Ransomware safety prevention and control method, ransomware safety prevention and control device and computer equipment
By constructing bait files and collecting ransomware process information, and performing path tracing and virus processing, the problem of difficulty in preventing and controlling ransomware from the root in the existing technology is solved, and efficient ransomware prevention and control is achieved.
Patent Information
- Application Number
- CN202411752841.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-02
- Publication Date
- 2025-03-18
AI Technical Summary
The existing technology is difficult to effectively prevent and control ransomware from the root, resulting in poor security protection.
By obtaining the normal file information of the target device, building the bait file information, collecting ransomware process information in the bait file area, tracing the path to obtain the source information of the virus, generating virus processing strategies, and virus prevention and control of the ransomware.
Directly trace the source of ransomware, and perform source isolation and file deletion to resolve ransomware threats from the root and improve the security protection effect of ransomware.
Smart Images
Figure CN119646810A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer security technology, and in particular to a ransomware security prevention and control method, device and computer equipment. Background Art
[0002] With the rapid development of cloud computing, all walks of life are becoming more and more closely connected with cloud servers, resulting in a large number of web application servers being migrated to the cloud, and even personal terminal PCs are gradually migrating to cloud computers or cloud terminals. As more and more businesses are being run on cloud servers, more and more security issues are being encountered, such as ransomware. More and more cloud hosts are facing the threat of ransomware. Once the data on the cloud host is encrypted by the ransomware, it will not only cause data loss and economic losses, but may also cause the entire cloud host business system and file system to be completely encrypted and damaged. Therefore, how to improve the security protection effect against ransomware is the current research focus.
[0003] Traditional protection measures against ransomware are to install anti-ransomware software, use bait files to dynamically detect ransomware behavior, or manually back up data regularly. However, the above methods can only treat the symptoms and not the root cause. They cannot detect and kill the ransomware at the source, resulting in poor security protection against ransomware. Summary of the invention
[0004] Based on this, it is necessary to provide a ransomware security prevention and control method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.
[0005] In a first aspect, the present application provides a method for security prevention and control of ransomware, including:
[0006] Acquire normal file information of a target device, and construct decoy file information of the target device based on the normal file information;
[0007] Deploy the bait file information in the bait file area of the target device, and collect ransomware process information of the ransomware virus in the bait file area;
[0008] Perform path tracing on the ransomware process information to obtain virus source information of the ransomware virus, and generate a virus processing strategy for the ransomware virus based on the virus source information;
[0009] Based on the virus processing strategy, virus prevention and control processing is performed on the ransomware virus to obtain a processing result of the ransomware virus, and the processing result is fed back to the target device.
[0010] Optionally, constructing the bait file information of the target device based on the normal file information includes:
[0011] Identify the file content of each file type of the normal file information, and based on the file content of each file type, query the bait database for an initial bait file of each file type;
[0012] For each file type, identifying the similarity between the file content of the file type and the bait file content of each initial bait file of the file type through a data similarity network, and selecting the initial bait file corresponding to the maximum similarity as the bait file of the file type;
[0013] The bait files of all file types are used as the bait file information of the target device.
[0014] Optionally, in the bait file area, collecting ransomware process information of the ransomware virus includes:
[0015] Collecting the current file status of the bait file information, and when the current file status is in a normal state, returning to the step of collecting the current file status of the bait file information, until when the current file status is in an abnormal state, recording the file change process of the bait file information;
[0016] The file change process is used as ransomware process information of the ransomware virus.
[0017] Optionally, performing path tracing on the ransomware process information to obtain virus source information of the ransomware virus includes:
[0018] Based on the ransomware process information, identifying ransomware virus identification information corresponding to the ransomware process information;
[0019] Through the file tracing program, the file path of the ransomware file information and the file information of the ransomware file information are identified, and the file path and the file information are used as the virus source information of the ransomware virus.
[0020] Optionally, generating a virus processing strategy for the ransomware virus based on the virus source information includes:
[0021] Based on the file path, a virus path isolation strategy for the ransomware virus is generated, and based on the file information, a virus file identification strategy for the ransomware virus is generated;
[0022] The virus path isolation strategy and the virus file identification strategy are used as the virus processing strategy for the ransomware virus.
[0023] Optionally, performing virus prevention and control processing on the ransomware virus based on the virus processing strategy to obtain a processing result of the ransomware virus includes:
[0024] Based on the virus path isolation strategy, the ransomware virus is isolated;
[0025] Through the virus file identification strategy, the target virus file is identified in the target device, and the target virus file is deleted to obtain the processing result of the ransomware virus.
[0026] In a second aspect, the present application also provides a ransomware security prevention and control device, including:
[0027] An acquisition module, used to acquire normal file information of a target device, and construct decoy file information of the target device based on the normal file information;
[0028] A deployment module, used to deploy the bait file information in the bait file area of the target device, and collect ransomware process information of the ransomware virus in the bait file area;
[0029] A generation module is used to perform path tracing processing on the ransomware process information to obtain virus source information of the ransomware virus, and generate a virus processing strategy for the ransomware virus based on the virus source information;
[0030] A processing module is used to perform virus prevention and control processing on the ransomware virus based on the virus processing strategy, obtain a processing result of the ransomware virus, and feed back the processing result to the target device.
[0031] Optionally, the acquisition module is specifically used to:
[0032] Identify the file content of each file type of the normal file information, and based on the file content of each file type, query the bait database for an initial bait file of each file type;
[0033] For each file type, identifying the similarity between the file content of the file type and the bait file content of each initial bait file of the file type through a data similarity network, and selecting the initial bait file corresponding to the maximum similarity as the bait file of the file type;
[0034] The bait files of all file types are used as the bait file information of the target device.
[0035] Optionally, the deployment module is specifically used to:
[0036] Collecting the current file status of the bait file information, and when the current file status is in a normal state, returning to the step of collecting the current file status of the bait file information, until when the current file status is in an abnormal state, recording the file change process of the bait file information;
[0037] The file change process is used as ransomware process information of the ransomware virus.
[0038] Optionally, the generating module is specifically used for:
[0039] Based on the ransomware process information, identifying ransomware virus identification information corresponding to the ransomware process information;
[0040] Through the file tracing program, the file path of the ransomware file information and the file information of the ransomware file information are identified, and the file path and the file information are used as the virus source information of the ransomware virus.
[0041] Optionally, the generating module is specifically used for:
[0042] Based on the file path, a virus path isolation strategy for the ransomware virus is generated, and based on the file information, a virus file identification strategy for the ransomware virus is generated;
[0043] The virus path isolation strategy and the virus file identification strategy are used as the virus processing strategy for the ransomware virus.
[0044] Optionally, the processing module is specifically used to:
[0045] Based on the virus path isolation strategy, the ransomware virus is isolated;
[0046] Through the virus file identification strategy, the target virus file is identified in the target device, and the target virus file is deleted to obtain the processing result of the ransomware virus.
[0047] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.
[0048] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.
[0049] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.
[0050] The above-mentioned ransomware security prevention and control method, device and computer equipment obtain the normal file information of the target device, and construct the bait file information of the target device based on the normal file information; deploy the bait file information in the bait file area of the target device, and collect the ransom process information of the ransomware in the bait file area; perform path tracing on the ransomware process information to obtain the virus source information of the ransomware, and generate the virus processing strategy of the ransomware based on the virus source information; perform virus prevention and control on the ransomware based on the virus processing strategy to obtain the processing result of the ransomware, and feed the processing result back to the target device. This solution, through the construction of bait files, monitors bait files, traces the ransomware information and performs virus file operation processing, thereby directly tracing the ransomware, isolating the ransomware from the source, and deleting the files, which fundamentally solves the ransomware threat of the ransomware and the potential threat of future ransomware, thereby improving the security protection effect of the ransomware. BRIEF DESCRIPTION OF THE DRAWINGS
[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0052] Figure 1 A schematic diagram of a process of a ransomware security prevention and control method in one embodiment;
[0053] Figure 2 A schematic diagram of a process of a ransomware security prevention and control example in one embodiment;
[0054] Figure 3 It is a structural block diagram of a ransomware security prevention and control device in one embodiment;
[0055] Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION
[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0057] The ransomware security prevention and control method provided in the embodiment of the present application can be applied to the application environment of ransomware security prevention and control. Among them, the method can be applied to a terminal, can also be applied to a server, can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be, but is not limited to, various personal computers, laptops, mid-size computers, etc. Among them, the terminal constructs a bait file, thereby monitoring the bait file, tracing the ransomware information, and performing operations on the virus file, thereby directly tracing the ransomware, isolating the ransomware from the source, and deleting the file, thereby solving the ransomware threat of the ransomware and the potential threat of future ransomware from the root, thereby improving the security protection effect against the ransomware.
[0058] In an exemplary embodiment, Figure 1 As shown, a ransomware security prevention and control method is provided, which is described by taking the method applied to a terminal as an example, and includes the following steps S101 to S104. Among them:
[0059] Step S101, obtaining normal file information of a target device, and constructing bait file information of the target device based on the normal file information.
[0060] In this embodiment, the terminal responds to the staff's information upload operation and obtains the file information of each file stored in the target device as normal file information. The target device can be an online system such as a cloud host, a cloud platform, a cloud system, etc. that can receive multiple file transfers. Then the terminal constructs the bait file information of the target device based on the normal file information. The bait file is the file information corresponding to the normal file information containing a specified directory, a specified type and keywords. The specific construction process will be described in detail later.
[0061] Step S102, deploying the bait file information in the bait file area of the target device, and collecting the ransomware process information of the ransomware virus in the bait file area.
[0062] In this embodiment, the terminal deploys the bait file information in the bait file area of the target device, and collects the ransom process information of the ransomware virus in the bait file area. Among them, the ransom process information of the ransomware virus is the record information generated when the bait file is encrypted or deleted. The specific collection process will be described in detail later. Among them, the collection method is a monitoring method of file monitoring through the fanotify interface of the agent of the target device.
[0063] Step S103, performing path tracing processing on the ransomware process information to obtain virus source information of the ransomware virus, and generating a virus processing strategy for the ransomware virus based on the virus source information.
[0064] In this embodiment, the terminal performs path tracing on the ransomware process information to obtain the virus source information of the ransomware virus, and generates a virus processing strategy for the ransomware virus based on the virus source information. Among them, the path tracing processing method is a technical tracing method through the fanotify interface of the agent of the target device, and the specific tracing process will be described in detail later.
[0065] Step S104: Based on the virus processing strategy, virus prevention and control processing is performed on the ransomware virus, a processing result of the ransomware virus is obtained, and the processing result is fed back to the target device.
[0066] In this embodiment, the terminal performs virus prevention and control processing on the ransomware based on the virus processing strategy, obtains the processing result of the ransomware, and feeds back the processing result to the target device. Among them, the virus prevention and control processing is a processing method for isolating the path of the ransomware and / or deleting the ransomware file. Finally, after the terminal user isolates and / or deletes the virus file, the processing result is fed back to the front end to tell the user whether the processing is successful.
[0067] Based on the above solution, by constructing bait files, the bait files can be monitored, the ransomware information can be traced, and the virus file operations can be performed, so as to directly trace the ransomware, isolate the source of the ransomware, and delete the files, thereby solving the ransomware threat of the ransomware and the potential threat of future ransomware from the root, thereby improving the security protection effect against the ransomware.
[0068] Optionally, based on normal file information, construct bait file information for the target device, including: identifying the file content of each file type in the normal file information, and based on the file content of each file type, querying the initial bait file of each file type in the bait database; for each file type, identifying the file content of the file type and the similarity between the bait file content of each initial bait file of the file type through a data similarity network, and screening the initial bait file corresponding to the maximum similarity as the bait file of the file type; using the bait files of all file types as the bait file information of the target device.
[0069] In this embodiment, the terminal identifies the file content of each file type of normal file information, and based on the file content of each file type, queries the initial bait file of each file type in the bait database. The bait database stores the bait file content of different file types. The file type is the file type of each file content stored in the target device. For each file type, the similarity between the file content of the file type and the bait file content of each initial bait file of the file type is identified through a data similarity network, and the initial bait file corresponding to the maximum similarity is selected as the bait file of the file type. The data similarity recognition network is a program network corresponding to a similarity recognition program that identifies the similarity between two data contents. Finally, the terminal uses the bait files of all file types as the bait file information of the target device.
[0070] Based on the above solution, by splitting normal file information into file contents of each file type, bait files of each file type are generated, thereby improving the accuracy and comprehensiveness of bait file generation.
[0071] Optionally, in the bait file area, ransomware process information of the ransomware virus is collected, including: collecting the current file status of the bait file information, and when the current file status is normal, returning to execute the step of collecting the current file status of the bait file information, until the current file status is abnormal, recording the file change process of the bait file information; and using the file change process as the ransomware process information of the ransomware virus.
[0072] In this embodiment, the terminal collects the current file status of the bait file information, and when the current file status is normal, returns to the step of collecting the current file status of the bait file information, until the current file status is abnormal, and records the file change process of the bait file information. The current file status includes but is not limited to a normal file status or an abnormal file status, and the abnormal file status is the file status of the abnormal file when the bait file is encrypted or deleted.
[0073] Finally, the terminal uses the file change process of the bait file as the ransomware process information. Specifically, the terminal uses the fanotify interface to monitor whether the file event has been encrypted and tampered with, and obtains the pid of the tampered process, the path of the executable program, the tampering time and other traceability information through the tampering event.
[0074] Based on the above solution, by monitoring the status of the bait file, it is possible to identify whether the bait file has been tampered with by a ransomware virus, thereby improving the accuracy of file monitoring.
[0075] Optionally, the ransomware process information is traced to obtain the virus source information of the ransomware virus, including: based on the ransomware process information, identifying the ransomware virus identification information corresponding to the ransomware process information; through a file tracing program, identifying the file path of the ransomware virus file information and the file information of the ransomware virus file information, and using the file path and the file information as the virus source information of the ransomware virus.
[0076] In this embodiment, the terminal identifies the ransomware virus identification information corresponding to the ransomware process information based on the ransomware process information. Then, the terminal identifies the file path of the ransomware virus file information and the file information of the ransomware virus file information through the file tracing program, and uses the file path and the file information as the virus source information of the ransomware virus. Among them, the file path is the path of the executable program of the ransomware virus source file. Among them, the file tracing program is the fanotify technology corresponding to the agent of the target device.
[0077] Based on the above solution, the accuracy and efficiency of file tracing are improved by tracing the ransomware process information.
[0078] Optionally, based on the virus source information, a virus processing strategy for the ransomware virus is generated, including: generating a virus path isolation strategy for the ransomware virus based on the file path, and generating a virus file identification strategy for the ransomware virus based on the file information; and using the virus path isolation strategy and the virus file identification strategy as the virus processing strategy for the ransomware virus.
[0079] In this embodiment, the terminal generates a virus path isolation strategy for the ransomware virus based on the file path, and generates a virus file identification strategy for the ransomware virus based on the file information. Among them, the virus file identification strategy is to perform file identification on files containing the file information, file path, file pid and other information. Finally, the terminal uses the virus path isolation strategy and the virus file identification strategy as the virus processing strategy for the ransomware virus.
[0080] Based on the above solution, path isolation strategy and virus file identification strategy are implemented through file path and file information, which improves the processing efficiency and accuracy of ransomware viruses.
[0081] Optionally, based on the virus processing strategy, virus prevention and control processing is performed on the ransomware virus to obtain the processing result of the ransomware virus, including: based on the virus path isolation strategy, virus isolation processing is performed on the ransomware virus; through the virus file identification strategy, target virus files are identified in the target device, and file deletion processing is performed on the target virus files to obtain the processing result of the ransomware virus.
[0082] In this embodiment, the terminal performs virus isolation processing on the ransomware virus based on the virus path isolation strategy. Then, the terminal identifies the target virus file in the target device through the virus file identification strategy, and performs file deletion processing on the target virus file to obtain the processing result of the ransomware virus.
[0083] Based on the above solution, the efficiency of file processing on virus files is improved by isolating and / or deleting virus files.
[0084] This application also provides a ransomware security prevention and control example, such as Figure 2 As shown, the specific processing process includes the following steps:
[0085] Step S201, obtaining normal file information of the target device.
[0086] Step S202, identifying the file content of each file type of normal file information, and based on the file content of each file type, searching for an initial bait file of each file type in a bait database.
[0087] Step S203, for each file type, using a data similarity network, identifies the similarity between the file content of the file type and the bait file content of each initial bait file of the file type, and selects the initial bait file corresponding to the maximum similarity as the bait file of the file type.
[0088] Step S204: using bait files of all file types as bait file information of the target device.
[0089] Step S205, deploying the bait file information in the bait file area of the target device.
[0090] Step S206, collect the current file status of the bait file information, and when the current file status is normal, return to execute the step of collecting the current file status of the bait file information, until the current file status is abnormal, record the file change process of the bait file information.
[0091] Step S207, using the file change process as ransomware process information of the ransomware virus.
[0092] Step S208: Based on the ransomware process information, identifying ransomware virus identification information corresponding to the ransomware process information.
[0093] Step S209, identifying the file path of the ransomware file information and the file information of the ransomware file information through a file tracing program, and using the file path and the file information as virus source information of the ransomware.
[0094] Step S210, based on the file path, a virus path isolation strategy for the ransomware virus is generated, and based on the file information, a virus file identification strategy for the ransomware virus is generated.
[0095] Step S211, using the virus path isolation strategy and the virus file identification strategy as the virus processing strategy for the ransomware virus.
[0096] Step S212: Based on the virus path isolation strategy, the ransomware virus is isolated.
[0097] Step S213, through the virus file identification strategy, in the target device, identify the target virus file, and perform file deletion processing on the target virus file to obtain the processing result of the ransomware virus.
[0098] Step S214: Feedback the processing result to the target device.
[0099] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0100] Based on the same inventive concept, the embodiment of the present application also provides a ransomware security prevention and control device for implementing the ransomware security prevention and control method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more ransomware security prevention and control devices provided below can refer to the limitations of the ransomware security prevention and control method above, and will not be repeated here.
[0101] In an exemplary embodiment, Figure 3 As shown, a ransomware security prevention and control device is provided, including: an acquisition module 310, a deployment module 320, a generation module 330, and a processing module 340, wherein:
[0102] The acquisition module 310 is used to acquire the normal file information of the target device and construct the bait file information of the target device based on the normal file information;
[0103] A deployment module 320, configured to deploy the bait file information in a bait file area of the target device, and collect ransomware process information of the ransomware virus in the bait file area;
[0104] A generating module 330 is used to perform path tracing processing on the ransomware process information to obtain virus source information of the ransomware virus, and generate a virus processing strategy for the ransomware virus based on the virus source information;
[0105] The processing module 340 is used to perform virus prevention and control processing on the ransomware virus based on the virus processing strategy, obtain a processing result of the ransomware virus, and feed back the processing result to the target device.
[0106] Optionally, the acquisition module 310 is specifically configured to:
[0107] Identify the file content of each file type of the normal file information, and based on the file content of each file type, query the bait database for an initial bait file of each file type;
[0108] For each file type, identifying the similarity between the file content of the file type and the bait file content of each initial bait file of the file type through a data similarity network, and selecting the initial bait file corresponding to the maximum similarity as the bait file of the file type;
[0109] The bait files of all file types are used as the bait file information of the target device.
[0110] Optionally, the deployment module 320 is specifically configured to:
[0111] Collecting the current file status of the bait file information, and when the current file status is in a normal state, returning to the step of collecting the current file status of the bait file information, until when the current file status is in an abnormal state, recording the file change process of the bait file information;
[0112] The file change process is used as ransomware process information of the ransomware virus.
[0113] Optionally, the generating module 330 is specifically configured to:
[0114] Based on the ransomware process information, identifying ransomware virus identification information corresponding to the ransomware process information;
[0115] Through the file tracing program, the file path of the ransomware file information and the file information of the ransomware file information are identified, and the file path and the file information are used as the virus source information of the ransomware virus.
[0116] Optionally, the generating module 330 is specifically configured to:
[0117] Based on the file path, a virus path isolation strategy for the ransomware virus is generated, and based on the file information, a virus file identification strategy for the ransomware virus is generated;
[0118] The virus path isolation strategy and the virus file identification strategy are used as the virus processing strategy for the ransomware virus.
[0119] Optionally, the processing module 340 is specifically configured to:
[0120] Based on the virus path isolation strategy, the ransomware virus is isolated;
[0121] Through the virus file identification strategy, the target virus file is identified in the target device, and the target virus file is deleted to obtain the processing result of the ransomware virus.
[0122] Each module in the above-mentioned ransomware security prevention and control device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.
[0123] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 4As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for safe prevention and control of ransomware viruses is realized. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.
[0124] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0125] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of a method for security prevention and control of ransomware when executing the computer program.
[0126] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, steps of a method for security prevention and control of ransomware are implemented.
[0127] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of a method for security prevention and control of ransomware.
[0128] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.
[0129] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.
[0130] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0131] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.
Claims
1. A method for safe prevention and control of ransomware, characterized in that: The method comprises: Acquire normal file information of a target device, and construct decoy file information of the target device based on the normal file information; Deploy the bait file information in the bait file area of the target device, and collect ransomware process information of the ransomware virus in the bait file area; Perform path tracing on the ransomware process information to obtain virus source information of the ransomware virus, and generate a virus processing strategy for the ransomware virus based on the virus source information; Based on the virus processing strategy, virus prevention and control processing is performed on the ransomware virus to obtain a processing result of the ransomware virus, and the processing result is fed back to the target device.
2. The method according to claim 1, characterized in that The step of constructing the bait file information of the target device based on the normal file information includes: Identify the file content of each file type of the normal file information, and based on the file content of each file type, query the bait database for an initial bait file of each file type; For each file type, identifying the similarity between the file content of the file type and the bait file content of each initial bait file of the file type through a data similarity network, and selecting the initial bait file corresponding to the maximum similarity as the bait file of the file type; The bait files of all file types are used as the bait file information of the target device.
3. The method according to claim 1, characterized in that In the bait file area, the ransomware process information of the ransomware virus is collected, including: Collecting the current file status of the bait file information, and when the current file status is in a normal state, returning to the step of collecting the current file status of the bait file information, until when the current file status is in an abnormal state, recording the file change process of the bait file information; The file change process is used as ransomware process information of the ransomware virus.
4. The method according to claim 1, characterized in that: The path tracing process of the ransomware process information to obtain the virus source information of the ransomware virus includes: Based on the ransomware process information, identifying ransomware virus identification information corresponding to the ransomware process information; Through the file tracing program, the file path of the ransomware file information and the file information of the ransomware file information are identified, and the file path and the file information are used as the virus source information of the ransomware virus.
5. The method according to claim 4, characterized in that The generating a virus processing strategy for the ransomware virus based on the virus source information includes: Based on the file path, a virus path isolation strategy for the ransomware virus is generated, and based on the file information, a virus file identification strategy for the ransomware virus is generated; The virus path isolation strategy and the virus file identification strategy are used as the virus processing strategy for the ransomware virus.
6. The method according to claim 5, characterized in that The performing virus prevention and control processing on the ransomware virus based on the virus processing strategy to obtain the processing result of the ransomware virus includes: Based on the virus path isolation strategy, the ransomware virus is isolated; Through the virus file identification strategy, the target virus file is identified in the target device, and the target virus file is deleted to obtain the processing result of the ransomware virus.
7. A ransomware security prevention and control device, characterized in that: The device comprises: An acquisition module, used to acquire normal file information of a target device, and construct decoy file information of the target device based on the normal file information; A deployment module, used to deploy the bait file information in the bait file area of the target device, and collect ransomware process information of the ransomware virus in the bait file area; A generation module is used to perform path tracing processing on the ransomware process information to obtain virus source information of the ransomware virus, and generate a virus processing strategy for the ransomware virus based on the virus source information; A processing module is used to perform virus prevention and control processing on the ransomware virus based on the virus processing strategy, obtain a processing result of the ransomware virus, and feed back the processing result to the target device.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.