Suspicious process processing method and device, storage medium and electronic equipment

Abstract

The invention provides a suspicious process processing method and device, a storage medium and electronic equipment, relates to the technical field of data security, and aims to effectively detect attack behaviors of ransomware. The suspicious process processing method comprises the following steps: monitoring processes running in a terminal system; in response to monitoring that the operation corresponding to the process meets the preset condition, determining that the process is a suspicious process, and suspending the suspicious process; sending the information of the suspicious process to a server to request the server to judge whether the suspicious process has a secret stealing behavior or not, and obtaining a judgment result; obtaining the judgment result sent by the server; and processing the suspicious process according to the judgment result. The method provided by the embodiment of the invention are suitable for detecting the attack behavior of the ransomware.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to a suspicious process processing method, device, storage medium and electronic equipment. Background technique [0002] In recent years, in the ransomware attacks disclosed by relevant security vendors for many times, it was found that the attackers were not limited to encrypting files during the extortion process, but adopted the form of extortion with secret stealing and encryption, which has a higher threat and further Increases the chances of the victim paying the ransom after the extortion. For victims, the file backup strategy usually formulated to deal with ransomware attacks is no longer able to fully combat this form of extortion. When facing this form of extortion, they also face the threat of sensitive files being leaked. Contents of the invention [0003] In view of this, one or more embodiments of the present invention provide a suspicious process processing ...

AI Technical Summary

Problems solved by technology

For victims, the file backup strategy usually developed to deal with ransomware attacks is no longer able to fully comb

Images