Apparatus and method for ransomware decryption

Abstract

The present application relates to the technical field of data decryption, and in particular provides a blood-based automatic decryption method after a ransomware attack. The present application discloses a device for ransomware decryption. The device is used to obtain a first backup image of user data at a first time point T1 and a second backup image of the user data at a second time point T2, wherein T2 is later than T1. The device is also used to detect whether one or more files of the user data are encrypted by a ransomware between the time point T1 and the time point T2. Further, the device is used to decrypt one or more determined files encrypted by the ransomware using the first backup image and the second backup image.

Description

TECHNICAL FIELD

[0001] The present invention relates to a data decryption method, and in particular to an automatic decryption method after a ransomware attack. To this end, the present invention provides a device and a corresponding method for ransomware decryption, as well as a system comprising said device for ransomware decryption. BACKGROUND

[0002] Ransom malware, or ransomware, is a malware that prevents users from accessing their data, usually by encrypting the data, and then demands a ransom in order to regain access (decrypt the encrypted data).

[0003] In recent years, ransomware has become increasingly popular. There are many different variants of ransomware. Various cybersecurity companies (e.g. Kaspersky, aWidth, Emsisoft) continuously release decryption tools (also known as decryptors, e.g. Kaspersky’s Rexph Decryptor) to help users decrypt their data infected by the most modern and advanced variants of ransomware.

[0004] The use of all ransomware decryptors requires the user to manually operate the decryptor, including identifying the ransomware, selecting the decryptor, and installing and running the decryptor. Furthermore, for more advanced variants of ransomware, the decryptor can impose restrictions, e.g. requiring a pair of files, specifically a non-encrypted file and an encrypted version of the same file. Other restrictions can be as follows: in a given pair of files, the size of the file provided to the decryptor must be maximized, as some decryptors are able to decrypt files whose size must be less than or equal to the provided file. Additionally, it is usually up to the user to determine the optimal decryptor and the optimal pair of files, which will result in the maximum number of decrypted files, especially since not all decryptors are able to decrypt encrypted files 100%.

[0005] When a ransomware infects a system protected by a backup application, the application can continue to backup user data, including data encrypted by the ransomware, resulting in a system that cannot use the backup and data loss.

[0006] Existing solutions require the user to use existing databases to identify the ransomware, find a suitable decryption tool for it, and then manually install and run the ransomware, and manually verify the decryption correctness.

[0007] As mentioned above, since different decryption tools have different operating requirements, manually meeting these requirements can not be simple and can result in not being able to correctly decrypt as many files as possible.

[0008] Some data protection systems monitor a protected environment and raise an alert when a user suspects that the environment is under a ransomware attack. However, such systems do not provide a solution for the case that the ransomware has already been able to encrypt parts of the environment before detection. Other data protection systems can restore an old version of an encrypted file. However, for these systems, any new data created after the last ransomware pre-backup will be lost. SUMMARY

[0009] In view of the above limitations and problems, embodiments of the present invention aim at providing an improved ransomware decryption method. It is an object to provide an automatic process of ransomware decryption which neither requires a user to manually select and install a decryption tool nor requires a user to select input for the decryption tool. It is an object to base the decryption on a lineage created by a backup system.

[0010] The objects are achieved by the embodiments provided by the independent claims. Advantageous implementations of embodiments of the present invention are further defined in the dependent claims.

[0011] A first aspect of the present invention provides a device for ransomware decryption. The device is configured to obtain a first backup image of user data at a first point in time T1 and a second backup image of the user data at a second point in time T2, wherein T2 is later than T1, to detect whether one or more files of the user data have been encrypted by a ransomware between the point in time T1 and the point in time T2, and to decrypt one or more determined files encrypted by the ransomware using the first backup image and the second backup image.

[0012] Thus, it is proposed to rely on properties of a backup system to provide automatic ransomware decryption. In particular, a lineage-based decryption method is provided which relies on the historical existence of certain encrypted files. The device of the first aspect does not require a user to manually select and install a decryption tool nor does it require a user to select input for the decryption tool. Thus, an improved ransomware decryption device is provided.

[0013] In an implementation form of the first aspect, the device is configured to analyze the first backup image and the second backup image, and to determine that a file has been encrypted by the ransomware between the point in time T1 and the point in time T2 if the file is not encrypted in the first backup image but encrypted in the second backup image.

[0014] In particular, a check can be performed automatically to detect a ransomware, for example. The ransomware detection can be performed by the extension of a file or the location of some "ransom instructions" file created by the ransomware, for example, or can be based on changes that have been made since the last backup.

[0015] In an implementation form of the first aspect, the device is configured to: identify the ransomware; obtain and install a first decryption tool related to the ransomware; and decrypt the one or more determined files encrypted by the ransomware using the installed first decryption tool.

[0016] The ransomware can be identified by using existing tools or developing dedicated ransomware identification tools. Accordingly, for example, a corresponding decryption tool will be automatically selected for the ransomware, thereby providing higher decryption efficiency.

[0017] In an implementation form of the first aspect, the device is configured to: maintain a database mapping a plurality of ransomware to a plurality of decryption tools, wherein each decryption tool is related to a ransomware.

[0018] Optionally, the database containing mapping of various ransomware to related decryption tools can be consulted to select the decryption tool. The database can be maintained and / or continuously updated by the device. Alternatively, an external (existing) ransomware database, for example, a ransomware database from some cyber security companies, can also be used.

[0019] In an implementation form of the first aspect, the device is configured to: select a first file from the one or more determined files encrypted by the ransomware; obtain an unencrypted version and an encrypted version of the first file from the first backup image and the second backup image, respectively; and generate one or more encryption keys based on the unencrypted version and the encrypted version of the first file.

[0020] Optionally, if the decryption tool requires one or more files, the one or more files can be automatically selected for decryption. For example, the decryption tool can require a pair of files, i.e., a pair of files before and after encryption. In some other cases, only the encrypted file can be required.

[0021] In an implementation form of the first aspect, the device is configured to: decrypt the one or more determined files encrypted by the ransomware based on the one or more generated encryption keys.

[0022] In an implementation form of the first aspect, the device is configured to: select a file from the one or more determined files encrypted by the ransomware as the first file according to a determined selection criterion.

[0023] It will be appreciated that the determined selection criterion can refer to selecting the file for which the installed decryption tool is best suited. For example, for some decryption tools, the larger the file, the more other encrypted files can be decrypted. In this case, the largest of the determined encrypted files can be selected as the first file.

[0024] In an implementation form of the first aspect, the device is configured to verify the correctness of the decryption of the one or more determined files encrypted by the ransomware using the first backup image and the second backup image.

[0025] It will be appreciated that in some cases, a decryption tool can not be able to decrypt all encrypted files completely, or the decryption tool can not be able to decrypt encrypted files absolutely correctly. Optionally, the device can therefore perform an automatic verification process to check the correctness of the decryption process.

[0026] In an implementation form of the first aspect, the device is configured to verify the correctness of the decryption of the determined encrypted files by comparing the non-encrypted versions of the one or more files in the first backup image with the respective decrypted versions of the one or more files obtained after decrypting the one or more determined files encrypted by the ransomware.

[0027] Optionally, the original file, i.e. the non-encrypted version of the file, can be used for comparison with the decrypted version of the file, i.e. the file obtained after decryption.

[0028] In an implementation form of the first aspect, if the verification indicates that additional decryption is required, the device is configured to obtain and install a second decryption tool associated with the ransomware, and to use the installed second decryption tool to decrypt the determined files encrypted by the ransomware.

[0029] It will be appreciated that there can be one or more decryption tools associated with a particular ransomware. Optionally, another decryption tool can therefore be automatically installed and run on the device to maximize the number of successfully decrypted files.

[0030] In an implementation form of the first aspect, after decrypting the determined files encrypted by the ransomware, the device is configured to store the second backup image comprising the decrypted versions of the one or more determined files encrypted by the ransomware, or to store the second backup image comprising the encrypted versions of the one or more determined files and additionally store the decrypted versions of the one or more determined files encrypted by the ransomware.

[0031] Optionally, the encrypted version of the backup image can be stored after the affected files are decrypted and used to save data in future incremental backups. The decrypted version can be used for later data recovery.

[0032] In an implementation form of the first aspect, the device is a virtual machine (VM) of a host.

[0033] For example, a VM can be created and the backup image can be attached to the VM as a volume. The decryption tool can be installed and run on the VM for decryption.

[0034] In the first aspect and its implementation forms, the above-described functions can be implemented in hardware, software, firmware, or a combination thereof.

[0035] The second aspect of the application provides a system for ransomware decryption, comprising a device according to the first aspect and its respective implementation forms, a production device accessible to a user and comprising user data, and a backup device comprising a backup image of the user data.

[0036] Generally, the entire system consists of three devices, which can be implemented as follows: a production device (in the implementation, referred to as a production system) that performs normal operations; a backup device for backing up data in the production device (in the implementation, also referred to as a backup system); and a computing device (node) according to the first aspect and its respective implementation forms, which can be accessed by an administrator of the entire system and used to decrypt encrypted files subjected to ransomware attacks.

[0037] The system provided by the second aspect can be extended to the implementation forms corresponding to the implementation forms of the device provided by the first aspect. Therefore, the implementation forms of the system include one or more features of the corresponding implementation forms of the device.

[0038] The system of the second aspect and its implementation forms provides the same advantages and effects as the device of the first aspect and its respective implementation forms as described above.

[0039] The third aspect of the application provides a method for ransomware decryption. The method comprises: obtaining a first backup image at a first time point T1 and a second backup image at a second time point T2, wherein T2 is later than T1; detecting whether one or more files between the time point T1 and the time point T2 are encrypted by a ransomware; and decrypting the determined files encrypted by the ransomware using the first backup image and the second backup image.

[0040] The method provided by the third aspect can be extended to the implementation manners corresponding to the implementation manners of the device provided by the first aspect. Therefore, the implementation manners of the method include one or more features of the corresponding implementation manners of the device.

[0041] The method of the third aspect and the implementation manners thereof provide the same advantages and effects as the device of the first aspect and the implementation manners thereof.

[0042] The fourth aspect of the application provides a computer program product comprising program code for performing the method according to the third aspect and the implementation manners thereof when implemented on a processor.

[0043] The fifth aspect of the application provides a computer-readable storage medium comprising computer-executable computer program code instructions. When running on a computer, the computer program code instructions will perform the method according to the third aspect and the implementation manners thereof. The computer-readable storage medium comprises one or more of the following group: read-only memory (ROM), programmable ROM (PROM), erasable programmable ROM (EPROM), flash memory, electrically EPROM (EEPROM), and hard disk drive.

[0044] The sixth aspect of the application provides a device for ransomware decryption, comprising a processor and a memory. The memory stores instructions, so that the processor executes the method according to the third aspect and the implementation manners thereof.

[0045] The computer program product provided by the fourth aspect, the computer-readable storage medium provided by the fifth aspect, and the device for ransomware decryption provided by the sixth aspect can be extended to the implementation manners corresponding to the implementation manners of the device provided by the first aspect. Therefore, the implementation manners of the computer program product, the computer-readable storage medium, and the device for ransomware decryption respectively include one or more features in the corresponding implementation manners of the device of the first aspect.

[0046] The computer program product provided by the fourth aspect, the computer-readable storage medium provided by the fifth aspect, and the device for ransomware decryption provided by the sixth aspect provide the same advantages and effects as the device of the first aspect and the implementation manners thereof.

[0047] It has to be noted that all devices, elements, units and means described in the present application can be implemented in software or hardware elements or any combination thereof. All steps and functions described in the present application are intended to be implemented in the respective devices, elements, units or means, unless otherwise specified. Although the various entities described in the present application are shown as single entities, it will be appreciated that these entities can be implemented in software or hardware elements or any combination thereof. Furthermore, the steps and functions described in the present application can be implemented in software or hardware elements or any combination thereof. It will be appreciated that, in some embodiments, the steps and functions described in the present application can be implemented in software, which can be executed by one or more processors. In some embodiments, the steps and functions described in the present application can be implemented in hardware elements or any combination thereof. BRIEF DESCRIPTION OF DRAWINGS

[0048] The above described aspects and implementation forms of the present application will be explained in the following description of specific embodiments in relation to the enclosed drawings, in which:

[0049] Figure 1 A device for ransomware decryption is shown;

[0050] Figure 2 A system comprising the device is shown;

[0051] Figure 3 A decryption process is shown; and

[0052] Figure 4 A method is shown. DETAILED DESCRIPTION

[0053] The illustrative embodiments of the method, device and program product for ransomware decryption are described in relation to the enclosed drawings. Although the description provides detailed examples of possible implementations, it has to be noted that the details are intended to illustrate and in no way limit the scope of the present application.

[0054] Furthermore, one embodiment / example can refer to other embodiments / examples. For example, any description including but not limited to terminology, elements, procedures, explanations and / or technical advantages mentioned in one embodiment / example applies to other embodiments / examples.

[0055] Figure 1An apparatus 100 according to embodiments of the present application is shown. The apparatus 100 can comprise processing circuitry (not shown) configured to perform, implement or initiate various operations of the apparatus 100 as described herein. The processing circuitry can comprise hardware and software. The hardware can comprise analog circuitry or digital circuitry, or both analog and digital circuitry. The digital circuitry can comprise components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or multi-purpose processors. In one embodiment, the processing circuitry comprises one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory can carry executable program code which, when executed by the one or more processors, causes the apparatus 100 to perform, implement or initiate the operations or methods described herein.

[0056] The apparatus 100 is configured to decrypt ransomware. In particular, the apparatus 100 is configured to obtain a first backup image 101 of user data at a first point in time T1 and a second backup image 102 of the user data at a second point in time T2, wherein T2 is later than T1. The apparatus 100 is further configured to detect whether one or more files of the user data have been encrypted by a ransomware between the point in time T1 and the point in time T2. Accordingly, the apparatus 100 is configured to decrypt one or more files determined to be encrypted by the ransomware using the first backup image 101 and the second backup image 102.

[0057] Embodiments of the present application provide the proposal of automatic offline ransomware decryption based on properties of a backup system. Generally, a production system or a production device is directly accessed by a user for performing normal operations, while the backup system is configured to backup data in the production system. The decryption process defined by embodiments of the present application can be regarded as an automatic offline decryption process. In particular, “offline” means that the decryption process is not part of a backup procedure. In other words, the apparatus 100 starts the decryption process after the backup is completed and is no longer concerned with the production environment.

[0058] According to an embodiment of the present application, a backup is performed on a user system (production system) at time T1, resulting in the first backup image 101. Possibly, the user also writes additional data into some files of the system. Then a ransomware attack occurs and some files in the user system are encrypted. After the ransomware infection, a further backup is performed on the user system at time T2, resulting in the second backup image 102. It is worth noting that the second backup image 102 can include one or more files that are being encrypted by the ransomware.

[0059] Optionally, according to an embodiment of the present application, the device 100 can be configured to analyze the first backup image 101 and the second backup image 102. Then, the device 100 is further configured to determine that a file is encrypted by the ransomware between the time point T1 and the time point T2, if the file is not encrypted in the first backup image but is encrypted in the second backup image.

[0060] It is worth noting that the device 100 automatically performs the check to detect the ransomware. In some scenarios, the ransomware can be detected by the extension of the file. For example, the extension of a normal Word file is.doc or.docx. Some ransomware changes the extension of the file to something else, such as.doc.crypt or.docx.crypt, to indicate that the file is encrypted.

[0061] Possibly, the device 100 can inform the user that the user system is attacked by the ransomware. That is, the device 100 can alert the user to prevent the user from further writing new data to the system.

[0062] In particular, according to an embodiment of the present application, the device 100 can be configured to identify the ransomware. The device 100 can also be configured to obtain and install a first decryption tool related to the ransomware. And the device 100 can be configured to use the installed first decryption tool to decrypt the one or more determined files encrypted by the ransomware.

[0063] In one example, the ransomware can be identified by an existing ransomware identification tool, such as a ransomware identification tool obtained from a network security company, which is not specifically limited in the present embodiment. Alternatively, the ransomware can also be identified by a special ransomware identification tool integrated in the device 100. After identifying the ransomware, a corresponding decryption tool will be selected for the ransomware. Possibly, the relevant decryption tool can be selected by querying or consulting a database containing a mapping of various ransomwares to their related decryption tools.

[0064] Optionally, the device 100 can rely entirely on existing external ransomware databases, i.e. accessing such databases provided by cyber security companies, to obtain relevant decryption tools. The present embodiment does not limit the type of database used by the device 100 to obtain relevant decryption tools. Alternatively, the device 100 can maintain its own database. It is noted that this database can be continuously updated by the device 100.

[0065] Accordingly, the device 100 can be configured to maintain a database mapping a plurality of ransomware to a plurality of decryption tools, wherein each decryption tool is associated with a ransomware.

[0066] In particular, the device 100 can be configured to select a first file from the one or more files determined to be encrypted by the ransomware. The device 100 can also be configured to obtain an unencrypted version and an encrypted version of the first file from the first backup image 101 and the second backup image 102, respectively. Further, the device 100 can be configured to generate one or more encryption keys based on the unencrypted version and the encrypted version of the first file.

[0067] Optionally, if the decryption tool requires one or more files, the one or more files can be automatically selected for decryption. For example, the decryption tool can require a pair of files, i.e. a pair of files before and after encryption. The pair of files can be used to infer the encryption key from which the encryption key can be used to decrypt other files. In some other cases, only the encrypted file can be required. It is noted that according to embodiments of the present application, the device 100 automatically proceeds with the process of selecting files (for decryption). The user does not need to manually select files or pairs of files.

[0068] Accordingly, the device 100 can be configured to decrypt the one or more files determined to be encrypted by the ransomware based on the one or more generated encryption keys. Here, conventional decryption processes that make use of encryption keys can be used.

[0069] In particular, according to embodiments of the present application, the device 100 can be configured to select a file from the one or more files determined to be encrypted by the ransomware as the first file according to determined selection criteria.

[0070] It is understood that the determined selection criteria can refer to selecting a file that is optimal for use with the installed decryption tool. For example, for some decryption tools, the larger the file, the more other encrypted files can be decrypted. In this case, the largest file from the determined encrypted files can be selected as the first file.

[0071] Optionally, the device 100 can be configured to verify the correctness of the decryption of the one or more files determined to be encrypted by the ransomware using the first backup image and the second backup image.

[0072] Notably, one decryption tool can not be able to decrypt all encrypted files, or the decryption tool can not be able to correctly decrypt encrypted files. Optionally, the device 100 can perform an automatic verification process to check the correctness of the decryption process.

[0073] Optionally, the device 100 can be configured to verify the correctness of the decryption of the determined encrypted files by comparing the non-encrypted versions of the one or more files in the first backup image with the respective decrypted versions of the one or more files obtained after decrypting the one or more determined encrypted files.

[0074] After the decryption tool execution is completed, the decryption correctness can be verified using information obtained from previous versions of the files (e.g., if it is known that the files do not change often). After decrypting the files in the second backup image 102, if many changes are found compared to the previous version in the first backup image 101, it can be assumed with high probability that the decryption tool did not correctly decrypt the files. Optionally, the decryption correctness can also be verified by trying to use the relevant files in the context of certain applications (e.g., trying to access an Oracle DB stored in an encrypted Oracle file). In this case, another decryption tool can be needed.

[0075] In particular, if the verification results indicate that additional decryption is needed, the device 100 can also be configured to obtain and install a second decryption tool related to the ransomware. Accordingly, the device 100 can also be configured to decrypt the determined encrypted files using the installed second decryption tool.

[0076] Obviously, there can be one or more decryption tools related to one particular ransomware. Optionally, another decryption tool can be automatically installed and run on the device 100 to maximize the number of successfully decrypted files. The decryption process using the second decryption tool can be similar to the decryption process using the first decryption tool. Accordingly, the device 100 can verify the correctness of the additional decryption.

[0077] Possibly, if the verification results still indicate that further decryption is needed, the device 100 can also be configured to obtain and install a third decryption tool related to the ransomware and accordingly decrypt.

[0078] According to embodiments of the application, after decrypting the determined files encrypted by the ransomware, the device 100 can be configured to store the second backup image 102 comprising the decrypted versions of the one or more determined files encrypted by the ransomware. Alternatively, the device 100 can be configured to store the second backup image 102 comprising the encrypted versions of the one or more determined files and additionally store the decrypted versions of the one or more determined files encrypted by the ransomware.

[0079] Possibly, after the affected files are decrypted, the encrypted versions of the backup images, i.e. the second backup image 102 provided by embodiments of the application, can also be stored. One purpose of storing the encrypted versions of the backup images is to allow for small incremental backups in the future (until a restore to the decrypted versions is performed).

[0080] In particular embodiments, the device 100 can be a VM of a host.

[0081] One possible way of implementing the application is to create a VM, in particular for accessing the backup system. A backup image from the backup system can be attached as a volume to the VM. The decryption tool can be installed and run on the VM for decryption.

[0082] It is to be understood that the decryption method proposed by the application is considered to be a blood relative ransomware decryption. That is, the method relies on the predecessor files in the backup system.

[0083] In particular embodiments, the device 100 can be configured to obtain a third backup image 103 of the user data at a first time point T3, wherein T3 is later than T2. The device 100 is further configured to detect whether one or more files of the user data have been encrypted by a ransomware between the time point T2 and the time point T3. Accordingly, the device 100 is configured to decrypt one or more determined files encrypted by the ransomware using the first backup image 101 and / or the second backup image 102 and the third backup image 103.

[0084] That is, if a ransomware attack is launched between T2 and T3, then multiple previous backup images (e.g. the first backup image 101 and the second backup image 102) can be used to decrypt the affected files (files encrypted by the ransomware).

[0085] Figure 2 A system 200 provided by embodiments of the application is shown. The system 200 comprises a device 100. In particular, Figure 2 The shown device 100 can be a Figure 1The device 100 is shown. It is worth noting that, similarly, all identical elements in the figures are labeled with the same reference symbols and functions.

[0086] Generally, the system 200 consists of three devices, which can achieve the following:

[0087] - Production equipment 201 can be directly accessed by users, including user data (also referred to as the production system in the implementation);

[0088] - Backup device 202, used to back up data in the production device 201, including a backup image of the user data (also referred to as a backup system in the implementation); and

[0089] - Computing device (node): Accessible to the administrator of the entire system and used to decrypt encrypted files that have been attacked by ransomware.

[0090] It is worth noting that the computing device is Figure 1 or Figure 2 The device 100 shown. One or more production devices 201 are located in a production environment. The backup device 202 may be a backup server.

[0091] Figure 3 The decryption process according to an embodiment of the present invention is illustrated. In this embodiment, a first backup image 101 of user data existing in production device 201 at time point T1 is created and stored in backup device 202. After backing up the user data at T1, the user performs further operations, such as writing new data into the memory of production device 201. Before creating a further backup of the newly added data, ransomware attacks production device 201 and encrypts some files in production device 201. At the next time point T2, a second backup image 102 of user data existing in production device 201 is also created and stored in backup device 202. It is understood that the ransomware encrypts one or more files in the second backup image 102. Device 100 performs ransomware decryption as described in the above embodiment of the present invention. Figure 3 The device 100 shown is specifically as follows: Figure 1 The device 100 shown.

[0092] Figure 4 A method 400 for ransomware decryption provided by an embodiment of the present invention is illustrated. Specifically, the method 400 is comprised of... Figure 1The device 100 shown executes the method 400. The method includes step 401: acquiring a first backup image 101 at a first time point T1 and a second backup image 102 at a second time point T2, where T2 is later than T1. The method further includes step 402: detecting whether one or more files are encrypted by ransomware between the time point T1 and the time point T2; and step 403: decrypting the files determined to be encrypted by the ransomware using the first backup image 101 and the second backup image 102.

[0093] It is worth noting that the method 400 may also include actions as described in the above embodiments of the device 100.

[0094] The present invention also provides a computer program product, including program code, which, when implemented on a processor, executes as follows: Figure 4 The method 400 shown is included in the computer-readable medium of the computer program product. The computer-readable medium can generally include any memory, such as ROM (Read-Only Memory), PROM (Programmable Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), and hard disk drive.

[0095] The invention has been described in conjunction with various embodiments and implementations as examples. However, those skilled in the art will understand and derive other variations by practicing the claimed invention, studying the drawings, this disclosure, and the independent claims. In the claims and description, the term "comprising" does not exclude other elements or steps, and "a" does not exclude the possibility of a plurality. A single element or other unit may fulfill the function of several entities or items recited in the claims. The mere fact that certain measures are described in mutually different dependent claims does not mean that a combination of these measures cannot be used in advantageous implementations.

Claims

1. A device (100) for ransomware decryption, characterized in that, Used for: Acquire a first backup image (101) of the user data at a first time point T1 and a second backup image (102) of the user data at a second time point T2, wherein T2 is later than T1; Detect whether one or more files containing the user data have been encrypted by ransomware between time point T1 and time point T2; Select one file from one or more files determined to be encrypted by the ransomware as the first file, wherein the first file is the largest file among the one or more files determined to be encrypted by the ransomware; Obtain the unencrypted and encrypted versions of the first file from the first backup image (101) and the second backup image (102), respectively; identify the ransomware, obtain and install a first decryption tool related to the ransomware from the database, the database including the mapping relationship between ransomware and decryption tools; And use the installed first decryption tool to decrypt the first file and generate one or more encryption keys; Based on one or more generated encryption keys, the one or more files determined to be encrypted by the ransomware are decrypted.

2. The device (100) according to claim 1, characterized in that, Used for: Analyze the first backup image (101) and the second backup image (102); and If a file is not encrypted in the first backup image (101) but is encrypted in the second backup image (102), then it is determined that the file was encrypted by the ransomware between the time point T1 and the time point T2.

3. The device (100) according to claim 1 or 2, characterized in that, Used for: Based on the determined selection criteria, a file is selected from the one or more files determined to be encrypted by the ransomware as the first file.

4. The device (100) according to claim 1 or 2, characterized in that, Used for: The first backup image (101) and the second backup image (102) are used to verify the correctness of the decryption of the one or more files determined to be encrypted by the ransomware.

5. The device (100) according to claim 4, characterized in that, Used for: The correctness of the decryption of the determined encrypted files is verified by comparing the unencrypted version of one or more files in the first backup image (101) with the decrypted version of each of the one or more files obtained after decrypting the one or more files determined to be encrypted by the ransomware.

6. The device (100) according to claim 4, characterized in that, Used for: If the verification result indicates that additional decryption is required. Obtain and install a second decryption tool associated with the ransomware; and Use the installed second decryption tool to decrypt the files identified as being encrypted by the ransomware.

7. The device (100) according to claim 1 or 2, characterized in that, Used after decrypting the file determined to be encrypted by the ransomware: Store the second backup image (102), the second backup image (102) including decrypted versions of the one or more files determined to be encrypted by the ransomware; or The second backup image (102) is stored, which includes encrypted versions of the one or more files determined to be encrypted, and additionally stores decrypted versions of the one or more files determined to be encrypted by the ransomware.

8. The device (100) according to claim 1 or 2, characterized in that, The device (100) is a virtual machine (VM) of the host.

9. A system (200) for ransomware decryption, characterized in that, Includes the device (100) as described in any one of claims 1 to 8, the production device (201) that is user-accessible and includes user data, and the backup device (202) that includes a backup image of the user data.

10. A method (400) for ransomware decryption, characterized in that, The method includes: Obtain (401) the first backup image (101) at the first time point T1 and the second backup image (102) at the second time point T2, where T2 is later than T1; Detect (402) whether one or more files are encrypted by ransomware between time point T1 and time point T2; and Select a file from one or more files determined to be encrypted by the ransomware as a first file, wherein the first file is the largest file among the one or more files determined to be encrypted by the ransomware; obtain unencrypted and encrypted versions of the first file from the first backup image (101) and the second backup image (102), respectively; identify the ransomware; obtain and install a first decryption tool related to the ransomware from a database, wherein the database includes a mapping relationship between ransomware and decryption tools; and use the installed first decryption tool to decrypt the first file to generate one or more encryption keys; Based on one or more generated encryption keys, the one or more files determined to be encrypted by the ransomware are decrypted.

11. A computer program product, characterized in that, Includes program code for performing the method of claim 10 when implemented on a processor.

Images