Method and system for preventing ransomware

Abstract

The invention relates to a method and system for preventing ransomware. The method includes the steps of creating a bait file in the system, and monitoring the bait file in real time; if monitoring that the bait file is retrieved and written by the same process, labeling a program corresponding to the process as suspected ransomware; preventing the program labeled as the suspected ransomware from conducting write operations on all files. The method and system for preventing ransomware can accurately and quickly discover the encrypted operation of the ransomware virus on the disk files, and prevent in time.

Description

technical field [0001] The invention relates to the technical field of software antivirus, in particular to a ransomware prevention method and system. Background technique [0002] Ransomware is a new type of computer virus, which mainly spreads in the form of emails, program Trojan horses, and web page hanging horses. Once the ransomware enters the local area, it will automatically run and delete the ransomware sample to avoid detection and analysis; next, the ransomware will encrypt the computer disk files, and it is almost impossible for anyone except the virus developer to decrypt ; After the encryption is completed, extort a high decryption fee from the computer user, bringing huge economic losses to the user. For example, in June 2017, a "file-encrypting" ransomware virus targeting Android phones was spread across the domestic network by disguising itself as an auxiliary tool for the mobile game "Glory of the King". Moreover, the variant type of ransomware virus is v...

AI Technical Summary

Problems solved by technology

Moreover, the variant type of ransomware virus is very fast, and it is immune to conventional antivirus software. The attack samples are mainly exe, js, wsf, vbe and other types, which is a great challenge to conventional security products that rely on feature detection

[0003] Traditional anti-virus software Traditional anti-virus software analyzes virus characteristics (for example: listening to inbound port 443) to achieve the effect of checking and killing viruses. It can only provide blackmail virus reminders, but cannot prevent encryption

Images