Method and system for trapping ransomware virus

Abstract

The present invention provides a method and system for trapping a ransomware virus. The method comprises: releasing a bait file to a specified system location; using a MINIFILTER filter driver framework to monitor access actions to the bait file; and when access actions to the bait file are monitored, an alarm is triggered and intercepted. The method and system for trapping a ransomware virus provided by the present invention can trap a ransomware virus.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a method and system for trapping ransomware viruses. Background Art Summary of the invention

[0002] The technical problem to be solved by the present invention is to provide a method and system for trapping ransomware viruses, which can trap ransomware viruses.

[0003] In order to solve the above technical problems, the present invention provides a method for trapping ransomware viruses, the method comprising: releasing a bait file to a specified system location; using a MINIFILTER filter driver framework to monitor access actions to the bait file; and when access actions to the bait file are monitored, an alarm is triggered.

[0004] In some implementations, the MINIFILTER filter driver framework can be used to monitor access actions to bait files, including: calculating whether the file CRC match is the set bait file; if the process that matches and accesses the bait file is not the system and the software itself, then the access action is determined to be an access action to the bait file.

[0005] In some implementations, it also includes: registering a process creation callback function in the kernel; when a process is created, the process filter calculates the hash value of the currently created process; using the hash value of the currently created process to match the hash value in the blacklist program; once the match is successful, triggering an interception action.

[0006] In some implementations, the blacklist is a calculated program file hash value.

[0007] In some implementations, the hash values ​​are stored in a MAP container.

[0008] In some implementations, it also includes: delayed startup of a third-party program when the computer is turned on.

[0009] In some embodiments, the delayed start of a third-party program at boot time includes: calculating the boot time in a process filtering callback function, and considering a time range as a gap period when the computer boots into the system. During this period, many boot-up programs will be started. The callback function will intercept all processes and calculate whether the program file HASH value matches the system and its own process. If so, it will be allowed to run normally. If it is a third-party process, it will enter the delay logic.

[0010] In addition, the present invention also provides a system for trapping a ransomware virus, the system comprising: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the method for trapping a ransomware virus as described above.

[0011] After adopting such a design, the present invention has at least the following advantages:

[0012] No process behavior monitoring is performed, only access monitoring of fixed bait files is performed to ensure system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0014] Figure 1 It is a method flow chart. DETAILED DESCRIPTION

[0015] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0016] The present invention realizes the trapping of ransomware viruses under Windows system. When the virus is scanning and encrypting user files, the virus scanning and encryption behavior is preferentially discovered, and the virus operation is intercepted, thereby preventing the virus from encrypting actual user files and preventing the disk boot area from being infected.

[0017] All monitoring and processing logic is implemented through the kernel and provided in a driver manner.

[0018] 1. Anti-ransomware software releases bait files to the specified system location. The bait files here are equivalent to bait, forming a trap file for ransomware. Bait files use random names and meaningless data in the random file content. Such files are completely meaningless to users, so users will not access and open these bait files under normal circumstances. The random name is not a completely random name. The name is defined by the file name and file type set after analyzing the file scanning method of a large number of ransomware samples, ensuring that the ransomware will scan the bait file first when scanning the file, thereby triggering the interception action in the first time to ensure that the user's actual files are not affected.

[0019] 2. The driver uses the MINIFILTER file filter framework to monitor the access actions of these decoy files. The implementation of the MINIFILTER filter driver framework is a system standard filter framework suggested by Microsoft. I will not introduce it in detail here. The MINIFILTER filter driver framework can monitor all file access actions of the system. Section 1 has already explained that the software will release a batch of decoy files to the user's system. Since the decoy files are random files that have nothing to do with the user, the user generally will not open and modify these files. When a process tries to access or even modify the decoy files, it can be confirmed that it is not the user's autonomous behavior operation, and it is considered an illegal access operation.

[0020] We have set up filtering judgments for file creation, reading, writing, deletion, and renaming operations in the MINIFILTER file filtering driver. When the bait file is accessed by the above operations, it will be intercepted by the file filtering driver. The driver calculates the file CRC match to see if it is the set bait file. If the process that matches and accesses the bait file is not the system or the software itself, an alarm will be triggered.

[0021] 3. The recorded ransomware processes will form a blacklist program list. The blacklist is the calculated program file HASH value and saved in a MAP container. The driver uses process filtering to match the started process in the blacklist, which will be directly intercepted and prevented from starting and running. The program can be matched through the feature library, which can achieve faster and safer interception of locally known ransomware.

[0022] We use PsSetCreateProcessNotifyRoutineEx in the kernel to register a process creation callback function. Whenever a process is created, the filtering and interception logic of the callback function will be triggered. The process filter will calculate the HASH value of the program file of the current created process and match the HASH in the blacklist program. If it matches, the interception action will be triggered.

[0023] 4. We have added a delayed start of third-party programs at boot time in process filtering. The driver intercepts the process when the computer boots into the system, so that non-system third-party programs will wait for the system and driver policies to take effect before running normally. In this way, when a ransomware virus is started at boot time, it will be delayed, the driver policy will take effect, and the virus will be intercepted when it resumes running.

[0024] The process filtering callback function calculates the boot time. Within a time range, it is considered to be the idle period when the system is booted. During this period, many boot-up programs will be started. The callback function will intercept all processes and calculate whether the program file HASH value matches the system and its own process. If it is, it will be allowed to run normally. If it is a third-party process, it will enter the delay logic. The callback function uses the KeWaitForSingleObject function to wait for a kernel event object, suspend all processes that need to be delayed, and let them wait for a fixed time. This time is a system boot time constant. If the software itself is started during this period and the policies are all effective, the kernel event will be triggered, and the waiting function will return immediately, and the delayed process will resume normal operation. After the normal running process passes through the delay logic, it will also pass through the relevant policy logic of the filter. The policy logic will verify the legitimacy of the process.

[0025] 5. A disk filter has been added to the kernel. By attaching it to the \\Driver\\disk device object, it filters all disk access actions. The filtering logic monitors the range of the first few sectors of the disk. The space of the first few sectors of the disk is the boot area and partition table storage location of the disk. Conventional software processes will not touch this location of the disk at all, so when a process tries to modify the monitored sector, it can be determined that it is an illegal access. The filter will go directly to the interception logic and set the modification length to 0, thereby ensuring that the process does not modify the disk data content.

[0026] The technical solution of the present invention has the following characteristics:

[0027] 1. No process behavior monitoring is performed, only access monitoring of fixed bait files is performed to ensure system performance

[0028] 2. By analyzing a large number of ransomware samples, we summarized the rules of ransomware file traversal, set bait files at fixed locations on the ransomware scanning disk, and ensure that the ransomware accesses the bait files first, so as to intercept and process the ransomware before accessing the actual user files.

[0029] 3. The bait files set up have random names and random content, and will not be analyzed by the ransomware to reveal obvious features, ensuring that the ransomware cannot bypass the trap.

[0030] 4. It has the function of delaying the startup of third-party programs, ensuring that other startup programs are released after the anti-ransomware software has run and protected the system. For startup ransomware, the virus is intercepted as soon as it is started, and user files will not be encrypted due to the running time difference of the startup program.

[0031] 5. With disk boot area protection function, the software adds protection function for the disk boot area, which can prevent disk encryption ransomware or boot ransomware from modifying the boot area. When disk encryption ransomware encrypts the disk and modifies the boot area (encrypts before booting the system), it can effectively intercept it.

[0032] 6. It has a blacklist of ransomware programs. When a blocked ransomware program is started again, it will be directly blocked and will not be given the opportunity to access files.

[0033] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Those skilled in the art may make some simple modifications, equivalent changes or modifications using the technical contents disclosed above, which all fall within the protection scope of the present invention.

Claims

1. A method for trapping a ransomware virus, characterized in that: include: Anti-ransomware software releases bait files to the specified system location; The MINIFILTER filter driver framework can be used to monitor access actions to bait files, including: Calculate the file CRC to see if it is the set bait file; If the process that matches and accesses the bait file is not the system or the software itself, the access action is considered to be an access action to the bait file; When monitoring the access to the bait file, an alarm is issued to intercept it; Delayed start of third-party programs at boot time, including: The boot time is calculated in the process filtering callback function. A time range is considered to be the idle period when the computer is booted into the system. During this period, the boot program will be started. The callback function will intercept all processes and calculate whether the program file HASH value matches the system and its own process. If it is, it will be allowed to run normally. If it is a third-party process, it will enter the delay logic. The callback function uses the KeWaitForSingleObject function to wait for a kernel event object, suspend all processes that need to be delayed, and let them wait for a fixed time. This time is a system boot time constant. If the software itself is started during this period and the policies are effective, the kernel event will be triggered, and the waiting function will return immediately. The delayed process resumes normal operation. After the normal operating process passes through the delay logic, it will also pass through the relevant policy logic of the filter. The policy logic will verify the legitimacy of the process. Among them, the software itself includes anti-ransomware software.

2. The method for trapping a ransomware virus according to claim 1, characterized in that: Also includes: Register the process creation callback function in the kernel; When a process is created, the process filter calculates the hash value of the currently created process; Use the hash value of the currently created process to match the hash value in the blacklisted program; Once the match is successful, the interception action is triggered.

3. The method for trapping a ransomware virus according to claim 2, characterized in that: The blacklist is calculated by hashing the program files.

4. The method for trapping a ransomware virus according to claim 2, characterized in that: The hash values ​​are stored in a MAP container.

5. A system for trapping ransomware, characterized in that: include: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method for trapping a ransomware virus according to any one of claims 1 to 4.

Images