Method and system for defending against extortionist virus during standby time

Abstract

The invention provides a method and a system for defending against extortionist virus during standby time. The method comprises the steps of firstly monitoring a device resource state in real time; when a device is detected to be in a standby state, monitoring courses in the system; judging whether a course for calling an encryption function exists and whether a course for changing a document type file state exists; if so, locking the corresponding courses, and searching and backing up a to-be-encrypted file or a file with the state to be changed; finally returning a list of backup files to a user; and recovering the corresponding files selectively based on a specific condition and a demand by the user. As the course for calling the encryption function and the course for trying to modify the document type file state are subjected to bidirectional monitoring, monitoring for risks possibly released by an extortionist becomes more comprehensive, and the method for defending against the extortionist virus during the standby time is more efficient and can reduce user loss to the lowest.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and system for defending against blackmailer viruses during standby time. Background technique [0002] With the rapid development of computer technology, electronic documents have become an indispensable tool in our work and life, but document security has become a major threat to our daily life. The extortionist series of viruses take advantage of the weak security awareness of computer users and spread through USB flash drives, CD-ROMs, emails, etc. When releasing threats, they will encrypt documents and files in the computer, and extort electronic currency or even money from users. The behavior of the blackmailer virus is no different from that of traditional application software, and it is very difficult to distinguish it. Traditional antivirus software cannot effectively detect and kill it. [0003] The reasons why most anti-virus software cannot reco...

AI Technical Summary

Problems solved by technology

[0005] 2. The cost of blackmailer virus R&D technology is low, and it can be written by someone with a little knowledge of programming, which makes it difficult for traditional black and white list defenses to catch the latest blackmailer programs;

[0007] 4. The documents encrypted by the blackmailer virus cannot be decrypted at present, and most of them use 4096-bit encryption algorithm, so once the file is encrypted by the blackmailer virus, it can only be recovered by accepting the attacker’s blackmail conditions

Images