Ransomware real-time detecting and defending method based on file request monitoring

Abstract

The invention provides a ransomware real-time detecting and defending method based on file request monitoring, and belongs to the technical field of system security. The method includes the steps of monitoring whether a tested program has operation behaviors on a user file or not in a user host, if yes, mirroring the file to a protected storage area, operating the file in the area, recording the complete operation information, judging whether the program is ransomware or not in combination with a dubiety measuring mechanism based on the file content and operation behavior analysis, if yes, deleting the file in the protected area and deleting the program, and if not, updating and synchronizing the file according to the file in the protected area so that the consistency of data under normalcircumstances can be ensured. Through the process, the malicious ransomware can be effectively detected, the damage of malicious codes to user data is minimized, and the aim of improving the securityand defending capacity of a server host system is achieved.

Description

technical field [0001] The invention relates to the technical field of system security, in particular to a method for real-time detection and defense of ransomware based on file request monitoring. Background technique [0002] Ransomware is a new type of malicious code that spreads by means of social engineering or network worm infection, and performs destructive behaviors such as file encryption and original file deletion on the invaded host. After the user's files are encrypted, the ransomware will ask for a high ransom, and the important data in the host can only be restored after the victim pays the bitcoin ransom by using the Tor network and other methods. [0003] While ransomware is raging, most of the corresponding security protection methods are still passive defense methods such as file backup and signature antivirus. It is often difficult for host users to back up their work documents in a timely and sufficient manner; and the signature matching method relies on...

AI Technical Summary

Problems solved by technology

It is often difficult for host users to back up their work documents in a timely and sufficient manner; and the signature matching method relies on maintaining and updating the virus signature database. With the emergence of a large number of ransomware variants, its lag is self-evident

Other detection methods, such as dynamic analysis based on virtualization sandbox, are difficult to be directly applied to the protected host, and the detection effect is not real-time; while other software behavior analysis mechanisms applied inside the host, although they have Certain malicious code detection capabilities, but the design and selection of monitoring methods and monitoring features are still not perfect, and the recovery of damaged files is often ignored

Images