A document protection method and system based on dynamic redirection

Abstract

The invention discloses a dynamic redirection-based document protection method and system. The method comprises the following steps of: sensing processes and operations in a system in real time; whenthe fact that a process carries out a modification operation on a document in the system is sensed, obtaining route information of the corresponding document, dynamically copying and baking up the corresponding document to an appointed catalog, and redirecting all the operations of the corresponding document to a backup document under the appointed catalog; dynamically monitoring an operation behavior, for the backup document, of the process, when the fact that the modification operation carried out on the backup document is completed is sensed, hanging the process, detecting whether a file format of the backup document is changed or not, and carrying out an operation of deleting or replacing an original catalog document on the backup document according to the judgement result. According to the method and system, detection can be dynamically carried out to determine whether documents are encrypted or not without influencing normal operations of users, and blackmailer virus can be correctly warned.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a document protection method and system based on dynamic redirection. Background technique [0002] Through the analysis of the current mainstream blackmailer viruses, blackmailer viruses are generally spread in the form of emails and malicious chain Trojan horses, and the operation of the virus generally scans and encrypts the entire disk file by injecting into the system or operating independently of the entity. After that, the document format is changed to the encrypted document, and all these actions do not have much malicious behavior, so malicious behavior detection is not suitable for ransomware viruses. After the blackmailer virus encrypts the document, it is almost impossible to decrypt the document without the private key. Therefore, most security vendors use the method of document backup to help users avoid harm caused by the blackmailer virus. However, wh...

AI Technical Summary

Problems solved by technology

After the blackmailer virus encrypts the document, it is almost impossible to decrypt the document without the private key. Therefore, most security vendors use the method of document backup to help users avoid the harm caused by the blackmailer virus. However, when the blackmailer virus knows that the document is encrypted After the storage location, the backup file can be re-encrypted, so the strategy of file backup cannot completely solve the problem of file encryption

And when there are a large number of backup operations, it will cause waste of storage space. At the same time, when the document is operated, the document cannot be backed up, so there is also the possibility of backup failure

Images