Method and device for blocking encryption behavior, storage medium and electronic equipment

Abstract

The embodiment of the invention discloses a method and device for blocking an encryption behavior, a storage medium and electronic equipment. Inserting virtual access information corresponding to a bait file at a starting position of a file list of each directory of directory data information returned by the system aiming at the file traversal behavior; and if a first encryption behavior executed by the target process for the bait file based on the virtual access information is monitored, blocking the first encryption behavior, determining that the target process is a target virus process, and terminating the target process.

Description

Technical Field

[0001] This invention relates to computer technology, and more particularly to a method, apparatus, storage medium, and electronic device for blocking encryption activities. Background Technology

[0002] With the acceleration of digitalization, viruses have evolved into one of the most serious cybersecurity threats worldwide. Their targets have expanded from individual users to enterprises, government agencies, medical institutions, and even industrial control systems, causing not only economic losses but also incalculable social impacts such as disruption of critical services and leakage of sensitive data.

[0003] Existing mainstream defense methods, such as traditional signature-based antivirus software, are increasingly ineffective against viruses. This is mainly because the extremely rapid mutation rate and the sheer number of variants of viruses make it difficult to update signature databases in real time, resulting in protection gaps. Furthermore, while decoy solutions currently on the market can offer some protection against variant viruses, they cannot detect attacks immediately, thus still leading to file loss for users. Moreover, virus variants employ numerous methods to bypass attack detection. Summary of the Invention

[0004] The purpose of the embodiments in this specification is to provide a method, apparatus, storage medium, and electronic device for blocking encryption behavior.

[0005] This specification provides a method for blocking encryption behavior. By using virtual decoys across the entire disk, it can accurately detect and eliminate target viruses in real time. The decoys occupy little disk space, requiring only one real file, resulting in high detection efficiency. The decoy file is the first to be encrypted and immediately blocked, leading to good detection performance. Virtual decoy files are present in all directories across the entire disk, eliminating any special or frequently used directories, virtually eliminating the chance of viruses bypassing the encryption. It can effectively detect various variants of currently collected popular virus families, ensuring zero loss of files for normal users. The method includes: If file traversal behavior executed by the target process is detected, virtual access information corresponding to the decoy file is inserted at the beginning of the file list of each directory in the directory data information returned by the system for the file traversal behavior. If the first encryption action performed by the target process on the decoy file based on the virtual access information is detected, the first encryption action is blocked, the target process is determined to be a target virus process, and the target process is terminated.

[0006] Furthermore, the method also includes: Initialize a decoy file corresponding to at least one real file format, wherein the decoy file includes real file data that matches the real file format.

[0007] Furthermore, the method also includes: Initialize a decoy file corresponding to at least one real file format based on the first encrypted record corresponding to the normal user file.

[0008] Furthermore, the method also includes: Initialize a decoy file corresponding to at least one real file format based on the second encrypted record corresponding to the historical decoy file.

[0009] Furthermore, the method also includes: For each directory, if it is detected that the target process has accessed the decoy file based on the virtual access information but has not encrypted the decoy file, back up one or more normal user files in that directory; If the second encryption behavior performed by the target process on multiple normal user files in the directory data information meets the first preset condition, the target process is determined to be a target virus process, and the target process is terminated; if the target normal user file in the multiple normal user files is encrypted by the target process, it is restored according to the backup file corresponding to the target normal user file; at least one backup file corresponding to the directory data information is deleted.

[0010] Furthermore, the first preset condition includes that the number of files corresponding to the plurality of normal user files is greater than or equal to a first preset quantity threshold.

[0011] Furthermore, the first preset condition also includes that the multiple normal user files correspond to the same file format.

[0012] Furthermore, the first preset condition also includes that the multiple normal user files belong to multiple directories, and the number of directories corresponding to the multiple directories is greater than or equal to the second preset number threshold.

[0013] Furthermore, the first preset condition also includes the multiple normal user files satisfying preset continuous encryption conditions.

[0014] Furthermore, the continuous encryption conditions include that the encryption interval corresponding to the plurality of normal user files is less than or equal to a first preset duration threshold and / or the total encryption duration corresponding to the plurality of normal user files is less than or equal to a second preset duration threshold.

[0015] Furthermore, the method also includes: If the target process is determined to be a normal process, delete at least one backup file corresponding to the directory data information.

[0016] Further, deleting at least one backup file corresponding to the directory data information includes: If, within a preset time range, the normal user file corresponding to the at least one backup file corresponding to the directory data information is not encrypted again, the at least one backup file is deleted.

[0017] Further, the step of deleting the at least one backup file corresponding to the directory data information if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range includes: For at least one backup file corresponding to the directory data information, if the remaining storage space meets the third preset condition, delete the at least one backup file. Otherwise, if the normal user file corresponding to at least one backup file is not re-encrypted within a subsequent preset time range, the at least one backup file is deleted.

[0018] Further, the step of deleting the at least one backup file corresponding to the directory data information if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range includes: For at least one backup file corresponding to the directory data information, if the file size of the at least one backup file meets the fourth preset condition, the at least one backup file is deleted. Otherwise, if the normal user file corresponding to at least one backup file is not re-encrypted within a subsequent preset time range, the at least one backup file is deleted.

[0019] This specification also provides an embodiment of an apparatus for blocking encryption behavior, comprising: The first monitoring module is used to insert virtual access information corresponding to the decoy file at the beginning of the file list of each directory in the directory data information returned by the system for the file traversal behavior if the target process is detected to be performing file traversal behavior. The second monitoring module is used to block the first encryption behavior performed by the target process on the decoy file based on the virtual access information if it is detected that the target process is a target virus process and terminates the target process.

[0020] This specification also provides a storage medium storing a computer program adapted to be loaded by a processor and to execute the steps of the method described above.

[0021] This specification also provides an electronic device, including a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method described above.

[0022] This specification also provides a computer program product that stores at least one instruction, characterized in that the at least one instruction, when executed by a processor, implements the steps of the above-described method.

[0023] According to the scheme in the embodiments of this specification, by using full-disk pre-positioned virtual decoys, the target virus can be accurately detected and killed in the first instance. Moreover, the decoy occupies little disk space, with only one real file, resulting in high detection efficiency. The decoy file is encrypted first and immediately blocked, resulting in good detection effect. Virtual decoy files are present in all directories of the entire disk, and there are no special or commonly used directories, so the chance of the virus bypassing is almost zero. It can effectively detect various variant samples of currently collected popular virus families, ensuring zero loss of normal user files. Attached Figure Description

[0024] Figure 1 A flowchart illustrating a method for blocking encryption behavior provided in an embodiment of this specification; Figure 2 A schematic diagram of a defense system for blocking encryption behavior provided as an embodiment of this specification; Figure 3 A schematic diagram of a device for blocking encryption behavior provided in an embodiment of this specification; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0026] Please see Figure 1 This is a flowchart illustrating a method for blocking encryption behavior provided in an embodiment of this specification. In this embodiment, the method for blocking encryption behavior is applied to the device for blocking encryption behavior (hereinafter referred to as the "encryption behavior blocking device") or an electronic device equipped with such a device. The following will focus on... Figure 1The process shown will be described in detail. The method for blocking encryption behavior may specifically include the following steps: S102, if file traversal behavior executed by the target process is monitored, insert virtual access information corresponding to the decoy file at the beginning of the file list of each directory in the directory data information returned by the system for the file traversal behavior.

[0027] In some embodiments, the file traversal behavior of each process is monitored. If file traversal behavior executed by the target process is detected, virtual access information corresponding to the decoy file is inserted at the beginning of the file list of each directory in the directory data information returned by the system for that file traversal behavior. In some embodiments, file traversal behavior refers to the behavior of accessing all subdirectories and files layer by layer from the root directory of the disk partition. The target virus will generally traverse all files on the disk and find the file types of interest for encryption. In some embodiments, the target virus (e.g., ransomware) is a special type of malicious program that uses encryption algorithms to encrypt the victim's files, making them inaccessible, and then demands a ransom. In some embodiments, the system is the operating system of the encryption behavior blocking device or the operating system of an electronic device equipped with the encryption behavior blocking device. It can monitor the file traversal behavior of each process at the kernel layer of the system based on Hook technology. The kernel layer is the core part of the operating system, responsible for managing the system's resources and hardware devices. Security monitoring and interception at this level have high privileges and deep visibility, and can more effectively combat advanced threats. Hook technology is a programming technique used to intercept or monitor the process of function calls, messages or events of the operating system or application. In the security field, it is often used to intercept system API (Application Programming Interface) calls to analyze behavior.

[0028] In some embodiments, a decoy file is a file with a special name or path that mimics a real user's sensitive file. The decoy file is used to lure the target virus to access it, thereby triggering the detection of the defense system. The decoy file includes, but is not limited to, at least one document, image, code, video, or other file that the target virus is interested in. This example embodiment does not make any special limitations on this.

[0029] In some embodiments, the file order in each directory of the directory data information is dynamically adjusted, and the decoy file is inserted at the beginning of the file list in each directory, that is, the decoy file is the first file in each directory, ensuring that the first file that the target virus attempts to encrypt is the decoy file, which can trigger the decoy file encryption behavior detection logic as soon as possible.

[0030] In some embodiments, virtual access information refers to virtual information (e.g., file path, file access identifier information, etc.) used to access the decoy file. Each process can access the decoy file based on this virtual access information. In some embodiments, the decoy file in this application uses a virtual scheme; not every directory contains a real file, but rather the virtual access information corresponding to the decoy file is inserted at the beginning of the file list of each target. There is only one real decoy file, occupying very little disk space. In some embodiments, virtual decoy files are used in all directories across the entire disk. There are no special or frequently used directories, making it impossible for viruses to bypass directories. This ensures that every directory accessed by the target virus contains a decoy file, making it impossible for viruses attempting to bypass specific directories to escape detection.

[0031] S104, if the first encryption behavior of the target process based on the virtual access information is detected, the first encryption behavior is blocked, the target process is determined to be a target virus process, and the target process is terminated.

[0032] In some embodiments, a file filtering driver (Minifilter) can monitor the first encryption behavior (file encryption behavior) of each process targeting the decoy file. If the first encryption behavior of the target process based on the virtual access information targeting the decoy file is detected, the first encryption behavior is blocked immediately. If the target process is identified as a target virus, the target process is immediately terminated. The file filtering driver is a driver program that runs in kernel mode and can intercept and process all operation requests to the file system (such as open, read, and write), providing support for real-time file monitoring. In the academic embodiment, by monitoring the first encryption behavior of the target process based on the virtual access information targeting the decoy file, as the first line of defense, the first line of defense can accurately detect and kill the target virus in the first instance by placing virtual decoys across the entire disk. This ensures zero loss of user files. The decoy file occupies little space, with only one real file, resulting in high detection efficiency and no loss of user files. The decoy file is encrypted first and immediately blocked, resulting in good detection effect. Virtual decoy files are present in all directories across the entire disk, making the chance of virus bypass almost zero. This can effectively detect various variant samples of currently collected popular virus families.

[0033] According to the scheme in the embodiments of this specification, by using full-disk pre-positioned virtual decoys, the target virus can be accurately detected and killed in the first instance. Moreover, the decoy occupies little disk space, with only one real file, resulting in high detection efficiency. The decoy file is encrypted first and immediately blocked, resulting in good detection effect. Virtual decoy files are present in all directories of the entire disk, and there are no special or commonly used directories, so the chance of the virus bypassing is almost zero. It can effectively detect various variant samples of currently collected popular virus families, ensuring zero loss of normal user files.

[0034] In some embodiments, the method further includes: initializing at least one decoy file corresponding to a real file format, wherein the decoy file includes real file data that matches the real file format. In some embodiments, it is necessary to first initialize at least one decoy file corresponding to a real file format, with one decoy file corresponding to each real file format, i.e., initializing at least one decoy file. In some embodiments, the decoy file corresponding to each real file format uses real file data that matches that real file format, rather than using random data, which can resist the anti-virus schemes of new viruses against file format correctness, file size, file data entropy, etc., and ensure that the virus can access the decoy file.

[0035] In some embodiments, the method further includes: initializing a decoy file corresponding to at least one real file format based on a first encrypted record corresponding to a normal user file. In some embodiments, at least one real file format is obtained from the first encrypted record corresponding to a normal user file in the operating system of the encryption behavior blocking device or an electronic device configured with the encryption behavior blocking device, i.e., the normal user file corresponding to the at least one real file format is encrypted in the first encrypted record, and the decoy file corresponding to the at least one real file format is initialized. In some embodiments, multiple real file formats corresponding to normal user files encrypted in the first encrypted record are first obtained, and then at least one real file format that meets a preset condition is determined from the multiple real file formats. The preset condition may refer to at least one normal user file corresponding to each of the at least one real file formats being encrypted within a recent preset time range (e.g., one month), or it may refer to the number of times the at least one normal user file corresponding to each of the at least one real file formats has been encrypted or the number of times it has been encrypted within the recent preset time range being greater than or equal to a preset number threshold. This example embodiment does not specifically limit the preset condition. In some embodiments, when initializing the decoy file corresponding to the at least one real file format, it is necessary to delete the previously initialized historical decoy files, that is, to update the decoy files regularly to ensure that the target virus cannot bypass the detection scheme through file characteristics.

[0036] In some embodiments, the method further includes: initializing a decoy file corresponding to at least one real file format based on a second encrypted record corresponding to a historical decoy file. In some embodiments, based on the second encrypted record corresponding to a previously initialized historical decoy file, one or more real file formats in the second encrypted record are obtained, i.e., one or more real file formats corresponding to the historical decoy file; based on the one or more real file formats, at least one real file format different from (i.e., distinct from) the one or more real file formats is determined; and a decoy file corresponding to the at least one real file format is initialized, wherein the one or more real file formats and the at least one real file format do not overlap. In some embodiments, all real file formats in the second encrypted record are first obtained, i.e., all real file formats corresponding to the historical decoy file; and then one or more real file formats that satisfy a preset condition are determined from all real file formats. The preset condition may refer to the fact that the decoy file corresponding to each of the one or more real file formats has not been encrypted or has not been encrypted within the most recent preset time range (e.g., one month), or it may refer to the number of times the decoy file corresponding to each of the one or more real file formats has been encrypted or the number of times it has been encrypted within the most recent preset time range being less than or equal to a preset number threshold. This example embodiment does not specifically limit the preset condition. In some embodiments, at least one real file format can be determined based on the first encrypted record corresponding to a normal user file and the second encrypted record corresponding to a historical decoy file, and the decoy file corresponding to the real file format can be initialized. For example, the at least one real file format includes real file formats for which at least one corresponding normal user file has been encrypted within the most recent preset time range, and the decoy file corresponding to the real file format has not been encrypted within the most recent preset time range. This example embodiment does not specifically limit the preset conditions. In some embodiments, when initializing the decoy file corresponding to the at least one real file format, it is necessary to delete previously initialized historical decoy files, that is, to update the decoy files regularly to ensure that the target virus cannot bypass the detection scheme through file characteristics.

[0037] In some embodiments, the method further includes: for each directory, if it is detected that the target process has accessed the decoy file based on the virtual access information but has not encrypted the decoy file, backing up one or more normal user files in that directory; if it is detected that the second encryption behavior performed by the target process on multiple normal user files in the directory data information meets a first preset condition, determining that the target process is a target virus process and terminating the target process; if the target normal user file in the multiple normal user files is encrypted by the target process, restoring it according to the backup file corresponding to the target normal user file; and deleting at least one backup file corresponding to the directory data information. In some embodiments, for each directory, if it is detected that a target process has accessed the decoy file based on the virtual access information but has not encrypted the decoy file (i.e., the virus did not encrypt the decoy file when traversing the directory; different viruses may encrypt different file types, and if the decoy file happens to be outside the virus's encryption range, it may bypass the decoy defense), then backups of each normal user file in that directory will begin. During the backup process of a normal user file, the normal user file cannot be accessed by the target process; that is, the target process cannot encrypt the normal user file during the backup process. In some embodiments, the backup location corresponding to the normal user file is located in a directory other than the directory data information. In some embodiments, the backup location corresponding to the normal user file is located in a directory that has already been traversed within the directory data information. In some embodiments, for each directory, if a target process is detected to have accessed the decoy file based on the virtual access information but has not encrypted the decoy file, a file filtering driver (Minifilter) will monitor the second encryption behavior (file encryption behavior) of each process on normal user files in that directory. This monitoring process starts simultaneously with the backup process described above, and there is no sequential relationship between the two. In some embodiments, if the second encryption behavior performed by the target process on multiple normal user files in the directory data satisfies a first preset condition, the target process can be identified as a target virus process. The target process is immediately terminated, and then the target normal user files in the directory data that have been encrypted by the target process are restored based on the backup files corresponding to the target normal user files.In some embodiments, if the target process is determined to be a target virus process, all backup files corresponding to the directory data information can be deleted after all normal user files encrypted by the target process in the directory data information have been restored. Alternatively, the backup files corresponding to each normal user file encrypted by the target process can be deleted after the normal user files have been restored, and then the remaining undeleted backup files corresponding to the directory data information can be deleted after all normal user files encrypted by the target process have been restored. In some embodiments, a second line of defense is achieved by monitoring the second encryption behavior performed by the target process on multiple normal user files in the directory data information. That is, the second line of defense is a lightweight behavior analysis engine and a file backup scheme. If the target virus does not encrypt the decoy file, its encryption behavior will still hit the system's behavior analysis engine. After the hit policy is implemented, it will be blocked and killed. The subsequent file backup capability will restore the files encrypted during the hit behavior. By specifying the depth and abstraction of the target virus's encryption behavior, a lightweight behavior analysis engine (analyzing whether the first preset condition is met) is specified. It can quickly associate and analyze the hit target virus. The engine has high performance and fast detection time. The file backup capability is also a lightweight backup engine. It does not back up all user files. Instead, it starts backing up normal user files in the current directory when it detects that the target process accesses the decoy file in the current directory but does not encrypt the decoy file. The backup is lightweight, has high performance, and can intercept virus samples that are not intercepted by the first line of defense. In some embodiments, the first and second lines of defense employ a scheme of full-disk front-end virtual decoy, behavioral analysis, and file backup. These two lines of defense comprehensively detect the attack of the target virus, ensuring zero loss of user files.

[0038] In some embodiments, the first preset condition includes the number of files corresponding to the plurality of normal user files being greater than or equal to a first preset quantity threshold.

[0039] In some embodiments, the first preset condition further includes the plurality of normal user files corresponding to the same file format. In some embodiments, the first preset condition includes the number of plurality of normal user files corresponding to the same file format being greater than or equal to a first preset quantity threshold.

[0040] In some embodiments, the first preset condition further includes that the plurality of normal user files belong to multiple directories, and the number of directories corresponding to the plurality of directories is greater than or equal to a second preset number threshold. In some embodiments, the first preset condition includes that the number of plurality of normal user files corresponding to the same file format is greater than or equal to a first preset number threshold, and that the plurality of normal user files are located in multiple different directories, i.e., the plurality of normal user files are not located in the same directory, and that the number of directories corresponding to the plurality of directories is greater than or equal to a second preset number threshold.

[0041] In some embodiments, the first preset condition further includes the plurality of normal user files satisfying a preset continuous encryption condition. In some embodiments, the first preset condition further includes the plurality of normal user files satisfying the preset continuous encryption condition, i.e., the plurality of normal user files need to be continuously encrypted by the target process. In some embodiments, the first preset condition includes the number of files corresponding to the plurality of normal user files satisfying the preset continuous encryption condition being greater than or equal to a first preset number threshold. In some embodiments, the first preset condition includes the number of files of the plurality of normal user files satisfying the preset continuous encryption condition and corresponding to the same file format being greater than or equal to a first preset number threshold. In some embodiments, the first preset condition includes the number of files of the plurality of normal user files satisfying the preset continuous encryption condition and corresponding to the same file format being greater than or equal to a first preset number threshold, and the plurality of normal user files are located in multiple different directories, and the number of directories corresponding to the multiple directories is greater than or equal to a second preset number threshold.

[0042] In some embodiments, the continuous encryption condition includes that the encryption interval corresponding to the plurality of normal user files is less than or equal to a first preset duration threshold and / or the total encryption duration corresponding to the plurality of normal user files is less than or equal to a second preset duration threshold. In some embodiments, the continuous encryption condition includes that the encryption interval corresponding to the plurality of normal user files is less than or equal to the first preset duration threshold, that is, the plurality of normal user files are sorted according to the time they were encrypted by the target process (from first to last, or from last to first), and the encryption interval corresponding to every two adjacent normal user files (i.e., the absolute value of the difference between the encryption times of the two adjacent normal user files) needs to be less than or equal to the first preset duration threshold. In some embodiments, the continuous encryption condition includes that the total encryption duration corresponding to the plurality of normal user files is less than or equal to the second preset duration threshold, that is, the difference between the encryption time of the first normal user file last encrypted by the target process and the encryption time of the second normal user file first encrypted by the target process.

[0043] In some embodiments, the method further includes: if the target process is determined to be a normal process, deleting at least one backup file corresponding to the directory data information. In some embodiments, after the target process completes file traversal of the directory data information, that is, after the target process completes the file traversal, if the target process is not determined to be a target virus process, then the target process can be determined to be a normal process, and at this time, all backup files corresponding to the directory data information need to be deleted.

[0044] In some embodiments, deleting at least one backup file corresponding to the directory data information includes: for at least one backup file corresponding to the directory data information, if the normal user file corresponding to the at least one backup file is not re-encrypted within a preset time range thereafter, deleting the at least one backup file. In some embodiments, after all target normal user files encrypted by the target process in the directory data information have been restored, all backup files corresponding to the directory data information are not immediately deleted; or, after each target normal user file encrypted by the target process has been restored, the backup file corresponding to that target normal user file is not immediately deleted; and after all target normal user files encrypted by the target process have been restored, the remaining undeleted backup files corresponding to the directory data information are not immediately deleted; or, after determining that the target process is a normal process, all backup files corresponding to the directory data information are not immediately deleted. In some embodiments, these backup files that need to be deleted are not deleted immediately, but only if the normal user files corresponding to the backup files are not re-encrypted within a preset time range (e.g., 1 hour) thereafter. This is to reduce the overhead of repeated file backups (time and space overhead). If the normal user files corresponding to the backup files are re-encrypted within the preset time range, the timer is reset and starts counting again from the re-encryption time. The backup files are only deleted if the normal user files corresponding to the backup files are not re-encrypted within the preset time range thereafter.

[0045] In some embodiments, deleting the at least one backup file corresponding to the directory data information if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range includes: deleting the at least one backup file if the remaining storage space meets a third preset condition; otherwise, deleting the at least one backup file if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range. In some embodiments, for these backup files that need to be deleted, if the remaining storage space of the encryption behavior blocking device or the electronic device configured with the encryption behavior blocking device meets the third preset condition, the backup file is deleted immediately; otherwise, the backup file is deleted only if the normal user file corresponding to the backup file is not re-encrypted within a subsequent preset time range (e.g., 1 hour). The third preset condition includes, but is not limited to, the remaining storage space size being less than or equal to a preset threshold, or the ratio of the remaining storage space size to the total storage space size being less than or equal to a preset threshold. This example embodiment does not specifically limit the third preset condition.

[0046] In some embodiments, deleting the at least one backup file corresponding to the directory data information if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range includes: deleting the at least one backup file if its file size meets a fourth preset condition; otherwise, deleting the at least one backup file if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range. In some embodiments, for these backup files that need to be deleted, if the file size of the backup file meets the fourth preset condition, the backup file is deleted immediately; otherwise, the backup file is deleted only if the normal user file corresponding to the backup file is not re-encrypted within a subsequent preset time range (e.g., 1 hour). The fourth preset condition includes, but is not limited to, the file size of the backup file being greater than or equal to a preset threshold, or the ratio of the file size of the backup file to the total storage space being greater than or equal to a preset threshold. This example embodiment does not specifically limit the fourth preset condition.

[0047] Figure 2 This is a schematic diagram of a defense system for blocking encryption behavior, provided as an embodiment of this specification.

[0048] like Figure 2As shown, the defense system generates decoys and updates them periodically. If the target process is detected traversing files, virtual access information corresponding to the decoy file is inserted at the beginning of the file list of each directory in the directory data information returned by the defense system for this file traversal behavior, through file virtualization and file pre-processing. A forged file list is then returned to the target process. In defense line 1, if the target process is detected encrypting the decoy file based on the virtual access information, the target process is identified as ransomware. A blocking operation is performed on the encrypted file behavior, terminating the target process. For each directory, if the target process has accessed the decoy file based on the virtual access information but has not encrypted the decoy file, normal user files in that directory are backed up through file backup. In defense line 2, if the target process is detected encrypting multiple normal user files of the same type in multiple directories in the directory data information, the target process is identified as ransomware, and the target process is terminated.

[0049] Figure 3 This is a schematic diagram of a device for blocking encryption behavior provided in an embodiment of this specification. This device (hereinafter referred to as "encryption behavior blocking device 1") can be implemented as all or part of an electronic device through software, hardware, or a combination of both. According to some embodiments, the encryption behavior blocking device 1 includes a first monitoring module 11 and a second monitoring module 12.

[0050] The first monitoring module 11 is used to insert virtual access information corresponding to the decoy file at the beginning of the file list of each directory in the directory data information returned by the system for the file traversal behavior if the file traversal behavior executed by the target process is monitored. The second monitoring module 12 is used to block the first encryption behavior if the target process performs a first encryption behavior on the decoy file based on the virtual access information, determine that the target process is a target virus process, and terminate the target process.

[0051] In some embodiments, the encryption behavior blocking device 1 is further configured to: initialize at least one decoy file corresponding to a real file format, wherein the decoy file includes real file data that matches the real file format.

[0052] In some embodiments, the encryption behavior blocking device 1 is further configured to: initialize at least one decoy file corresponding to a real file format based on a first encrypted record corresponding to a normal user file.

[0053] In some embodiments, the encryption behavior blocking device 1 is further configured to: initialize at least one decoy file corresponding to a real file format based on the second encrypted record corresponding to the historical decoy file.

[0054] In some embodiments, the encryption behavior blocking device 1 is further configured to: for each directory, if it is detected that the target process has accessed the decoy file based on the virtual access information but has not encrypted the decoy file, back up one or more normal user files in that directory; if it is detected that the second encryption behavior performed by the target process on multiple normal user files in the directory data information meets a first preset condition, determine that the target process is a target virus process, and terminate the target process; if the target normal user file in the multiple normal user files is encrypted by the target process, restore it according to the backup file corresponding to the target normal user file; and delete at least one backup file corresponding to the directory data information.

[0055] In some embodiments, the first preset condition includes the number of files corresponding to the plurality of normal user files being greater than or equal to a first preset quantity threshold.

[0056] In some embodiments, the first preset condition further includes the plurality of normal user files corresponding to the same file format.

[0057] In some embodiments, the first preset condition further includes that the plurality of normal user files belong to a plurality of directories, and the number of directories corresponding to the plurality of directories is greater than or equal to a second preset number threshold.

[0058] In some embodiments, the first preset condition further includes the plurality of normal user files satisfying preset continuous encryption conditions.

[0059] In some embodiments, the continuous encryption condition includes the encryption interval corresponding to the plurality of normal user files being less than or equal to a first preset duration threshold and / or the total encryption duration corresponding to the plurality of normal user files being less than or equal to a second preset duration threshold.

[0060] In some embodiments, the encryption behavior blocking device 1 is further configured to: if the target process is determined to be a normal process, delete at least one backup file corresponding to the directory data information.

[0061] In some embodiments, deleting at least one backup file corresponding to the directory data information includes: for at least one backup file corresponding to the directory data information, if the normal user file corresponding to the at least one backup file is not encrypted again within a preset time range thereafter, deleting the at least one backup file.

[0062] In some embodiments, the step of deleting the at least one backup file corresponding to the directory data information if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range includes: deleting the at least one backup file if the remaining storage space meets a third preset condition; otherwise, deleting the at least one backup file if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range.

[0063] In some embodiments, the step of deleting the at least one backup file corresponding to the directory data information if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range includes: deleting the at least one backup file if the file size of the at least one backup file meets a fourth preset condition; otherwise, deleting the at least one backup file if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range.

[0064] The above-described apparatus embodiments correspond to the aforementioned method embodiments. For detailed descriptions, please refer to the description in the method embodiments section; further details will not be repeated here. The apparatus embodiments are derived from the corresponding method embodiments and have the same technical effects. For detailed descriptions, please refer to the corresponding method embodiments.

[0065] This specification also provides a computer storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in this specification.

[0066] This specification also provides a computer program product that stores at least one instruction, which is loaded by the processor and executes the method described in this specification embodiment.

[0067] This specification also provides an electronic device, including a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and execute the method described in the embodiments of this specification.

[0068] The embodiments in this specification also provide Figure 4 The diagram shows the structure of the electronic device. Figure 4 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the above method.

[0069] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0070] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0071] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0072] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0073] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the function specified in one or more boxes.

[0074] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0075] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0076] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0077] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for blocking encryption behavior, comprising: If file traversal behavior executed by the target process is detected, virtual access information corresponding to the decoy file is inserted at the beginning of the file list of each directory in the directory data information returned by the system for the file traversal behavior. If the first encryption action performed by the target process on the decoy file based on the virtual access information is detected, the first encryption action is blocked, the target process is determined to be a target virus process, and the target process is terminated.

2. The method according to claim 1, further comprising: Initialize a decoy file corresponding to at least one real file format, wherein the decoy file includes real file data that matches the real file format.

3. The method according to claim 2, further comprising: Initialize a decoy file corresponding to at least one real file format based on the first encrypted record corresponding to the normal user file.

4. The method according to claim 2, further comprising: Initialize a decoy file corresponding to at least one real file format based on the second encrypted record corresponding to the historical decoy file.

5. The method according to claim 1, further comprising: For each directory, if it is detected that the target process has accessed the decoy file based on the virtual access information but has not encrypted the decoy file, back up one or more normal user files in that directory; If the second encryption behavior performed by the target process on multiple normal user files in the directory data information meets the first preset condition, the target process is determined to be a target virus process, and the target process is terminated. If the target normal user file in the plurality of normal user files is encrypted by the target process, it is restored according to the backup file corresponding to the target normal user file; Delete at least one backup file corresponding to the directory data information.

6. The method according to claim 5, wherein the first preset condition includes the number of files corresponding to the plurality of normal user files being greater than or equal to a first preset number threshold.

7. The method according to claim 6, wherein the first preset condition further includes that the plurality of normal user files correspond to the same file format.

8. The method according to claim 6 or 7, wherein the first preset condition further includes that the plurality of normal user files belong to a plurality of directories, and the number of directories corresponding to the plurality of directories is greater than or equal to a second preset number threshold.

9. The method according to claim 6, wherein the first preset condition further includes the plurality of normal user files satisfying a preset continuous encryption condition.

10. The method according to claim 9, wherein the continuous encryption condition includes the encryption interval corresponding to the plurality of normal user files being less than or equal to a first preset duration threshold and / or the total encryption duration corresponding to the plurality of normal user files being less than or equal to a second preset duration threshold.

11. The method of claim 5, further comprising: If the target process is determined to be a normal process, delete at least one backup file corresponding to the directory data information.

12. The method according to claim 5 or 11, wherein deleting at least one backup file corresponding to the directory data information comprises: If, within a preset time range, the normal user file corresponding to the at least one backup file corresponding to the directory data information is not encrypted again, the at least one backup file is deleted.

13. The method according to claim 12, wherein deleting the at least one backup file corresponding to the directory data information if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range includes: For at least one backup file corresponding to the directory data information, if the remaining storage space meets the third preset condition, delete the at least one backup file. Otherwise, if the normal user file corresponding to at least one backup file is not re-encrypted within a subsequent preset time range, the at least one backup file is deleted.

14. The method according to claim 12, wherein deleting the at least one backup file corresponding to the directory data information if the normal user file corresponding to the at least one backup file is not re-encrypted within a subsequent preset time range includes: For at least one backup file corresponding to the directory data information, if the file size of the at least one backup file meets the fourth preset condition, the at least one backup file is deleted. Otherwise, if the normal user file corresponding to at least one backup file is not re-encrypted within a subsequent preset time range, the at least one backup file is deleted.

15. An apparatus for blocking encryption behavior, comprising: The first monitoring module is used to insert virtual access information corresponding to the decoy file at the beginning of the file list of each directory in the directory data information returned by the system for the file traversal behavior if the target process is detected to be performing file traversal behavior. The second monitoring module is used to block the first encryption behavior performed by the target process on the decoy file based on the virtual access information if it is detected that the target process is a target virus process and terminates the target process.

16. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 14.

17. An electronic device, characterized in that, include: A processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method as claimed in any one of claims 1 to 14.

18. A computer program product having at least one instruction stored thereon, characterized in that, When the at least one instruction is executed by the processor, it implements the steps of the method according to any one of claims 1 to 14.

Images