Ransomware defense method, device, electronic device and storage medium

Abstract

Embodiments of the present invention relate to the field of computer security technology, and more particularly to a method, device, electronic device, and storage medium for defending against ransomware. The method for defending against ransomware dynamically analyzes known ransomware to obtain a determination scheme for determining whether a computer system is damaged, and formulates a defense vaccine against the ransomware based on the determination scheme, and then inputs the defense vaccine into the computer system to be defended. In this way, when the ransomware enters the computer system and runs, the ransomware will automatically exit after determining that the computer system has been damaged, thereby achieving the purpose of early and thorough defense against the ransomware, thereby achieving effective defense against the ransomware.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer security technology, and in particular to a method, device, electronic device and storage medium for defending against ransomware. Background Art

[0002] As the destructive behavior of ransomware continues to change, it becomes increasingly difficult to defend against it.

[0003] At present, ransomware is no longer limited to damaging files, but may directly damage computer systems. For example, some ransomware will modify the Master Boot Record (MBR), and some ransomware will modify the registry key value (Userinit).

[0004] However, current defense solutions cannot effectively defend against the above-mentioned destructive behaviors. Summary of the invention

[0005] In order to solve the problem that current defense schemes cannot effectively defend against the destructive behavior of ransomware, embodiments of the present invention provide a defense method, device, electronic device and storage medium for ransomware.

[0006] In a first aspect, an embodiment of the present invention provides a method for defending against ransomware, including:

[0007] Perform dynamic analysis on known ransomware viruses to obtain a solution for determining whether a computer system is damaged;

[0008] Based on the determination scheme, a defense vaccine against ransomware is developed;

[0009] The defense vaccine is input into the computer system to be defended to defend the computer system to be defended from the ransomware virus.

[0010] In one possible design, the determination scheme includes a static determination scheme and a dynamic determination scheme. The static determination scheme is used to indicate a process in which the ransomware releases a first specific object at a specific location in the computer system, and the dynamic determination scheme is used to indicate a process in which the ransomware releases a second specific object at a running location in the computer system.

[0011] In a possible design, the formulation of a defense vaccine against the ransomware virus based on the determination scheme includes:

[0012] Based on the static determination scheme, a static defense vaccine against the ransomware virus is formulated; wherein the static defense vaccine includes a first virtual object, and the identification information of the first virtual object is the same as the identification information of the first specific object obtained by dynamic analysis of a known ransomware virus.

[0013] In a possible design, the step of inputting the defense vaccine into the computer system to be defended comprises:

[0014] Based on the specific position included in the static determination scheme, all first virtual objects included in the static defense vaccine are input into the specific position corresponding to the first virtual object in the computer system to be defended; wherein the specific position corresponding to the first virtual object is the same as the specific position corresponding to the first specific object.

[0015] In a possible design, the formulation of a defense vaccine against the ransomware virus based on the determination scheme includes:

[0016] Based on the dynamic determination scheme, a dynamic defense vaccine against ransomware is formulated; wherein the dynamic defense vaccine at least includes a ransomware initiation action obtained through dynamic analysis of a known ransomware, and the ransomware initiation action is an action for first creating a second specific object at the running location of the ransomware in the computer system.

[0017] In a possible design, the step of inputting the defense vaccine into a computer system to be defended to defend the computer system to be defended against a ransomware virus includes:

[0018] inputting the dynamic defense vaccine into the computer system to be defended;

[0019] Use the driver layer to capture the ransomware's initial actions;

[0020] In response to capturing a ransomware initiation action of a ransomware virus, stopping the ransomware initiation action of the ransomware virus, and determining the type of the ransomware virus and the running location of the ransomware virus in the computer system;

[0021] Based on the type of the ransomware virus, creating a second virtual object corresponding to the ransomware virus; wherein the identification information of the second virtual object is the same as the identification information of the second specific object obtained by dynamic analysis of the known ransomware virus;

[0022] The created second virtual object is input into the determined running position to defend the computer system to be defended from the ransomware virus.

[0023] In a possible design, the first specific object and the second specific object each include at least one of the following: a system registry, a system window, a disk file, a memory mutex, and a process.

[0024] In a second aspect, an embodiment of the present invention further provides a ransomware defense device, including:

[0025] An analysis module is used to dynamically analyze known ransomware viruses to obtain a determination scheme for determining whether a computer system is damaged;

[0026] A formulation module, for formulating a defense vaccine against the ransomware virus based on the determination scheme;

[0027] An input module is used to input the defense vaccine into the computer system to be defended so as to defend the computer system to be defended from the ransomware virus.

[0028] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0029] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.

[0030] The embodiment of the present invention provides a method, device, electronic device and storage medium for defending against ransomware. By dynamically analyzing known ransomware, a determination scheme for determining whether a computer system is damaged is obtained, and a defense vaccine against the ransomware is formulated based on the determination scheme, and then the defense vaccine is input into the computer system to be defended. In this way, when the ransomware enters the computer system and runs, the ransomware will automatically exit after determining that the computer system has been damaged, thereby achieving the purpose of early and thorough defense against the ransomware, thereby achieving effective defense against the ransomware. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 This is a flow chart of a method for defending against ransomware provided by an embodiment of the present invention;

[0033] Figure 2 This is a flow chart of another method for defending against ransomware provided by an embodiment of the present invention;

[0034] Figure 3 is a hardware architecture diagram of an electronic device provided by an embodiment of the present invention;

[0035] Figure 4 The present invention is a structural diagram of a ransomware defense device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0037] As mentioned above, ransomware is no longer limited to destroying files, but may directly destroy computer systems. For example, some ransomware will modify the Master Boot Record (MBR), and some will modify the registry key (Userinit). These destructive behaviors cannot be defended. Even if its behavior is determined when it destroys files, the encryption behavior is blocked, and its process is terminated, after the computer system is restarted, the password of the ransomware publisher is still required to enter the system, that is, the ransomware behavior has been formed, which will lead to the failure of virus defense.

[0038] Traditional ransomware defense is reactive and is determined by whether the file is damaged. As mentioned earlier, some ransomware viruses are not designed to damage files, but can directly damage computer systems. Therefore, passive defense cannot truly suppress the ransomware behavior of ransomware viruses. Therefore, to solve the above technical problems, it is necessary to block all ransomware behaviors after the ransomware enters the computer system.

[0039] The inventors considered dynamically analyzing known ransomware viruses to obtain a determination scheme for determining whether a computer system is damaged, and based on the determination scheme, developing a defense vaccine against the ransomware virus, and then inputting the defense vaccine into the computer system to be defended. This method can curb the occurrence of ransomware behavior before the ransomware virus begins to damage the system and files. By delivering the vaccine to the computer system, the ransomware behavior of the ransomware virus can be directly blocked, making it completely ineffective. The defense effect of this method far exceeds the effect of passive ransomware defense, thereby achieving effective defense against ransomware viruses.

[0040] The specific implementation of the above concept is described below.

[0041] Please refer to Figure 1 , an embodiment of the present invention provides a method for defending against ransomware, the method comprising:

[0042] Step 100: Dynamically analyze the known ransomware virus to obtain a determination scheme for determining whether the computer system is damaged;

[0043] Step 102: Based on the determination scheme, a defense vaccine against the ransomware virus is formulated;

[0044] Step 104: Input the defense vaccine into the computer system to be defended to defend the computer system to be defended from the ransomware virus.

[0045] In the embodiment of the present invention, a determination scheme for determining whether a computer system is damaged is obtained by dynamically analyzing a known ransomware virus, and a defense vaccine against the ransomware virus is formulated based on the determination scheme, and then the defense vaccine is input into the computer system to be defended. In this way, when the ransomware virus enters the computer system and runs, the ransomware virus will automatically exit after determining that the computer system has been damaged, thereby achieving the purpose of early and thorough defense against the ransomware virus, thereby achieving effective defense against the ransomware virus.

[0046] Described below Figure 1 How the various steps are performed.

[0047] For step 100:

[0048] It should be noted that the defense method provided in the embodiment of the present invention is implemented based on the results obtained by dynamic analysis of known ransomware viruses, that is, the defense method provided in the embodiment of the present invention is mainly for effective defense against known ransomware viruses, and the defense method for unknown ransomware viruses is not in the application scenario of the embodiment of the present invention.

[0049] It is understandable that dynamic analysis can be performed by, for example, using a sandbox or virtual machine to simulate the running of a virus program, analyzing the dynamic behavior characteristics of the program during runtime by API interception or behavior monitoring, and analyzing file operations, network operations, registry operations, process operations, etc. during the execution of the computer virus. In this step, by dynamically analyzing a known ransomware virus, a determination scheme for determining whether a computer system is damaged can be obtained.

[0050] In some embodiments, the determination scheme includes a static determination scheme and a dynamic determination scheme. The static determination scheme is used to indicate the process of releasing a first specific object at a specific location of the ransomware in the computer system, and the dynamic determination scheme is used to indicate the process of releasing a second specific object at the running location of the ransomware in the computer system.

[0051] In this embodiment, static and dynamic determination schemes are obtained through dynamic analysis of known ransomware viruses. In this way, the static and dynamic determination schemes can be used to specify defense vaccines against known ransomware viruses, and the formulated defense vaccines can be delivered to the computer system to be defended, thereby achieving effective defense against ransomware viruses.

[0052] For example, through dynamic analysis of the ransomware virus Bad Rabbit, we can know that its dynamic behavior process is: Bad Rabbit releases the infpub.dat file in C:\Windows\, and then starts the rundll32.exe process, through which the infpub.dat file is loaded. After loading and running, the master boot record of the computer system is first modified, and then the files (such as office files, txt files, and pdf files, etc.) are encrypted. For the ransomware virus Bad Rabbit, the specific location included in its static determination scheme is C:\Windows\, and the first specific object included in its static determination scheme is the infpub.dat file, so you only need to master these two points to achieve effective defense against Bad Rabbit (the specific defense method is mentioned below and will not be repeated here).

[0053] For another example, through dynamic analysis of the Legion Locker ransomware, we can know that its dynamic behavior process is: after the Legion Locker related process is started, it will traverse the window types in the computer system. If a window class similar to processmonitor.exe is found, its ransomware behavior will be stopped. For the Legion Locker ransomware, the specific location included in its static determination scheme is any location in the computer system, and the first specific object included in its static determination scheme is a window class similar to processmonitor.exe. Therefore, you only need to master these two points to achieve effective defense against Legion Locker (the specific defense method is mentioned below and will not be repeated here).

[0054] For another example, through dynamic analysis of the Wannacry ransomware, we can know that its dynamic behavior process is: after the Wannacry related process is started, files such as a.wry and m.wry will be released at the location where the related process is running in the computer system. For the Wannacry ransomware, the running location included in its dynamic determination scheme needs to be obtained by monitoring the Wannacry related process, and the second specific object included in its dynamic determination scheme is files such as a.wry and m.wry. Therefore, you only need to master these two points to achieve effective defense against Wannacry (the specific defense method is mentioned below and will not be repeated here).

[0055] In some embodiments, the inventors obtain the specific types of the first specific object and the second specific object after dynamically analyzing a known ransomware virus, for example, they may be at least one of a system registry, a system window, a disk file, a memory mutex, and a process. This helps researchers create the first virtual object and the second virtual object of the defense vaccine through the specific types of the first specific object and the second specific object, and put them into the computer system to be defended to achieve active defense.

[0056] The first specific object and the first virtual object, as well as the second specific object and the second virtual object, are similar in that the specific object and the virtual object are of the same type and named the same (i.e., the same identification information); the difference is that the specific object has content, while the virtual object has no content. In this way, when the ransomware is executing its ransomware behavior, as long as it reads the related object in a read-only manner, the ransomware will think that the current computer system has been damaged, and will not execute subsequent running or loading actions, thereby effectively defending against its ransomware behavior.

[0057] The following introduces the technical solution of static defense.

[0058] The process of static defense is roughly as follows: through dynamic analysis of known ransomware, a first specific object of at least one of the following is obtained: system registry, disk file, system window, memory mutex and process, a first virtual object is created based on the obtained first specific object, and the first virtual object is placed in a specific location of the computer to be defended, so that the ransomware can determine that the computer system has been damaged during operation, and will no longer continue to execute subsequent ransomware and destructive actions, thereby achieving the purpose of early defense and thorough defense.

[0059] In some implementations, step 102 may include:

[0060] Based on the static determination scheme, a static defense vaccine against the ransomware virus is formulated; wherein the static defense vaccine includes a first virtual object, and identification information of the first virtual object is the same as identification information of a first specific object obtained through dynamic analysis of a known ransomware virus.

[0061] In some implementations, step 104 may include:

[0062] Based on the specific position included in the static determination scheme, all first virtual objects included in the static defense vaccine are input into the specific position corresponding to the first virtual object in the computer system to be defended; wherein the specific position corresponding to the first virtual object is the same as the specific position corresponding to the first specific object.

[0063] For example, the first specific object obtained through dynamic analysis is the infpub.dat file with content, and "infpub.dat" is the identification information of the file. Therefore, in order to achieve static defense, a blank file with the identification information "infpub.dat" can be created in advance and placed in the specific location of the computer system to be defended (i.e. C:\Windows\), so that the ransomware virus can determine that the computer system has been damaged during operation, and will no longer continue to execute subsequent ransomware and destructive actions, thereby achieving the purpose of early defense and thorough defense.

[0064] The following introduces the technical solution of dynamic defense.

[0065] The process of dynamic defense is roughly as follows: a known ransomware virus is dynamically analyzed to obtain at least one of the following second specific objects: system registry, disk file, system window, memory mutex and process, and the relevant features of the obtained second specific object are added to the code program of the dynamic defense vaccine, so as to establish a second virtual object when the ransomware virus triggers dynamic defense in the future. It should be noted that the dynamic defense process needs to be coordinated with the defense method of capturing the ransomware start action of the ransomware virus through the driver layer. When the ransomware start action of the ransomware virus is captured, the computer system will stop the ransomware start action of the ransomware virus, and determine the type of the ransomware virus and the running position of the ransomware virus in the computer system according to the captured ransomware start action, so as to send the type of the ransomware virus and its running position to the code program of the dynamic defense vaccine, so that the dynamic defense vaccine can create a second virtual object or put the pre-created second virtual object into the running position of the ransomware virus, so that the ransomware virus can determine the conclusion that the computer system has been damaged during the operation, and then will no longer continue to execute subsequent ransomware and destruction actions, achieving the purpose of early defense and thorough defense.

[0066] In some implementations, step 102 may include:

[0067] Based on the dynamic determination scheme, a dynamic defense vaccine is developed for ransomware viruses; wherein the dynamic defense vaccine at least includes a ransomware initiation action obtained through dynamic analysis of known ransomware viruses, and the ransomware initiation action is the action of first creating a second specific object at the running location of the ransomware virus in the computer system.

[0068] In some implementations, step 104 may include:

[0069] Entering the dynamic defense vaccine into the computer system to be defended;

[0070] Use the driver layer to capture the ransomware's initial actions;

[0071] In response to capturing a ransomware initiation action of the ransomware, stopping the ransomware initiation action of the ransomware, and determining the type of the ransomware and the running position of the ransomware in the computer system according to the captured ransomware initiation action;

[0072] Based on the type of the ransomware virus, a second virtual object corresponding to the ransomware virus is created; wherein the identification information of the second virtual object is the same as the identification information of the second specific object obtained by dynamic analysis of the known ransomware virus;

[0073] The created second virtual object is input into a determined running position to defend the computer system to be defended from the ransomware virus.

[0074] For example, the second specific object obtained through dynamic analysis is files such as a.wry and m.wry with content, and "a.wry, m.wry" is the identification information of these files. Therefore, in order to achieve dynamic defense, you can either create blank files with identification information "a.wry, m.wry" in advance and put them in a certain location of the computer system to be defended, or you can write the creation rules into the code program of the dynamic defense vaccine. When the ransomware's initial action is captured through the driver layer, the computer system will stop the ransomware's initial action and determine the type of ransomware (e.g., Wannacry) and the location where the ransomware runs in the computer system (e.g., G:\Windows\) based on the captured ransomware's initial action, so as to send Wannacry and G:\Windows\ to the code program of the dynamic defense vaccine, so that the dynamic defense vaccine can drop a blank file with identification information of "a.wry, m.wry" into G:\Windows\, so that the ransomware can determine that the computer system has been damaged during operation, and will no longer continue to execute subsequent ransomware and destructive actions, thereby achieving the purpose of early defense and thorough defense.

[0075] Figure 2A flowchart of a method for defending against ransomware according to another embodiment is shown. Figure 2 , the method comprising:

[0076] Step 200: dynamically analyzing a known ransomware virus to obtain a determination scheme for determining whether a computer system is damaged; wherein the determination scheme includes a static determination scheme and a dynamic determination scheme, the static determination scheme is used to indicate a process in which the ransomware virus releases a first specific object at a specific location in the computer system, and the dynamic determination scheme is used to indicate a process in which the ransomware virus releases a second specific object at a running location in the computer system;

[0077] Step 202: Based on the static determination scheme, a static defense vaccine against the ransomware virus is formulated; wherein the static defense vaccine includes a first virtual object, and the identification information of the first virtual object is the same as the identification information of the first specific object obtained by dynamic analysis of the known ransomware virus;

[0078] Step 204: Based on the specific position included in the static determination scheme, all first virtual objects included in the static defense vaccine are input into the specific position corresponding to the first virtual object in the computer system to be defended, so as to defend the computer system to be defended from the ransomware virus; wherein the specific position corresponding to the first virtual object is the same as the specific position corresponding to the first specific object;

[0079] Step 206: Based on the dynamic determination scheme, a dynamic defense vaccine against the ransomware virus is formulated; wherein the dynamic defense vaccine at least includes a ransomware initiation action obtained by dynamic analysis of a known ransomware virus, and the ransomware initiation action is an action of first creating a second specific object at the running location of the ransomware virus in the computer system;

[0080] Step 208: Inputting the dynamic defense vaccine into the computer system to be defended;

[0081] Step 210: using the driver layer to capture the ransomware initiation action;

[0082] Step 212: in response to capturing the ransomware initiation action of the ransomware, stopping the ransomware initiation action of the ransomware, and determining the type of the ransomware and the running position of the ransomware in the computer system according to the captured ransomware initiation action;

[0083] Step 214: based on the type of the ransomware virus, create a second virtual object corresponding to the ransomware virus; wherein the identification information of the second virtual object is the same as the identification information of the second specific object obtained by dynamic analysis of the known ransomware virus;

[0084] Step 216: Input the created second virtual object into the determined running position to defend the computer system to be defended from the ransomware virus.

[0085] like Figure 3 , Figure 4 As shown, an embodiment of the present invention provides a ransomware defense device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 3 As shown, it is a hardware architecture diagram of an electronic device in which a ransomware defense device provided by an embodiment of the present invention is located, except Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 4 As shown, as a device in a logical sense, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it.

[0086] like Figure 4 As shown, a ransomware defense device provided in this embodiment includes:

[0087] The analysis module 400 is used to dynamically analyze the known ransomware virus to obtain a determination scheme for determining whether the computer system is damaged;

[0088] A formulation module 402, for formulating a defense vaccine against the ransomware virus based on the determination scheme;

[0089] The input module 404 is used to input the defense vaccine into the computer system to be defended, so as to defend the computer system to be defended from the ransomware virus.

[0090] In the embodiment of the present invention, the analysis module 400 can be used to execute step 100 in the above method embodiment, the formulation module 402 can be used to execute step 102 in the above method embodiment, and the input module 404 can be used to execute step 104 in the above method embodiment.

[0091] In one embodiment of the present invention, the determination scheme includes a static determination scheme and a dynamic determination scheme. The static determination scheme is used to indicate the process of the ransomware releasing a first specific object at a specific location in the computer system, and the dynamic determination scheme is used to indicate the process of the ransomware releasing a second specific object at the running location in the computer system.

[0092] In one embodiment of the present invention, the formulation module 402 is used to perform the following operations:

[0093] Based on the static determination scheme, a static defense vaccine against the ransomware virus is formulated; wherein the static defense vaccine includes a first virtual object, and identification information of the first virtual object is the same as identification information of a first specific object obtained through dynamic analysis of a known ransomware virus.

[0094] In one embodiment of the present invention, the input module 404 is used to perform the following operations:

[0095] Based on the specific position included in the static determination scheme, all first virtual objects included in the static defense vaccine are input into the specific position corresponding to the first virtual object in the computer system to be defended; wherein the specific position corresponding to the first virtual object is the same as the specific position corresponding to the first specific object.

[0096] In one embodiment of the present invention, the formulation module 402 is used to perform the following operations:

[0097] Based on the dynamic determination scheme, a dynamic defense vaccine is developed for ransomware viruses; wherein the dynamic defense vaccine at least includes a ransomware initiation action obtained through dynamic analysis of known ransomware viruses, and the ransomware initiation action is the action of first creating a second specific object at the running location of the ransomware virus in the computer system.

[0098] In one embodiment of the present invention, the input module 404 is used to perform the following operations:

[0099] Entering the dynamic defense vaccine into the computer system to be defended;

[0100] Use the driver layer to capture the ransomware's initial actions;

[0101] In response to capturing a ransomware initiation action of the ransomware, stopping the ransomware initiation action of the ransomware, and determining the type of the ransomware and the running position of the ransomware in the computer system according to the captured ransomware initiation action;

[0102] Based on the type of the ransomware virus, a second virtual object corresponding to the ransomware virus is created; wherein the identification information of the second virtual object is the same as the identification information of the second specific object obtained by dynamic analysis of the known ransomware virus;

[0103] The created second virtual object is input into a determined running position to defend the computer system to be defended from the ransomware virus.

[0104] In one embodiment of the present invention, the first specific object and the second specific object each include at least one of the following: a system registry, a system window, a disk file, a memory mutex, and a process.

[0105] It is understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a ransomware defense device. In other embodiments of the present invention, a ransomware defense device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0106] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0107] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, a method for defending against ransomware in any embodiment of the present invention is implemented.

[0108] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a method for defending against ransomware in any embodiment of the present invention.

[0109] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0110] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0111] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0112] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0113] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0114] In summary, the present invention provides a method, device, electronic device and storage medium for defending against ransomware, and the present invention has at least the following beneficial effects:

[0115] 1. In one embodiment of the present invention, a determination scheme for determining whether a computer system is damaged is obtained by dynamically analyzing known ransomware viruses, and a defense vaccine against the ransomware virus is formulated based on the determination scheme, and then the defense vaccine is input into the computer system to be defended. In this way, when the ransomware virus enters the computer system and runs, the ransomware virus will automatically exit after determining that the computer system has been damaged, thereby achieving the purpose of early and thorough defense against the ransomware virus, thereby achieving effective defense against the ransomware virus.

[0116] 2. In one embodiment of the present invention, static and dynamic determination schemes are obtained through dynamic analysis of known ransomware viruses. In this way, the static and dynamic determination schemes can be used to specify defense vaccines against known ransomware viruses, and the formulated defense vaccines can be delivered to the computer system to be defended, thereby achieving effective defense against ransomware viruses.

[0117] 3. In one embodiment of the present invention, the inventor obtains the specific types of the first specific object and the second specific object after dynamically analyzing a known ransomware virus, for example, they may be at least one of a system registry, a system window, a disk file, a memory mutex, and a process. This helps researchers create the first virtual object and the second virtual object of the defense vaccine through the specific types of the first specific object and the second specific object, and put them into the computer system to be defended to achieve active defense.

[0118] 4. In one embodiment of the present invention, a first specific object of at least one of the following is obtained by dynamically analyzing a known ransomware virus: a system registry, a disk file, a system window, a memory mutex, and a process. A first virtual object is created based on the obtained first specific object, and the first virtual object is placed in a specific location of the computer to be defended, so that the ransomware virus can determine that the computer system has been damaged during operation, and will no longer continue to execute subsequent ransomware and destructive actions, thereby achieving the purpose of early defense and thorough defense.

[0119] 5. In one embodiment of the present invention, a second specific object of at least one of the following is obtained through dynamic analysis of a known ransomware virus: system registry, disk file, system window, memory mutex and process, and the relevant features of the obtained second specific object are added to the code program of the dynamic defense vaccine, so as to establish a second virtual object when the ransomware virus triggers dynamic defense in the future. When the ransomware virus's ransom initiation action is captured through the driver layer, the computer system will stop the ransomware virus's ransom initiation action, and determine the type of the ransomware virus and the running position of the ransomware virus in the computer system, so as to send the type of the ransomware virus and its running position to the code program of the dynamic defense vaccine, so that the dynamic defense vaccine can create a second virtual object or put the pre-created second virtual object into the running position of the ransomware virus, so that the ransomware virus can determine the conclusion that the computer system has been damaged during operation, and then will no longer continue to execute subsequent ransomware and destruction actions, thereby achieving the purpose of early defense and thorough defense.

[0120] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0121] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for defending against ransomware, characterized in that: include: Perform dynamic analysis on known ransomware viruses to obtain a solution for determining whether a computer system is damaged; Based on the determination scheme, a defense vaccine against ransomware is developed; Inputting the defense vaccine into the computer system to be defended to defend the computer system to be defended from the ransomware virus; The determination scheme includes a static determination scheme and a dynamic determination scheme, wherein the static determination scheme is used to indicate a process in which the ransomware virus releases a first specific object at a specific location in the computer system, and the dynamic determination scheme is used to indicate a process in which the ransomware virus releases a second specific object at a running location in the computer system; Based on the determination scheme, a defense vaccine against the ransomware virus is formulated, including: Based on the dynamic determination scheme, a dynamic defense vaccine against the ransomware virus is formulated; wherein the dynamic defense vaccine at least includes a ransomware initiation action obtained by dynamic analysis of a known ransomware virus, and the ransomware initiation action is an action of first creating a second specific object at the running location of the ransomware virus in the computer system; The step of inputting the defense vaccine into the computer system to be defended to defend the computer system to be defended from the ransomware virus includes: inputting the dynamic defense vaccine into the computer system to be defended; Use the driver layer to capture the ransomware's initial actions; In response to capturing a ransomware initiation action of a ransomware virus, stopping the ransomware initiation action of the ransomware virus, and determining the type of the ransomware virus and the running position of the ransomware virus in the computer system according to the captured ransomware initiation action; Based on the type of the ransomware virus, creating a second virtual object corresponding to the ransomware virus; wherein the identification information of the second virtual object is the same as the identification information of the second specific object obtained by dynamic analysis of the known ransomware virus; Inputting the created second virtual object into the determined running position to defend the computer system to be defended from the ransomware virus; The first specific object and the second specific object each include at least one of the following: a system registry, a system window, a disk file, a memory mutex, and a process; The second specific object and the second virtual object are similar in that: the specific object and the virtual object are of the same type and have the same identification information; the difference is that: the specific object has content, while the virtual object has no content.

2. The method according to claim 1, characterized in that Based on the determination scheme, a defense vaccine against the ransomware virus is formulated, including: Based on the static determination scheme, a static defense vaccine against the ransomware virus is formulated; wherein the static defense vaccine includes a first virtual object, and the identification information of the first virtual object is the same as the identification information of the first specific object obtained by dynamic analysis of a known ransomware virus.

3. The method according to claim 2, characterized in that The step of inputting the defense vaccine into the computer system to be defended comprises: Based on the specific position included in the static determination scheme, all first virtual objects included in the static defense vaccine are input into the specific position corresponding to the first virtual object in the computer system to be defended; wherein the specific position corresponding to the first virtual object is the same as the specific position corresponding to the first specific object, and the first specific object and the first virtual object are the same in that: the specific object and the virtual object are of the same type and have the same identification information; the difference is that: the specific object has content, and the virtual object has no content.

4. A ransomware defense device, characterized in that: include: An analysis module is used to dynamically analyze known ransomware viruses to obtain a determination scheme for determining whether a computer system is damaged; A formulation module, for formulating a defense vaccine against the ransomware virus based on the determination scheme; An input module, used for inputting the defense vaccine into the computer system to be defended, so as to defend the computer system to be defended from the ransomware virus; The determination scheme includes a static determination scheme and a dynamic determination scheme, wherein the static determination scheme is used to indicate a process in which the ransomware virus releases a first specific object at a specific location in the computer system, and the dynamic determination scheme is used to indicate a process in which the ransomware virus releases a second specific object at a running location in the computer system; The formulation module is used to perform the following operations: Based on the dynamic determination scheme, a dynamic defense vaccine against the ransomware virus is formulated; wherein the dynamic defense vaccine at least includes a ransomware initiation action obtained by dynamic analysis of a known ransomware virus, and the ransomware initiation action is an action of first creating a second specific object at the running location of the ransomware virus in the computer system; The input module is used to perform the following operations: Entering the dynamic defense vaccine into the computer system to be defended; Use the driver layer to capture the ransomware's initial actions; In response to capturing a ransomware initiation action of the ransomware, stopping the ransomware initiation action of the ransomware, and determining the type of the ransomware and the running position of the ransomware in the computer system according to the captured ransomware initiation action; Based on the type of the ransomware virus, a second virtual object corresponding to the ransomware virus is created; wherein the identification information of the second virtual object is the same as the identification information of the second specific object obtained by dynamic analysis of the known ransomware virus; Inputting the created second virtual object into the determined running position to defend the computer system to be defended from the ransomware virus; The first specific object and the second specific object each include at least one of the following: a system registry, a system window, a disk file, a memory mutex, and a process; The second specific object and the second virtual object are similar in that: the specific object and the virtual object are of the same type and have the same identification information; the difference is that: the specific object has content, while the virtual object has no content.

5. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

6. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 3.

Images