CN118051920B - A method, device, equipment and storage medium for generating a vulnerability verification request package - Google Patents

Abstract

The present application discloses a method, device, equipment and storage medium for generating a vulnerability verification request packet, and relates to the field of network information security technology. The method comprises: using an interactive application security testing tool to detect an application to be tested to obtain vulnerability data in the application to be tested; classifying a taint tracking data stream, and filtering the taint tracking data stream according to the classification result; traversing the filtered taint tracking data stream to obtain a data stream that truly contains taint information, and determining target taint source information; using several large language models to train the information of the test request packet, the target taint source information and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request packet; determining the final template of the vulnerability verification request packet, and inputting the information of the test request packet, the target taint source information and the vulnerability type into the final template to obtain the target vulnerability verification request packet. The present application improves the accuracy of automatic vulnerability verification and the efficiency of vulnerability verification to a certain extent.

Description

A method, device, equipment and storage medium for generating a vulnerability verification request package

Technical Field

The present application relates to the field of network information security technology, and in particular to a vulnerability verification request packet generation method, device, equipment and storage medium.

Background technique

IAST (Interactive Application Security Testing) is a technology that automatically identifies and diagnoses software vulnerabilities in applications. It can monitor and detect the running status of applications in real time, deeply analyze the internal logic and data flow of applications, and help discover potential security threats to applications.

The large language model has powerful text generation and understanding capabilities, and can generate text that conforms to grammatical and semantic rules based on the context.

However, traditional vulnerability verification methods usually rely on manually written verification request packages, which has problems such as low efficiency and prone to errors.

Summary of the invention

The present application provides a method for generating a vulnerability verification request package, which aims to solve the problems of low efficiency and easy errors in handwritten verification request packages in the prior art.

To achieve the above objectives, this application adopts the following technical solutions:

A vulnerability verification request packet generation method of the present application includes the following steps:

Using an interactive application security testing tool to detect the application to be tested, and obtaining vulnerability data in the application to be tested, wherein the vulnerability data includes a taint tracking data flow, a test request packet, and a vulnerability type;

Classifying the taint tracking data stream according to the relative relationship between the taint and the vulnerability parameter, and filtering the taint tracking data stream according to the classification result;

Traverse the filtered taint tracking data stream to obtain the data stream that actually contains taint information, and determine the target taint source information based on it;

Using several large language models to respectively train the information of the test request package, the target taint source information and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request package;

The final template of the vulnerability verification request package is determined according to the multiple candidate templates, and the information of the test request package, the target taint source information and the vulnerability type are input into the final template to obtain the target vulnerability verification request package.

Preferably, the taint tracking data stream includes taint source information, taint propagation information and taint sink information;

The taint source information includes an execution method for obtaining a request parameter value, a code location, a vulnerability parameter, and a taint.

Preferably, the classifying the taint tracking data stream according to the relative relationship between the taint and the vulnerability parameter, and filtering the taint tracking data stream according to the classification result, comprises:

Determine whether the vulnerability parameter and the taint are the same value, and if the vulnerability parameter and the taint are the same value, delete the code position and the vulnerability parameter in the taint source information;

When the vulnerability parameter and the taint are not the same value, the code position in the taint source information is deleted.

Preferably, the traversing the filtered taint tracking data stream to obtain a data stream that actually contains taint information, and determining the target taint source information accordingly, includes:

The data stream that actually contains taint information in the filtered taint tracking data stream is obtained by executing the function data signature, and the first taint propagation information or taint convergence point information containing the data signature is used as the target taint source information.

Preferably, the method of using several large language models to respectively train the information of the test request packet, the target taint source information and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request packet includes:

Write a basic template for a vulnerability verification request package according to the information of the test request package, the target taint source information and the vulnerability type;

Based on the basic template, several large language models are used to train the information of the test request package, the target taint source information and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request package.

Preferably, the determining a final template of the vulnerability verification request packet according to the multiple candidate templates includes:

Acquire test data, input the test data into the multiple candidate templates respectively to obtain several output results, and use the candidate template whose output result best meets the preset conditions as the final template of the vulnerability verification request package.

A vulnerability verification request packet generating device, comprising:

A detection module, used to detect the application to be tested using an interactive application security testing tool to obtain vulnerability data in the application to be tested, wherein the vulnerability data includes a taint tracking data flow, a test request packet, and a vulnerability type;

A preprocessing module, used for classifying the taint tracking data stream according to the relative relationship between the taint and the vulnerability parameter, and filtering the taint tracking data stream according to the classification result;

The traversal module is used to traverse the filtered taint tracking data stream to obtain the data stream that actually contains taint information, and determine the target taint source information accordingly;

A training module, used to use several large language models to respectively train the information of the test request package, the target taint source information and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request package;

The output module is used to determine the final template of the vulnerability verification request package according to the multiple candidate templates, and input the information of the test request package, the target taint source information and the vulnerability type into the final template to obtain the target vulnerability verification request package.

Preferably, the training module comprises:

A writing unit, used to write a basic template of a vulnerability verification request package according to the information of the test request package, the target taint source information and the vulnerability type;

The training unit is used to train the information of the test request package, the target taint source information and the vulnerability type based on the basic template using several large language models to obtain multiple candidate templates of the vulnerability verification request package.

An electronic device comprises a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement a vulnerability verification request packet generation method as described in any one of the above.

A computer-readable storage medium storing a computer program, wherein the computer program enables a computer to implement a vulnerability verification request packet generation method as described in any one of the above when executed.

The present invention has the following beneficial effects:

This application combines the taint tracking data stream obtained by scanning with the IAST tool and the large language model to generate a vulnerability verification request package that is more in line with the actual scenario. Through this method of comprehensive utilization of different technical means, the software development team can more quickly discover, verify and repair potential vulnerabilities, which improves the accuracy and efficiency of vulnerability verification to a certain extent. At the same time, it also lowers the technical threshold for code repair and improves overall work efficiency.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

FIG1 is a schematic diagram of a vulnerability verification request packet generation method of the present application;

FIG2 is a flow chart of a method for generating a vulnerability verification request packet in the present application;

FIG3 is a schematic diagram of a device for generating a vulnerability verification request packet according to the present application;

FIG4 is a schematic diagram of an electronic device implementing a method for generating a vulnerability verification request packet according to the present application.

Detailed ways

The following will be combined with the accompanying drawings to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

The terms "first", "second", etc. in the claims and specification of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable under appropriate circumstances. This is merely a way of distinguishing objects with the same properties in the embodiments of the present application. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, so that a process, method, system, product or apparatus that includes a series of units is not necessarily limited to those units, but may include other units not expressly listed or inherent to these processes, methods, products or apparatuses.

Example 1

As shown in FIG. 1 and FIG. 2, a method for generating a vulnerability verification request packet includes the following steps:

S110, using an interactive application security testing tool to detect the application to be tested, and obtaining vulnerability data in the application to be tested, wherein the vulnerability data includes a taint tracking data flow, a test request packet, and a vulnerability type;

S120, classifying the taint tracking data flow according to the relative relationship between the taint and the vulnerability parameter, and filtering the taint tracking data flow according to the classification result;

S130, traversing the filtered taint tracking data stream to obtain the data stream that actually contains taint information, and determining the target taint source information accordingly;

S140, using several large language models to respectively train the information of the test request packet, the target taint source information and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request packet;

S150. Determine a final template of the vulnerability verification request package according to the multiple candidate templates, and input the information of the test request package, the target taint source information and the vulnerability type into the final template to obtain a target vulnerability verification request package.

In this embodiment, the application to be tested is first started, and then the interactive application security testing tool, i.e., the IAST tool, is used to detect the application to be tested. When there is a vulnerability in the application to be tested, the vulnerability data in the application to be tested can be obtained, wherein the vulnerability data includes data such as taint tracking data flow, request data packet, code location information, vulnerability parameters, and vulnerability type. Preferably, the taint tracking data flow includes taint source, i.e., source point information, taint propagation information, and taint sink point information. The source point information includes an execution method for obtaining a request parameter value, a code location, vulnerability parameters, and taints. The specific structure of the taint tracking data flow and the source point information is as follows:

Taint tracking data flow:

Source point information,

Taint propagation information 1,

…

Taint propagation information N,

Sink point information

]

Source point information: {

Execution method: Specific execution method, such as java.lang.String[] org.apache.catalina.connector.RequestFacade.getParameterValues(java.lang.String),

Code location: The specific code location of the taint source, such as getParameterValues()@ServletWebRequest.java:153,

Vulnerability parameters: specific vulnerability parameters, such as username=123,

Taint: Specific taint value, such as: 123

}

The function of the execute method is to obtain the value of the request parameter. In Web development, HTTP requests can contain multiple parameters with the same name. The getParameterValues function is used to obtain the array values of these parameters. It can also be used to handle the case of parameters with the same name. For example, when a form is submitted, if there are multiple input fields with the same name, these values will be passed to the backend as an array. It can also be used to locate the position of the taint in the request packet, that is, to locate whether it is the request header, URL, or request body. At the same time, the data structure of the source point information, taint propagation information, and sink information in the taint tracking data flow is the same as the above source point information.

It should also be pointed out here that taint analysis can be abstracted into a triple form of 〈sources, sinks, sanitizers〉, where source is the taint source, which represents the direct introduction of untrusted data or confidential data into the system; sink is the taint sink, which represents the direct generation of security-sensitive operations, namely, violation of data integrity or leakage of private data to the outside world, namely, violation of data confidentiality; sanitizer is harmless processing, which means that the taint has been filtered or the parameters have been verified, which means that data propagation will no longer pose a threat to the information security of the software system through data encryption or removal of harmful operations. The taint tracking data stream obtained by IAST records the process of taint analysis. The discovery, propagation and execution of taint are recorded step by step like a chain of evidence. Therefore, no matter which stage the taint is in, there will be corresponding code and vulnerability parameter information.

Next, the obtained taint tracking data stream is preprocessed for the first time according to the relative relationship between the taint and the vulnerability parameters.

Specifically, determining whether the vulnerability parameter and the taint are the same value, and when the vulnerability parameter and the taint are the same value, deleting the code position and the vulnerability parameter in the taint source information;

When the vulnerability parameter and the taint are not the same value, the code position in the taint source information is deleted.

The first preprocessing is to determine whether the vulnerability parameter in the source point information of the taint tracking data flow is the same as the taint, so as to classify the taint tracking data flow. If the vulnerability parameter in the source point information is the same as the taint, the code position and vulnerability parameter in the source point information are directly deleted, and only the execution method and taint are retained. The structure of the source point information after preprocessing is as follows:

Source point information: {

Execution method: Specific execution method, such as java.lang.String[] org.apache.catalina.connector.RequestFacade.getParameterValues(java.lang.String),

Taint: Specific taint value, such as: 123

}

If the vulnerability parameter in the source point information is not the same as the taint value, the code position is considered interference data, and the code position in the source point information is directly filtered out. The structure of the source point information after preprocessing is as follows:

Source point information: {

Execution method: Specific execution method, such as java.lang.String[] org.apache.catalina.connector.RequestFacade.getParameterValues(java.lang.String),

Vulnerability parameters: specific vulnerability parameters, such as username=123,

Taint: Specific taint value, such as: 123

}

However, since the execution methods of the source point in the taint tracking data stream, such as getInputStream, do not have specific taint information, it is necessary to traverse the entire taint tracking data stream to find the data stream that actually contains taint information as the target source point information. getParameterValues and getInputStream are both execution methods of the source point. GetInputStream is used as an example here because it does not clearly display the specific information of the taint at the source point, and it is necessary to propagate information or sink point information to find it, that is, perform a second preprocessing.

Specifically, the data stream that actually contains taint information in the filtered taint tracking data stream is obtained by executing the function data signature, and the first taint propagation information or taint convergence point information containing the data signature is used as the target taint source information.

To find the data stream with real tainted information, you can use the execution function data signature method. For example, the execution function "com.fasterxml.jackson.core.json.UTF8StreamJsonParser.getText" refers to the function for obtaining specific taints. Then, the first taint propagation information or sink point information containing the data signature in the data stream that actually contains tainted information is used as the corrected source point information, that is, the target source point information. The target source point information is exemplified as follows:

Target source point information: {

Execution method: The execution method of a specific data signature, such as com.fasterxml.jackson.core.json.UTF8StreamJsonParser.getText,

Vulnerability parameters: Vulnerability parameters, such as username=123,

Taint: Taint value, such as: 123

}

The target source point information helps to locate the position of the taint in the test request package, so that the vulnerability verification request package generated by the subsequent large language model can be used directly.

Then, based on the text generation and understanding capabilities of the large language model, a verification vulnerability payload of a specific vulnerability type is constructed based on the target source point information and the test request package information to form a customized vulnerability verification request package for vulnerability verification.

Specifically, a basic template of a vulnerability verification request package is written according to the information of the test request package, the target taint source information and the vulnerability type;

Based on the basic template, several large language models are used to train the information of the test request package, the target taint source information and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request package.

First, write a basic prompt or basic template according to the target source point information, test request package information and vulnerability type, as follows:

Basic Prompt: "Assuming you are an expert in XX field, please follow the steps below to complete the task:

Determine the location of the payload in the request packet based on the test request packet information {req} and the real taint source information {source} in the taint tracking data stream";

Combine the execution method and the location of the tainted value to inject the {type} vulnerability verification payload;

Output strictly in the following json format:

‘‘‘json{

"Request package": specific vulnerability verification request package

}

’’’

”

Next, use a large language model with more parameters such as chatgpt4 and mistral8x7B to generate multiple alternative prompts with the same semantics. Then, obtain test data and input the test data into these multiple alternative prompts to obtain the output results. The alternative prompt whose output results best meet the preset requirements is used as the final prompt of the vulnerability verification request package. Finally, use the role-playing ability of the large language model to input the target source point information, test request package information, and vulnerability type into the final prompt. The test request package information is the basic guarantee for the testable request package, and the target source information can determine the location of the taint in the test request package, which helps to inject the vulnerability verification payload at the location of the taint, thereby realizing a customized automatic vulnerability verification function and outputting it in a fixed format to obtain the target vulnerability verification request package.

Compared with the existing technology, this embodiment can lower the vulnerability verification threshold for developers, improve the accuracy of automated vulnerability verification and the efficiency of vulnerability verification to a certain extent, and provide a new idea for the implementation of large models in the field of network security.

Example 2

As shown in FIG3 , a vulnerability verification request packet generating device includes:

The detection module 10 is used to detect the application to be tested by using an interactive application security testing tool to obtain vulnerability data in the application to be tested, wherein the vulnerability data includes a taint tracking data flow, a test request packet and a vulnerability type;

A preprocessing module 20, for classifying the taint tracking data stream according to the relative relationship between the taint and the vulnerability parameter, and filtering the taint tracking data stream according to the classification result;

A traversal module 30 is used to traverse the filtered taint tracking data stream to obtain the data stream that actually contains taint information, and determine the target taint source information accordingly;

A training module 40 is used to use several large language models to train the information of the test request packet, the target taint source information and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request packet;

The output module 50 is used to determine the final template of the vulnerability verification request package according to the multiple candidate templates, and input the information of the test request package, the target taint source information and the vulnerability type into the final template to obtain the target vulnerability verification request package.

An implementation of the above-mentioned device may be as follows: the detection module 10 uses an interactive application security testing tool to detect the application to be tested and obtains vulnerability data in the application to be tested, wherein the vulnerability data includes a taint tracking data stream, a test request packet and a vulnerability type; the preprocessing module 20 classifies the taint tracking data stream obtained by the detection module 10 according to the relative relationship between the taint and the vulnerability parameter, and filters the taint tracking data stream according to the classification result; the traversal module 30 traverses the taint tracking data stream filtered by the preprocessing module 20 to obtain a data stream that truly contains taint information, and determines the target taint source information accordingly; the training module 40 uses several large language models to train the information of the test request packet, the target taint source information determined by the traversal module 30 and the vulnerability type to obtain multiple candidate templates of the vulnerability verification request packet; the output module 50 determines the final template of the vulnerability verification request packet according to the multiple candidate templates generated by the training module 40, and inputs the information of the test request packet, the target taint source information and the vulnerability type into the final template to obtain the target vulnerability verification request packet.

Specifically, a training module 40 of a vulnerability verification request packet generating device further includes:

A writing unit, used to write a basic template of a vulnerability verification request package according to the information of the test request package, the target taint source information and the vulnerability type;

The training unit is used to train the information of the test request package, the target taint source information and the vulnerability type based on the basic template using several large language models to obtain multiple candidate templates of the vulnerability verification request package.

Example 3

As shown in FIG. 4 , an electronic device includes a memory 401 and a processor 402 , wherein the memory 401 is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 402 to implement the above-mentioned vulnerability verification request packet generation method.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the electronic device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

A computer-readable storage medium storing a computer program, wherein the computer program enables a computer to implement a vulnerability verification request packet generation method as described above when executed.

Exemplarily, the computer program may be divided into one or more modules/units, one or more modules/units are stored in the memory 401 and executed by the processor 402, and the I/O interface transmission of data is completed by the input interface 405 and the output interface 406 to complete the present invention. The one or more modules/units may be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may include, but is not limited to, a memory 401 and a processor 402. Those skilled in the art may understand that this embodiment is only an example of a computer device and does not constitute a limitation on the computer device. The computer device may include more or fewer components, or a combination of certain components, or different components. For example, the computer device may also include an input device 407, a network access device, a bus, etc.

The processor 402 may be a central processing unit (CPU), or other general-purpose processors 402, digital signal processors 402 (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor 402 may be a microprocessor 402 or the processor 402 may also be any conventional processor 402, etc.

The memory 401 may be an internal storage unit of a computer device, such as a hard disk or memory of the computer device. The memory 401 may also be an external storage device of the computer device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device. Furthermore, the memory 401 may include both an internal storage unit of the computer device and an external storage device. The memory 401 is used to store computer programs and other programs and data required by the computer device. The memory 401 may also be used to temporarily store in the output device 408. The aforementioned storage media include various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory ROM403, a random access memory RAM404, a disk or an optical disk.

The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (8)

1. The vulnerability verification request packet generation method is characterized by comprising the following steps:

Detecting an application to be detected by using an interactive application security test tool to obtain vulnerability data in the application to be detected, wherein the vulnerability data comprises a stain tracking data stream, a test request packet and a vulnerability type, the stain tracking data stream comprises stain source information, stain propagation information and stain convergence point information, and the stain source information comprises an execution method, a code position, vulnerability parameters and stains for acquiring a request parameter value;

Judging whether the loophole parameter and the stain are the same value, and deleting the code position and the loophole parameter in the stain source information when the loophole parameter and the stain are the same value;

deleting the code position in the stain source information when the vulnerability parameter and the stain are not the same value;

classifying the stain tracking data stream according to the relative relation between the stain and the loophole parameters, and filtering the stain tracking data stream according to the classification result;

traversing the filtered stain tracking data stream to obtain a data stream truly containing stain information, and determining target stain source information according to the data stream;

Training the information of the test request packet, the target stain source information and the vulnerability type by using a plurality of large language models to obtain a plurality of alternative templates of the vulnerability verification request packet;

Determining a final template of the vulnerability verification request packet according to the multiple alternative templates, and inputting the information of the test request packet, the target stain source information and the vulnerability type into the final template to obtain the target vulnerability verification request packet.

2. The method of claim 1, wherein traversing the filtered dirty trace data stream to obtain a data stream that actually contains dirty information, and determining target dirty source information based on the data stream comprises:

And obtaining the data stream truly containing the taint information in the filtered taint tracking data stream by executing the function data signature mode, and taking the taint propagation information or the taint convergence point information of the first containing the data signature as the target taint point source information.

3. The method for generating a vulnerability verification request packet according to claim 1, wherein training the information of the test request packet, the target taint source information and the vulnerability type by using a plurality of large language models to obtain a plurality of alternative templates of the vulnerability verification request packet respectively comprises:

Compiling a basic template of a vulnerability verification request packet according to the information of the test request packet, the target pollution source information and the vulnerability type;

based on the basic template, training the information of the test request packet, the target stain source information and the vulnerability type by using a plurality of large language models to obtain a plurality of alternative templates of the vulnerability verification request packet.

4. The method of claim 1, wherein determining a final template of the vulnerability verification request package according to the plurality of candidate templates comprises:

And obtaining test data, respectively inputting the test data into the plurality of alternative templates to obtain a plurality of output results, and taking the alternative template with the output result most conforming to the preset condition as the final template of the vulnerability verification request packet.

5. A vulnerability verification request packet generation apparatus, comprising:

the detection module is used for detecting an application to be detected by using an interactive application security test tool to obtain vulnerability data in the application to be detected, wherein the vulnerability data comprises a stain tracking data stream, a test request packet and a vulnerability type, the stain tracking data stream comprises stain source information, stain propagation information and stain convergence point information, and the stain source information comprises an execution method, a code position, a vulnerability parameter and a stain for acquiring a request parameter value;

The preprocessing module is used for judging whether the loophole parameter and the stain are the same value, and deleting the code position and the loophole parameter in the stain source information when the loophole parameter and the stain are the same value;

deleting the code position in the stain source information when the vulnerability parameter and the stain are not the same value;

the traversing module is used for traversing the filtered stain tracking data stream to obtain a data stream truly containing stain information, and determining target stain source information according to the data stream;

The training module is used for training the information of the test request packet, the target stain source information and the vulnerability type by utilizing a plurality of large language models to obtain a plurality of alternative templates of the vulnerability verification request packet;

The output module is used for determining a final template of the vulnerability verification request packet according to the plurality of alternative templates, and inputting the information of the test request packet, the target stain source information and the vulnerability type into the final template to obtain the target vulnerability verification request packet.

6. The vulnerability verification request packet generation apparatus of claim 5, wherein the training module comprises:

The compiling unit is used for compiling a basic template of the vulnerability verification request packet according to the information of the test request packet, the target pollution point source information and the vulnerability type;

The training unit is used for respectively training the information of the test request packet, the target stain source information and the vulnerability type by utilizing a plurality of large language models based on the basic template to obtain a plurality of alternative templates of the vulnerability verification request packet.

7. An electronic device comprising a memory and a processor, the memory to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement a vulnerability verification request packet generation method of any one of claims 1-4.

8. A computer-readable storage medium storing a computer program, wherein the computer program causes a computer to execute a vulnerability verification request packet generation method according to any one of claims 1-4.