Ransomware file identification and detection method and system

Abstract

The invention provides a ransomware file identification and detection method and a ransomware file identification and detection system, which are used for detecting whether a computer has ransomware or not. The method comprises the following steps of: performing at least two times of retrieval of a computer disk by adopting a file driver, and generating a retrieval result of each retrieved file in the computer disk and a hash file corresponding to each retrieved file; judging whether the retrieval results are consistent or not by comparing the single retrieval results of the same retrieved file; if not, comparing hash files generated by single retrieval of the same retrieved file, reading byte codes of changed files in the hash files, and judging whether the byte codes are normal or not; and carrying out encryption feature detection on the retrieved file corresponding to the abnormal byte code to determine whether the ransomware exists or not. According to the method, ransomware identification and detection can be comprehensively and accurately carried out on the file in the computer, and reliable safety protection is provided for a user.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a method and system for identifying and detecting blackmail virus files. Background technique [0002] Ransomware is a relatively popular virus in the past two years, especially in 2016, China's ransomware has exploded. It is mainly transmitted in the form of mail, program Trojan horse, web page hanging horse, etc., and uses various asymmetric encryption algorithms to encrypt document files, picture files, text files, databases, source codes, compressed files, etc. on the computer disk. After the encryption is successful, it will Through webpage files, TXT files, screen saver pictures, etc., the user is notified that the decryption will only be done after paying the ransom within a certain period of time. The ransomware virus is bad in nature and extremely harmful. Once infected, it will bring immeasurable losses to users. [0003] In the existing technology, there ar...

AI Technical Summary

Problems solved by technology

However, these detection methods have some limitations, such as: the scope of detection is not comprehensive enough, sometimes the ransomware virus is missed, and sometimes the existence of the ransomware virus cannot be detected. Therefore, it is necessary to provide a more accurate detection result and a more comprehensive detection range. Ransomware identification and detection method

Images