A ransomware defense method and system

Abstract

The invention relates to a ransomware defense method and system. The method comprises the following steps that 1, overall hooking is performed on an API which must be called by ransomware in the kernel mode or the user mode of an operation system; 2, finite segment cheating data is generated and deployed; 3, when a process is subjected to file traversal operation, a certain amount of cheating datais inserted into the traversal result and returned back to the process so as to cheat the process; 4, when the API obtained after overall hooking finds that the process operates the cheating data, whether the cheating data is abnormally changes or not is monitored so that whether the process is a malicious act of the ransomware or not is determined; 5, if the process is the malicious act of the ransomware, the process is ended and the user is informed. Under the condition of low consumption and zero loss, real-time detection and termination can be performed on the process of the ransomware, and users' and enterprises' data and property safety are protected.

Description

technical field [0001] The invention relates to the field of computer network security, and is aimed at ransomware, especially a defense system for encrypted ransomware, and more specifically, a method and system for defending ransomware using deception. Background technique [0002] Ransomware is a type of malware designed to extort money. It appeared in 1989. In recent years, with the emergence and popularization of Bitcoin technology, ransomware has risen and become a network security problem that cannot be ignored. [0003] The modes of transmission are diverse. Most ransomware invades user systems through social engineering methods, such as phishing emails, phishing websites, and watering hole attacks. In April 2016, there appeared ransomware SamSam that exploited system vulnerabilities to spread. In May 2017, WannaCry, which used the SMB remote arbitrary code execution vulnerability to spread, swept the world and caused huge losses. It is foreseeable that there may...

AI Technical Summary

Problems solved by technology

In May 2017, WannaCry, which used the SMB remote arbitrary code execution vulnerability to spread, swept the world and caused huge losses.

Existing ransomware detection methods have problems to varying degrees, especially in terms of accuracy and real-time performance, the shortcomings are very obvious

Images