ATM program updating safety protection method and system

Abstract

The invention discloses an ATM program updating safety protection method and system. The method comprises the following steps of: dynamically sensing whether an updating program is operated in an ATMterminal or not, and if the sensing result is positive, stopping the operation of the updating program and carrying out encryption and backup on all the pieces of information in the ATM terminal; after the encryption and backup are finished, releasing the operation of the updating program; creating a bait folder, and if a behavior for modifying a bait file by the updating program is sensed, judging that the updating program is malicious and stopping the operation of the updating program; if the behavior for modifying a bait file by the updating program is not sensed, automatically testing theupdated program and judging whether the updating program is malicious or not according to the test result; aiming at the condition that the updating program is malicious, deleting all the pieces of information created by the updating program and recovering the data which undergoes encryption and backup; and the updating program is not malicious, considering that the updating program is safe. The method and system are capable of effectively judging whether updating programs have potential threats or not.

Description

Technical field [0001] The present invention relates to the technical field of information security, in particular to a security protection method and system for updating ATM programs. Background technique [0002] At present, mainstream anti-virus software uses the MD5 of the file as a feature to detect and kill. This is bound to cause a phenomenon. Anti-virus software always lags behind the latest viruses. For individual users, this kind of killing is acceptable. , Because the virus database is updated every day, and the user will be prompted which programs have some suspicious behaviors for the user to choose. But it is not feasible to detect and kill the ATM. First of all, ATM exists in a closed intranet and does not update the virus database in real time every day. At the same time, ATM is an unattended model, and ATM main business procedures cannot be interrupted. Therefore, in the past, the MD5 method of files can only cure the symptoms, but cannot cure the root cause, a...

AI Technical Summary

Problems solved by technology

But this traditional method is only pre-judgment, and its judgment range is limited. When the pre-judgment fails, the loss cannot be saved, which is unacceptable for equipment with high security requirements like ATM.

Images