Backup protection method and system for ransomware preventing file data

Abstract

The invention relates to a backup protection method and system for ransomware preventing file data. The method comprises the following steps: receiving a file operation request; determining whether the file size is less than a preset upper limit value; if the file size is less than the preset upper limit value, determining whether the file is of the preset file backup type; if the file is of the preset file backup type, backing up the file in a storage medium, and performing the file operation request; and if the file is not of the preset file backup type, directly performing the file operation request. With the adoption of the method and the system, files can be prevented from encryption threat of ransomware, and moreover, the backup storage space of the storage medium can be further saved.

Description

technical field [0001] The invention relates to the field of information security, in particular to a backup protection method and system for defending ransomware file data. Background technique [0002] Ransomware is a type of malicious software used by hackers to hijack user assets or resources and extort money from users on the condition of this. Ransomware usually encrypts documents, emails, databases, source codes, pictures, compressed files and other files on the user's system in some form to make them unusable, or interferes with the normal use of the system by modifying the system configuration files The method reduces the availability of the system, and then sends a blackmail notice to the user through a pop-up window, dialog box, or text file, requiring the user to remit money to a designated account to obtain the password for decrypting the file or obtain a method to restore the normal operation of the system. [0003] There are mainly four known file data backup...

AI Technical Summary

Problems solved by technology

[0011] Disadvantage 1. Since the copy backup does not have the function of data recovery after being changed, it cannot resist ransomware attacks

[0012] Disadvantage 2. Full backup is not suitable for fighting ransomware because it needs to take up a large amount of backup storage space.

[0013] Disadvantage 3. Differential backup and incremental backup are mainly backup methods designed for regular backup, which are not suitable for regular backup, so they are not suitable for fighting against ransomware (because if you do not have the attribute of regular backup, then you will be blackmailed After the software is encrypted, all changed data during the time interval between regular backup and encryption will be encrypted)

[0014] Disadvantage 4. In the face of ransomware attacks, from the backup logic, there are the following defects:

[0015] 1. If you do not set a backup limit for the size of a single backup file, the ransomware will repeatedly write large junk files with different data

And the backup system will keep backing up, when these junk files fill up the maximum value of the backup storage medium, it will cause the backup to be paralyzed

After the paralysis, the user can modify the file normally and you can't back it up.

[0016] 2. If the upper limit of the backup size of a single file backup is set, then the files exceeding the upper limit cannot be backed up

[0017] Disadvantage 5. The above-mentioned backup methods are basically general-purpose backups (all types of files are backed up) in practical applications, and users cannot choose to back up only bmp and doc files, for example.

Therefore, there is currently no backup and protection solution that can effectively defend against ransomware file data

Images