Ransomware detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a ransomware detection method and a device, electronic equipment and a storage medium, and aims at solving the problems that in the prior art, a feature detection method is adopted for detecting ransomware, universality is not achieved, and a method for detecting and intercepting API calling is adopted, so that system performance is affected. The method comprises the following steps: constructing a false process information list; the Hook enumerates all APIs required by the process and the ending process of the current system; if the API of the enumeration process is called, normally calling the API, and adding corresponding false process information into return information of the API; and if the API of the ending process is called, judging whetherthe information of the API operation object is in false process information, if yes, further judging whether the API caller is a known normal program, and if not, judging that ransomware exists in thecurrent system.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a ransomware detection method, device, electronic equipment and storage medium. Background technique [0002] With the development and popularization of computer technology, computer applications have fully penetrated into people's work and life, and have become an indispensable important tool and home entertainment equipment for people. With the widespread use of computers, corresponding computer security issues will also arise, and ransomware is a way to threaten computer security. Ransomware is a popular Trojan horse that makes users' data assets or computing resources unusable by means of harassment, intimidation, or even kidnapping of user files, and extorts money from users on this condition. Such user data assets include documents, emails, databases, source codes, pictures, compressed files and other files. The ransom comes in real money, Bitcoin or othe...

AI Technical Summary

Problems solved by technology

[0004] The embodiment of the present invention provides a ransomware detection method, device, electronic equipment, and storage medium, which are used to solve the problem of detecting ransomware in the prior art by using a feature detection method, which is not universal, and uses a method of detecting and intercepting API calls , issues that have an impact on system performance

Images