Ransomware virus detection method, device, computer equipment and storage medium

Abstract

The present application provides a method, device, computer equipment and storage medium for detecting ransomware, which relates to the field of network security technology and is used to reduce the storage space occupied by bait files and reduce system resource consumption. The method mainly includes: obtaining directory information of a preset directory in real time; detecting in real time whether there is a suspicious process traversing the target root directory; if there is a suspicious process traversing the target root directory, creating a bait directory under the target root directory according to the directory information of the preset directory, and creating multiple virtual bait files of document types under the bait directory; redirecting the path of the virtual bait file to the bait file under the preset directory; when the suspicious process operates on the virtual bait file in the bait directory, determining whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a ransomware detection method, device, computer equipment and storage medium. Background Art

[0002] Ransomware is a malicious program that targets the document data in the user's computer. It uses various encryption technologies to encrypt the document content and delete the original file. The only way to recover the file is to obtain the decryption key by paying a ransom. It can be spread through system vulnerabilities, Trojans, emails, and other forms. It is a program virus that has caused great harm in recent years. Placing bait files in common system directories to detect the existence of ransomware as early as possible has always been a major document threat detection method against ransomware.

[0003] Traditional bait files are actually created in a specific directory of the host system. The number of bait files required to place baits in the directories is equal to the number of bait files. In order to improve the detection rate of ransomware, it is usually necessary to create as many bait files of various document types as possible, which takes up a lot of disk storage space. At the same time, the creation and deletion of bait files also consumes system resources. Summary of the invention

[0004] The embodiments of the present application provide a ransomware detection method, apparatus, computer equipment, and storage medium for accurately identifying ransomware while reducing the storage space occupied by bait files and reducing system resource consumption.

[0005] An embodiment of the present invention provides a method for detecting ransomware, the method comprising:

[0006] Acquire directory information of a preset directory, wherein the preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types;

[0007] Real-time detection of whether there is a suspicious process traversing the target root directory, where the target root directory that needs to be protected from ransomware is located;

[0008] If there is a suspicious process traversing the target root directory, a bait directory is created under the target root directory according to the directory information of the preset directory, and virtual bait files of multiple document types are created under the bait directory;

[0009] Redirecting the path of the virtual bait file to the bait file in the preset directory;

[0010] When the suspicious process operates the virtual bait file in the bait directory, it is determined whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected.

[0011] An embodiment of the present invention provides a ransomware virus detection device, the device comprising:

[0012] An acquisition module, used for acquiring directory information of a preset directory, wherein the preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types;

[0013] A detection module, used to detect in real time whether there is a suspicious process traversing a target root directory, where the target root directory is the root directory where the target directory to be protected from ransomware is located;

[0014] A creation module, used for creating a bait directory under the target root directory according to the directory information of the preset directory if there is a suspicious process traversing the target root directory, and creating virtual bait files of multiple document types under the bait directory;

[0015] A redirection module, used for redirecting the path of the virtual bait file to the bait file in the preset directory;

[0016] A determination module is used to determine whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected when the suspicious process operates on the virtual bait file in the bait directory.

[0017] A computer device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned ransomware virus detection method when executing the computer program.

[0018] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the ransomware virus detection method is implemented.

[0019] The present invention provides a method, device, computer equipment and storage medium for detecting ransomware. The present invention first obtains directory information of a preset directory, and then detects in real time whether there is a suspicious process traversing a target root directory, where the target root directory is the root directory where the target directory that needs to defend against ransomware is located; if there is a suspicious process traversing the target root directory, a bait directory is created under the target root directory according to the directory information of the preset directory, and virtual bait files of multiple document types are created under the bait directory; when the suspicious process operates the virtual bait file in the bait directory, it is determined whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected. That is, the present invention feeds back corresponding data to the suspicious process according to the access of the bait file in the preset directory, thereby realizing that according to the use of a real bait file, when any process accesses any directory, the bait file in the preset directory can be accessed, and then the present invention realizes that while accurately identifying the ransomware virus, the storage space occupied by the bait file is reduced, and the consumption of system resources is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flow chart of a ransomware detection method provided in this application;

[0021] Figure 2 A flowchart of another ransomware detection method provided for this application;

[0022] Figure 3 A schematic diagram of the structure of the ransomware detection device provided in this application;

[0023] Figure 4 A schematic diagram of a computer device provided for this application. DETAILED DESCRIPTION

[0024] In order to better understand the above-mentioned technical scheme, the technical scheme of the embodiments of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical scheme of the embodiments of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments may be combined with each other.

[0025] See also Figure 1 , an embodiment of the present invention provides a ransomware virus detection method, the method specifically includes steps S101-S105:

[0026] Step S101, obtaining directory information of a preset directory.

[0027] The preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types. Specifically, the document types of the bait files include document types that are frequently accessed by ransomware, and the document types may be text types, picture types, video types, etc., which are not specifically limited in this embodiment. The bait files in this embodiment are used to determine whether a suspicious process is a bait virus.

[0028] Step S102: Detect in real time whether there is any suspicious process traversing the target root directory.

[0029] The target root directory is the root directory where the target directory that needs to be protected from ransomware is located. The target directory can be a pre-set directory that needs to be protected. In this embodiment, any one or more directories under the root directory of each disk in the terminal device can be determined as the target directory according to the protection requirements.

[0030] It should be noted that the suspicious process in this embodiment can be any process in the terminal device, can also be a process not in the whitelist, and can also be a process set by the management user, which is not specifically limited in the embodiment of the present invention.

[0031] Step S103, if there is a suspicious process traversing the target root directory, a bait directory is created under the target root directory according to the directory information of the preset directory, and multiple virtual bait files of different document types are created under the bait directory.

[0032] For example, if the target directory to be defended is C:\work, then the target root directory corresponding to the target directory is C:\, then a decoy directory is created under the C drive, and then multiple virtual decoy files of document types are created under the decoy directory. The number of virtual decoy files in the decoy directory can be the same as the real decoy files in the preset directory, that is, the decoy files in the decoy directory are exactly the same as the decoy files in the preset directory; the virtual decoy files in the decoy directory can also be part of the real decoy files in the preset directory, which is not specifically limited in this embodiment.

[0033] Furthermore, the present embodiment can first determine the file type of each bait file in the preset directory, and then create a corresponding number of virtual files in the bait directory according to the number of file types. For example, if there are three types of bait files in the preset directory, namely type 1, type 2 and type 3, virtual bait files corresponding to type 1, type 2 and type 3 can be created in the bait directory, and each type of bait file can be one or more.

[0034] Step S104, redirecting the path of the virtual bait file to the bait file in the preset directory.

[0035] For example, if a suspicious process accesses file 1 in the bait directory, it can be redirected to file 1 in the preset directory through the path of file 1. That is, the operation of the suspicious process on file 1 in the bait directory is actually an access to file 1 in the preset directory. The redirection technology is used to ensure that the virtual bait files accessed are all bait files in the preset directory. In other words, no matter which virtual bait file in the bait directory the suspicious process accesses, the bait files actually accessed are all real bait files in the preset directory. Therefore, this embodiment can reduce the storage space occupied by the bait files, and only the bait files in the preset directory are used to detect ransomware viruses in all directories.

[0036] Step S105, when the suspicious process operates the virtual bait file in the bait directory, it is determined whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected.

[0037] The operation of the suspicious process on the bait file may be a deletion operation, an encryption operation, a modification operation, etc., which is not specifically limited in this embodiment. For example, if the suspicious process performs an encryption operation or a deletion operation on the bait file 1 in the bait directory, the object of its actual operation is the real bait file corresponding to the bait file 1 in the preset directory. When it is found that the real bait file corresponding to the bait file 1 in the preset directory is encrypted or deleted, the suspicious process operating on it can be determined as a ransomware virus, and then the determined ransomware virus is deleted.

[0038] The present invention provides a method for detecting ransomware, which first obtains directory information of a preset directory, and then detects in real time whether there is a suspicious process traversing a target root directory, where the target root directory is located and the target directory that needs to defend against ransomware; if there is a suspicious process traversing the target root directory, a bait directory is created under the target root directory according to the directory information of the preset directory, and virtual bait files of multiple document types are created under the bait directory; when the suspicious process operates the virtual bait file in the bait directory, it is determined whether the suspicious process is a ransomware according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected. That is, the present invention feeds back corresponding data to the suspicious process according to the access of the bait file in the preset directory, thereby realizing that according to the use of a real bait file, when any process accesses any directory, the bait file in the preset directory can be accessed, and then the present invention realizes that while accurately identifying the ransomware, the storage space occupied by the bait file is reduced, and the consumption of system resources is reduced.

[0039] See also Figure 2, an embodiment of the present invention provides a ransomware virus detection method, the method specifically includes steps S201-step S209:

[0040] Step S201, obtaining directory information of a preset directory.

[0041] The preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types.

[0042] Step S202, loading a file filter driver, intercepting all processes from traversing a target directory, opening a target file, and / or querying file information of the target file.

[0043] Among them, the target directory is a directory that needs to be defended against ransomware. The file information of the target file may specifically include the file type, file size, file creation time, file modification time, etc. of the target file, which is not specifically limited in this embodiment. Furthermore, the target file can be a file in the target directory, that is, it can be a file in the directory that needs to be defended; it can also be a file in any directory, that is, the target file can also be a file in the directory that does not need to be defended. For example, the directory c:\work includes file 1, file 2, and file 3. If the directory c:\work is set as the target directory that needs to be defended, the target files are file 1, file 2, and file 3; if only a certain file is defended, such as defending file 1, then the target file is file 1.

[0044] It should be noted that the file filtering driver in this embodiment is used to enable ransomware interception, that is, the driver intercepts all processes from traversing the target directory, opening the target file, and / or querying the file information of the target file, thereby realizing the protection of the target directory and the target file. In this embodiment, there can be multiple target directories, which can be directories in any disk in the terminal device; there can also be multiple target files, and their storage location can also be in any disk in the terminal device. In this embodiment, as long as the suspicious process has operations such as traversing the target directory, opening the target file, and / or querying the target file information, a bait directory can be created under the traversed target directory, and the bait directory includes multiple virtual bait files. When the suspicious process accesses the bait file in the bait directory, the path of the virtual bait file is redirected to the formal bait file (i.e., the bait file under the preset directory) to ensure that the suspicious process actually accesses the real bait file.

[0045] Step S203: Detect in real time whether there is any suspicious process traversing the target root directory.

[0046] The target root directory is the root directory where the target directory that needs to be protected from ransomware is located.

[0047] Step S204: if there is a suspicious process traversing the target root directory, a bait directory is created under the target root directory according to the directory information of the preset directory, and virtual bait files of multiple document types are created under the bait directory.

[0048] It should be noted that step S203 and step S204 in this embodiment are the same as Figure 1 The descriptions of the corresponding steps in are the same and will not be repeated in this embodiment.

[0049] Step S205, obtaining the bait file that has not been redirected in the preset directory.

[0050] Step S206, determining the file types corresponding to the virtual bait files.

[0051] Step S207, redirecting the path of the virtual bait file to a bait file that has the same file type as the virtual bait file and has not been redirected.

[0052] For example, there are 12 bait files in the preset directory, of which 3 bait files are of type 1, 4 bait files are of type 2, and 5 bait files are of type 3. After creating virtual bait files of multiple document types in the bait directory, obtain the bait files that have not been redirected in the preset directory, and determine the file types corresponding to the virtual bait files (such as the bait files that have not been redirected are: bait file 1, bait file 2, bait file 3, where bait file 1 is of type 1, bait file 2 is of type 2, and bait file 3 is of type 3), and redirect the path of the virtual bait file (the virtual bait file is of type 1) to a bait file that has the same file type as the virtual bait file and has not been redirected (i.e., bait file 1 in the preset directory).

[0053] Step S208, when the suspicious process operates the virtual bait file in the bait directory, determine whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected.

[0054] Step S209, stop the file filtering driver, delete the bait directory created in the target root directory, and the virtual bait file in the bait directory.

[0055] In this embodiment, if the terminal device does not need to be protected against ransomware, the file filtering driver can be stopped, and the bait directory created in the target root directory and the virtual bait file in the bait directory can be deleted, thereby reducing interference with the normal use of the user.

[0056] In an optional embodiment provided by the present invention, the method further includes: if there is a suspicious process traversing the bait directory, obtaining directory information of the bait directory; feeding back the directory information of the bait directory to the suspicious process. If there is a suspicious process querying the file information of the virtual bait file, obtaining the bait file in the preset directory to which the virtual bait file is redirected; obtaining the file information of the redirected bait file in the preset directory; feeding back the file information of the bait file to the suspicious process.

[0057] The present embodiment provides a ransomware virus detection method, which initially creates a batch of real bait files and bait directories in a system specified directory, intercepts the process's access to files and directories through a file filtering driver, and if a bait file needs to be inserted into the directory to be accessed, the real bait file and bait directory information are placed in the return result of the directory. When the process's access to the bait file is intercepted, the access to the bait file is redirected to the real bait file, thereby achieving the goal of using only one bait file so that other system processes can see it when accessing multiple directories.

[0058] Since the real bait file is only created once, it reduces the disk space usage and other system resource consumption, and also facilitates the management of bait files. As many types of bait documents as possible can be created, which is conducive to improving the detection rate of ransomware. At the same time, it can select in real time which directories the process can access to the bait file, reducing the interference with the normal use of users.

[0059] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0060] In one embodiment, a ransomware virus detection device is provided, and the ransomware virus detection device corresponds one-to-one to the ransomware virus detection method in the above embodiment. Figure 3 As shown, the functional modules of the ransomware detection device are described in detail as follows:

[0061] An acquisition module 31 is used to acquire directory information of a preset directory, wherein the preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types;

[0062] A detection module 32, used to detect in real time whether there is a suspicious process traversing a target root directory, where the target root directory is the root directory where the target directory to be protected from ransomware is located;

[0063] A creation module 33, configured to create a bait directory under the target root directory according to the directory information of the preset directory if there is a suspicious process traversing the target root directory, and to create virtual bait files of multiple document types under the bait directory;

[0064] A redirection module 34, used for redirecting the path of the virtual bait file to the bait file in the preset directory;

[0065] The determination module 35 is used to determine whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected when the suspicious process operates the virtual bait file in the bait directory.

[0066] In an optional embodiment, the device further comprises: an interception module 36;

[0067] The interception module 36 is used to load the file filter driver, intercept all processes from traversing the target directory, opening the target file and / or querying the file information of the target file. The target directory is a directory that needs to be protected from ransomware.

[0068] In an optional embodiment, the acquisition module 31 is further used to obtain directory information of the bait directory if there is a suspicious process traversing the bait directory; and feed back the directory information of the bait directory to the suspicious process.

[0069] In an optional embodiment, the acquisition module 31 is also used to obtain the bait file in the preset directory to which the virtual bait file is redirected if there is a suspicious process that queries the file information of the virtual bait file; obtain the file information of the bait file in the redirected preset directory; and feed back the file information of the bait file to the suspicious process.

[0070] In an optional embodiment, the redirection module 34 is specifically configured to:

[0071] Obtaining the bait file that has not been redirected in the preset directory;

[0072] The path of the virtual bait file is redirected to the bait file that has not been redirected.

[0073] In an optional embodiment, the redirection module 34 is further used for:

[0074] Determine the file types corresponding to the virtual bait files respectively;

[0075] The path of the virtual bait file is redirected to the bait file which has the same file type as the virtual bait file and has not been redirected.

[0076] In an optional embodiment, the device further comprises: a stopping module 37;

[0077] The stop module 37 is used to stop the file filtering driver, delete the bait directory created in the target root directory, and the virtual bait file in the bait directory.

[0078] For the specific definition of the ransomware detection device, please refer to the definition of the ransomware detection method above, which will not be repeated here. Each module in the above device can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory in the computer device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0079] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a ransomware virus detection method is implemented.

[0080] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0081] Acquire directory information of a preset directory, wherein the preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types;

[0082] Real-time detection of whether there is a suspicious process traversing the target root directory, where the target root directory that needs to be protected from ransomware is located;

[0083] If there is a suspicious process traversing the target root directory, a bait directory is created under the target root directory according to the directory information of the preset directory, and virtual bait files of multiple document types are created under the bait directory;

[0084] Redirecting the path of the virtual bait file to the bait file in the preset directory;

[0085] When the suspicious process operates the virtual bait file in the bait directory, it is determined whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected.

[0086] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0087] Acquire directory information of a preset directory, wherein the preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types;

[0088] Real-time detection of whether there is a suspicious process traversing the target root directory, where the target root directory that needs to be protected from ransomware is located;

[0089] If there is a suspicious process traversing the target root directory, a bait directory is created under the target root directory according to the directory information of the preset directory, and virtual bait files of multiple document types are created under the bait directory;

[0090] Redirecting the path of the virtual bait file to the bait file in the preset directory;

[0091] When the suspicious process operates the virtual bait file in the bait directory, it is determined whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected.

[0092] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0093] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0094] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A method for detecting ransomware, characterized in that: The method comprises: Acquire directory information of a preset directory, wherein the preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types; Real-time detection of whether there is a suspicious process traversing the target root directory, where the target root directory that needs to be protected from ransomware is located; If there is a suspicious process traversing the target root directory, a bait directory is created under the target root directory according to the directory information of the preset directory, and virtual bait files of multiple document types are created under the bait directory; Redirecting the path of the virtual bait file to the bait file in the preset directory; When the suspicious process operates the virtual bait file in the bait directory, it is determined whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected.

2. The method according to claim 1, characterized in that Before detecting in real time whether there is a suspicious process traversing the directory information, the method further includes: Load a file filter driver to intercept all processes from traversing the target directory, opening the target file, and / or querying the file information of the target file. The target directory is a directory that needs to be protected from ransomware.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: If there is a suspicious process traversing the bait directory, obtaining directory information of the bait directory; The directory information of the decoy directory is fed back to the suspicious process.

4. The method according to claim 1 or 2, characterized in that: The method further comprises: If there is a suspicious process that queries the file information of the virtual bait file, then obtaining the bait file in the preset directory to which the virtual bait file is redirected; Obtaining file information of the bait file in the redirected preset directory; The file information of the bait file is fed back to the suspicious process.

5. The method according to claim 1, characterized in that The step of redirecting the path of the virtual bait file to the bait file in the preset directory comprises: Obtaining the bait file that has not been redirected in the preset directory; The path of the virtual bait file is redirected to the bait file that has not been redirected.

6. The method according to claim 5, characterized in that The step of redirecting the path of the virtual bait file to the bait file that has not been redirected comprises: Determine the file types corresponding to the virtual bait files respectively; The path of the virtual bait file is redirected to the bait file which has the same file type as the virtual bait file and has not been redirected.

7. The method according to claim 2, characterized in that The method further comprises: Stop the file filtering driver, delete the bait directory created in the target root directory, and the virtual bait file in the bait directory.

8. A ransomware virus detection device, characterized in that: The device comprises: An acquisition module, used for acquiring directory information of a preset directory, wherein the preset directory includes a plurality of bait files that are actually created, and the bait files include a plurality of document types; A detection module, used to detect in real time whether there is a suspicious process traversing a target root directory, where the target root directory is the root directory where the target directory to be protected from ransomware is located; A creation module, used for creating a bait directory under the target root directory according to the directory information of the preset directory if there is a suspicious process traversing the target root directory, and creating virtual bait files of multiple document types under the bait directory; A redirection module, used for redirecting the path of the virtual bait file to the bait file in the preset directory; A determination module is used to determine whether the suspicious process is a ransomware virus according to the operation result of the suspicious process on the bait file in the preset directory to which the virtual bait file is redirected when the suspicious process operates on the virtual bait file in the bait directory.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the ransomware virus detection method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the ransomware virus detection method according to any one of claims 1 to 7 is implemented.

Images