Multilayer ransomware protection system and method based on dynamic credibility

Abstract

The invention discloses a multilayer ransomware protection system and method based on dynamic credibility, and belongs to the technical field of ransomware defense. The system comprises a process verification module and a suspicious process monitoring module, when a certain process calls a system function to obtain a file list, the system intercepts the operation through a code instrumentation technology, and judges the type of the process through the process verification module; and if the process is not included in the black and white list, judging that the process is a suspicious process, and returning a file list containing a bait file to the process. The suspicious process monitoring module carries out real-time monitoring on a file list containing bait files traversed by the process, and if the suspicious process accesses the bait files, the suspicious process is marked as a malicious process and added into a blacklist; otherwise, the system intercepts the system call related to the file access through a code instrumentation technology, and adopts different protection strategies according to the value level of the file. According to the method, the misjudgment rate of the normal process is reduced, and accurate detection and defense of the ransomware are realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of ransomware defense, and specifically refers to a multi-layer ransomware protection system and method based on dynamic trust. Background Art

[0002] With the development of digital technology, data plays an increasingly important role for a company or organization. As a malicious program, ransomware mainly invades users' computers or network devices, encrypts users' data files or restricts access permissions, and then extorts ransom from users in exchange for decryption or restoration of access. The spread of such malicious software has various ways, including email attachments, malicious website links, online advertisements, etc., among which the way of spreading through email attachments or links is the most common. When a user's device is infected, ransomware will quickly encrypt or lock important files, resulting in the user being unable to access or losing data, thus causing serious economic losses and data security risks.

[0003] Currently, ransomware has become a major challenge in the field of network security. Attackers continuously use various technical means to develop new types of ransomware, and its spread speed and attack scope are also continuously expanding. Facing this increasingly severe threat, traditional defense measures have become inadequate, so it is necessary to continuously research and innovate more efficient and intelligent protection technologies to cope with the diverse attack methods of ransomware and effectively protect the data security and privacy of users from being violated.

[0004] Existing technical solutions detect and defend against ransomware by implanting decoy files in the user file system. These decoy files are usually designed as high-value false files to attract ransomware to access. Once a process accesses a decoy file, the system can determine that the process is a malicious process and take corresponding defense measures. Although the specific implementation schemes of this technology are diverse, its core design goals mainly focus on the following two aspects: First, generate highly realistic decoy files to enhance the attraction to attackers and ensure that ransomware can actively identify and access these files; Second, deploy decoy files at key locations where ransomware is more likely to access, so as to improve the accuracy and timeliness of detection. Through the above design, the existing technology can effectively identify and intercept malicious behaviors before ransomware damages real files, providing certain protection for data security.

[0005] The existing deception-based protection strategy based on decoy files has the following two main defects in practical applications:

[0006] (1) When the number of decoy files is large, legitimate users or normal processes may trigger access to decoy files due to misoperations, resulting in the system misjudging them as malicious behaviors and thus affecting the operation of normal services;

[0007] (2) When the number of decoy files is small, before the ransomware accesses the decoy files, it may have traversed and encrypted a large number of user files, resulting in the protection mechanism being unable to detect and block malicious behavior in a timely manner, thus reducing the defense effect.

[0008] These defects limit the practicability and reliability of the existing technology, and there is an urgent need for a more efficient and accurate solution to make up for the above deficiencies. Summary of the Invention

[0009] Aiming at the problems of poor detection and defense effect and low efficiency of ransomware in the existing technology, the present invention proposes a multi-layer ransomware protection system and method based on dynamic trust, which monitors suspicious processes in real time and introduces a file protection mechanism to improve the defense accuracy and defense efficiency of ransomware while protecting file security.

[0010] A multi-layer ransomware protection method based on dynamic trust includes the following steps:

[0011] Step 1, set an initial whitelist and blacklist;

[0012] The whitelist is initially manually added by a trusted administrator, and the blacklist is initially empty and dynamically added during subsequent detection.

[0013] Step 2, when a certain process calls a system function to obtain a file list, the system intercepts this operation through code instrumentation technology and determines the type of the process through a process verification function;

[0014] The core of the process verification function is to inject a hook function into the system call path through code instrumentation technology to intercept key operations. The specific determination logic is as follows: obtain the unique identifier of the process through a process fingerprint generation algorithm, and combine it with the software digital signature to compare with the whitelist and blacklist for verification.

[0015] Processes are divided into the following three types:

[0016] 1. Legitimate process: If the process exists in the whitelist, it is determined to be a legitimate process. The system will release the process and call the original system function to return the real file list to it;

[0017] 2. Malicious process: If the process exists in the blacklist, it is determined to be a malicious process. The system will immediately terminate the process to prevent it from causing further damage;

[0018] 3. Suspicious processes: If a process is neither in the whitelist nor in the blacklist, it is determined to be an unknown suspicious process. The system will fabricate and return a file list containing decoy files to this process to guide it to access the decoy files. Here, the false decoy file information is generated based on the current directory context information, thus achieving a highly realistic and seductive effect.

[0019] Using code instrumentation technology, some decoy file information is generated and inserted when the system returns the file list, but these decoy files are false and do not actually exist.

[0020] Step 3, if the process is a suspicious process, the system monitors and responds to it in real time through the suspicious process monitoring module;

[0021] The suspicious process traverses the file list containing decoy files, and the suspicious process monitoring module monitors in real time whether the file it accesses is a decoy file. If so, the system will immediately terminate the process, mark it as a malicious process, and add it to the blacklist to prevent its subsequent operations; otherwise, when the suspicious process accesses user files, the system will intercept the system calls related to file access through code instrumentation technology and adopt different protection strategies according to the value level of the file.

[0022] The value level of the file is specified by the user customarily, including high-value files and medium-low-value files;

[0023] The different protection strategies for files of different value levels include:

[0024] For high-value files, the system will call a legitimate silent process to preempt the file handle and directly prevent the suspicious process from encrypting or modifying operations, ensuring the absolute security of high-value files;

[0025] For medium-low-value files, the system restricts the access speed of the suspicious process through a dynamic delay mechanism, artificially introduces an operation delay, delays its encryption behavior, and buys more time for the system to perform behavior analysis and response, enhancing the timeliness of defense. If the suspicious process accesses a decoy file during the delay period, the system immediately terminates the process and adds it to the blacklist.

[0026] The system for implementing the above multi-layer ransomware protection method includes a process verification module and a suspicious process monitoring module.

[0027] The beneficial effects of the present invention are as follows:

[0028] (1) Reducing the misjudgment rate: Through the whitelist mechanism, this system can accurately distinguish legitimate processes from suspicious processes, avoiding legitimate users or normal processes being misjudged as malicious behaviors due to accidental access to decoy files, and significantly improving the usability and user experience of the system.

[0029] (2) Improve the timeliness of defense: Introduce a delay mechanism to delay the encryption behavior of suspicious processes when they access important files, gain more time for the system to detect and block malicious processes, and effectively reduce the possibility of ransomware encrypting a large number of user files before accessing decoy files.

[0030] (3) Accurately detect malicious behaviors: Through decoy files and fictional file lists, the system can dynamically and actively induce suspicious processes to access decoy files, thereby achieving accurate detection and defense, and enhancing the intelligent response ability to ransomware. Description of the Drawings

[0031] Figure 1 is the overall technical solution flowchart of the multi-layer ransomware protection method based on dynamic trust of the present invention;

[0032] Figure 2 is the flowchart of Embodiment 1 of the present invention;

[0033] Figure 3 is the flowchart of Embodiment 2 of the present invention. Detailed Implementation Manner

[0034] The present invention will be further described in detail below in conjunction with the drawings and embodiments.

[0035] The key technology of the present invention is to intercept file operating system calls through code instrumentation technology and insert custom process verification functions, and classify and manage processes in combination with the whitelist and blacklist mechanisms. Existing technologies usually only rely on decoy files for detection, lacking dynamic classification and accurate management of processes. The present invention can accurately distinguish legitimate processes from suspicious processes through the whitelist and blacklist, and return a fictional file list containing decoy files to suspicious processes through code instrumentation technology, avoiding legitimate processes being misjudged due to accidental access to decoy files, and significantly reducing the misjudgment rate.

[0036] In addition, when using existing technologies, ransomware may encrypt a large number of user files before accessing decoy files, resulting in untimely defense. The present invention realizes an access delay mechanism and a file handle preemption mechanism through code instrumentation. After a suspicious process obtains the fictional file list and starts to access important files, an artificial operation delay is introduced or its file handle is directly preempted to delay its encryption behavior, gaining more time for the system to observe and detect suspicious processes, thereby improving the timeliness and effectiveness of defense.

[0037] The present invention solves the problems existing in the prior art through the following technical means:

[0038] (1) Through code instrumentation technology, when a suspicious process triggers a system call related to file access, the code flow is taken over and custom code is run. The system adopts different processing strategies according to the type of the process (legitimate process, suspicious process or malicious process): return the real file list for legitimate processes; return a fictional file list containing decoy files for suspicious processes, and monitor and respond to their behaviors in real time; immediately terminate the operations of malicious processes.

[0039] (2) When monitoring a suspicious process, through code instrumentation technology, a delayed access mechanism and a file handle preemption mechanism are introduced when the process accesses user files to delay time and protect user files.

[0040] (3) When generating a fictional file list, by collecting directory context information, a false file list containing realistic and highly valuable and tempting decoy files is generated to actively induce the suspicious process to preferentially access the decoy files.

[0041] Specifically, as Figure 1 shown, the implementation process of the multi-layer ransomware protection method based on dynamic trust of the present invention is as follows:

[0042] (1) System call interception and process verification

[0043] When a certain process calls a system function to obtain a file list, the system intercepts this operation through code instrumentation technology and inserts a custom process verification function. The process verification function determines the process based on the data in the whitelist and blacklist, and classifies it into the following three types:

[0044] Legitimate process: If the process exists in the whitelist, it is determined to be a legitimate process. The system will release this process and call the original system function to return the real file list to it;

[0045] Malicious process: If the process exists in the blacklist, it is determined to be a malicious process. The system will immediately terminate this process to prevent it from causing further damage;

[0046] Suspicious process: If the process is neither in the whitelist nor in the blacklist, it is determined to be an unknown suspicious process. The system will fictionalize and return a file list containing decoy files to this process to guide it to access the decoy files. Here, the false decoy file information is generated according to the current directory context information, so as to achieve a high degree of simulation and temptation effect.

[0047] (2) Suspicious process monitoring and response

[0048] For the processes determined to be suspicious, the system will monitor them in real time:

[0049] 1. Access Bait File: If a suspicious process accesses a bait file, the system will immediately terminate the process, mark it as a malicious process, and add it to the blacklist to prevent its subsequent operations;

[0050] 2. Access User Files: If a suspicious process accesses user files, the system will intercept the system calls related to file access through code instrumentation technology and adopt different protection strategies according to the value level of the files. High-value files are specified by the user customarily. The user can set specific files or directories as high-value files according to their needs, and the system will protect these files specially according to the criteria set by the user.

[0051] For high-value files, the system will call a legitimate silent process to preempt the file handle and directly prevent the suspicious process from encrypting or modifying operations to ensure the absolute security of high-value files;

[0052] For medium- and low-value files, the system restricts the access speed of the suspicious process through a dynamic delay mechanism, artificially introduces an operation delay, delays its encryption behavior, and buys more time for the system to perform behavior analysis and response, enhancing the timeliness of defense. If the suspicious process accesses a bait file during the delay period, the system will immediately terminate the process and add it to the blacklist.

[0053] The purpose of adding the delay is to increase the probability of the suspicious process accessing the bait file. It is impossible to ensure 100% that the suspicious process will definitely access the bait file at any time. This method is safer and more reliable than the situation without delay. And for general ransomware, it will scan and encrypt user files by means of sequential traversal. As long as a certain delay is added, in most cases, the ransomware will scan the bait file, it's just a matter of time.

[0054] If an operation is performed on a non-bait file during the delay period, due to the limitation of the delay mechanism, the suspicious process cannot access and encrypt the non-bait file.

[0055] (3) White and Black List Management

[0056] In this solution, the white list is manually added by the administrator, and the applications in it have all been strictly audited, representing high security and trust. The main purpose of setting the white list is to minimize the interference to legitimate business processes and ensure that normal business is not affected. While the applications in the black list are dynamically added after being identified as malware during the detection process. Initially, the black list is empty, and its function is to directly intercept when the same malicious process appears again, thereby reducing the detection overhead and improving the system efficiency.

[0057] Through the above technical solution, the present invention realizes accurate and timely detection and response to malicious behaviors such as ransomware through a hierarchical protection mechanism, while significantly reducing the false positive rate. While ensuring the security of user files, the system minimizes the impact on normal processes, improves the security and availability of the system, and provides a reliable guarantee for data security.

[0058] Embodiment 1

[0059] As Figure 2 shown, assume that a ransomware process attempts to traverse the user file system and encrypt files. The ransomware calls system functions (such as readdir) to obtain a file list. This system intercepts this request through code instrumentation technology and calls a custom process verification function. The process verification function checks and finds that the process is neither in the whitelist nor in the blacklist, determines it as a suspicious process, and then fabricates and returns a file list containing bait files.

[0060] Next, the ransomware starts to traverse the returned file list. If the ransomware accesses a bait file, the system immediately terminates the process and adds it to the blacklist. If the ransomware accesses a high-value user file, the system intercepts its file operation through code instrumentation technology and calls a silent legitimate process to preempt the file handle of the file, preventing the ransomware from operating on the high-value file. If the ransomware accesses medium- and low-value user files, intercept its file operation through code instrumentation technology and introduce an operation delay (such as a 5-second delay) to delay its encryption behavior. During the delay period, the system continues to monitor the behavior of the ransomware. If the ransomware accesses a bait file during the delay period, the system immediately terminates the process and adds it to the blacklist.

[0061] Embodiment 2

[0062] As Figure 3 shown, assume that a legitimate text editor process (such as Microsoft Word) attempts to open a user document. This process has been manually added to the whitelist by the user and is therefore determined to be a legitimate process by this system. The text editor calls system functions (such as readdir) to obtain a file list. This system intercepts this request through code instrumentation technology and calls a custom process verification function. The process verification function checks and finds that the process exists in the whitelist, indicating that the process is highly secure and trustworthy, and directly calls the original system function to return the real file list. At this time, the text editor accesses the user files normally according to the returned file list, and this system does not interfere with or delay the file access operations of legitimate processes.

Claims

1. A multi-layer ransomware protection method based on dynamic trust, characterized in that, It includes the following steps: Step 1: Set the initial whitelist and blacklist; The whitelist is manually added by a trusted administrator initially, and the blacklist is initially empty and dynamically added during subsequent detection processes; Step 2: When a certain process calls a system function to obtain a file list, the system intercepts this operation through code instrumentation technology and determines the type of this process through a process verification function; The process verification function injects a hook function in the system call path through code instrumentation technology to intercept key operations. Its determination logic is as follows: Obtain the unique identifier of the process through a process fingerprint generation algorithm, and combine it with the software digital signature to compare with the whitelist and blacklist for verification; The process is classified into the following three types through determination: legitimate process, malicious process, and suspicious process; Step 3: If the process is a suspicious process, the system monitors and responds to it in real time through a suspicious process monitoring module; The suspicious process traverses the file list containing the decoy file. The suspicious process monitoring module monitors in real time whether the file accessed by the suspicious process is a decoy file. If so, the system will immediately terminate the process and mark it as a malicious process and add it to the blacklist; otherwise, when the suspicious process accesses user files, the system will intercept the system calls related to file access through code instrumentation technology and adopt different protection strategies according to the value level of the file.

2. The multi-layer ransomware protection method based on dynamic trust according to claim 1, characterized in that, The process is determined and classified into the following three categories through the process verification function: (1) Legitimate process: If the process exists in the whitelist, it is determined as a legitimate process; the system will allow the process to pass and call the original system function to return a real file list to it; (2) Malicious process: If the process exists in the blacklist, it is determined as a malicious process, and the system will immediately terminate the process; (3) Suspicious process: If the process is neither in the whitelist nor in the blacklist, it is determined as an unknown suspicious process; the system will fabricate and return a file list containing a decoy file to this process to guide it to access the decoy file.

3. A method for multi-layer ransomware protection based on dynamic trust according to claim 2, characterized in that, The decoy file is a false file generated according to the current directory context information with high simulation and temptation.

4. A multi-layer ransomware protection method based on dynamic trust according to claim 2 or 3, characterized in that, The decoy file uses code instrumentation technology to insert the decoy file into the file list when the system returns the file list to the suspicious process, so that the suspicious process receives the file list containing the decoy file.

5. A method for multi-layer ransomware protection based on dynamic trust according to claim 1, characterized in that, The value level of the file is custom-specified by the user and includes high-value files and medium-low-value files.

6. A multi-layer ransomware protection method based on dynamic trust according to claim 1 or 5, characterized in that, Different protection strategies are adopted according to the value level of the file. Specifically: For high-value files, the system will call a legitimate silent process to preempt the file handle and directly prevent the suspicious process from encrypting or modifying operations to ensure the absolute security of high-value files; For medium-low-value files, the system restricts the access speed of the suspicious process through a dynamic delay mechanism, artificially introduces an operation delay, delays its encryption behavior, and buys more time for the system to perform behavior analysis and response; if the suspicious process accesses the decoy file during the delay period, the system immediately terminates the process and adds it to the blacklist.

7. A multi-layer ransomware protection system based on dynamic trust, characterized in that, It includes a process verification module and a suspicious process monitoring module, and implements the technical solutions described in claims 1 to 6 above.

Images