CN116614265A - Point cloud characteristic enhanced block chain DDoS attack classification and segmentation method - Google Patents

Abstract

The embodiment of the application discloses a point cloud characteristic enhanced block chain DDoS attack classification and segmentation method, belonging to the technical field of network security. The method comprises the following steps: based on the CIC-DDoS2019 data set, acquiring data of a plurality of DDoS attack types, and establishing a data set with the DDoS attack types; preprocessing data except for data of a plurality of DDoS attack types in the CIC-DDoS2019 data set to obtain first data with effective characteristics; inputting the first data with the effective characteristics into a decision tree model for screening to obtain second data with key characteristics; generating a DDoS real-time detection dataset based on the second data with key features and the dataset with DDoS attack type; inputting second data with key characteristics to the point cloud, enhancing the characteristics of the point cloud, and establishing a detection model; and inputting the DDoS real-time detection data set into a detection model to obtain classification and segmentation results of DDoS attack flow. Therefore, the embodiment of the application can effectively classify and divide DDoS attacks in a distributed network environment.

Description

A Blockchain DDoS Attack Classification and Segmentation Method Enhanced by Point Cloud Features

technical field

The present application relates to the technical field of network security, in particular to a method for classifying and segmenting blockchain DDoS attacks with enhanced point cloud features.

Background technique

A mesh topology is used to build the peer-to-peer (P2P) network structure that makes up the blockchain. In the context of a blockchain network, each node can act as both a client and a server. Since every node on the blockchain network can send and receive data, traffic is not concentrated like it would be in a client, server network, but distributed across all network nodes. Due to the distributed network architecture adopted by the blockchain system, there are multiple connection points, which may make some network nodes more vulnerable to attack. Moreover, since the blockchain system provides a public database, attackers can quickly obtain all system-related data in order to attack the system more successfully.

One of the most significant risks to blockchain security is a DDoS attack, a type of cyber attack in which attackers attempt to flood a network or server with traffic from various sources in order to disrupt service. DDoS attacks have different characteristics in a blockchain ecosystem than in a typical network environment. Compared with the DDoS attack in the traditional network environment, the attacker can use a large number of attacked nodes to launch an attack, flooding the inbound connection of the target node, and finally causing the network to be paralyzed. Additionally, attackers may exploit network congestion as a means of interfering with the normal functioning of the network and reducing node availability and reliability.

In recent years, artificial intelligence algorithms have developed into one of the viable options for identifying DDoS attacks. The proposed framework is characterized by its high accuracy in detecting emerging DDoS attacks and its lightweight algorithm. Utilizes machine learning algorithms and Bloom filters to detect DDoS attacks without involving the multi-class classification security professionals need to detect DDoS attack types. However, DDoS attacks often show concurrency in the blockchain ecosystem, where multiple different attack types may occur at the same time. Current DDoS attack detection technologies cannot correctly detect different forms of attacks, including LDAP, MSSQL, NetBIOS, Portmap, Syn, UDP, UDPLag, etc. In the blockchain scenario, normal nodes and nodes attacked by DDoS exist in the same network, and both can communicate with other nodes. Since the nodes attacked by DDoS cannot work normally, and cannot process transaction requests from other nodes in a timely manner, the efficiency of the entire network will be reduced and the stability of the blockchain will be affected.

Contents of the invention

In order to solve the existing technical problems, the embodiment of the present application provides a blockchain DDoS attack classification and segmentation method with enhanced point cloud features. Described technical scheme is as follows:

In the first aspect, a block chain DDoS attack classification and segmentation method enhanced by point cloud features is provided, wherein the method comprises:

Based on the CIC-DDoS2019 data set, obtain data of multiple DDoS attack types, and establish a data set with DDoS attack types;

Preprocessing the data other than the data of the multiple DDoS attack types in the CIC-DDoS2019 data set to obtain the first data with valid features;

Inputting the first data with valid features to the decision tree model for screening to obtain second data with key features;

Generate a DDoS real-time detection data set according to the second data with key features and the data set with DDoS attack type;

Input the second data with key features into the point cloud, enhance the point cloud features, establish a detection model, and input the DDoS real-time detection data set into the detection model to obtain the classification and segmentation results of DDoS attack traffic.

Further, the data set with the type of DDoS attack includes: a subset with the type of DDoS attack and a subset without the type of DDoS attack, the subset with the type of DDoS attack and the subset without the type of DDoS attack The proportion of data in each set accounts for half of the data sets with DDoS attack types.

Further, the subset with DDoS attack types includes at least seven types, and the subset without DDoS attack types includes at least one type.

Further, the process of preprocessing data other than the multiple DDoS attack types in the CIC-DDoS2019 data set includes: deleting data and invariant features containing null and zero values to obtain the first feature; based on the The first feature is to exclude useless features to obtain the second feature; based on the second feature, the correlation between the features is counted, and the remaining features with high correlation are deleted to obtain the first data with valid features.

Further, the process of inputting the first data with effective features to the decision tree model for screening includes: training the first data with effective features by the decision tree model, and grouping them according to the importance of the training results to obtain Secondary data with key characteristics.

Further, each feature data of the second data with key features is standardized.

Further, the DDoS real-time detection data set includes at least fourteen kinds of characteristic data and eight kinds of tag types.

Further, the detection model simultaneously detects classification and segmentation of DDoS attack traffic.

In a second aspect, a computer-readable storage medium is provided, wherein at least one instruction, at least one program, code set or instruction set is stored in the storage medium, and the at least one instruction, the at least one program 1. The code set or instruction set is loaded and executed by a processor to realize the block chain DDoS attack classification and segmentation method enhanced by point cloud features as claimed in any one of claims 1 to 7.

In a third aspect, a computer device is provided, wherein the computer device includes a processor and a memory, at least one instruction, at least one section of program, code set or instruction set are stored in the memory, and the at least one instruction , the at least one section of program, the code set or the instruction set is loaded and executed by the processor to realize the blockchain DDoS attack classification and segmentation method of point cloud feature enhancement according to any one of claims 1 to 7 .

The beneficial effect brought by the technical solution provided by the embodiment of the application is: through a point cloud feature enhanced blockchain DDoS attack classification and segmentation method, a series of typical and abnormal cases using deep learning are investigated based on the CIC-DDoS2019 data set model. Data is processed and screened using statistical techniques, and features are screened using decision tree methods. Then, the improved point cloud is used to classify whether there is a DDoS attack and the type of DDoS attack. It provides a multi-dimensional, accurate and effective DDoS attack classification and segmentation method for the blockchain environment, which helps to maintain the stability and security of the blockchain system.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings that need to be used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

Fig. 1 is a schematic flow diagram of a block chain DDoS attack classification and segmentation method with point cloud feature enhancement provided by an embodiment of the present application;

FIG. 2 is a schematic diagram of a feature selection process based on a decision tree provided by an embodiment of the present application;

FIG. 3 is a schematic diagram of a data set with random sample data values and label values provided by the embodiment of the present application;

Fig. 4 is a schematic diagram of the improved point cloud network structure provided by the embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the implementation manners of the present application will be further described in detail below in conjunction with the accompanying drawings.

It should be clear that the described embodiments are only some of the embodiments of the present application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of this application.

When the following description refers to the accompanying drawings, the same numerals in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with aspects of the present application as recited in the appended claims.

In the description of the present application, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence, nor can they be Read as indicating or implying relative importance. Those of ordinary skill in the art can understand the specific meanings of the above terms in this application according to specific situations. In addition, in the description of the present application, unless otherwise specified, "plurality" means two or more.

As shown in Figure 1, the embodiment of the present application provides a block chain DDoS attack classification and segmentation method with point cloud feature enhancement, and the method includes the following steps:

S101. Based on the CIC-DDoS2019 data set, obtain data of multiple DDoS attack types, and establish a data set with DDoS attack types.

In the blockchain scenario, normal nodes and nodes attacked by DDoS exist in the same network, and both communicate with other nodes. However, since the nodes attacked by DDoS cannot work normally and cannot process transaction requests from other nodes in time, it will reduce the efficiency of the entire network and affect the stability of the blockchain. The CIC-DDoS2019 dataset is a collection of datasets used to detect DDoS attacks. Due to its high diversity, it can more accurately represent the actual scene situation. Therefore, using the CIC-DDoS2019 dataset to develop models is more suitable for identifying various DDoS attacks. First, randomly select a subset of DDoS attack entries from the CIC-DDoS2019 data set to establish a data set with DDoS attack types, wherein the data set with DDoS attack types includes the percentages of entries with and without DDoS attacks. 50%, the entry without DDoS attack includes 10,500 pieces of data with the label BENIGN, and the entry with DDoS attack includes 1,500 pieces of data with the following labels: LDAP, MSSQL, NetBIOS, Portmap, Syn, UDP and UDPLag.

S102. Preprocess data other than the data of the multiple DDoS attack types in the CIC-DDoS2019 data set to obtain first data with valid features.

Preprocess 87 feature quantities other than data of multiple DDoS attack types in the CIC-DDoS2019 dataset, verify each piece of data, and first delete zero-value and null-value data; secondly, delete 12 always Keep the same features to get the first feature; then, based on the first feature, remove the ones that do not have the usual statistical correlation, that is, delete the 6 feature quantities that are useless for model training, including FlowID, SourceIP, DestinationIP, Timestamp, SimilarHTTP, Unnamed: 0, get the second feature; then, based on the second feature, count the correlation between the feature quantities, delete 30 redundant features with high correlation including the total length of the Bwd data packet and the FwdIAT greater than 0.9 Quantity; After removing features such as FwdPSHFlags, SynFlagCount, and CWEFlagCount, only 29 feature quantities are retained as valid features, including ActiveMean, ActiveStd, ActiveMax, ActiveMin, and IdleStd, as well as additional 0 values.

S103. Input the first data with valid features to the decision tree model for screening to obtain second data with key features.

As shown in Figure 2, the remaining 29 effective features are further screened using the decision tree method. In order to divide the dataset into subsets and partition the features, the decision tree needs training data. First, from the beginning position, all data is divided into one node, the root node. Then go through two judgment steps, the judgment conditions include: if the data is an empty set, jump out of the loop; if the node is the root node, return Null; if the node is an intermediate node, mark the node as the class with the most categories in the training data ; If the samples belong to the same category, jump out of the loop, and the node is marked as this category; if the two judgment conditions do not jump out of the loop, consider dividing the node. In order to improve efficiency and accuracy, the optimal attribute division under the current conditions is selected, that is, the best features are selected for division, and the Gini index is selected as the index in training. The Gini index of the k-type distribution is shown in the following formula. The larger the Gini index, the greater the uncertainty of the sample.

After the above steps are divided, new nodes are generated, and then the conditions are cyclically judged, and new branch nodes are continuously generated until all nodes jump out of the loop, and the decision tree of feature screening results is obtained; among them, in order to avoid overfitting, once the decision tree The build is pruned; the input data sample is classified using a decision tree; starting from the root node, it proceeds to the leaf nodes by searching each layer according to the feature value of the input sample. The classification result of the input sample is the category corresponding to the leaf node. Each leaf node of the decision tree represents a category, and each branch reflects the value of a feature represented by each internal node. Obviously, the internal nodes of the tree structure feature are one of its most important elements, and they are grouped according to importance, including source port, destination port, protocol, total number of forwarded packets, total number of backward packets, forwarded packets Length, Maximum Backward Packet Length, Flow Bytes/Sec, Flow IAT Average, Flow IAT Criterion, Maximum Packet Length, ACK Flag Count, URG Flag Count, Inbound and 14 other characteristics, i.e. second data.

S104. Generate a DDoS real-time detection data set according to the second data with key features and the data set with DDoS attack types.

In the subsequent training, the data is filtered for the key feature source port and target port, and only 10 of the commonly used port numbers are kept, while setting the value of the rest of the port numbers to -1. Then, to create a standardized set of data, each feature quantity is normalized by taking its value and subtracting it from its mean and dividing by its standard deviation. Based on key features and data sets with DDoS attack types, a data set for real-time DDoS detection is generated, including at least fourteen kinds of characteristic data and eight label types. In the DDoS detection process, one method can collect multiple feature labels at the same time, and then detect the results of classification (judging whether there is a DDoS attack/no DDoS attack) and segmentation (dividing which type of DDoS attack belongs to) at the same time; Method According to the 14 important features screened above, a data set that can be used for real-time DDoS detection is created by random extraction. As shown in Table 1, feature rows and category columns correspond one-to-one, and no

Table 1

A DDoS attack category is indicated by category "0", and a DDoS attack category is indicated by category "1". Further, Fig. 3 shows the data values and label values of random samples in the established dataset with DDoS attack types, each element in each sample has a one-to-one correlation with its label value, and the numbers 1 to 8 are respectively Represents benign, ldap, mssqll, NetBIOS, Portmap, Syn, UDP, and UDPLag types. It should be noted that among samples with DDoS attacks, the number and types of DDoS attacks that may occur simultaneously may be different.

S105. Input the second data with key features into the point cloud, enhance the feature of the point cloud, establish a detection model, and input the DDoS real-time detection data set into the detection model to obtain the classification and segmentation results of DDoS attack traffic.

The PointNet deep learning architecture is used to process point cloud data, it uses a multi-layer perceptron to learn point cloud features, and has a symmetric architecture to quickly process point clouds (MLP). Therefore, DDoS attacks can be detected using point clouds. To discover possible attack patterns and effectively learn network traffic characteristics, point clouds can analyze network traffic to detect DDoS attacks. It can be trained to distinguish between legitimate and malicious traffic, and it can classify new incoming traffic. Point Cloud can process point cloud data more efficiently than other computers because it uses globally shared feature extraction technology, can handle multiple point clouds, and is not sensitive to order. But the number of point clouds often limits learning methods. First, enhance the point cloud in this part, and use the standard point cloud to process the 3D point cloud. There are three channels in the point cloud at this time. The improved point cloud network structure is shown in Figure 4, using 14-channel point cloud to solve the DDoS detection problem. The improved point cloud receives in its input layer a data sample with multiple entries, each with 14 feature quantities, represented as n×14 two-dimensional tensors. Then, the global branch and local branch of the improved point cloud convert low-dimensional features into high-dimensional space through feature dimension enhancement operations, making it easier for the network to learn complex feature representations and improve classification and segmentation accuracy. In the global branch, global features are realized by using fully connected layers to map low-dimensional features to high-dimensional spaces. In the local branch, local features are implemented by using point convolutional layers to map low-dimensional features into high-dimensional spaces. The global features obtained by max pooling have a total of 2048 elements, which are used for the classification problem of detecting whether there is a DDoS attack. In the local branch, the 64D high-dimensional features obtained by feature transformation are concatenated with the 2048D global features to obtain a 2062D feature tensor. Therefore, the segmentation results of DDoS attack types can be obtained after being processed by the fully connected layer. The calculation process of point convolution: Let the input point cloud be Among them, N represents the number of points in the point cloud, and C represents the number of features of each point. The output of the point convolutional layer is /> where D represents the number of output features. The parameters of the point convolution layer are /> The calculation process of the point convolution layer is the same as Y=XW. Since the dimensionality reduction mapping process transforms high-dimensional point cloud data into a low-dimensional space, fewer parameters are required in classification and segmentation networks to extract global features of point clouds. This enhances the generalization ability of the network. This layer concatenates the outputs of the global and local branches at the output layer of the network and transfers them to the output space using a fully connected layer. The output layer uses a softmax activation function for classification tasks and a sigmoid activation function for segmentation tasks. The sigmoid function produces a number between 0 and 1 that represents the likelihood that a sample belongs to a particular class.

Specifically, the classification method is: the input is a collection of all point cloud data of one frame, expressed as a two-dimensional tensor of nx14, where n represents the number of point clouds, and 14 corresponds to x, y, and z coordinates. The input data is first aligned by multiplying it with a transformation matrix learned by T-Net, which ensures the invariance of the model to specific spatial transformations. Through multiple MLP convolutions using shared weights, after feature extraction for each point cloud data, a T-Net is used to align the features. A max pooling operation is performed on each dimension of the feature to obtain the final global feature. For the classification task, the global feature is used to predict the final classification score through MLP; for the segmentation task, the global feature is concatenated with the local features of each point cloud learned before, and then the classification result of each data point is obtained through MLP. The global features extracted from the improved point cloud can perform classification tasks well.

The application discloses a block chain DDoS attack classification and segmentation method with enhanced point cloud features, which belongs to the technical field of network security. The method includes: based on the CIC-DDoS2019 data set, obtaining data of a plurality of DDoS attack types, setting up a data set with a DDoS attack type; The first data with valid features; the first data with valid features is input into the decision tree model screening, and the second data with key features is obtained; based on the second data with key features and the data set with DDoS attack types, generate DDoS real-time detection Data set; input the second data with key features into the point cloud to enhance the feature of the point cloud and establish a detection model; input the DDoS real-time detection data set into the detection model to obtain the classification and segmentation results of DDoS attack traffic. Therefore, the embodiment of the present application can classify and segment DDoS attacks in a multi-dimensional, accurate and effective manner in a distributed network environment, which helps to maintain the stability and security of the blockchain system.

Based on the same technical concept, corresponding to the method of the present application, the embodiment of the present application also provides a computer-readable storage medium, in which at least one instruction, at least one program, code set or instruction set is stored, and the At least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to implement the above-mentioned blockchain DDoS attack classification and segmentation method with enhanced point cloud features.

Based on the same technical idea, the embodiment of the present application also provides a computer device, which may have relatively large differences due to different configurations or performances, including one or more processors and memories, where the memories may be Temporary storage or permanent storage. The memory may store at least one instruction, at least one section of program, code set or instruction set, and the at least one instruction, said at least one section of program, said code set or instruction set are loaded and executed by said processor to realize the above points Blockchain DDoS attack classification and segmentation method enhanced by cloud features.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in computer readable media, in the form of random access memory (RAM) and/or nonvolatile memory such as read only memory (ROM) or flash RAM. The memory is an example of a computer readable medium.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can be implemented by any method or technology for storage of information. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media excludes transitory computer-readable media, such as modulated data signals and carrier waves.

It should also be noted that the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes Other elements not expressly listed, or elements inherent in the process, method, commodity, or apparatus are also included. Without further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

The above are only examples of the present application, and are not intended to limit the present application. For those skilled in the art, various modifications and changes may occur in this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the scope of the claims of the present application.

Claims (10)

1. The method for classifying and segmenting the DDoS attack of the block chain with the enhanced point cloud characteristics is characterized by comprising the following steps:

based on the CIC-DDoS2019 data set, acquiring data of a plurality of DDoS attack types, and establishing a data set with the DDoS attack types;

preprocessing data except the data of the plurality of DDoS attack types in the CIC-DDoS2019 data set to obtain first data with effective characteristics;

inputting the first data with the effective characteristics into a decision tree model for screening to obtain second data with key characteristics;

generating a DDoS real-time detection data set according to the second data with the key characteristics and the data set with the DDoS attack type;

inputting the second data with the key characteristics to the point cloud, enhancing the point cloud characteristics, establishing a detection model, inputting the DDoS real-time detection data set to the detection model, and obtaining classification and segmentation results of DDoS attack flow.

2. The point cloud feature enhanced blockchain DDoS attack classification and segmentation method of claim 1, wherein the dataset with DDoS attack types comprises: a subset with a DDoS attack type and a subset without a DDoS attack type, wherein the proportion of data of the subset with the DDoS attack type and the subset without the DDoS attack type each accounts for half of the data set with the DDoS attack type.

3. The point cloud feature enhanced blockchain DDoS attack classification and segmentation method of claim 2, wherein the subset of DDoS attack types includes at least seven, and the subset of DDoS attack types not includes at least one.

4. The point cloud feature enhanced blockchain DDoS attack classification and segmentation method of claim 1, wherein the preprocessing of data other than the plurality of DDoS attack types in the CIC-DDoS2019 dataset comprises: deleting the data containing null values and zero values and unchanged features to obtain first features; based on the first feature, removing useless features to obtain a second feature; based on the second features, counting the correlation among the features, deleting the residual features with high correlation, and obtaining the first data with the effective features.

5. The method of point cloud feature enhanced blockchain DDoS attack classification and segmentation of claim 1, wherein the process of inputting the first data with valid features into the decision tree model for filtering comprises: the decision tree model trains the first data with the effective characteristics and groups the first data according to the importance of the training result to obtain second data with the key characteristics.

6. The point cloud feature enhanced blockchain DDoS attack classification and segmentation method of claim 5, wherein each feature data of the second data with key features is normalized.

7. The point cloud feature enhanced blockchain DDoS attack classification and segmentation method of claim 1, wherein the DDoS real-time detection dataset comprises at least fourteen feature data and eight tag types.

8. The point cloud feature enhanced blockchain DDoS attack classification and segmentation method of claim 1, wherein the detection model detects classification and segmentation of DDoS attack traffic simultaneously.

9. A computer readable storage medium having stored therein at least one instruction, at least one program, code set, or instruction set loaded and executed by a processor to implement the point cloud feature enhanced blockchain DDoS attack classification and splitting method of any of claims 1 to 7.

10. A computer device comprising a processor and a memory having stored therein at least one instruction, at least one program, code set, or instruction set that is loaded and executed by the processor to implement the point cloud feature enhanced blockchain DDoS attack classification and segmentation method of any of claims 1-7.