System and method for detecting security threats based on asynchronous I / O and machine learning model

Abstract

The present invention relates to a security threat detection system and method that minimizes the impact on network traffic performance by performing security threat detection on web requests using an asynchronous I / O method, and detects and blocks various security threats in real time through a machine learning model. The system comprises: a firewall execution unit that processes web requests on a network asynchronously, requests security threat detection for received web requests, and blocks or forwards said web requests to a destination web server according to the security threat detection result; and a security threat detection unit that analyzes web request data through a machine learning model according to the request of said firewall execution unit to detect whether there is a security threat and transmits the result.

Description

Technology Field

[0001] The present invention relates to a security threat detection system and method that provides high performance and high availability in computer network security, particularly in internet-based services, and is characterized by performing security threat detection on web requests using an asynchronous I / O method to minimize the impact on network traffic performance, and detecting and blocking various security threats in real time through a machine learning model. Background Technology

[0003] A Web Application Firewall (WAF) is a security system designed to enhance the security of web applications, protecting them by detecting and blocking various types of attacks.

[0004] Existing firewall systems primarily manage network traffic using static rule-based filtering, but this approach has the problem of being difficult to respond to new types of security threats or rapidly changing network patterns because it relies on fixed rules.

[0005] Furthermore, existing firewall systems often use synchronous I / O processing methods, which can lead to I / O bottlenecks caused by traffic inspection and analysis in large-scale traffic environments, potentially degrading overall system performance and negatively impacting the provision of web services.

[0006] Korean Registered Patent No. 10-0958250 describes a technology that provides a web server security method and a web firewall for reducing the occurrence of duplicate checks by avoiding excessive security options. It describes a technology that distinguishes and inspects transmitted and received packets to inspect only the area where hacking occurs, but there is still a problem that it is difficult to respond to various rapidly changing network patterns. The problem to be solved

[0008] The present invention aims to solve the aforementioned problems by overcoming the limitations of existing firewall systems and implementing a firewall system capable of detecting and responding to security threats in real time while maintaining high performance and high availability. To this end, the system performance is optimized by processing threat detection for each web request asynchronously, and intelligent security threat detection and response are enabled by applying a machine learning model. means of solving the problem

[0010] A security threat detection system based on asynchronous input / output and a machine learning model according to one embodiment of the present invention may include: a firewall execution unit that processes a web request on a network in an asynchronous manner, requests security threat detection for a received web request, and blocks the web request or transmits it to a destination web server according to the security threat detection result; and a security threat detection unit that analyzes web request data through a machine learning model according to the request of the firewall execution unit to detect whether there is a security threat and transmits the result.

[0011] In addition, the firewall execution unit may include an asynchronous processing unit that processes multiple communication connections and multiple web requests received from the communication connections as asynchronous parallel operations.

[0012] Additionally, the firewall execution unit may further include a detection request unit that parses received web request data to configure target items for analyzing security threat status and requests security threat detection for the target items according to a defined web-based integration standard.

[0013] In addition, the security threat detection unit detects security threats regarding the URL, cookie value, user-agent, and body of an HTTP request packet through a security threat detection model, wherein the security threat detection model detects a pre-learned attack type for input data including the URL, cookie value, user-agent, and body of the HTTP request packet and outputs a result label indicating the detected attack type or normal for each item of the input data.

[0014] In addition, the above security threat detection model is characterized by being a model trained to classify attack types by extracting features through TF-IDF vectorization from a training dataset consisting of abnormal web request data and normal web request data including attack types, and applying the TF-IDF vectors to a Support Vector Machine (SVM) model.

[0015] In addition, the above attack types may include access control, download, include injection, logic SQL injection, SQL injection, shellcode, upload, URL regular expression, web attack programs, and XSS (cross-site scripting) attacks.

[0016] In addition, it operates in a cloud environment, receives security threat detection requests via a web-based API, and can transmit the results of the security threat detection requests.

[0017] In addition, the firewall execution unit can record / store log information regarding web requests in which security threats have been detected in a database, and provide real-time status and statistical information regarding detected security threats by visualizing the log information.

[0018] Meanwhile, a security threat detection method based on asynchronous input / output and a machine learning model according to one embodiment of the present invention may include: receiving a web request in an asynchronous input / output and machine learning model-based security threat detection system; parsing the received web request to configure a target item for detecting a security threat; performing security threat detection for the target item; and blocking the web request or forwarding it to a destination web server according to the security threat detection result.

[0019] Additionally, the step of performing security threat detection for the above-mentioned target item may include: performing data preprocessing including decoding, removal of newline characters, removal of whitespace, and conversion to lowercase on the target item included in the received security threat detection request data, and configuring input data for a security threat detection model; applying the input data to the security threat detection model to detect security threats in the URL, cookie value, user-agent, and body, and outputting a result label indicating the detected attack type or normal; and generating and transmitting result data for the detection request including the result label.

[0020] In addition, if the security threat detection result includes an attack type, the method may further include the step of storing information about abnormal web requests as a log and visualizing and outputting it. Effects of the invention

[0022] By applying machine learning models trained on various security threats instead of rule-based threat detection, new and complex security threats can be detected and responded to in real time.

[0023] In addition, by processing threat detection for each web request asynchronously, stable performance is maintained even under high load conditions, and network resources are utilized efficiently to reduce overall system operating costs.

[0024] In addition, by providing firewall services through a machine learning-based security threat detection model and proxy functions integrated via REST API, it is easy to apply, expand, and update existing web systems. Brief explanation of the drawing

[0026] FIG. 1 is an overall relationship diagram of an asynchronous input / output and machine learning model-based security threat detection system according to one embodiment of the present invention. FIG. 2 is a block diagram of the functions of an asynchronous input / output and machine learning model-based security threat detection system according to one embodiment of the present invention. FIG. 3 is an example screen of a dashboard visualizing a web request detected as abnormal in an asynchronous input / output and machine learning model-based security threat detection system according to an embodiment of the present invention. FIG. 4 is a diagram showing the hardware structure of an asynchronous input / output and machine learning model-based security threat detection system according to one embodiment of the present invention. FIG. 5 is a service flowchart for security threat detection performed in an asynchronous input / output and machine learning model-based security threat detection system according to an embodiment of the present invention. FIG. 6 is a flowchart of a method for detecting security threats based on asynchronous input / output and machine learning models according to an embodiment of the present invention. FIG. 7 is a flowchart illustrating in detail the process of detecting a security threat in a security threat detection method based on asynchronous input / output and machine learning model according to an embodiment of the present invention. Specific details for implementing the invention

[0027] Specific embodiments of the present invention will be described in detail below with reference to the drawings. However, the concept of the present invention is not limited to the presented embodiments. Those skilled in the art who understand the concept of the present invention may easily propose other inventions that are inferior or other embodiments included within the scope of the concept of the present invention by adding, changing, or deleting other components within the same scope of the concept, and such are also to be considered to be included within the scope of the concept of the present invention.

[0028] Furthermore, the terms described below are established considering their functions in the present invention; since these may vary depending on the inventor's intent or convention, their definitions should be based on the content throughout this specification. Additionally, if it is determined that a detailed description of known configurations or functions related to the present invention in this specification could obscure the essence of the invention, such detailed description will be omitted.

[0030] Hereinafter, an asynchronous I / O and machine learning model-based security threat detection system and method are described with reference to the drawings.

[0031] FIG. 1 is an overall relationship diagram of an asynchronous input / output and machine learning model-based security threat detection system according to one embodiment of the present invention.

[0032] Referring to FIG. 1, an asynchronous input / output and machine learning model-based security threat detection system (hereinafter referred to as the security threat detection system (100)) can communicate with each other by being connected to a web system (200) and a user terminal (300) via a network.

[0033] The term "network" as used in the present invention may refer to a core network integrated with a wired public network, a wireless mobile communication network, or the mobile internet, and may refer to a global open computer network structure that provides the TCP / IP protocol and various services existing at the upper layer, such as HTTP (Hyper Text Transfer Protocol), HTTPS (Hyper Text Transfer Protocol Secure), Telnet, FTP (File Transfer Protocol), etc. It is not limited to these examples but comprehensively refers to a data communication network capable of transmitting and receiving data in various forms.

[0034] The terminal mentioned in the present invention should be interpreted as including various communication means such as desktops, tablets, laptops, smartphones, and wearable smart devices, and can execute various functions provided by a server or system through a web-based or separate software / application.

[0036] The security threat detection system (100) of the present invention relates to a firewall system that blocks abnormal requests by performing security threat detection on web requests in real time. It performs security threat detection on web service requests in an asynchronous I / O manner to minimize the impact on network traffic performance, detects various security threats in real time through a machine learning model, records information on abnormal requests, and provides visualization thereof.

[0037] The security threat detection system (100) can operate as a reverse proxy server connected between the user terminal (300) and the web system (200) to perform the role of a firewall. That is, it receives web requests coming into the web system (200) on behalf of the system, detects security threats, forwards normal requests to the web system (200), and blocks abnormal requests.

[0038] Here, the web system (200) means a web server or a web application server including a web server.

[0039] Meanwhile, the security threat detection system (100) detects security threats by applying a machine learning model that detects attack types learned from web request data.

[0040] At this time, the machine learning model can be deployed and operated in a cloud environment, and the model can be used on a server outside the cloud via a REST API.

[0041] That is, the security threat detection system (100) is composed of a firewall execution unit (110) that performs the role of a reverse proxy that requests security threat detection for a received web request and blocks the web request or forwards it to a destination web server according to the security threat detection result, and a security threat detection unit (120) that operates in a cloud environment and detects security threats for a specific web request (Http / Https request) based on machine learning according to the request of the firewall execution unit (110).

[0042] At this time, the two configurations may be installed / operated separately by physical separation, and the two configurations may communicate with each other via REST API.

[0043] With such an architecture, a security threat detection system (100) can be easily built / installed on an existing web service or website, the cost burden for server resources for artificial intelligence model operation can be reduced, and model retraining and deployment to reflect rapidly changing attack types in the model is easy.

[0044] In addition, the firewall execution unit (110) and the security threat detection unit (120) may be installed and operated on the same physical server, without being limited thereto.

[0046] The firewall execution unit (110) and security threat detection unit (120) described above will be explained in detail with reference to FIG. 2.

[0047] FIG. 2 is a block diagram of the functions of an asynchronous input / output and machine learning model-based security threat detection system according to one embodiment of the present invention.

[0048] Referring to FIG. 2, the security threat detection system (100) has a firewall execution unit (110) that processes web requests on a network asynchronously, requests security threat detection for the received web requests, and blocks or forwards the web requests to a destination web server according to the security threat detection results, and a security threat detection unit (120) that analyzes web request data through a machine learning model according to the request of the firewall execution unit to detect whether there is a security threat and transmits the result.

[0049] The firewall execution unit (110) includes an asynchronous processing unit (111), a detection request unit (112), a detection result processing unit (113), a log generation unit (114), and a visualization unit (115).

[0050] The asynchronous processing unit (111) processes multiple communication connections and multiple web requests received from the communication connections as asynchronous parallel operations.

[0051] For asynchronous parallel operations, the asynchronous processing unit (111) manages an event queue, and web requests received from multiple user terminals (300) are registered in the event queue.

[0052] The asynchronous processing unit (111) processes tasks registered in the event queue by multiple threads managed by a single work process, thereby processing web requests in an asynchronous parallel manner for a large number of concurrent requests, so that stable performance can be maintained even in high-load situations and network resources can be used efficiently.

[0054] The detection request unit (112) parses the received web request data to configure target items for analyzing whether there is a security threat, and requests the detection of security threats for the target items according to the defined web-based integration standard.

[0055] The detection request unit (112) is a functional block performed by an individual thread that parses a single web request, i.e., HTTP request data according to the specifications of the HTTP protocol, extracts the URL, cookie value, user-agent, and body to form a target item, and requests the security threat detection unit (120) to detect a security threat on the extracted target item through a predetermined REST API.

[0056] For example, as shown below, when making a request via the REST API, the target item name and parsed HTTP request data can be configured and transmitted in JSON format.

[0058] The detection result processing unit (113) is a function block performed by an individual thread that blocks the web request or forwards it to the destination web server according to the detection result received from the security threat detection unit (120).

[0059] The detection results received from the security threat detection unit (120) may include four detection results for URL, cookie value, user-agent and body.

[0060] For example, if SQL injection is detected for the URL and the remaining three items are determined to be normal, result data may be delivered as follows.

[0061] ["URL": "sqli", "cookie value": "valid", "user-agent": "valid", "body": "valid"]

[0062] In addition, the result data can be delivered in JSON format included in the response message of the requested REST API.

[0063] The detection result processing unit (113) transmits the web request to the destination web system (200) when the detection results of each item are all normal, and if there is an item determined to be an attack type in the detection results, it blocks the web request by considering it an abnormal request and requests the log generation unit (114) to record information about the web request.

[0065] The log generation unit (114) records / stores log information for web requests in which a security threat has been detected in a database.

[0066] The stored log information may include IP address, TimeStamp, Request Method, server_protocol, Referer, Request Uri, User Agent, Body, Cookie, and model judgment results.

[0067] The above log information is stored in real time whenever a security threat is detected, and subsequently, statistical data regarding the logs for minutes / hours / days / months / years can be generated by a batch job.

[0069] The visualization unit (115) generates and visualizes real-time status and statistical information by attack type for logs of abnormal web requests stored in the database.

[0070] The visualization unit (115) can be provided in the form of a dashboard so that a user or administrator can check the status of security threats through a web screen or app screen.

[0071] FIG. 3 is an example screen of a dashboard visualizing a web request detected as abnormal in an asynchronous input / output and machine learning model-based security threat detection system according to an embodiment of the present invention.

[0072] Referring to Fig. 3, the dashboard can provide graph charts that visualize the number of normal requests, the number of requests for each type of attack, and various statistical data generated based on the number of requests for real-time and specific periods.

[0074] Referring again to FIG. 2, the security threat detection unit (120) will be described.

[0075] The security threat detection unit (120) analyzes web request data through a machine learning model in response to a request from the firewall execution unit, detects whether there is a security threat, and transmits the result.

[0076] The security threat detection unit (120) includes a data preprocessing unit (121), a security threat detection model (122), and a detection result transmission unit (123).

[0077] The data preprocessing unit (121) decodes the encoded data from the detection target item for the detection request requested by the firewall execution unit (110), and performs a data preprocessing process that removes newline characters, removes spaces, and converts uppercase letters to lowercase.

[0078] In addition, the task of transforming the data is performed so that the preprocessed data can be applied as input data for the model.

[0079] The security threat detection unit (120) detects security threats by applying the data with completed data preprocessing to the security threat detection model (122).

[0080] Here, the security threat detection model (122) detects a pre-learned attack type for input data including the URL, cookie value, user-agent, and body of an HTTP request packet, and outputs a result label indicating the detected attack type or normal for each item of the input data.

[0081] In addition, the security threat detection model (122) is characterized by being a model trained to classify attack types by extracting features through TF-IDF vectorization from a training dataset consisting of abnormal web request data and normal web request data including attack types collected from an actual network, and applying the TF-IDF vectors to a support vector machine (SVM) model.

[0082] In other words, key features are extracted from the detection target items given as input data, and the attack type is classified by calculating the similarity between the extracted features and the classification criterion, the attack type.

[0083] In this case, the attack types included in the training data may include access control, download, include injection, logical operation SQL injection, SQL injection, shellcode, upload, URL regular expression, web attack programs, and XSS (Cross-site scripting) attacks. However, the model is not limited to these and can be trained on various types of web attacks that occur in actual networks.

[0084] In addition, the security threat detection model (122) outputs a label corresponding to the attack type or a label corresponding to normal for the input data item.

[0085] The detection result transmission unit (123) configures the output result of the security threat detection model (122) into a predetermined format and transmits it as a response to the request of the firewall execution unit (110).

[0086] The format defined here is the result text composed of JSON, which can be included in the body of the response message for a REST API request and transmitted.

[0088] FIG. 4 is a diagram showing the hardware structure of an asynchronous input / output and machine learning model-based security threat detection system according to one embodiment of the present invention.

[0089] The security threat detection system (100) is composed of hardware including a central processing unit (1000), memory (2000), user interface (3000), database interface (4000), network interface (5000), web server (6000), etc.

[0090] The user interface (3000) provides input and output interfaces to the user by using a graphical user interface (GUI).

[0091] The database interface (4000) provides an interface between the database and the hardware structure.

[0092] The network interface (5000) provides a network connection between devices owned by the user.

[0093] The web server (6000) provides a means for a user to access the hardware structure through a network. Most users can access the web server remotely and use the security threat detection system (100).

[0094] Each step of the configuration or method described above may be implemented as computer-readable code on a computer-readable recording medium or transmitted via a transmission medium. A computer-readable recording medium is a data storage device capable of storing data that can be read by a computer system.

[0095] Examples of computer-readable recording media include, but are not limited to, databases, ROM, RAM, CD-ROM, DVD, magnetic tape, floppy disk, and optical data storage devices. Transmission media may be transmitted via the Internet or various types of communication channels. Additionally, computer-readable recording media may be distributed through networked computer systems so that computer-readable code is stored and executed in a distributed manner.

[0096] In addition, at least one component applied in the present invention may include or be implemented by a processor, such as a central processing unit (CPU) or a microprocessor, that performs a respective function, and two or more of said components may be combined into a single component to perform all operations or functions of the combined two or more components. Furthermore, a part of the at least one component applied in the present invention may be performed by another of these components. Additionally, communication between said components may be performed via a bus.

[0097] In addition, components deployed and operating in a cloud environment can also be configured as a virtual environment including the hardware elements described above.

[0099] FIG. 5 is a service flowchart for security threat detection performed in an asynchronous input / output and machine learning model-based security threat detection system according to an embodiment of the present invention, and FIG. 6 is a flowchart for a method for asynchronous input / output and machine learning model-based security threat detection according to an embodiment of the present invention.

[0100] Referring to FIGS. 5 and 6, a method for detecting security threats based on asynchronous input / output and machine learning models will be described.

[0101] A method for detecting security threats based on asynchronous input / output and machine learning models is performed in a security threat detection system (100).

[0102] As previously explained, the security threat detection system (100) performs the role of a web firewall (WAF) through a firewall execution unit (110) that operates as a reverse proxy server connected between a user terminal (300) and a web system (200) to perform the role of a firewall, and a security threat detection unit (120) that is deployed in a cloud environment to detect learned attack types regarding web request data.

[0103] First, the security threat detection system (100) performs the step (S100) of receiving a web request (Http request) from a user terminal (300).

[0104] At this time, the firewall execution unit (110) of the security threat detection system (100) receives multiple web requests and processes each web request in an asynchronous parallel manner.

[0105] Next, the step (S200) of parsing the received web request data according to HTTP protocol rules to configure target items for detecting security threats is performed.

[0106] The target items include a URL, a cookie value, a user-agent, and a body. Data of the above items included in the web request is extracted, and a security threat detection unit (120) is requested to detect security threats on the extracted target items through a predetermined REST API.

[0107] After step S200, the security threat detection unit (120) performs step (S300) of performing security threat detection on a target item in response to the security threat detection request requested by the firewall execution unit (110).

[0108] Step S300 is explained in detail with reference to Fig. 7.

[0109] FIG. 7 is a flowchart illustrating in detail the process of detecting a security threat in a security threat detection method based on asynchronous input / output and machine learning model according to an embodiment of the present invention.

[0110] In step S300, data preprocessing including decoding, removal of newline characters, removal of spaces, and conversion to lowercase is performed on the target items included in the received security threat detection request data, and a step (S310) of configuring the input data of the security threat detection model is performed.

[0111] Subsequently, the above input data is applied to a security threat detection model to detect security threats in the URL, cookie value, user-agent, and body, and a result label indicating the detected attack type or normal for each item is output (S320).

[0112] Then, result data for the detection request, including the above result label, is generated and transmitted to the firewall execution unit (110) (S330). At this time, the result data may be transmitted in JSON form in the response to the REST API.

[0113] Meanwhile, referring again to FIG. 6, after step S300, the firewall execution unit (110) performs step S400, which blocks the web request or forwards it to the destination web server according to the security threat detection result transmitted by the security threat detection unit (120).

[0114] If the detection result is normal, the corresponding web request is forwarded to the web server, and if the detection result includes an attack type (abnormal request), the corresponding web request can be blocked.

[0115] In addition, in the case of an abnormal request, a step (S500) of storing information about the abnormal web request in a log and visualizing and outputting it can be further performed.

[0116] Thus, the web system (200) administrator can check the real-time status of abnormal requests (attacks) and statistical data by attack type, and establish response and security policies for attacks based on this.

[0118] Although the structure and features of the present invention have been described above based on embodiments according to the present invention, the present invention is not limited thereto. It is understood by those skilled in the art that various changes or modifications can be made within the spirit and scope of the present invention, and thus such changes or modifications fall within the scope of the appended claims. Explanation of the symbols

[0120] 100: Security Threat Detection System 110: Firewall Execution Unit 111: Asynchronous Processing Unit 112: Detection Request Unit 113: Detection Result Processing Unit 114: Log Generation Unit 115: Visualization Section 120: Security Threat Detection Unit 121: Data Preprocessing Unit 122: Security Threat Detection Model 123: Detection Result Transmission Unit 200: Web System 300: User terminal

Claims

Claim 1 A firewall execution unit that processes web requests on a network asynchronously, requests security threat detection for received web requests, and blocks or forwards said web requests to a destination web server depending on the security threat detection result; and a security threat detection unit that analyzes web request data through a machine learning model in response to the request of said firewall execution unit to detect whether there is a security threat and transmits the result;The firewall execution unit parses received web request data to configure target items for analyzing security threat status, requests security threat detection for the target items from the security threat detection unit via a predetermined REST API, and receives the result; the security threat detection unit operates in a cloud environment, is executed by a predetermined REST API call to perform security threat detection work, and transmits the detection result as a response; the security threat detection unit detects security threats regarding the URL, cookie value, user-agent, and body of an HTTP request packet through a security threat detection model; the security threat detection model detects pre-learned attack types for input data including the URL, cookie value, user-agent, and body of an HTTP request packet, outputs a result label indicating the detected attack type or normal for each item of the input data, extracts features from a training dataset composed of abnormal web request data including attack types and normal web request data through TF-IDF vectorization, and A security threat detection system based on an asynchronous I / O and machine learning model, wherein the model is trained to classify attack types by applying TF-IDF vectors to a Support Vector Machine (SVM) model, and the said attack types include access control, download, include injection, logic SQL injection, SQL injection, shellcode, upload, URL regular expression, web attack program, and XSS (Cross-site scripting) attacks. Claim 2 A security threat detection system based on asynchronous input / output and machine learning model according to claim 1, wherein the firewall execution unit comprises an asynchronous processing unit that processes a plurality of communication connections and a plurality of web requests received from the communication connections as asynchronous parallel operations. Claim 3 delete Claim 4 delete Claim 5 delete Claim 6 delete Claim 7 delete Claim 8 In claim 1, the firewall execution unit records / stores log information regarding web requests in which a security threat has been detected in a database, and provides real-time status and statistical information regarding the detected security threat based on the log information, an asynchronous I / O and machine learning model-based security threat detection system. Claim 9 A security threat detection method performed by an asynchronous I / O and machine learning model-based security threat detection system comprises: a step in which a firewall execution unit of the security threat detection system receives a web request; a step in which the received web request is parsed to configure target items for security threat detection and a request for security threat detection is made to a security threat detection unit of the security threat detection system; a step in which the security threat detection unit performs security threat detection for the target items and transmits the result; and a step in which the firewall execution unit blocks the web request or transmits it to a destination web server according to the security threat detection result; wherein the step of performing security threat detection for the target items comprises: a step of performing data preprocessing including decoding, removal of newline characters, removal of whitespace, and lowercase conversion on target items included in the received security threat detection request data, and configuring input data for a security threat detection model; a step of applying the input data to a security threat detection model to detect security threats in the URL, cookie value, user-agent, and body, and outputting a result label indicating a detected attack type or normal. and a step of generating and transmitting result data for a detection request, including the above result label;A method for detecting security threats based on asynchronous I / O and a machine learning model, comprising: a security threat detection model; wherein the security threat detection model is a model trained to classify attack types by extracting features through TF-IDF vectorization from a training dataset composed of abnormal web request data including attack types and normal web request data, and applying the TF-IDF vectors to a Support Vector Machine (SVM) model; wherein the attack types include access control, download, include injection, logic SQL injection, SQL injection, shellcode, upload, URL regular expression, web attack program, and XSS (Cross-site scripting) attacks; and wherein the security threat detection unit operates in a cloud environment, is executed by a predetermined REST API call to perform a security threat detection task, and transmits the detection result as a response. Claim 10 delete Claim 11 A method for detecting security threats based on a synchronous I / O and machine learning model, further comprising the step of, in claim 9, storing information about abnormal web requests as a log and visualizing and outputting it when an attack type is included in the security threat detection result.

Images