File protection method and device, equipment, storage medium and program product

Abstract

The invention provides a file protection method, relates to the technical field of network security, and can be applied to the technical field of finance. The method comprises the following steps: determining a target file based on a file updating model, wherein the file updating model is generated by self-learning based on a system file updating condition; determining a generation rule of a bait file based on the file size and the file name of the target file; generating a bait file corresponding to the target file according to the generation rule; placing the bait file in a specified file path; monitoring the bait file in real time to record process information of accessing the bait file; and performing alarm operation according to the process information and the white list. The invention further provides a file protection device, equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, specifically to the field of file anti-ransomware technology, and more specifically to a file protection method, device, equipment, storage medium and program product. Background Art

[0002] Among the current cybersecurity threats, ransomware has become a rampant form of attack. Ransomware encrypts the victim's important files and demands a ransom for the decryption key. Enterprises face huge risks, which may not only lead to financial losses, but also cause serious consequences such as damaged brand reputation and business stagnation. Although the industry is currently focusing on developing and using various security tools to detect ransomware, if there is a missed report or failure to detect the ransomware in time, the company's important data is at great risk. Even though most ransomware attacks can be resolved after being detected, if the important data has been encrypted, even if the ransomware attack is resolved, the data may not be recoverable. Therefore, a file protection method is urgently needed to deal with the risk of ransomware attacks.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a file protection method, device, equipment, storage medium and program product for preventing ransomware attacks.

[0005] According to a first aspect of the present disclosure, a file protection method is provided, the method comprising:

[0006] Determine the target file based on a file update model, wherein the file update model is generated by self-learning based on the system file update situation;

[0007] Determine a generation rule of the bait file based on the file size and file name of the target file;

[0008] Generate a bait file corresponding to the target file according to the generation rule;

[0009] Placing the bait file in a specified file path;

[0010] monitoring the bait file in real time to record process information of accessing the bait file; and

[0011] An alarm operation is performed according to the process information and the whitelist.

[0012] According to an embodiment of the present disclosure, the generation rule of the bait file determined based on the file size and file name of the target file includes:

[0013] Determining the content generation rules of the bait file according to the target file size; and

[0014] The naming rule of the bait file is determined according to the target file name.

[0015] According to an embodiment of the present disclosure, the content generation rule of the bait file determined according to the target file size includes:

[0016] If it is determined that the target file size is greater than a second preset threshold, determining to use a sparse file to create a bait file; and

[0017] If it is determined that the target file size is less than or equal to the second preset threshold, it is determined that the size and content of the bait file are consistent with the target file.

[0018] According to an embodiment of the present disclosure, determining the naming rule of the bait file according to the target file name includes:

[0019] If it is determined that a fixed naming rule exists for the target file name, determining a naming rule for the decoy file based on the fixed naming rule; and

[0020] If it is determined that there is no fixed naming rule for the target file name, the naming rule for the bait file is determined based on the target file name.

[0021] According to an embodiment of the present disclosure, the fixed naming rule includes naming by date and naming by number, and the naming rule of the bait file determined based on the fixed naming rule includes:

[0022] If it is determined that the fixed naming rule is named according to date, the file name of the bait file is set to the earliest or latest date; and

[0023] If it is determined that the fixed naming rule is to name according to the number, the file name of the bait file is set to the maximum or minimum number.

[0024] According to an embodiment of the present disclosure, the naming rule of determining the bait file based on the target file name includes:

[0025] Add special characters before and after the target file name as the file name of the bait file.

[0026] According to an embodiment of the present disclosure, determining the target file based on the file update model includes:

[0027] Acquire system file data within a preset learning period, wherein the system file data includes file name, file type, folder path, file content, and update frequency; and

[0028] The file whose update frequency is greater than a first preset threshold is determined as a target file.

[0029] According to an embodiment of the present disclosure, before performing an alarm operation according to the process information and the whitelist, it also includes:

[0030] Collecting full process information of accessing the decoy file within a preset learning period; and

[0031] A whitelist is established based on the full process information.

[0032] According to an embodiment of the present disclosure, the alarm operation according to the process information and the whitelist includes:

[0033] Filtering the process information according to the whitelist to determine the illegal access process; and

[0034] If it is determined that there is an illegal access process, an alarm message will be sent via email or text message.

[0035] According to an embodiment of the present disclosure, it also includes:

[0036] The corresponding bait file is updated according to the update frequency of the target file.

[0037] A second aspect of the present disclosure provides a file protection device, the device comprising:

[0038] A target file determination module, used to determine the target file based on a file update model, wherein the file update model is generated by self-learning based on system file update conditions;

[0039] A determination module, used for determining a generation rule of a decoy file based on the file size and file name of the target file;

[0040] A generation module, used to generate a bait file corresponding to the target file according to the generation rule;

[0041] A storage module, used for placing the bait file in a specified file path;

[0042] A monitoring module, used for real-time monitoring of the bait file to record process information of accessing the bait file; and

[0043] The alarm module is used to perform an alarm operation according to the process information and the whitelist.

[0044] According to an embodiment of the present disclosure, the determination module includes: a first determination submodule and a second determination submodule.

[0045] A first determination submodule is used to determine a content generation rule of a decoy file according to a target file size; and

[0046] The second determining submodule is used to determine the naming rule of the bait file according to the target file name.

[0047] According to an embodiment of the present disclosure, the first determining submodule includes a first determining unit and a second determining unit.

[0048] A first determining unit, configured to determine to use a sparse file to create a decoy file if it is determined that the target file size is greater than a second preset threshold; and

[0049] The second determination unit is used to determine that the size and content of the bait file are consistent with the target file if it is determined that the target file size is less than or equal to a second preset threshold.

[0050] According to an embodiment of the present disclosure, the second determining submodule includes a third determining unit and a fourth determining unit.

[0051] A third determining unit is configured to determine a naming rule of the decoy file based on the fixed naming rule if it is determined that the target file name has a fixed naming rule; and

[0052] The fourth determining unit is used to determine the naming rule of the bait file based on the target file name if it is determined that there is no fixed naming rule for the target file name.

[0053] According to an embodiment of the present disclosure, the third determination unit is also used to set the file name of the bait file to the earliest or latest date if it is determined that the fixed naming rule is named according to date; and if it is determined that the fixed naming rule is named according to number, set the file name of the bait file to the maximum or minimum number.

[0054] According to an embodiment of the present disclosure, the fourth determining unit is further configured to add special characters before and after the target file name as the file name of the decoy file.

[0055] According to an embodiment of the present disclosure, the target file determination module includes an acquisition submodule and a target file determination submodule.

[0056] An acquisition submodule, used to acquire system file data within a preset learning cycle, wherein the system file data includes file name, file type, folder path, file content and update frequency; and

[0057] The target file determination submodule is used to determine the file whose update frequency is greater than a first preset threshold as a target file.

[0058] According to an embodiment of the present disclosure, it also includes a process collection module and a whitelist establishment module.

[0059] A process collection module, used to collect all process information of accessing the bait file within a preset learning period; and

[0060] The whitelist establishment module is used to establish a whitelist according to the full process information.

[0061] According to an embodiment of the present disclosure, the whitelist establishment module includes a screening submodule and an alarm submodule.

[0062] a screening submodule, configured to screen the process information according to the whitelist to determine an illegally accessed process; and

[0063] The alarm submodule is used to send an alarm message in the form of email or SMS if it is determined that there is an illegal access process.

[0064] According to an embodiment of the present disclosure, it also includes: a bait file update module.

[0065] The bait file update module is used to update the corresponding bait file according to the update frequency of the target file.

[0066] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned file protection method.

[0067] The fourth aspect of the present disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned file protection method.

[0068] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above-mentioned file protection method when executed by a processor.

[0069] A file protection method provided by an embodiment of the present disclosure determines a target file based on a file update model, wherein the file update model is generated by self-learning based on the system file update situation; determines a generation rule of a bait file based on the file size and file name of the target file; generates a bait file corresponding to the target file according to the generation rule; places the bait file in a specified file path; monitors the bait file in real time to record process information accessing the bait file; and performs an alarm operation based on the process information and the whitelist. Compared with related technologies, the embodiment of the present disclosure can self-learn the system file update situation according to the file update model, and then automatically determine important files; in addition, the generation rule of the bait file is determined according to the target file size and file name, which can increase the probability of the bait file being indexed and reduce the storage resource occupation of the bait file. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0071] Figure 1 The application scenario diagram of the file protection method, apparatus, device, storage medium and program product according to the embodiment of the present disclosure is schematically shown;

[0072] Figure 2a A system architecture diagram of a file protection device provided according to an embodiment of the present disclosure is schematically shown;

[0073] Figure 2b A file protection flow chart provided according to an embodiment of the present disclosure is schematically shown;

[0074] Figure 3 A flowchart of a file protection method provided according to an embodiment of the present disclosure is schematically shown;

[0075] Figure 4 A flowchart of a file protection method provided according to another embodiment of the present disclosure is schematically shown;

[0076] Figure 5 A flowchart of a method for determining a generation rule of a decoy file based on the file size and file name of the target file provided according to an embodiment of the present disclosure is schematically shown;

[0077] Figure 6 A flowchart of a method for determining content generation rules of a decoy file according to a target file size provided in accordance with an embodiment of the present disclosure is schematically shown;

[0078] Figure 7 A flowchart of a method for determining a naming rule of a decoy file according to a target file name provided in accordance with an embodiment of the present disclosure is schematically shown.

[0079] Figure 8 A structural block diagram of a file protection device according to an embodiment of the present disclosure is schematically shown; and

[0080] Fig. 9 A block diagram of an electronic device suitable for implementing a file protection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0081] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0082] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0083] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0084] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0085] Based on the above technical problems, an embodiment of the present disclosure provides a file protection method, which includes: determining a target file based on a file update model, wherein the file update model is generated by self-learning based on the system file update situation; determining a generation rule for a bait file based on the file size and file name of the target file; generating a bait file corresponding to the target file according to the generation rule; placing the bait file in a specified file path; monitoring the bait file in real time to record process information of accessing the bait file; and performing an alarm operation based on the process information and the whitelist.

[0086] Figure 1 The application scenario diagram of the file protection method, apparatus, device, storage medium and program product according to the embodiments of the present disclosure is schematically shown.

[0087] like Figure 1As shown, the application scenario 100 according to this embodiment may include a file protection scenario. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0088] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0089] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0090] Server 105 may be a back-end server, which may execute the file protection method provided by the embodiment of the present disclosure, determine a first number of network requests in response to a network request from a client; if it is determined that the first number of network requests is less than or equal to a first preset threshold, perform traffic shaping on the network requests based on a leaky bucket algorithm; if it is determined that the first number of network requests is greater than the first preset threshold, perform verification on each network request based on a preset verification rule to determine a second number of network requests; and forward the network requests based on a preset token bucket algorithm and the second number of network requests, wherein a timestamp is added to the token in the preset token bucket algorithm.

[0091] It should be noted that the file protection method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the file protection device provided in the embodiment of the present disclosure can generally be set in the server 105. The file protection method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the file protection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0092] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0093] It should be noted that the file protection method and device determined in the embodiments of the present disclosure can be used in the field of Internet technology, the field of financial technology, and any field other than the financial field. The application field of the file protection method and device determined in the embodiments of the present disclosure is not limited.

[0094] Figure 2a The system architecture diagram of the file protection device provided according to the embodiment of the present disclosure is schematically shown. Figure 2b The following schematically shows a file protection flow chart provided according to an embodiment of the present disclosure. Figure 2a and Figure 2b As shown, it includes a self-learning module A1, a generation module A2 and a monitoring module A3. Among them, the self-learning module A1 sets a learning cycle, and is responsible for learning all files updated in the system within a cycle, and establishing a file update model, including information such as file name, file type, folder path, file content, and update frequency. The generation module A2 is responsible for generating and placing specific bait files based on the learning results and generation strategy of the self-learning module A1, and the bait files are updated regularly. The monitoring module A3 is responsible for real-time monitoring of the bait files and alarming.

[0095] The following will be based on Figure 1 Describe the application scenarios and Figure 2a The system architecture described by Figure 3 to Figure 6 The file protection method of the embodiment of the present disclosure is described in detail.

[0096] Figure 3 The flowchart of a file protection method provided according to an embodiment of the present disclosure is schematically shown. Figure 3 As shown, the file protection method of this embodiment includes operations S210 to S260, and the method can be executed by a server or other computing devices.

[0097] In operation S210, a target file is determined based on a file update model.

[0098] According to an embodiment of the present disclosure, the file update model is generated by self-learning based on the system file update situation.

[0099] In one example, in order to protect important enterprise files to cope with the risk of ransomware attacks. The disclosed embodiment adopts the concept of bait files, which induces attackers to shift their attention and behavior to these files by placing bait files that appear to be important but are actually specially made in the system, thereby reducing the ransomware's attack on truly important files. In order to more quickly determine the target files that need to be protected among many files, the target files are determined based on the file update model. Specifically, a learning cycle is set, which is responsible for learning all files updated in the system within a cycle, and establishing a file update model. The target file is automatically determined by the file update model.

[0100] In operation S220, a generation rule of a decoy file is determined based on the file size and file name of the target file.

[0101] In operation S230, a decoy file corresponding to the target file is generated according to the generation rule;

[0102] In operation S240, the bait file is placed in a designated file path;

[0103] In one example, in order to increase the probability of bait files being indexed and reduce the storage space occupied by bait files, when generating bait files, the generation rules of the bait files are determined based on the file size and file name of the target file, and the bait files corresponding to the target files are generated according to the generation rules. The bait files are placed in the specified file path. For specific generation rules, see Figure 5 to Figure 7 operation.

[0104] In operation S250, the bait file is monitored in real time to record process information of accessing the bait file.

[0105] In operation S260, an alarm operation is performed according to the process information and the whitelist.

[0106] In one example, the monitoring module is responsible for real-time monitoring of the decoy file and alarming, which is mainly divided into two stages. The first is to set a learning cycle and use the eBPF (extended Berkeley Packet Filter) technology. eBPF (extended Berkeley Packet Filter) is a technology for running user-written programs in the Linux kernel. The eBPF program is event-driven and can be executed at multiple hook points in the kernel, such as system calls, function entry / exit, kernel trace points, network events, etc. The eBPF technology is used to capture the system call "sys enter openat" for opening files, and filter out the access to the decoy file, and pass the captured event to the user-mode program for processing. The user-mode program receives the event notification from eBPF, records the process information that accesses the decoy file, and establishes a whitelist. After the learning cycle ends, if a process that is not in the whitelist accesses the decoy file, an alarm is issued.

[0107] A file protection method provided by an embodiment of the present disclosure determines a target file based on a file update model, wherein the file update model is generated by self-learning based on the system file update situation; determines a generation rule of a bait file based on the file size and file name of the target file; generates a bait file corresponding to the target file according to the generation rule; places the bait file in a specified file path; monitors the bait file in real time to record process information accessing the bait file; and performs an alarm operation based on the process information and the whitelist. Compared with related technologies, the embodiment of the present disclosure can self-learn the system file update situation according to the file update model, and then automatically determine important files; in addition, the generation rule of the bait file is determined according to the target file size and file name, which can increase the probability of the bait file being indexed and reduce the storage resource occupation of the bait file.

[0108] Figure 4 A flowchart of another file protection method provided according to an embodiment of the present disclosure is schematically shown.

[0109] like Figure 4 As shown, operation S410 to operation S490 are included.

[0110] In operation S410, system file data within a preset learning period is acquired.

[0111] According to an embodiment of the present disclosure, the system file data includes a file name, a file type, a folder path, a file content, and an update frequency.

[0112] In operation S420, the file whose update frequency is greater than a first preset threshold is determined as a target file.

[0113] In one example, all files updated in the system are learned within a cycle, and a file update model is established, including information such as file name, file type, folder path, file content, update frequency, etc. Files with an update frequency greater than a first preset threshold are determined to be target files, i.e., important files. Optionally, files in a specified folder path can also be determined to be target files.

[0114] In operation S430, a generation rule of a decoy file is determined based on the file size and file name of the target file.

[0115] In operation S440, a decoy file corresponding to the target file is generated according to the generation rule;

[0116] According to an embodiment of the present disclosure, the corresponding bait file is updated according to the update frequency of the target file.

[0117] In operation S450, the bait file is monitored in real time to record process information of accessing the bait file.

[0118] In operation S460, full process information of accessing the bait file is collected within a preset learning period.

[0119] In operation S470, a whitelist is created according to the full process information.

[0120] In operation S480, the process information is screened according to the white list to determine the illegally accessed process.

[0121] In operation S490, if it is determined that there is an illegal access process, an alarm message is sent in the form of an email or a text message.

[0122] In one example, after a bait file is generated, the bait file is monitored in real time, and process information accessing the bait file is recorded. Specifically, the full process information accessing the bait file is collected within a preset learning cycle. A whitelist is established based on the full process information, and the whitelist contains access process records of legitimate users. The process information is filtered according to the whitelist to determine illegal access processes. If it is determined that there is an illegal access process, an alarm message is sent in the form of an email or text message. The disclosed embodiment provides a more proactive anti-ransomware attack method, which enhances the protection of important files by placing bait files and monitoring them in real time, thereby preventing ransomware attacks. By real-time monitoring of the access and modification of bait files, abnormal activities can be discovered early, and timely measures can be taken to prevent further attacks on important files by ransomware, thereby maximizing data security and business continuity.

[0123] Combine the following Figure 5 to Figure 7 The generation rules of the bait file in the embodiment of the present disclosure are described in detail. Figure 5 A flowchart of a method for determining a generation rule of a decoy file based on the file size and file name of the target file according to an embodiment of the present disclosure is schematically shown. Figure 6 The flowchart of the method for determining the content generation rule of a bait file according to the target file size provided in accordance with an embodiment of the present disclosure is schematically shown. Figure 7 A flowchart of a method for determining a naming rule of a decoy file according to a target file name provided in accordance with an embodiment of the present disclosure is schematically shown.

[0124] like Figure 5 As shown, operation S220 includes operation S310 and operation S320.

[0125] In operation S310, a content generation rule of a decoy file is determined according to a target file size.

[0126] like Figure 6 As shown, operation S310 includes operation S311 and operation S312.

[0127] In operation S311, if it is determined that the target file size is greater than a second preset threshold, it is determined to use a sparse file to create a bait file.

[0128] In operation S312, if it is determined that the target file size is less than or equal to the second preset threshold, it is determined that the size and content of the bait file are consistent with the target file.

[0129] In one example, the content generation rules of the bait file are differentiated according to the size of the target file. For example, for files within 100M, the size and content of the corresponding bait file are consistent with the target file. For files larger than 100M, in order to save server disk space and control the disk occupancy of the bait file as much as possible, a sparse file is used to create the corresponding bait file. The file size is displayed as the file size applied at the beginning, and the occupied space is the actual amount of data written. For example, a virtual machine snapshot file of 2G is stored on the server system. The corresponding bait file is a sparse file that applies for a 2G size but actually occupies 100M. The actual content of the file is consistent with the first 100M of the snapshot file.

[0130] In operation S320, a naming rule of the decoy file is determined according to the target file name.

[0131] like Figure 7 As shown, operation S320 includes operation S321 and operation S322.

[0132] In operation S321, if it is determined that a fixed naming rule exists for the target file name, a naming rule for the decoy file is determined based on the fixed naming rule.

[0133] According to an embodiment of the present disclosure, the fixed naming rule includes naming by date and naming by number, and the naming rule of the bait file determined based on the fixed naming rule includes: if it is determined that the fixed naming rule is named by date, the file name of the bait file is set to the earliest or latest date; and if it is determined that the fixed naming rule is named by number, the file name of the bait file is set to the maximum or minimum number.

[0134] In operation S322, if it is determined that there is no fixed naming rule for the target file name, a naming rule for the decoy file is determined based on the target file name.

[0135] According to an embodiment of the present disclosure, special characters are added before and after the target file name as the file name of the decoy file.

[0136] In one example, there are two cases of naming file names. One is that the naming of important files follows specific naming rules, that is, there are fixed naming rules, such as naming by date or number. The naming of bait files also needs to follow the naming rules, and set the date or number to the smallest or largest to ensure that they are indexed first. The other is that there are no rules for naming important files. In order to ensure that the bait file is indexed first, special characters are added before and after the target file name as the bait file name.

[0137] Based on the above file protection method, the present disclosure also provides a file protection device. Figure 8 The device is described in detail.

[0138] Figure 8 The structure block diagram of a file protection device according to an embodiment of the present disclosure is schematically shown. Figure 8 As shown, the file protection device 700 of this embodiment includes a target file determination module 710 , a determination module 720 , a generation module 730 , a storage module 740 , a monitoring module 750 and an alarm module 760 .

[0139] The target file determination module 710 is used to determine the target file based on the file update model, and the file update model is generated by self-learning based on the system file update situation. In one embodiment, the target file determination module 710 can be used to perform the operation S210 described above, which will not be repeated here.

[0140] The determination module 720 is used to determine the generation rule of the bait file based on the file size and file name of the target file. In one embodiment, the determination module 720 can be used to perform the operation S220 described above, which will not be repeated here.

[0141] The generation module 730 is used to generate a bait file corresponding to the target file according to the generation rule. In one embodiment, the generation module 730 can be used to perform the operation S230 described above, which will not be described in detail here.

[0142] The storage module 740 is used to place the bait file in a specified file path. In one embodiment, the storage module 740 can be used to perform the operation S240 described above, which will not be described in detail here.

[0143] The monitoring module 750 is used to monitor the bait file in real time to record the process information of accessing the bait file. The monitoring module 750 can be used to perform the operation S250 described above, which will not be described in detail here.

[0144] The alarm module 760 is used to perform an alarm operation according to the process information and the whitelist. The alarm module 760 can be used to perform the operation S260 described above, which will not be described in detail here.

[0145] According to an embodiment of the present disclosure, the determination module includes: a first determination submodule and a second determination submodule.

[0146] The first determination submodule is used to determine the content generation rule of the bait file according to the target file size. The first determination submodule can be used to perform the operation S310 described above, which will not be described in detail here.

[0147] The second determination submodule is used to determine the naming rule of the bait file according to the target file name. The second determination submodule can be used to perform the operation S320 described above, which will not be described in detail here.

[0148] According to an embodiment of the present disclosure, the first determining submodule includes a first determining unit and a second determining unit.

[0149] The first determination unit is used to determine whether to use a sparse file to create a bait file if it is determined that the target file size is greater than a second preset threshold. The first determination unit can be used to perform the operation S311 described above, which will not be repeated here.

[0150] The second determination unit is used to determine that the size and content of the bait file are consistent with the target file if it is determined that the target file size is less than or equal to the second preset threshold. The second determination unit can be used to perform the operation S312 described above, which will not be repeated here.

[0151] According to an embodiment of the present disclosure, the second determining submodule includes a third determining unit and a fourth determining unit.

[0152] The third determination unit is used to determine the naming rule of the bait file based on the fixed naming rule if it is determined that the target file name has a fixed naming rule; the third determination unit can be used to perform the operation S321 described above, which will not be repeated here.

[0153] The fourth determining unit is used to determine the naming rule of the bait file based on the target file name if it is determined that the target file name does not have a fixed naming rule. The fourth determining unit can be used to perform the operation S322 described above, which will not be described in detail here.

[0154] According to an embodiment of the present disclosure, the third determination unit is also used to set the file name of the bait file to the earliest or latest date if it is determined that the fixed naming rule is named according to date; and if it is determined that the fixed naming rule is named according to number, set the file name of the bait file to the maximum or minimum number.

[0155] According to an embodiment of the present disclosure, the fourth determining unit is further configured to add special characters before and after the target file name as the file name of the decoy file.

[0156] According to an embodiment of the present disclosure, the target file determination module includes an acquisition submodule and a target file determination submodule.

[0157] The acquisition submodule is used to obtain system file data within a preset learning cycle, and the system file data includes file name, file type, folder path, file content and update frequency; the acquisition submodule can be used to execute the operation S410 described above, which will not be repeated here.

[0158] The target file determination submodule is used to determine the file whose update frequency is greater than the first preset threshold as the target file. The target file determination submodule can be used to perform the operation S420 described above, which will not be described in detail here.

[0159] According to an embodiment of the present disclosure, it also includes a process collection module and a whitelist establishment module.

[0160] The process collection module is used to collect the full amount of process information of accessing the bait file within a preset learning cycle; the process collection module can be used to perform the operation S460 described above, which will not be repeated here.

[0161] The whitelist establishment module is used to establish a whitelist according to the full process information. The whitelist establishment module can be used to perform the operation S470 described above, which will not be described in detail here.

[0162] According to an embodiment of the present disclosure, the whitelist establishment module includes a screening submodule and an alarm submodule.

[0163] The screening submodule is used to screen the process information according to the whitelist to determine the illegally accessed process; the screening submodule can be used to perform the operation S480 described above, which will not be described in detail here.

[0164] The alarm submodule is used to send an alarm message in the form of an email or a text message if it is determined that there is an illegal access process. The alarm submodule can be used to perform the operation S490 described above, which will not be repeated here.

[0165] According to an embodiment of the present disclosure, it also includes: a bait file update module.

[0166] The bait file update module is used to update the corresponding bait file according to the update frequency of the target file. The bait file update module can be used to perform the operations described above, which will not be described in detail here.

[0167] According to an embodiment of the present disclosure, any multiple modules of the target file determination module 710, the determination module 720, the generation module 730, the storage module 740, the monitoring module 750 and the alarm module 760 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the target file determination module 710, the determination module 720, the generation module 730, the storage module 740, the monitoring module 750 and the alarm module 760 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the target file determination module 710, determination module 720, generation module 730, storage module 740, monitoring module 750 and alarm module 760 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0168] Fig. 9 A block diagram of an electronic device suitable for implementing a file protection method according to an embodiment of the present disclosure is schematically shown.

[0169] like Fig. 9 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0170] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0171] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 909 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 909 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0172] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the file protection method according to the embodiment of the present disclosure is implemented.

[0173] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0174] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the file protection method provided by the embodiment of the present disclosure.

[0175] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0176] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0177] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0178] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0179] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0180] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0181] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A file protection method, characterized in that: The method comprises: Determine the target file based on a file update model, wherein the file update model is generated by self-learning based on the system file update situation; Determine a generation rule of the bait file based on the file size and file name of the target file; Generate a bait file corresponding to the target file according to the generation rule; Placing the bait file in a specified file path; monitoring the bait file in real time to record process information of accessing the bait file; and An alarm operation is performed according to the process information and the whitelist.

2. The method according to claim 1, characterized in that The generation rule of the bait file determined based on the file size and file name of the target file includes: Determining the content generation rules of the bait file according to the target file size; and The naming rule of the bait file is determined according to the target file name.

3. The method according to claim 2, characterized in that The content generation rule of the bait file determined according to the target file size includes: If it is determined that the target file size is greater than a second preset threshold, determining to use a sparse file to create a bait file; and If it is determined that the target file size is less than or equal to the second preset threshold, it is determined that the size and content of the bait file are consistent with the target file.

4. The method according to claim 2, characterized in that: The naming rule of determining the bait file according to the target file name includes: If it is determined that a fixed naming rule exists for the target file name, determining a naming rule for the decoy file based on the fixed naming rule; and If it is determined that there is no fixed naming rule for the target file name, the naming rule for the bait file is determined based on the target file name.

5. The method according to claim 4, characterized in that The fixed naming rules include naming by date and naming by number. The naming rules for bait files determined based on the fixed naming rules include: If it is determined that the fixed naming rule is named according to date, the file name of the bait file is set to the earliest or latest date; and If it is determined that the fixed naming rule is to name according to the number, the file name of the bait file is set to the maximum or minimum number.

6. The method according to claim 4, characterized in that The naming rule of determining the bait file based on the target file name includes: Add special characters before and after the target file name as the file name of the bait file.

7. The method according to claim 1, characterized in that Determining the target file based on the file update model includes: Acquire system file data within a preset learning period, wherein the system file data includes file name, file type, folder path, file content, and update frequency; and The file whose update frequency is greater than a first preset threshold is determined as a target file.

8. The method according to any one of claims 1 to 7, characterized in that Before performing an alarm operation according to the process information and the whitelist, the method further includes: Collecting full process information of accessing the decoy file within a preset learning period; and A whitelist is established based on the full process information.

9. The method according to claim 8, characterized in that The alarm operation according to the process information and the whitelist includes: Filtering the process information according to the whitelist to determine the illegal access process; and If it is determined that there is an illegal access process, an alarm message will be sent via email or text message.

10. The method according to claim 9, characterized in that Also includes: The corresponding bait file is updated according to the update frequency of the target file.

11. A document protection device, characterized in that: The device comprises: A target file determination module, used to determine the target file based on a file update model, wherein the file update model is generated by self-learning based on system file update conditions; A determination module, used for determining a generation rule of a decoy file based on the file size and file name of the target file; A generation module, used to generate a bait file corresponding to the target file according to the generation rule; A storage module, used for placing the bait file in a specified file path; A monitoring module, used for real-time monitoring of the bait file to record process information of accessing the bait file; and The alarm module is used to perform an alarm operation according to the process information and the whitelist.

12. An electronic device comprising: one or more processors; a storage device for storing one or more computer programs, The method is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images