training samples. Specifically, the calculation method is as follows: calculate the average Euclidean distance between the current input feature vector and the nearest samples in the historical training set. The smaller the distance, the more surrounding historical samples there are, and the denser the distribution; the larger the distance, the more "isolated" the current sample is, potentially indicating a new attack variant. The second confidence level = 1 / (1 + average distance). The final second confidence factor is equal to the average score of the confidence level obtained from the prediction entropy value and the confidence level obtained from the sample distribution density.

[0062] In an optional embodiment of the present invention, step 13, matching the disposal work order with the capability tags of resource providers in a preset emergency response resource pool to determine the target resource provider, includes: Step 131: Obtain the event subclass, event level, and responsible unit area information from the handling work order, and the capability tags, area coverage information, and level qualification information of each resource provider in the emergency handling resource pool; Step 132: Match the event subclass with the capability tags of the resource provider to obtain the first matching result; The resource provider's capabilities include: security assessment services, attack and defense drills, website phishing monitoring, website malware monitoring, website tampering monitoring, security planning and design, asset / exposure surface analysis, vulnerability assessment, risk assessment, attack and defense drills, network security inspections, configuration baseline verification, Eagle Map asset mapping, manual source tracing, security consulting, vulnerability scanning, security training, incident response, security hardening, system security assessment, enterprise security inspection, phishing drill services, penetration testing, vulnerability assessment, individual combat technical capability enhancement and training, full network traffic analysis, network vulnerability management, network asset mapping, high-risk and low-risk inspections, data analysis, threat intelligence, threat handling, compliance assessment, Lingxi vulnerability scanning, honeypot systems, and verification of the effectiveness of security protection capabilities.

[0063] In this embodiment, a mapping matrix between preset event subclasses and resource provider capability tags is used. For security event subclasses, the mapping matrix is ​​shown in Table 1 below: Table 1. Mapping Matrix of Security Event Subclasses

[0064] For the vulnerability / potential subclass, the mapping matrix is ​​shown in Table 2 below: Table 2, Vulnerability Risk Event Subclass Mapping Matrix

[0065] The event subclasses are mapped according to the above-mentioned preset mapping table. The required capability tags obtained after mapping are matched with the capability tags of each technical support unit in the technical support unit resource pool. The intersection and matching degree are calculated to obtain the first matching result.

[0066] Step 133: Match the event classification with the resource provider's qualification information to obtain a second matching result; The resource provider's qualification information includes four levels: Level A, Level B, Level C, and Level D. Level A can handle all events from Level 1 to Level 4; Level B can handle Level 2, Level 3, and Level 4 events; Level C can handle Level 3 and Level 4 events; and Level D can handle Level 4 events. Matching is performed between the event level and the resource provider. If the qualifications match, the second matching result is 1; otherwise, it is 0.

[0067] Step 134: Match the regional information of the responsible unit with the regional coverage information of the resource provider to obtain a third matching result; In this embodiment, a distance coefficient mapping method based on administrative divisions is adopted. According to the administrative affiliation between the responsible unit and the resource provider, the distance coefficient is assigned as follows: 1.0 when the responsible unit and the resource provider are in the same city; 0.8 when they belong to the same administrative region (e.g., the same province); 0.5 when they belong to the same geographical region but not the same administrative region; and 0.3 when they are neither in the same city, nor in the same administrative region, nor in the same geographical region (i.e., across geographical regions). This yields the third matching result.

[0068] Step 135: Determine the target resource provider based on the first matching result, the second matching result, and the third matching result.

[0069] Specifically, the first matching result, the second matching result, and the third matching result are multiplied by their respective weight values ​​and then summed to obtain the overall matching degree.

[0070] The resource provider with the highest overall matching degree is selected as the target resource provider. Preferably, the weight of the first matching result is 0.5, and the weights of the second and third matching results are each 0.25.

[0071] In an optional embodiment of the present invention, such as Figure 4 As shown, the emergency collaborative handling methods applied to the monitoring and dispatch center on the business private network side also include: Step 21: Receive the cybersecurity warning output by the situation prediction model; the situation prediction model summarizes the response results of multiple responsible parties to the warning, as well as the handling work orders and work order handling results within a recent period, as the current state, forms a global situation awareness and predicts the risks within a future period, and outputs a cybersecurity warning.

[0072] Step 22: Send the network security warning to the Internet-side collaborative processing terminal through the secure cross-network interaction gateway; Step 23: Receive the early warning response result sent by the collaborative handling terminal through the secure cross-network interaction gateway. The responsible unit receives the network security early warning, conducts self-inspection and collaborative handling of the warnings included in the network security early warning, and forms an early warning response result by compiling the self-inspection conclusions, the implementation status of protective measures, and the response time, which is then transmitted back to the monitoring and dispatching center on the private network side through the gateway.

[0073] In an optional embodiment of the present invention, the emergency collaborative response method across physically isolated networks further includes: Step 24: Obtain the handling work orders, work order handling results, and early warning response results within the target historical time range. Here, the regulatory dispatch center obtains the handling work orders, work order handling results, and early warning response results that occurred within a certain period of time as the basic data for the situation prediction model. The handling work orders include information such as event level, event subclass, event area, and dispatch time; the work order handling results include information such as handling status, handling time, and root cause conclusions; the early warning response results include information such as response time, self-inspection findings, and implementation status of protective measures. Data cleaning is performed on the three types of data obtained to remove abnormal data.

[0074] Step 25: Extract structured time-series feature vectors based on the work orders, work order handling results, and early warning response results within the target historical time range; Here, the work orders, work order processing results, and early warning response results within the target historical time range are divided into N time steps by day. In each time step... Extract the following features: Based on the work order information, historical event statistical features are extracted, including the number of occurrences of the kth event subclass on day i. And the number of Level l events occurring on day i. ; Based on the work order information, environmental vulnerability characteristics are extracted, namely, the number of backlogged work orders that have not yet been closed at the end of day i. ; Based on the work order processing results, extract the processing efficiency feedback features, namely the proportion of successfully processed work orders in the closed loop on day i. And the average processing time of the work order closed on day i. ; Based on the early warning response results, the main protective resilience characteristics are extracted, including the early warning response timeliness rate on day i. This refers to the number of units that provide feedback within the specified time; and the self-inspection detection rate on day i. This refers to the number of units that reported discovering new hidden dangers in the response results.

[0075] The extracted historical event statistical features, environmental vulnerability features, response effectiveness feedback features, and main protective resilience features are normalized. The normalized features are then concatenated in a fixed order to form a D-dimensional daily feature vector. The daily feature vectors of N consecutive days are stacked in chronological order to form a structured time-series feature vector.

[0076] Step 26: Input the structured time-series feature vector into the situation prediction model and output a network security warning. The network security warning includes the risk level for a future period and the risk value of each event subclass.

[0077] The situation prediction model adopts a multi-output temporal prediction architecture. The input structured temporal feature vector is processed by convolution in the hidden layer and then mapped to the future predicted value through a fully connected output layer. ,in This is the vector of the prediction results for the j-th day in the future. It contains two parts: the risk value of each event subclass and the risk level for a future period of time.

[0078] The risk value for each event subclass is represented as follows: ,in This represents the predicted risk value for the Kth event subclass. The risk level for the future period is expressed as:

[0079] in Risk level, The average comprehensive hazard score for the next M days is obtained by multiplying the risk value of each event subclass by its corresponding hazard weight, summing the weighted values, and then taking the average. The threat weights can be preset, for example, a threat weight of 10 for ransomware and 3 for weak passwords.

[0080] The situation prediction model described in this embodiment employs a temporal convolutional network model, which includes an input layer (receiving the aforementioned structured temporal feature vector), a hidden layer, and an output layer. The hidden layer consists of multiple stacked residual blocks, each containing two layers of dilated causal convolutions, with the dilation coefficient increasing exponentially with the number of layers. By adjusting the convolutional kernel size, the number of layers, and the dilation cardinality, the receptive field of the model can be precisely controlled. The output layer is a fully connected layer that maps the feature dimension to the target dimension, outputting the risk level and risk values ​​for each event subclass over a future period.

[0081] In an optional embodiment of the present invention, the emergency collaborative response method across physically isolated networks further includes: Step 27: Based on the actual handling work orders, work order handling results, and warning response results received within the target time range after the network security warning is issued, the actual handling work orders, work order handling results, and warning response results are taken as true values. Step 28: Use the network security warning as a predicted value; Step 29: Train the situation prediction model based on the true value and the predicted value.

[0082] In this embodiment, the model's previous predictions (i.e., the cybersecurity warning output in step 26) are compared with the actual data that occurred afterward (i.e., the actual handling work orders, work order handling results, and warning response results described in step 27). The deviation between the two is used to optimize the model parameters in reverse, allowing the model to continuously approach the actual patterns during operation. Specifically, after the target future time range (e.g., the next 7 days) following the issuance of the cybersecurity warning ends, the regulatory dispatch center extracts from the database the actual handling work orders (including the actual event level, event subclass, and incident area), work order handling results (including the actual handling status and handling time), and warning response results (including the actual response time and self-inspection findings) that occurred during that time period. These post-event recorded statistical data are used as the true values, and the cybersecurity warnings (including the predicted risk level and risk values ​​for each event subclass) output by the situation prediction model in step 26 for the same future time period at historical moments are used as the predicted values.

[0083] Based on the true and predicted values, the loss function is calculated. For numerical prediction tasks (such as the occurrence count of each event subclass, comprehensive risk score), the mean squared error is used as the loss function, and its formula is: Where M is the number of days to be predicted, K is the total number of target variables to be predicted, For the predicted value of the k-th event subclass on day j, Let be the ground truth value of the k-th event subclass on day j. By minimizing this loss function, the weight and bias parameters of the situation prediction model are updated using the backpropagation algorithm, thus achieving model training and optimization. Simultaneously, to improve the model's sensitivity to recent situational changes, a sliding window incremental training strategy is adopted—each time a new batch of real data is obtained, instead of retraining all historical data, the model is fine-tuned for a limited number of rounds using the sliding window data from the most recent N days as the training set. This allows the model to retain its long-accumulated generalization ability while quickly adapting to the dynamic evolution of attack methods. After these three steps are completed, the updated model will be used for the next round of prediction (returning to step 24), thus forming a complete intelligent closed loop of "prediction, release, response, ground truth collection, model correction, and re-prediction," enabling the situation prediction model to continuously evolve.

[0084] The above embodiments of the present invention significantly improve the speed of emergency response to cybersecurity incidents, enabling full-process online closed-loop management, eliminating time-consuming offline processes, and shortening the emergency response cycle from several hours to several days to less than 30 minutes, improving efficiency by over 90%. Cross-entity collaboration barriers are effectively broken down; multi-role cross-network architecture opens up multi-entity linkage channels, increasing the collaboration participation rate from less than 60% to 100%, and the information transmission accuracy rate from approximately 70% to over 99%. A unified resource pool intelligently matches supporting units, achieving a matching accuracy rate of over 95%, shortening the scheduling response time from 2 to 4 hours to less than 5 minutes, and reducing the resource mismatch rate by over 80%. The entire handling process is traceable and auditable, with automatic full-process archiving and 100% material integrity, reducing audit traceability time from several days to minutes. Network boundary security is controllable; cross-network data encryption transmission meets the national cryptographic standard SM4, achieving a 100% abnormal access interception rate and reducing the risk of data leakage to zero. The system provides a comprehensive understanding of the regulatory situation, achieves 100% coverage in issuing early warnings, has a response status synchronization delay of less than 3 seconds, and improves overall prevention and control decision-making efficiency by more than 70%.

[0085] like Figure 5 As shown, embodiments of the present invention also provide an emergency event handling device 50 across physically isolated networks, comprising: The acquisition module 51 is used to receive an emergency event handling request sent by the Internet-side collaborative handling terminal through the secure cross-network interactive gateway. The emergency event handling request includes an event description and evidence data. Processing module 52 is used to classify and categorize events in the emergency event handling request through parallel reasoning via rule channels and machine learning channels, and generate handling work orders; match the handling work orders with the capability tags of resource providers in a preset emergency handling resource pool to determine the target resource provider; send the handling work order to the Internet-side collaborative handling terminal through a secure cross-network interaction gateway, and then send the handling work order to the target resource provider through the Internet-side collaborative handling terminal, so that the target resource provider receives the handling work order and handles it to obtain the work order handling result; receive the work order handling result sent by the target resource provider through the collaborative handling terminal through the secure cross-network interaction gateway; and review and store the work order handling result.

[0086] Optionally, by using parallel reasoning through rule channels and machine learning channels, the events in the emergency response request are classified and categorized to generate a response work order, including: The data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway are obtained, and after verifying the data packets, structured and unstructured features are extracted to obtain a feature vector; The feature vector is input into a preset decision tree model, and the event classification, subclass identification and event grading are performed in sequence to obtain the first judgment result; The feature vector is input into a preset machine learning model to obtain a second determination result; Determine the first confidence factor of the first judgment result and the second confidence factor of the second judgment result respectively; Based on the first confidence factor and the first judgment result, the second confidence factor and the second judgment result, the event classification result in the emergency event handling request is obtained, and a handling work order is generated.

[0087] Optionally, the data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway are obtained, and after verifying the data packets, structured and unstructured features are extracted to obtain a feature vector, including: The system acquires data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway and performs integrity verification on the data packets. The numerical and categorical features in the data packet are encoded to obtain a structured feature vector; The unstructured text in the data packet is semantically encoded to obtain a semantic vector; Based on the cross-network transmission quality information of the data packet, a transmission quality vector is obtained; The feature vector is obtained based on the structured feature vector, semantic vector, and transmission quality vector.

[0088] Optionally, determining the first confidence factor of the first determination result and the second confidence factor of the second determination result respectively includes: The first confidence factor of the first determination result is determined based on the completeness of the feature vector, the matching specificity between the feature vector and the preset decision tree model, and the completeness of the data packet. The second confidence factor of the second determination result is determined based on the predicted entropy value of the machine learning model and the sample distribution density of the feature vector.

[0089] Optionally, the disposal work order is matched with the capability tags of resource providers in a preset emergency response resource pool to determine the target resource provider, including: Obtain the event subclass, event level, and responsible unit area information from the handling work order, and the capability tags, area coverage information, and level qualification information of each resource provider in the emergency handling resource pool; The event subclass is matched with the capability tags of the resource provider to obtain a first matching result; The event classification is matched with the resource provider's qualification information to obtain a second matching result; The regional information of the responsible unit is matched with the regional coverage information of the resource provider to obtain a third matching result; The target resource provider is determined based on the first matching result, the second matching result, and the third matching result.

[0090] Optionally, emergency response methods across physically isolated networks also include: Receive network security early warnings output by the situation prediction model; The network security warning is sent to the Internet-side collaborative processing terminal through the secure cross-network interaction gateway; The secure cross-network interactive gateway receives the early warning response results sent by the collaborative processing terminal.

[0091] Optionally, emergency response methods across physically isolated networks also include: Obtain the work orders, work order processing results, and early warning response results within the target historical time range; Extract structured time-series feature vectors based on the work orders, work order processing results, and early warning response results within the target's historical time range; The structured time-series feature vector is input into the situation prediction model, and a network security early warning is output. The network security early warning includes the risk level for a future period of time and the risk value of each event subclass.

[0092] Optionally, emergency response methods across physically isolated networks also include: Based on the actual handling work orders, work order handling results, and warning response results received within a future target time range after the network security warning is issued, the actual handling work orders, work order handling results, and warning response results are taken as the truth values. The aforementioned network security warning will be used as a predicted value. The situation prediction model is trained based on the true values ​​and predicted values.

[0093] It should be noted that this device is the same as the method described above. All implementations in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0094] Embodiments of the present invention also provide a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0095] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0096] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0097] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0098] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0099] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0100] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0101] Furthermore, it should be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Moreover, the steps performing the above series of processes can naturally be executed in the order described, but are not necessarily required to be executed in chronological order; some steps can be executed in parallel or independently of each other. Those skilled in the art will understand that all or any step or component of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or a combination thereof. This is something that those skilled in the art can achieve by using their basic programming skills after reading the description of the present invention.

[0102] Therefore, the object of the present invention can also be achieved by running a program or a set of programs on any computing device. The computing device can be a known general-purpose device. Therefore, the object of the present invention can also be achieved simply by providing a program product containing program code implementing the method or apparatus. That is, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent to the present invention. Furthermore, the steps performing the above series of processes can naturally be performed in the order described, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel or independently of each other.

[0103] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for handling emergency incidents across physically isolated networks, characterized in that, It is applied to the monitoring and scheduling center on the business private network side, including: Receive emergency event handling requests sent by Internet-side collaborative handling terminals through a secure cross-network interactive gateway, wherein the emergency event handling requests include event descriptions and evidence data; By using parallel reasoning through rule channels and machine learning channels, events in the emergency event handling request are classified and graded to generate a handling work order. The processing work order is matched with the capability tags of resource providers in the preset emergency response resource pool to determine the target resource provider; The processing work order is sent to the Internet-side collaborative processing terminal through a secure cross-network interaction gateway, and then sent to the target resource provider through the Internet-side collaborative processing terminal, so that the target resource provider receives the processing work order and processes it to obtain the work order processing result; The secure cross-network interaction gateway receives the work order processing results sent by the target resource provider through the collaborative processing terminal. The results of the work order processing are reviewed and stored.

2. The emergency incident handling method across physically isolated networks according to claim 1, characterized in that, By using parallel reasoning through rule-based channels and machine learning channels, events in the emergency response request are classified and categorized to generate a response work order, including: The data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway are obtained, and after verifying the data packets, structured and unstructured features are extracted to obtain a feature vector; The feature vector is input into a preset decision tree model, and the event classification, subclass identification and event grading are performed in sequence to obtain the first judgment result; The feature vector is input into a preset machine learning model to obtain a second determination result; Determine the first confidence factor of the first judgment result and the second confidence factor of the second judgment result respectively; Based on the first confidence factor and the first judgment result, the second confidence factor and the second judgment result, the event classification result in the emergency event handling request is obtained, and a handling work order is generated.

3. The emergency event handling method across physically isolated networks according to claim 2, characterized in that, After acquiring the data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway and verifying the data packets, structured and unstructured features are extracted to obtain a feature vector, including: The system acquires data packets sent by the collaborative processing terminal through the secure cross-network interaction gateway and performs integrity verification on the data packets. The numerical and categorical features in the data packet are encoded to obtain a structured feature vector; The unstructured text in the data packet is semantically encoded to obtain a semantic vector; Based on the cross-network transmission quality information of the data packet, a transmission quality vector is obtained; The feature vector is obtained based on the structured feature vector, semantic vector, and transmission quality vector.

4. The emergency incident handling method across physically isolated networks according to claim 2, characterized in that, Determining the first confidence factor of the first judgment result and the second confidence factor of the second judgment result respectively includes: The first confidence factor of the first determination result is determined based on the completeness of the feature vector, the matching specificity between the feature vector and the preset decision tree model, and the completeness of the data packet. The second confidence factor of the second determination result is determined based on the predicted entropy value of the machine learning model and the sample distribution density of the feature vector.

5. The emergency incident handling method across physically isolated networks according to claim 1, characterized in that, The processing work order is matched with the capability tags of resource providers in the preset emergency response resource pool to determine the target resource provider, including: Obtain the event subclass, event level, and responsible unit area information from the handling work order, and the capability tags, area coverage information, and level qualification information of each resource provider in the emergency handling resource pool; The event subclass is matched with the capability tags of the resource provider to obtain a first matching result; The event classification is matched with the resource provider's qualification information to obtain a second matching result; The regional information of the responsible unit is matched with the regional coverage information of the resource provider to obtain a third matching result; The target resource provider is determined based on the first matching result, the second matching result, and the third matching result.

6. The emergency incident handling method across physically isolated networks according to claim 1, characterized in that, Also includes: Receive network security early warnings output by the situation prediction model; The network security warning is sent to the Internet-side collaborative processing terminal through the secure cross-network interaction gateway; The secure cross-network interactive gateway receives the early warning response results sent by the collaborative processing terminal.

7. The emergency event handling method across physically isolated networks according to claim 6, characterized in that, Also includes: Obtain the work orders, work order processing results, and early warning response results within the target historical time range; Extract structured time-series feature vectors based on the work orders, work order processing results, and early warning response results within the target's historical time range; The structured time-series feature vector is input into the situation prediction model, and a network security early warning is output. The network security early warning includes the risk level for a future period of time and the risk value of each event subclass.

8. The emergency incident handling method across physically isolated networks according to claim 6, characterized in that, Also includes: Based on the actual handling work orders, work order handling results, and warning response results received within a future target time range after the network security warning is issued, the actual handling work orders, work order handling results, and warning response results are taken as the truth values. The aforementioned network security warning will be used as a predicted value. The situation prediction model is trained based on the true values ​​and predicted values.

9. An emergency event handling device spanning physically isolated networks, characterized in that, include: The acquisition module is used to receive emergency event processing requests sent by the Internet-side collaborative handling terminal through a secure cross-network interactive gateway. The emergency event processing request includes an event description and evidence data. The processing module is used to classify and categorize the events in the emergency event handling request through parallel reasoning via rule channels and machine learning channels, and generate a handling work order; the handling work order is matched with the capability tags of resource providers in a preset emergency handling resource pool to determine the target resource provider; The processing work order is sent to the Internet-side collaborative processing terminal via a secure cross-network interaction gateway, and then sent to the target resource provider via the Internet-side collaborative processing terminal, so that the target resource provider receives the processing work order and processes it to obtain the work order processing result; the processing result of the work order sent by the target resource provider through the collaborative processing terminal is received via the secure cross-network interaction gateway; the processing result of the work order is reviewed and stored.

10. A computing device, characterized in that, include: A processor, a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any one of claims 1 to 8.

Images