Ransomware defense method and device

Abstract

The invention discloses a ransomware defense method and device. The method comprises the following steps: creating at least one trap folder fitting ransomware encryption type in a magnetic disc; determining whether the trap folder changes, wherein the change includes at least one of the followings: modifying, deleting and renaming the trap folder, and adding a new file into the trap folder; and inhibiting to performing default operation on the magnetic disc in case that the trap folder changes. With the adoption of the ransomware defense method and device, the technical problem that an existing ransomware defense scheme in the prior art is too weak to defense known or unknown ransomware can be solved.

Description

technical field [0001] The present invention relates to the field of information security, in particular to a ransomware defense method and device. Background technique [0002] Ransomware is a type of malicious software used by hackers to hijack user assets or resources and extort money from users on the condition of this. Ransomware usually encrypts documents, emails, databases, source codes, pictures, compressed files and other files on the user's system in some form to make them unusable, or interferes with the normal use of users by modifying system configuration files. The systematic method reduces the availability of the system, and then sends a blackmail notice to the user through pop-up windows, dialog boxes, or text files, requiring the user to transfer money to the designated account to obtain the password for decrypting the file or obtain the method to restore the normal operation of the system. [0003] The defense scheme for ransomware in the prior art is main...

AI Technical Summary

Problems solved by technology

[0003] The defense scheme for ransomware in the prior art is mainly to discover known ransomware by means of antivirus engine scanning features; Use the samples in the virus database to compare all the programs or files in the machine to see if they match these samples. If it is, it is a virus, otherwise it is not necessarily a virus (because there are still many that have not been discovered or have just been detected. generated virus), but since the virus library of the antivirus engine is known and the collected samples are generated by extracting features, it is impossible to prevent unknown samples that have not been collected, and the scheme based on this principle cannot detect Unknown ransomware; and because the virus database is obtained based on the binary data extraction characteristics of the sample, and the antivirus engine judges whether an unknown file is a virus (ransomware) based on the matching degree of this characteristic, therefore, even known Sample, as long as the binary data judged by the antivirus engine as a feature is changed, the antivirus engine will not be able to detect it, so the defense scheme for ransomware in the prior art has the disadvantage that it cannot be detected even for known viruses and ransomware (as long as If the feature code is changed)

[0004] For the problem that the existing defense schemes against ransomware in the above-mentioned prior art are not enough to deal with known or unknown ransomware, no effective solution has been proposed yet

Images