Ransomware detection and defense methods, devices, equipment and media

Abstract

The embodiment of the present invention discloses a method, device, equipment and medium for detecting and defending against ransomware. The method includes: classifying the uplink and downlink messages transmitted by the IoT terminal device to obtain file data; if the file data is detected to contain suspected ransomware malicious programs or is confirmed to contain embedded ransomware, the file data is alarmed and isolated and killed, and internal threat intelligence is generated based on the file data; the internal threat intelligence is shared with the IoT cloud platform and other edge computing nodes for threat disposal; if the IoT cloud platform is detected to contain infection features of the ransomware, an alarm is triggered, and the connection between the IoT cloud platform and the IoT cloud platform and other edge computing nodes is disconnected. The present application realizes decentralized detection and defense against ransomware, ensures the security of IoT terminal devices and cloud IoT cloud platforms, and avoids the spread and diffusion of ransomware threats.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a method, device, equipment and medium for detecting and defending against ransomware. Background Art

[0002] In the era of the Internet of Everything, new technologies such as 5G, big data, and artificial intelligence have brought innovative vitality to the Internet of Things (IoT). The IoT is deeply integrated with personal and family life and industrial production, bringing profound changes to the whole society. With the rapid development of the IoT, the number of IoT devices has exploded, and the accompanying IoT security threats are also emerging in an endless stream. R4IoT is a new type of malware whose ultimate goal is to gain an initial foothold by exploiting exposed and vulnerable IoT devices (such as IP cameras) and then deploy ransomware in IT (information technology) networks, combining IoT entry points with lateral movement and encryption associated with ransomware, thereby causing widespread impact on IT and OT (operational technology) networks.

[0003] The current prevention method for ransomware is mainly to detect, block and kill ransomware through firewalls and EDR (Endpoint Detection and Response) products. However, centralized protection strategies have shortcomings. Ransomware is hidden and difficult to detect and defend. Once it breaks through the detection and defense of security products, it will easily spread horizontally and cause large-scale terminal infections. Especially in the face of the huge number of terminals in the Internet of Things scenario, the risk is particularly prominent. Summary of the invention

[0004] The embodiments of the present invention provide a method, apparatus, device and medium for detecting and defending against ransomware, aiming to ensure the security of IoT terminal devices and IoT cloud platforms and prevent the spread and diffusion of ransomware threats.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting and defending against ransomware, which is applied to any edge computing node in an Internet of Things system, and includes:

[0006] Classifying uplink and downlink messages transmitted by the IoT terminal device to obtain message classification results, wherein the message classification results include file data;

[0007] Isolate and detect the file data. If the detection finds that there is a suspected ransomware malicious program or confirms that the ransomware is embedded, issue an alarm and isolate and kill the file data, and generate internal threat intelligence based on the file data;

[0008] Sharing the internal threat intelligence with the IoT cloud platform and other edge computing nodes in the IoT system, so that the IoT cloud platform and other edge computing nodes perform threat handling according to the internal threat intelligence;

[0009] Periodically detect the key core files and system behaviors of the IoT cloud platform. If the detection finds the infection characteristics of the ransomware virus, an alarm is triggered, and the connection between itself and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform is disconnected.

[0010] In a second aspect, an embodiment of the present invention further provides a ransomware detection and defense device, which is applied to any edge computing node in an Internet of Things system, and includes:

[0011] A classification unit, used to classify uplink and downlink messages transmitted by the IoT terminal device to obtain message classification results, wherein the message classification results include file data;

[0012] A detection and generation unit is used to perform isolation detection on the file data. If the detection finds that there is a suspected ransomware malicious program or confirms that the ransomware is embedded, the file data is warned and isolated and killed, and internal threat intelligence is generated according to the file data;

[0013] A sharing unit, used to share the internal threat intelligence with the IoT cloud platform and other edge computing nodes in the IoT system, so that the IoT cloud platform and other edge computing nodes perform threat disposal according to the internal threat intelligence;

[0014] The detection and disconnection unit is used to perform periodic detection on the key core files and system behaviors of the IoT cloud platform. If the detection finds the infection characteristics of the ransomware virus, an alarm is triggered, and the connection between itself and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform is disconnected.

[0015] In a third aspect, an embodiment of the present invention further provides an edge computing device, which includes a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above method when executing the computer program.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program can implement the above method when executed by a processor.

[0017] The embodiment of the present invention provides a method, device, equipment and medium for detecting and defending against ransomware. The method includes: classifying the uplink and downlink messages transmitted by the IoT terminal device to obtain the message classification results, wherein the message classification results include file-type data; isolating and detecting the file-type data, and if the detection finds that there is a suspected ransomware malicious program or confirms that the ransomware is embedded, the file-type data is alarmed and isolated and killed, and internal threat intelligence is generated according to the file-type data; the internal threat intelligence is shared with the IoT cloud platform and other edge computing nodes in the IoT system, so that the IoT cloud platform and other edge computing nodes perform threat disposal according to the internal threat intelligence; periodically detecting the key core files and system behaviors of the IoT cloud platform, and if the detection finds that there are infection characteristics of the ransomware, an alarm is triggered, and the connection between itself and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform is disconnected. The technical solution of the embodiment of the present invention detects, defends against and disposes of ransomware at edge computing nodes, and realizes decentralized detection and defense of ransomware based on the linkage between distributed edge computing nodes and between edge computing nodes and the Internet of Things cloud platform, thereby ensuring the security of Internet of Things terminal devices and cloud-based Internet of Things cloud platforms and avoiding the spread and diffusion of ransomware threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0019] Figure 1 A schematic diagram of a process flow of a method for detecting and defending against ransomware provided by an embodiment of the present invention;

[0020] Figure 2 A simplified flowchart of a method for detecting and defending against ransomware provided in an embodiment of the present invention;

[0021] Figure 3 A schematic diagram of a ransomware detection and defense system provided by an embodiment of the present invention;

[0022] Figure 4 A schematic block diagram of a ransomware detection and defense device provided by an embodiment of the present invention;

[0023] Figure 5 A schematic block diagram of an edge computing device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0026] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0027] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0028] As used in this specification and the appended claims, the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if [described condition or event] is detected" may be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0029] See also Figure 1 , Figure 1 It is a flow chart of a method for detecting and defending against ransomware provided by an embodiment of the present invention. The method for detecting and defending against ransomware of an embodiment of the present invention can be applied to any edge computing node in an Internet of Things system, wherein the edge computing node is an edge computing device, for example, the method for detecting and defending against ransomware can be implemented by a software program configured on the edge computing device. It should be noted that the Internet of Things system includes an Internet of Things terminal device, an edge computing node, and an Internet of Things cloud platform. The method for detecting and defending against ransomware includes the following steps S110-S140.

[0030] S110. Classify uplink and downlink messages transmitted by the IoT terminal device to obtain message classification results, wherein the message classification results include file data.

[0031] In an embodiment of the present invention, in view of the fact that malicious programs are easily hidden in files, the uplink and downlink messages transmitted by the IoT terminal device in the edge computing node are classified to obtain a message classification result, wherein the message classification result includes file-type data and ordinary data; the data type and data content of the ordinary data are detected for abnormality to obtain an abnormal detection result; if there is abnormal data in the abnormal detection result, the abnormal data is intercepted and an alarm is given; it is understandable that if there is no abnormal data in the abnormal detection result, the abnormal data is not intercepted and an alarm is given. It should be noted that, in the present embodiment, the edge computing node is, for example, an edge computing gateway in an IoT system. It should also be noted that, in the present embodiment, the data type and data content of the ordinary data are detected for abnormality through preset detection rules to obtain an abnormal detection result.

[0032] S120: Isolate and detect the file data. If the detection finds that there is a suspected ransomware malicious program or confirms that the ransomware is embedded, issue an alarm and isolate and kill the file data, and generate internal threat intelligence based on the file data.

[0033] In an embodiment of the present invention, for file-type data, the file-type data is isolated and detected. Specifically, external threat intelligence is obtained, and the file-type data is isolated and detected in combination with the external threat intelligence, threat feature analysis, file behavior analysis, and ransomware trapping, wherein the external threat intelligence includes domain name, IP address, and other information. If the detection finds that there is a suspected ransomware malicious program in the file-type data or confirms that the ransomware is embedded, the file-type data is alarmed and isolated and killed, and internal threat intelligence is generated according to the file-type data. Further, the threat intelligence is generated according to the file-type data, including: extracting the file-type data and the features of the ransomware module in the file-type data to obtain the file ransomware features; recording the information of the Internet of Things terminal device where the file-type data is located to obtain the terminal device information; and summarizing the file ransomware features and the terminal device information to generate the internal threat intelligence. It should be noted that in this embodiment, when the file-type data is isolated and detected, it is necessary to combine the external threat intelligence, the threat feature analysis, the file behavior analysis, and the ransomware trapping for a comprehensive analysis to improve the accuracy of isolation detection. It should also be noted that, in the present embodiment, the file-type data is isolated and checked, which may specifically include terminating related processes, deleting related files, and other checking and killing operations; during the isolation and checking of the file-type data, the file-type data will be disconnected from the IoT terminal device.

[0034] S130. Share the internal threat intelligence with the IoT cloud platform and other edge computing nodes in the IoT system, so that the IoT cloud platform and other edge computing nodes perform threat disposal according to the internal threat intelligence.

[0035] In an embodiment of the present invention, after generating the internal threat intelligence, the edge computing node shares the internal threat intelligence with the IoT cloud platform and other edge computing nodes in the IoT system, so that the IoT cloud platform and other edge computing nodes perform threat disposal based on the internal threat intelligence. Specifically, suspected ransomware malicious programs or malicious codes are disposed of and alerted based on the internal threat intelligence.

[0036] Furthermore, after the internal threat intelligence is shared with the IoT cloud platform and other edge computing nodes in the IoT system, the database in the IoT cloud platform will be updated according to the internal threat intelligence, wherein the database stores a variety of threat intelligence, including ransomware feature information, system asset vulnerability identification, the internal threat intelligence generated by the edge computing node, and terminal device information of malicious programs.

[0037] S140, periodically checking the key core files and system behaviors of the IoT cloud platform. If the detection finds the infection characteristics of the ransomware virus, an alarm is triggered, and the connection between itself and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform is disconnected.

[0038] In an embodiment of the present invention, the key core files and system behaviors of the IoT cloud platform are periodically detected, wherein the key core files include core files and database files; the system behaviors include system backups, system services, and port scanning behaviors; specifically, if it is detected that the core files and the database files are encrypted, the system backups are deleted, the system services are interrupted, and there are a large number of port scanning behaviors, then it is determined that the IoT cloud platform has the infection characteristics of the ransomware virus. Understandably, if the detection finds that the IoT cloud platform has the infection characteristics of the ransomware virus, an alarm is triggered, and the connection between itself and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform are disconnected.

[0039] Furthermore, after disconnecting the connection between itself and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform, the uplink and downlink messages are cached; if the edge computing node detects that the ransomware threat in the IoT cloud platform is lifted, the cached uplink and downlink messages are uploaded to the IoT cloud platform.

[0040] See also Figure 2 , Figure 2 A flowchart of a method for detecting and defending against ransomware provided by an embodiment of the present invention is provided. Figure 2 In the embodiment of the present invention, the ransomware detection and defense method includes three steps, namely, message classification detection, threat isolation disposal and threat intelligence synchronization. During message classification detection, the uplink and downlink messages transmitted by the IoT terminal device are divided into file data and ordinary data; threat isolation disposal is to detect and kill suspected ransomware malicious programs or ransomware, and disconnect the IoT terminal device; threat intelligence synchronization is to share the generated internal threat intelligence with other edge computing nodes and the IoT cloud platform.

[0041] For ease of understanding, the detection and defense methods of ransomware are described through the following specific examples:

[0042] Classify and detect the uplink and downlink messages transmitted by IoT terminal devices, such as Figure 3As shown, the IoT terminal device type selects a 5G CPE device with stronger functions. The IoT terminal device is connected to the IoT edge computing node B. At the same time, there is an IoT edge computing node A. The edge computing node A and the edge computing node B are interconnected and connected to the IoT cloud platform respectively. The parameter table of the 5G CPE device is shown in the following table:

[0043] Table 1 is the parameter table of 5GCPE equipment

[0044] Parameter name Data Types Parameter name Data Types CPE Model string Network latency double CPU Int32 Packet loss double Memory Int32 Jitter double disk Int32 Online Status enum System version information string Online time float CPU utilization float rsrp float Memory Utilization float rsrq float Uplink and downlink speed float sinr float Disk Utilization float Community Information string io usage double Fault log .log Files

[0045] Edge computing node B performs virtualization isolation detection on the fault log file 20230821.log.vir uploaded by the 5GCPE device, and detects whether the fault log file 20230821.log.vir is maliciously embedded with a ransomware virus by means of file suffix detection, file behavior analysis (disk traversal, process termination, file encryption, recycle bin emptying, port scanning, vulnerability exploitation), and releasing bait files. After detection, it was found that the suffix of the fault log file 20230821.log.vir was an abnormal suffix, and a new module file backdoor_virus was released at the same time. The module file backdoor_virus has disk traversal, file encryption, and port scanning. It is determined that the fault log file 20230821.log.vir is maliciously embedded with the ransomware program backdoor_virus. The edge computing node immediately takes isolation and killing measures and issues an alarm. At the same time, edge computing node A and / or edge computing node B periodically monitor and analyze the key core files and system behaviors of the IoT cloud platform, and find that the core files and database files of the IoT cloud platform are encrypted, the system backup is deleted, and the business is interrupted. A large number of port scanning behaviors are detected, and it is determined that the IoT cloud platform has been infected with a ransomware virus and the IoT system has collapsed. Edge computing node A and edge computing node B immediately disconnect from the cloud platform to protect the security of the terminal device, and cache the data uploaded by the terminal device.

[0046] Edge computing node B extracts the features of the fault log file 20230821.log.vir and the module file backdoor_virus, including the file name, suffix, file size, malicious process name, and disk traversal path features, and records the terminal device 5GCPE information, including device type, model, operating system, components and middleware, IP address, and open ports, etc. The above information is aggregated to generate internal threat intelligence, and synchronized to edge computing node A and the IoT cloud platform. Edge computing node A and the IoT cloud platform use internal threat intelligence to detect suspicious files, and focus on monitoring the same type of 5GCPE devices. Malicious files that hit the threat intelligence features are directly isolated and killed.

[0047] It should be noted that, in this embodiment, the ransomware risk detection of the IoT system is moved from traditional cloud-based centralized detection to the network edge computing nodes, effectively blocking the spread of security risks; threat intelligence is synchronized between edge computing nodes and between edge computing nodes and the IoT cloud platform to achieve a global response to a single alarm, and to efficiently and quickly curb the spread of the virus; in the face of extreme scenarios where the IoT cloud platform has been infected with a ransomware virus, all edge computing nodes are linked to disconnect all connections with the IoT cloud platform to protect IoT terminal devices from infection, curb the spread of the virus, and cache data reported by IoT terminal devices to reduce losses caused by business data loss.

[0048] Figure 4 2 is a schematic block diagram of a ransomware detection and defense device 200 provided in an embodiment of the present invention. Figure 4 As shown, corresponding to the above ransomware virus detection and defense method, the present invention also provides a ransomware virus detection and defense device 200. The ransomware virus detection and defense device 200 includes a unit for executing the above ransomware virus detection and defense method. Figure 4 The ransomware detection and defense device 200 includes a classification unit 201, a detection generation unit 202, a sharing unit 203, and a detection disconnection unit 204.

[0049] Among them, the classification unit 201 is used to classify the uplink and downlink messages transmitted by the Internet of Things terminal device to obtain a message classification result, wherein the message classification result includes file-type data; the detection generation unit 202 is used to isolate and detect the file-type data. If the detection finds that there is a suspected ransomware malicious program or confirms that the ransomware is embedded, the file-type data is alarmed and isolated and killed, and internal threat intelligence is generated based on the file-type data; the sharing unit 203 is used to share the internal threat intelligence with the Internet of Things cloud platform and other edge computing nodes in the Internet of Things system, so that the Internet of Things cloud platform and other edge computing nodes perform threat disposal according to the internal threat intelligence; the detection disconnection unit 204 is used to periodically detect the key core files and system behaviors of the Internet of Things cloud platform. If the detection finds that there are infection characteristics of the ransomware, an alarm is triggered, and the connection between itself and the Internet of Things cloud platform and the connection between other edge computing nodes and the Internet of Things cloud platform are disconnected.

[0050] In some embodiments, such as the present embodiment, the detection generation unit 202 includes an acquisition detection unit, an extraction unit, a recording unit, and a summary generation unit.

[0051] Among them, the acquisition and detection unit is used to obtain external threat intelligence, and isolate and detect the file-type data in combination with the external threat intelligence, threat feature analysis, file behavior analysis and ransomware trapping; the extraction unit is used to extract the file-type data and the features of the ransomware module in the file-type data to obtain file ransomware features; the recording unit is used to record the information of the Internet of Things terminal device where the file-type data is located to obtain terminal device information; the summary generation unit is used to summarize the file ransomware features and the terminal device information to generate the internal threat intelligence.

[0052] In some embodiments, such as this embodiment, the disconnection detection unit 204 includes a detection determination unit.

[0053] Among them, the detection and judgment unit is used to determine that the Internet of Things cloud platform has the infection characteristics of the ransomware virus if it is detected that the core file and the database file are encrypted, the system backup is deleted, the system service is interrupted, and there are a large number of port scanning behaviors.

[0054] In some embodiments, such as the present embodiment, the ransomware detection and defense device 200 further includes an anomaly detection unit, an interception alarm unit, an update unit, a cache unit, and a detection upload unit.

[0055] Among them, the anomaly detection unit is used to perform anomaly detection on the data type and data content of the ordinary data to obtain anomaly detection results; the interception and alarm unit is used to intercept and alarm the abnormal data if there is abnormal data in the anomaly detection result; the update unit is used to update the database in the Internet of Things cloud platform according to the internal threat intelligence, wherein the database stores a variety of threat intelligence, and the threat intelligence includes ransomware feature information, system asset vulnerability identification, the internal threat intelligence generated by the edge computing node, and terminal device information of malicious programs; the cache unit is used to cache the uplink and downlink messages; the detection upload unit is used to upload the cached uplink and downlink messages to the Internet of Things cloud platform if it is detected that the ransomware threat in the Internet of Things cloud platform is lifted.

[0056] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned ransomware detection and defense device 200 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and brevity of description, it will not be repeated here.

[0057] The above-mentioned ransomware detection and defense device can be implemented in the form of a computer program, which can be used in Figure 5 Running on the edge computing device shown.

[0058] See also Figure 5 , Figure 5 1 is a schematic block diagram of an edge computing device provided in an embodiment of the present application. The edge computing device 900 is a device capable of detecting and defending against ransomware.

[0059] See also Figure 5 The edge computing device 900 includes a processor 902, a memory and an interface 907 connected via a system bus 901, wherein the memory may include a storage medium 903 and an internal memory 904.

[0060] The storage medium 903 may store an operating system 9031 and a computer program 9032. When the computer program 9032 is executed, the processor 902 may execute the above-mentioned ransomware virus detection and defense method.

[0061] The processor 902 is used to provide computing and control capabilities to support the operation of the entire edge computing device 900.

[0062] The internal memory 904 provides an environment for the operation of the computer program 9032 in the storage medium 903. When the computer program 9032 is executed by the processor 902, the processor 902 can execute a method for detecting and defending against ransomware.

[0063] The interface 905 is used to communicate with other devices. Those skilled in the art will appreciate that Figure 5 The structure shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the edge computing device 900 to which the scheme of the present application is applied. The specific edge computing device 900 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0064] The processor 902 is used to run a computer program 9032 stored in the memory to implement the process steps of the embodiment of the above method.

[0065] It should be understood that in the embodiment of the present application, the processor 902 may be a central processing unit (CPU), and the processor 902 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0066] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing related hardware through a computer program. The computer program can be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the wireless communication system to implement the process steps of the embodiment of the above method.

[0067] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program. When the computer program is executed by a processor, the processor executes any embodiment of the above-mentioned ransomware detection and defense method.

[0068] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0069] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, wireless communication software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0070] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0071] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0072] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or partly contributed to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The wireless communication software product is stored in a storage medium, including several instructions for enabling an edge computing device (which can be a personal wireless communication, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0073] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0074] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0075] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for detecting and defending against ransomware, applied to any edge computing node in an Internet of Things system, characterized in that: include: Classifying uplink and downlink messages transmitted by the IoT terminal device to obtain message classification results, wherein the message classification results include file data and general data; The file data is isolated and tested. If the detection finds that there is a suspected ransomware malicious program or confirms that the ransomware is embedded, the file data is warned and isolated and killed, and internal threat intelligence is generated according to the file data. The suspected ransomware malicious program or malicious code is handled and warned according to the internal threat intelligence; Share the internal threat intelligence with the IoT cloud platform and other IoT systems Edge computing nodes, so that the IoT cloud platform and other edge computing nodes perform threat handling according to the internal threat intelligence; Perform periodic detection on the key core files and system behaviors of the IoT cloud platform. If the detection finds the infection characteristics of the ransomware virus, an alarm is triggered, and the connection between itself and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform is disconnected; The isolating and detecting the file data includes: Obtain external threat intelligence, and perform isolation detection on the file data by combining the external threat intelligence, threat feature analysis, file behavior analysis, and ransomware trapping, wherein the external threat intelligence includes domain names and IP addresses; The generating of internal threat intelligence according to the file data includes: Extract the file data and the features of the ransomware virus module in the file data to obtain the file ransomware virus module. Characteristics of the virus; Record the information of the IoT terminal device where the file data is located to obtain the terminal device information; Aggregating the file ransomware virus features and the terminal device information to generate the internal threat intelligence; The method further comprises: Performing anomaly detection on the data type and data content of the ordinary data to obtain an anomaly detection result; If there is abnormal data in the abnormal detection result, intercept and alarm the abnormal data; The key core files include core files and database files; the system behaviors include system backup, system services, and port scanning behaviors; the periodic detection of the key core files and system behaviors of the Internet of Things cloud platform includes: If it is detected that the core file and the database file are encrypted, the system backup is deleted, the system service is interrupted, and there are a large number of port scanning behaviors, it is determined that the Internet of Things cloud platform has the infection characteristics of the ransomware virus.

2. The method for detecting and defending against ransomware according to claim 1, characterized in that: After the internal threat intelligence is shared with the IoT cloud platform and other edge computing nodes in the IoT system so that the IoT cloud platform and other edge computing nodes perform threat handling according to the internal threat intelligence, the method further includes: The database in the IoT cloud platform is updated according to the internal threat intelligence, wherein the database stores a variety of threat intelligence, including ransomware feature information, system asset vulnerability identification, the internal threat intelligence generated by the edge computing node, and terminal device information of malicious programs.

3. The method for detecting and defending against ransomware according to claim 1, characterized in that: The method further includes: performing periodic detection on the key core files and system behaviors of the IoT cloud platform, and triggering an alarm if the detection finds the infection characteristics of the ransomware virus, and disconnecting the connection between the edge computing node and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform. Buffering the uplink and downlink messages; If it is detected that the ransomware threat in the IoT cloud platform is lifted, the cached uplink and downlink messages are uploaded to the IoT cloud platform.

4. A ransomware detection and defense device, applied to any edge computing node in an Internet of Things system, characterized in that: include: A classification unit, used to classify uplink and downlink messages transmitted by the IoT terminal device to obtain message classification results, wherein the message classification results include file data and ordinary data; A detection and generation unit is used to perform isolation detection on the file data. If the detection finds that there is a suspected ransomware malicious program or confirms that the ransomware is embedded, the file data is warned and isolated and killed, and internal threat intelligence is generated according to the file data, wherein the suspected ransomware malicious program or malicious code is handled and warned according to the internal threat intelligence; A sharing unit, used to share the internal threat intelligence with the IoT cloud platform and other edge computing nodes in the IoT system, so that the IoT cloud platform and other edge computing nodes perform threat disposal according to the internal threat intelligence; A detection and disconnection unit, used for periodically detecting key core files and system behaviors of the IoT cloud platform, and triggering an alarm if the detection finds the presence of infection features of the ransomware virus, and disconnecting the connection between itself and the IoT cloud platform and the connection between other edge computing nodes and the IoT cloud platform; Wherein, the detection generation unit includes: An acquisition detection unit is used to acquire external threat intelligence, and isolate and detect the file data by combining the external threat intelligence, threat feature analysis, file behavior analysis, and ransomware trapping, wherein the external threat intelligence includes domain names and IP addresses; An extraction unit, used to extract the file data and features of a ransomware virus module in the file data to obtain file ransomware virus features; A recording unit, used for recording information of the IoT terminal device where the file data is located to obtain terminal device information; A summary generation unit, used to summarize the file ransomware virus features and the terminal device information to generate the internal threat intelligence; The device also includes: An anomaly detection unit, used to perform an anomaly detection on the data type and data content of the common data to obtain an anomaly detection result; An interception and alarm unit, configured to intercept and alarm the abnormal data if there is abnormal data in the abnormal detection result; The key core files include core files and database files; the system behaviors include system backup, system services and port scanning behaviors; the disconnection detection unit includes: The detection and determination unit is used to determine that the IoT cloud platform has infection characteristics of the ransomware virus if it is detected that the core file and the database file are encrypted, the system backup is deleted, the system service is interrupted, and there are a large number of port scanning behaviors.

5. An edge computing device, characterized in that: The edge computing device includes a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 3 when executing the computer program.

6. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 3 can be implemented.

Images