A ransomware defense method and system based on fine-grained access control

Abstract

The present application relates to a kind of ransomware defense method and system based on fine-grained access control.The method comprises: real-time monitoring the application behavior of host, according to authorization policy, fine-grained control application permission to file system, and determine whether application behavior exists file operation exception;Application behavior is analyzed, whether the application intent deviates from user intent is judged, and then whether the application behavior exists program intent exception is judged;When determining that application behavior exists file operation exception or program intent exception, abnormality is handled in stages, and according to the ability of user, exception is handled by user or reported to cloud administrator for processing.The present application improves authorization granularity, permission management, exception handling three parts on the basis of current access control based ransomware defense system, and can better realize the management and protection of the resource file of user.

Description

Technical Field

[0001] This invention belongs to the field of computer security and relates to access control methods and systems for ransomware defense centered on user intent. Background Technology

[0002] In recent years, various cybersecurity incidents have occurred frequently. Among them, ransomware has rapidly developed into the most serious malicious software threatening cybersecurity and has become one of the main forms of cybercrime. From government networks to critical information infrastructure, from individuals to enterprises, from computer devices to mobile devices and servers, ransomware attacks indiscriminately affect all industries and sectors, all types of network users, and all types of devices worldwide, causing serious adverse effects on society.

[0003] Ransomware is an attack that attempts to gain access to user files without their consent or by violating their intentions. It does not modify or attack operating system modules, and may then attempt to disable user access (e.g., through file encryption) or compromise exclusive access to user interaction (e.g., through information leakage), with the aim of extorting ransom from the victim.

[0004] Ransomware analysis can be divided into two categories: static feature-based analysis and behavior-based analysis. Static analysis is an analysis method that extracts structural features from source code and binary strings without running the code. Static analysis is a safe and efficient method, but it cannot deal with obfuscated ransomware. Dynamic analysis refers to analyzing the behavior of a program during execution. Ransomware behavior analysis reveals characteristics such as frequent folder access, extensive file creation and reading / writing, modification of as many file types as possible, and causing changes to the behavior of benign applications.

[0005] Ransomware defense falls into two categories: detection and prevention. Ransomware detection, like malware detection, can be divided into misuse-based detection and anomaly-based detection. However, misuse-based detection cannot detect unknown attacks, while anomaly-based detection suffers from a high false positive rate. Ransomware prevention protects potential victims from malware attacks by proactively preventing the corruption of files and other resources.

[0006] Currently, mobile operating systems like Android and iOS improve ransomware defense by introducing permission-based access control for each application, while desktop operating systems like Windows use role-based access control (RBAC), resulting in a lack of isolation between applications. Open operating systems lack appropriate access control mechanisms to strengthen their defenses against ransomware attacks, relying instead on methods designed for general malware to defend against ransomware.

[0007] Current access control systems used in industry primarily suffer from problems in three areas: authorization granularity, permission management, and exception handling. Because access control systems often grant application permissions with excessively coarse granularity, authorization policies may not align with user intent, allowing ransomware to exploit vulnerabilities and gain access to sensitive file resources. Furthermore, the system's failure to promptly revoke permissions and adjust judgments based on environmental information allows ransomware-modified applications to take advantage of vulnerabilities. When anomalies occur, current defense solutions rely on users to handle all exceptions, neglecting the possibility that users may have been misled by ransomware. Therefore, a more suitable access control system is needed to effectively manage and protect users' resource files. Summary of the Invention

[0008] In view of the problems existing in current ransomware defense solutions, this invention improves the authorization granularity, permission management and exception handling of the current ransomware defense system based on access control.

[0009] To achieve the above objectives, the present invention employs the following solution:

[0010] A ransomware defense method based on fine-grained access control includes the following steps:

[0011] It monitors the behavior of applications on the host in real time, controls the permissions of applications to the file system in fine granularity according to the authorization policy, and determines whether there are any abnormal file operation behaviors of the applications.

[0012] Analyze application behavior to determine whether the application intent deviates from the user intent, and then determine whether the application behavior has abnormal program intent;

[0013] When an application is found to have abnormal file operation behavior or abnormal program intent, the abnormality is handled in a tiered manner, and the user can choose to handle the abnormality or report it to the cloud administrator for processing, depending on the user's ability.

[0014] Furthermore, the fine granularity refers to the permissions managed by the present invention. Permissions refer to a specific operation of an application on a certain file resource, such as the permission of the application photoshop.exe to modify the image file test1.jpg.

[0015] Furthermore, the input to the authorization policy is the permission request initiated by the client host application and a whitelist. If the permission request exists in the whitelist, the application's operation is allowed; otherwise, permission is requested from the user, who then decides whether to block the current operation. When an application initiates a permission request for a sensitive file, it is considered abnormal behavior; this abnormality is called a file operation exception. By configuring a whitelist to filter application behavior, it is ensured that permission requests are not frequently initiated while the program is running normally.

[0016] Furthermore, the whitelist contains the permissions that can be granted to applications on the user's host. The whitelist refers to a .json file configured by the server for the client host and adjusted according to context information; write / modify permissions for this file are only granted to the server. The whitelist contains the permissions that can be granted to applications on the user's host, and the format of the whitelist is: application path -> access resource path -> operation.

[0017] Furthermore, the analysis of application behavior to determine whether the application intent deviates from the user intent, and thus to determine whether the application behavior has abnormal program intent, includes: collecting standard behavior sequences of applications in the whitelist and behavior sequences of ransomware, and matching the application's real-time behavior sequence with the above two types of behavior sequences to detect in a timely manner whether the application intent deviates from the user intent. If it deviates from the user intent, the application behavior is determined to be abnormal, and this abnormality is called program intent abnormality.

[0018] Furthermore, the collection of the application's standard behavior sequence (normal behavior) refers to running the application in a Windows sandbox and recording its behavior in the following format: file type -> behavior name. The collected behavior sequence is then used as the application's standard behavior sequence.

[0019] Furthermore, the aforementioned ransomware behavior sequence refers to the typical file behavior of ransomware, reflecting its behavioral characteristics. The format of ransomware behavior is: file type -> behavior name.

[0020] Furthermore, the aforementioned behavior matching refers to behavior similarity analysis, which involves performing similarity calculations between the application's real-time behavior sequence and the ransomware's behavior sequence, respectively, to obtain two similarity values. These two similarity values ​​are compared to determine whether the application's intent matches the user's intent. If the similarity between the application's real-time behavior sequence and the ransomware's behavior sequence is greater than or equal to the similarity between the application's real-time behavior sequence and the application's standard behavior sequence, the application is deemed to be behaving abnormally.

[0021] Furthermore, the tiered handling of anomalies includes cloud-based monitoring functionality. When a program's intent is abnormal or when it requests sensitive permissions, a cloud administrator takes over the handling to reduce potential risks caused by improper handling of anomalies.

[0022] Furthermore, the cloud-based monitoring refers to the fact that the server-side administrator takes over exceptions that the client cannot handle and dynamically adjusts the whitelist based on the frequency of exceptions, thereby achieving dynamic management of the client host's applications.

[0023] A ransomware defense system based on fine-grained access control can be divided into three functional modules: a file system management module, a program intent analysis module, and an anomaly classification and handling module, in order to protect the security of the host's file resources and handle anomalies quickly and correctly.

[0024] The file system management module is used to manage file system permissions using access control, including real-time monitoring of host application behavior, fine-grained control of application permissions to the file system according to authorization policies, and determination of whether there are any abnormal file operations in the application behavior.

[0025] The program intent analysis module is used to analyze the behavior of the application, determine whether the application intent deviates from the user intent, and then determine whether the application behavior has program intent abnormality.

[0026] The exception classification and processing module is used to classify and process exceptions when it is determined that the application behavior has file operation exceptions or program intent exceptions. Depending on the user's ability, the user can choose to handle the exception or report it to the cloud administrator for processing.

[0027] Furthermore, the file system management module uses access control to manage file system permissions. Access control technology prevents unauthorized access to any resources, ensuring that file resources are used within legal limits. This invention enables fine-grained access to the file system by setting authorization policies. The inputs to the authorization policy of this invention are permission requests initiated by the client host application and a whitelist. If the permission request exists in the whitelist, the application's operation is allowed; otherwise, permission is requested from the user, allowing the user to decide whether to block the current operation. When an application initiates a permission request for a sensitive file, it is determined as abnormal behavior; this abnormality is called a file operation abnormality.

[0028] Furthermore, the program intent analysis module analyzes the operational behavior of applications in the whitelist to determine whether the program intent deviates from the user's intent, thereby detecting whether the programs in the whitelist have been maliciously tampered with. This invention collects and stores standard behavior sequences of various applications and ransomware behavior sequences, and performs behavior matching operations between the current program's real-time behavior sequence and both, obtaining two similarity values. The two similarity values ​​are compared to determine whether the program intent conforms to the user's intent. The similarity comparison method used is behavior matching. When the similarity between the current behavior and ransomware behavior is greater than or equal to the similarity with normal behavior, the program behavior is determined to be abnormal; this abnormality is called program intent abnormality.

[0029] Furthermore, the aforementioned anomaly classification and handling module assesses anomalies upon occurrence and, based on the user's capabilities, selects whether the user should handle the anomaly or report it to the cloud administrator for processing. The input to the anomaly classification and handling module is the anomaly details, including two types of anomalies: program intent anomalies and file operation anomalies, as well as the user's identity identifier, used to record the user's anomaly handling capabilities. This invention determines the anomaly level. When the user's capabilities allow for correct handling of the anomaly, a pop-up window informs the user of the anomaly details and requests secondary confirmation. When the anomaly level exceeds the user's handling capabilities, the client reports the anomaly to the server for processing by the cloud administrator. After anomaly handling is completed, this invention collects the processing results and updates and maintains the whitelist based on feedback.

[0030] Compared with the prior art, the positive effects of the present invention are as follows: Figure 1 As shown, specifically:

[0031] This invention provides finer-grained permission management for the file system. By refining permissions down to specific operations, it avoids situations where applications acquire permissions contrary to user intent due to overly coarse permission granting. Simultaneously, the timely revocation of permissions prevents potential dangers caused by applications retaining permissions after environmental changes.

[0032] This invention periodically analyzes the intent of whitelisted applications, preventing benign programs from retaining privileges after being tampered with and launching attacks without being identified. This invention uses behavior matching to calculate similarity, because ransomware behaviors share commonalities and can be easily distinguished from benign applications. The behavior matching calculation method is simple, reducing excessive time and space overhead caused by computation.

[0033] This invention employs a tiered approach to anomalies, preventing ransomware from exploiting vulnerabilities when users lack sufficient awareness and are unable to handle them correctly and promptly. Anomalies are assessed, and the user's capabilities are recorded. Anomalies that the user cannot handle are forwarded to the cloud administrator. This reduces the risk of anomalies being ignored after they occur. Attached Figure Description

[0034] Figure 1 This is a schematic diagram illustrating the advantages of the present invention.

[0035] Figure 2 This is a flowchart illustrating the overall process of the present invention.

[0036] Figure 3 This is a flowchart for determining abnormal behavior in this invention.

[0037] Figure 4 This is a flowchart of the decision-making process for the file system management module.

[0038] Figure 5 This is a flowchart of the determination process for the program intent analysis module.

[0039] Figure 6 This is a flowchart of the judgment process for the anomaly classification and handling module. Detailed Implementation

[0040] To make the objectives, solutions, and advantages of this invention clearer, an experiment conducted on the constructed attack model is used as an example to further illustrate the invention in detail. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of the invention.

[0041] The present invention discloses a ransomware defense method based on fine-grained access control, the overall process of which is as follows: Figure 2 As shown, this solution provides real-time monitoring of host application behavior and fine-grained control over application permissions to the file system. It also configures a whitelist to filter program behavior, ensuring that benign programs do not frequently request permissions. This solution includes application intent detection, which involves collecting standard application behavior sequences, storing and updating ransomware behavior sequences, and matching the application's real-time behavior sequences with these two types of sequences to promptly detect whether the program's intent deviates from the user's intent. This solution also features cloud-based monitoring; when program intent is abnormal or sensitive permissions are requested, cloud administrators take over the handling to reduce potential risks caused by improper handling of anomalies.

[0042] The abnormal behavior determination process of this invention is as follows: Figure 3 As shown. This invention enables fine-grained access to the file system by setting an authorization policy. The input to the authorization policy of this invention is the permission request initiated by the client host application and a whitelist. If the permission request exists in the whitelist, the application's operation is allowed; otherwise, permission is requested from the user, who decides whether to block the current operation. When an application initiates a permission request for sensitive files, it is judged as abnormal behavior. This invention also analyzes the operational behavior of applications in the whitelist to determine whether the program's intent deviates from the user's intent, in order to detect whether the programs in the whitelist have been maliciously tampered with. This invention collects and stores standard behavior sequences of various applications and ransomware behavior sequences, and performs behavior matching calculations on the current program's real-time behavior sequence with both, obtaining two similarity values. The two similarity values ​​are compared to determine whether the program's intent conforms to the user's intent. The similarity comparison method used is behavior matching. When the similarity between the current behavior and ransomware behavior is greater than or equal to the similarity with normal behavior, the program behavior is judged as abnormal.

[0043] The ransomware defense system based on fine-grained access control of the present invention can be divided into three functional modules: a file system management module, a program intent analysis module, and an anomaly classification and handling module, so as to protect the security of the host's file resources and handle anomalies quickly and correctly.

[0044] The processing flow of the file system management module is as follows: Figure 4 As shown, this module manages file system permissions using access control to prevent unauthorized access to any resources, ensuring that file resources are used within legal limits. This module enables fine-grained access to the file system by setting authorization policies. The input to the authorization policy is the permission request initiated by the client host application and a whitelist. If the permission request exists in the whitelist, the application's operation is allowed; otherwise, permission is requested from the user, who then decides whether to block the current operation. When an application initiates a permission request for a sensitive file, it is considered abnormal behavior.

[0045] The processing flow of the program intent analysis module is as follows: Figure 5 As shown, this module analyzes the operational behavior of applications in the whitelist to determine whether the program's intent deviates from the user's intent, thus detecting whether the programs in the whitelist have been maliciously tampered with. This module collects and stores standard behavior sequences of various applications and ransomware behavior sequences, and performs behavior matching operations between the current program's real-time behavior sequence and both. Specifically, it searches for sequences in both sets of behavior sequences that are similar or equal to the real-time behavior sequence, obtaining the maximum similarity for each, thus generating two similarity values. These two similarity values ​​are compared to determine whether the program's intent matches the user's intent. The similarity comparison method used is behavior matching. The similarity P between the current behavior and the ransomware behavior is... 勒 The similarity P between the current behavior and the normal behavior (standard behavior sequence) is greater than or equal to 1. 标 When this happens, the program is deemed to be behaving abnormally.

[0046] The processing flow of the exception classification handling module is as follows: Figure 6 As shown. This module evaluates exceptions when they occur and, based on the user's capabilities, chooses whether the user should handle the exception or report it to the cloud administrator for processing. The input for exception classification and handling is the exception details, including two types of exceptions: program intent exceptions and file operation exceptions, as well as the user's identity identifier P. U This is used to record the user's ability to handle exceptions. This invention will classify the exception level P of program intent exceptions. e The exception level P of file operation exceptions f A determination is made based on whether the user's capabilities allow for the correct handling of the exception (P). U ≥P e or P U ≥P fThis invention will display a pop-up window informing the user of the exception details and requesting secondary confirmation. When the exception level exceeds the user's handling capacity, the client will report the exception to the server for processing by the cloud administrator. After the exception is handled, this invention collects the processing results and updates and maintains the whitelist based on the feedback.

[0047] The following example, using photoshop.exe to delete the target file test.jpg, illustrates the specific implementation steps of the ransomware defense method based on fine-grained access control of this invention.

[0048] First, photoshop.exe initiates a permission request to delete test.jpg, which is monitored by this invention. This solution obtains the application path, file resource path, and operation type of this permission request. The permission request is compared with a whitelist. The whitelist allows photoshop.exe to read the file test.jpg, but not to delete it. This permission request is intercepted by this invention and awaits confirmation.

[0049] This invention assesses the sensitivity of operations on the file test.jpg and the user's capabilities. If the sensitivity is high, an exception is triggered; if the sensitivity is low, the user handles the exception, choosing to block the action or allow the program's current operation.

[0050] The behavior of whitelisted applications during normal operation (i.e., real-time behavior sequences) is also monitored and recorded in real time by this invention, and the behavior sequences of the programs are analyzed periodically.

[0051] When an application's file operation is deemed abnormal, this invention assesses and classifies the abnormality, determining whether it should be handled by the user or by the cloud administrator based on the user's processing capabilities.

[0052] For example, this invention periodically analyzes the behavior sequence of photoshop.exe, comparing the currently generated behavior sequence with the application's standard behavior sequence and ransomware behavior sequences. If the current behavior sequence involves numerous file read, write, and delete operations, accesses many different file types, and exhibits a high degree of similarity to ransomware behavior sequences, the program is deemed abnormal. This invention immediately halts all activity of the application and notifies the user of this anomaly via a pop-up window or uploads it to the cloud administrator. Based on the specific processing results, the cloud administrator maintains and updates the whitelist.

[0053] In this embodiment, other processes on the host were not significantly affected after application, while the user's host file resources were provably protected, demonstrating the usability and effectiveness of this invention in protecting local files.

[0054] In other embodiments of the present invention, the file system management module can use APIs related to file operations to monitor and filter file operations. The program intent analysis module can further consider information such as the temporal sequence of behaviors, and use methods such as decision trees to supervise the learning of benign behavior sequences, inputting past behavior sequences to determine the likelihood that the current operation might become an abnormal operation; simultaneously, the file operation sequence is stored as natural language and can be processed using relevant natural language processing algorithms, such as the Long Short-Term Memory (LSTM) algorithm, where each behavior can be input as a word, thus solving the problem of dependencies between distant behaviors and predicting the current behavior. The hierarchical processing module can be implemented using a Virtual Private Network (VPN) approach, which also enables encrypted communication and remote access.

[0055] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0056] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) storing a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0057] The above description is merely one embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A ransomware defense method based on fine-grained access control, characterized in that, Includes the following steps: It monitors the behavior of applications on the host in real time, controls the permissions of applications to the file system in fine granularity according to the authorization policy, and determines whether there are any abnormal file operation behaviors of the applications. Analyze application behavior to determine whether the application intent deviates from the user intent, and then determine whether the application behavior has abnormal program intent; When an application is found to have abnormal file operation behavior or abnormal program intent, the abnormality is handled in a graded manner, and the user can choose to handle the abnormality or report it to the cloud administrator for processing, depending on the user's ability. The analysis of application behavior to determine whether the application intent deviates from the user intent, and thus to determine whether the application behavior has abnormal program intent, includes: collecting the standard behavior sequence of applications in the whitelist and the behavior sequence of ransomware, and matching the real-time behavior sequence of the application with the two types of behavior sequences, so as to detect in a timely manner whether the application intent deviates from the user intent. If it deviates from the user intent, it is determined to be abnormal program intent. The behavior matching refers to behavior similarity analysis, which involves performing similarity calculations on the application's real-time behavior sequence and the ransomware's behavior sequence to obtain two similarity values. These two similarity values ​​are then compared to determine whether the application's intent matches the user's intent. If the similarity between the application's real-time behavior sequence and the ransomware's behavior sequence is greater than or equal to the similarity between the application's real-time behavior sequence and the application's standard behavior sequence, the application's behavior is deemed abnormal. The tiered handling of exceptions includes: details of input exceptions, including two types of exceptions: program intent exceptions and file operation exceptions, as well as the user identity identifier P. U It is used to record the user's exception handling capabilities; the exception level P for exceptions that deviate from the program's intended intent. e The exception level P of file operation exceptions f Make a judgment when P U ≥P e or P U ≥P f The system will inform the user of the anomaly details and request secondary confirmation; when the anomaly level exceeds the user's handling capacity, the client will report the anomaly to the server for processing by the cloud administrator; after the anomaly is handled, the processing results will be collected and the whitelist will be updated and maintained.

2. The method according to claim 1, characterized in that, The input to the authorization policy is the permission request initiated by the application on the client host and a whitelist. If the permission request exists in the whitelist, the application's operation is allowed; otherwise, permission is requested from the user, who then decides whether to block the current operation. When an application makes a permission request for a sensitive file, it is determined to be an abnormal file operation.

3. The method according to claim 1, characterized in that, The collection of standard behavioral sequences of applications in the whitelist and the behavioral sequences of ransomware includes: Run the application in the Windows sandbox and record its behavior in the following format: file type -> behavior name. Use the collected behavior sequences as the standard behavior sequences for the application. We collect typical file behaviors of ransomware as a sequence of ransomware behaviors. The format of ransomware behavior is: file type -> behavior name.

4. The method according to claim 1, characterized in that, The tiered handling of anomalies includes cloud-based monitoring functionality. When a program's intent is abnormal or it requests sensitive permissions, the cloud administrator takes over the handling to reduce potential risks caused by improper handling of anomalies.

5. The method according to claim 4, characterized in that, The cloud-based monitoring refers to the server-side administrator taking over exceptions that the client cannot handle and dynamically adjusting the whitelist based on the frequency of exception occurrences, thereby achieving dynamic management of the client host's applications.

6. A ransomware defense system based on fine-grained access control employing the method described in any one of claims 1 to 5, characterized in that, include: The file system management module is used to manage file system permissions using access control, including real-time monitoring of host application behavior, fine-grained control of application permissions to the file system based on authorization policies, and determination of whether there are any abnormal file operation behaviors in application behavior. The application intent analysis module is used to analyze the behavior of the application, determine whether the application intent deviates from the user intent, and thus determine whether the application behavior has abnormal application intent. The exception classification and handling module is used to classify and handle exceptions when it is determined that the application behavior has file operation exceptions or program intent exceptions. Depending on the user's ability, the user can choose to handle the exception or report it to the cloud administrator for processing.

7. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 5.

Images