A method and system for defending against ransomware and secondary encryption of host files

Abstract

The present invention provides a method and system for defending against ransomware secondary encryption of host files, including: after the ransomware alarm is triggered and dealt with through blackmail defense means, information on the corresponding operation process of the ransomware is obtained and added to the blackmail list; correlate host environment information with the information in the blacklist, and perform in-depth cleaning of ransomware data; after the host system restarts, start the file awareness program, and when it senses that there is a process of modifying files, it will filter the files operated by the modification process Check and match the specific operation information with the blacklist data to determine whether there is residual ransomware data in the host environment; if there is, it will be cleaned and written into the blacklist, otherwise the corresponding process will be released. The invention can accurately locate and deeply clean the remaining ransomware data in the system, and accurately defend the restarted host, so as to ensure that the operating system and host files are not damaged and modified by the ransomware again.

Description

technical field [0001] The present invention relates to the technical field of information security, and in particular to a method and system for defending against ransomware from secondary encryption of host files. Background technique [0002] At present, the mainstream ransomware virus runs immediately after entering the user's host. The encryption process has evolved from a single modification of file content to a multi-dimensional means of destruction. After the system restarts, it will cause irreparable damage to the operating system and host files. Existing defense technologies are difficult to accurately defend against this phenomenon. They can only back up the original files, but cannot achieve effective defense, and cannot guarantee that the ransomware will not attack the host again after the system is restarted. Contents of the invention [0003] The present invention proposes a defense method for restarting the operating system of the ransomware virus to encry...

AI Technical Summary

Problems solved by technology

[0002] At present, the mainstream ransomware virus runs immediately after entering the user's host. The encryption process has evolved from a single modification of file content to a multi-dimensional means of destruction. After the system restarts, it will cause irreparable damage to the operating system and host files

Existing defense technologies are difficult to accurately defend against this phenomenon. They can only back up their original documents, which cannot be effectively defended. There is no guarantee that the ransomware virus will not attack the host again after the system is restarted.

Images