Ransomware detection method based on file status analysis

Abstract

The invention especially relates to a ransomware detection method based on file status analysis. According to the ransomware detection method based on file status analysis, in a monitoring time window W, file access behaviors of a to-be-detected program are continuously inspected at three aspects including file content monitoring, file directory monitoring and file additions and deletions monitoring, monitoring factors are fed back to an analysis module of a system, and if the numerical value sum of the monitoring factors reaches or exceeds a preset alarm threshold value, the to-be-detected program is determined to be a ransomware. According to the ransomware detection method based on file status analysis, ransomware characteristics of the to-be-detected program are accurately reflected through analyzing status of an modified object of the ransomware; and legal software and potential ransomware can be efficiently distinguished by the multi-aspect logic comprehensive judgment method, degrees of damage of host files by malicious codes are minimized, and finally the purposes of improving self security and defense capability of the server host system are achieved.

Description

technical field [0001] The invention relates to the technical field of software detection methods, in particular to a ransomware detection method based on file state analysis. Background technique [0002] Ransomware is a new type of malicious code that spreads by means of social engineering or network worm infection, and performs destructive behaviors such as file encryption on the invaded host. Ransomware will ask for a high ransom, and the victim can restore the important files affected in the host after paying the ransom. Undoubtedly, ransomware has become one of the biggest threats to the host computer security of large enterprises and even individual users at this stage. [0003] Most current ransomware detection technologies follow the traditional method of signature signatures. Security software matches the signatures of unknown samples with the signature data of the local signature database. If there is a match, the software is prevented from running. With the eme...

AI Technical Summary

Problems solved by technology

With the emergence of a large number of ransomware variants, the lag of signature database updates has become increasingly significant, and passive signature detection methods have gradually become incapable, especially for unknown malicious codes.

Images