A computer security protection system and method for defending against ransomware

Abstract

The invention discloses a computer security protection system for preventing ransovirus. The system comprises a network server, a front-end controller, a file backup computer and a mobile storage terminal, The network server is in communication connection with the front-end controller, the file backup computer and the mobile storage terminal; The front-end controller is connected with the protected computer and is used for processing the target file in the protected computer and generating a target file directory; The file backup computer is in communication connection with the network serverand used for obtaining and storing the processed target file from the front-end controller, and the file backup computer and the protected computer run different operation systems; And the mobile storage terminal is used for acquiring and storing the target file directory from the front-end controller. According to the method, the target file is disguised to avoid ransovirus scanning, so that thetarget file is protected, and the safety of the target file is further improved by adopting a backup mode.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a computer security protection system and method for defending against ransomware viruses. Background technique [0002] Ransomware virus is a kind of malicious computer virus that has emerged in recent years. When the user's computer is invaded by the ransomware virus, the ransomware virus will encrypt important files on the user's system and blackmail the user by decrypting these important files. , and the encryption method used by the ransomware virus cannot be cracked, victims often can only choose to give up the file or pay a high ransom. [0003] Specifically, the general principle of ransomware is that after the victim triggers the ransomware, the ransomware scans the files in the user's computer, then first copies the files to be encrypted, then encrypts the copies, and finally deletes the original files. Usually, the ransomware identifies the files to be encry...

AI Technical Summary

Problems solved by technology

[0005] However, the current signature detection and killing scheme can only target known ransomware, but for new or variant unknown ransomware, it is impossible to detect ransomware by matching signatures in the virus database

That is to say, if the user system has been infected with an unknown ransomware virus, that is, the user files have been encrypted, and the operating system can only wait for the antivirus software to update the virus database, and then scan and kill the virus signature. It is impossible to recover the loss caused by the user's files being encrypted

[0006] Therefore, the existing defense methods of identifying and sniping the ransomware itself have limited effects, and it is difficult to deal with the endless variants of ransomware

Images