Method and system for resisting ransomware attacks based on host honeypot

Abstract

The invention relates to a method and a system for resisting ransomware attacks based on a host honeypot. The method comprises steps of: 1) building a host honeypot environment in a host group; 2) generating and deploying a honey bait file in the host honeypot, and recording the initial file type and the entropy value state thereof; 3) monitoring the remote login state of the host honeypot, and notifying the host honeypot to start a real-time monitoring behavior, when the system detects that a remote login operation occurs; 4) monitoring the file type and the entropy value information of the honey bait file, and determining ransomware attacks when both the file type and the entropy value have abnormal changes; 5) collecting the traceable information of an attacker host, when the host honeypot detects the ransomware attacks; and 6) sending traceable information of the collected attacker host to a secure host as a traceable clue. According to the method and the system for resisting ransomware attacks based on the host honeypot, the method and the system can protect the data and property security of users and enterprises, by deceiving attackers and defending against ransomware attacksunder conditions of a low consumption and a zero loss.

Description

technical field [0001] The invention belongs to the field of computer network security, and relates to a method and system for resisting ransomware attacks based on host honeypots. Background technique [0002] Ransomware (Ransomware) is widely regarded as a type of malicious software that encrypts data and locks devices as the attack method and extorts ransom as the main purpose. Traditional malware is often designed to be stealthy, collecting private information such as banking credentials, user keystrokes, screenshots, etc. without arousing suspicion. Ransomware exhibits distinct behavioral differences compared to traditional malware, often publicly notifying users of infection with the intent of demanding a ransom. [0003] In recent years, ransomware attacks have intensified and become a serious security threat on the Internet today. While ransomware has caused serious data and property losses to infected users, it has also attracted the full attention of the security...

AI Technical Summary

Problems solved by technology

However, a single detection and defense technology cannot deter attackers or curb the spread of ransomware

At present, there is no complete and effective forensics and traceability technology for advanced ransomware attackers, which has contributed to the arrogance of ransomware attackers to a certain extent

Images