A data extraction method for defending against ransomware based on file system directory table

Abstract

The present invention discloses a data extraction method for defending against ransomware based on a file system directory table, which comprises: a ransomware defense program extracts computer hardware information to generate a key, and then encrypts the INDX table sector corresponding to a protected folder according to the key; when the computer is attacked by a ransomware, in a safe and non-toxic system environment, the ransomware defense program is installed, the key is imported, the INDX table sector corresponding to the protected folder is decrypted, and the data backed up in the folder is extracted. The present invention can effectively block virus attacks and quickly and safely extract backed-up data.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data extraction method for defending against ransomware based on a file system directory table. Background Art

[0002] As the RaaS (Ransomware as a Service) model matures, ransomware developers provide tools to interested malicious actors so that they can launch ransomware attacks. Although the ransomware rollback function has been developed, the essence is to back up files to the C:\System Volume Information\ directory, and large files cannot be backed up. This directory is the system volume information folder of the WINDOWS operating system. Under normal circumstances, it is inaccessible and files in this directory cannot be read or written. Based on this principle, after the privilege is elevated, the backup data is written to the C:\SystemVolume Information\ directory to protect the data from being encrypted. However, the first step of most ransomware encryption attacks is to elevate privileges to obtain access rights to all directories, then traverse the disk to establish a directory tree to be attacked, and finally start the multi-threaded encryption process. Therefore, the above method is not enough to protect data from being encrypted by ransomware, and it is not effective to store data in the ransomware encryption whitelist directory (such as C:\WINDOWS\, C:\Program Files). Virus attackers can create more refined whitelist directories at any time to make the above method invalid. Summary of the invention

[0003] In view of this, the present invention provides a data extraction method for defending against ransomware based on a file system directory table.

[0004] The present invention discloses a data extraction method for defending against ransomware based on a file system directory table, which comprises:

[0005] Step 1: The ransomware protection program extracts computer hardware information to generate a key, and then encrypts the INDX table sector corresponding to the protected folder based on the key;

[0006] Step 2: When the computer is attacked by a ransomware virus, install a ransomware protection program in a safe and non-toxic system environment, import the key, decrypt the INDX table sector corresponding to the protected folder, and extract the backed-up data in the folder.

[0007] Furthermore, the step 1 comprises:

[0008] Step 11: Install the ransomware protection program at the file system layer, and set parameters according to the ransomware protection program guidance; the parameters include the protected folder path, automatic backup source file\folder path, synchronization rules, and synchronization time; the protected folder path selects the partition root directory folder;

[0009] Step 12: The ransomware protection program generates an asymmetric algorithm private key based on the computer's hardware ID. The ransomware protection program encrypts the INDX table sector corresponding to the protected folder using an asymmetric encryption algorithm. After encryption, the file system layer is completely inaccessible through the protected folder, thereby blocking the ransomware encryption attack.

[0010] The step 1 also includes:

[0011] After decrypting the INDX table corresponding to the protected folder, it takes effect immediately. When you access the protected folder again, you can read and write files in the directory corresponding to the protected file without restarting the operating system or the hard disk.

[0012] Further, the step 12 comprises:

[0013] The ransomware defense program generates an asymmetric algorithm private key based on the computer's hardware ID; after writing the private key into the encryption dongle that comes with the ransomware defense program or exporting the private key into a file for the user to store, and writing it into the built-in database of the ransomware defense program, the ransomware defense program begins to encrypt the INDX table sector corresponding to the protected folder using an asymmetric encryption algorithm based on the computer's hardware ID. After the encryption is completed, the file system layer is completely inaccessible through the protected folder, resulting in the ransomware being unable to generate a directory tree to be attacked for the files under the protected folder and all the files in its subfolders, thereby blocking the ransomware encryption attack.

[0014] Furthermore, after step 1 and before step 2, the method further includes:

[0015] Step 101: Before each user backs up data, the ransomware protection program writes the MDF database file according to the standard template library to verify whether the file name, file size and file hexadecimal code of the MDF database file are consistent with the built-in template library; if there is any inconsistency, go to step 2; if all are consistent, go to step 102;

[0016] Step 102: After the data synchronization is completed, the ransomware protection program uses an asymmetric algorithm to encrypt the INDX table sector corresponding to the protected folder according to the computer's hardware ID, making it inaccessible and giving a prompt: the file or directory is damaged and cannot be read.

[0017] Furthermore, the step 101 further includes:

[0018] After verification, the ransomware protection program calls the private key in the database to decrypt the INDX table sector corresponding to the protected folder at the specified time according to the automatic backup parameters set by the user, and then compresses the data using a compression algorithm and writes it to the protected folder based on the source file and folder path specified by the user and the synchronization rules set by the user.

[0019] Furthermore, the step 2 comprises:

[0020] Step 201: After discovering that the computer is infected with a ransomware virus, first check and kill the virus to confirm that there is no active virus in the computer or install the hard disk and ransomware virus protection program on a safe and virus-free isolated network computer;

[0021] Step 202: Import the key, decrypt the INDX table sector corresponding to the folder protected by the ransomware protection program, decrypt the INDX table sector corresponding to the protected folder, and after the decryption is completed, the directory corresponding to the protected folder can be accessed normally to extract data.

[0022] Furthermore, after step 201 and before step 202, the method further includes:

[0023] The ransomware protection program writes a verification file for verification.

[0024] Furthermore, the ransomware protection program writes a verification file for verification, including:

[0025] The MDF database file is written according to the standard template library built into the ransomware protection program. After the MDF database file is written, the ransomware protection program waits for a preset time and then verifies whether the file name, file size and file hexadecimal code of the MDF database file are consistent with the built-in template library;

[0026] If there is any inconsistency, return to step 201; if all are consistent, go to step 202.

[0027] Furthermore, the step 202 includes:

[0028] Import the private key in the dongle or saved by the user, decrypt the INDX table sector corresponding to the protected folder, and the directory can be accessed normally after the decryption is completed;

[0029] The ransomware protection program calls the compression algorithm to decompress the files in the directory and extract the backup data in the files in the directory.

[0030] Due to the adoption of the above technical solution, the present invention has the following advantages: the present invention is suitable for use by individuals and small enterprises, has low cost, does not require high software, hardware and labor costs, has high reliability, and is based on the working principle of the file system to block the ransomware virus from traversing the disk to generate an attack directory tree. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0032] Figure 1 This is a schematic diagram of an encrypted TEXT folder according to an embodiment of the present invention;

[0033] Figure 2 This is a schematic diagram of data that can be accessed immediately after decryption of a TEXT folder according to an embodiment of the present invention;

[0034] Figure 3 The present invention is a flowchart of a method for extracting data based on a file system directory table to defend against ransomware. DETAILED DESCRIPTION

[0035] The present invention is further described in conjunction with the accompanying drawings and embodiments, and the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present invention.

[0036] The main purpose of this invention is to propose a data backup method for individuals and small business users based on the operating principle of the file system, with controllable costs and high reliability, in response to the behavior of ransomware viruses traversing the disk to establish a directory tree to be attacked before encryption. Figure 3 The present invention provides an embodiment of a data extraction method for defending against ransomware based on a file system directory table, which includes:

[0037] In most cases, users use the WINDOWS operating system, so the present invention uses the NTFS (Microsoft Journal File System) file system, which is the most widely used, as an example. The INDX (index file table) corresponding to the TEXT folder in the root directory is encrypted. After encryption, the folder cannot be accessed, and it prompts that the file or directory is damaged and cannot be read. Figure 1As shown in the figure, the ransomware cannot access the directory at the file system level and cannot obtain the TrustedInstaller (trusted security subject) permission to access the directory, so the ransomware cannot encrypt the files in the directory. After decrypting the INDX table corresponding to the TEXT folder, it will take effect immediately. When you access the folder again, you can read and write files in the directory, such as Figure 2 As shown, there is no need to restart the operating system or restart the hard disk.

[0038] Specifically, this embodiment includes: the ransomware protection program extracts computer hardware information to generate a key, and then encrypts the INDX table sector corresponding to the protected folder according to the key. When the computer is attacked by a ransomware virus, in a safe and non-toxic system environment, the ransomware protection program is installed, the key is imported, the INDX table sector corresponding to the folder protected by the ransomware protection program is decrypted, and the backup data in the folder is extracted. The specific steps are as follows:

[0039] S1: Install the ransomware protection program at the file system level, and follow the instructions of the ransomware protection program to set the protected folder path (it is recommended to select the partition root folder), automatic backup source file\folder path, synchronization rules, synchronization time and other parameters.

[0040] S2: After the ransomware protection program is set up, the ransomware protection program will generate an asymmetric algorithm private key based on the computer's hardware ID (identification number). After writing the key into the encryption dongle that comes with the ransomware protection program (to further reduce costs, the private key can also be exported as a file for the user to store properly) and the ransomware protection program's built-in database, the ransomware protection program will begin to encrypt the INDX table sector corresponding to the protected folder using an asymmetric encryption algorithm based on the computer's hardware ID (identification number). After the encryption is completed, the folder will be completely inaccessible from the file system layer. Since the ransomware cannot access this folder by any means when traversing the disk, it is also impossible to generate a directory tree to be attacked for all files in the folder and subfolders, thereby blocking the ransomware encryption attack.

[0041] S3: In daily use, before backing up data each time, the ransomware protection program will write a 50MB MDF database file to the operating system desktop according to its built-in standard template library. After the file is written, the ransomware protection program will wait for 300 seconds. After the 300-second countdown is completed, three verifications will be performed, namely, the file name, file size, and file hexadecimal code will be compared according to the built-in template library. (Ransomware encryption attacks use special encryption logic for files in special paths or similar MDF database files. Most file header encryption attack ransomware completely encrypts files in the desktop directory. Even if the file exceeds the threshold, only a certain number of sectors in the file header need to be partially encrypted in other paths, and it will still be completely encrypted on the desktop.) If any of the three verifications fails, proceed to S5; if all three verifications pass, the ransomware protection program will automatically backup the parameters set by the user, call the private key in the database at the specified time to decrypt the INDX table sector corresponding to the protected folder, and then compress the data using a compression algorithm according to the user-specified source file, folder path, and synchronization rules set by the user, and write it to the protected folder.

[0042] S4: After data synchronization is completed, the ransomware protection program will encrypt the INDX table sector corresponding to the protected folder using an asymmetric algorithm based on the computer's hardware ID (identification number), making it inaccessible and prompting: the file or directory is damaged and cannot be read.

[0043] S5: After discovering that the computer is infected with a ransomware virus, first check and kill the virus to confirm that there are no active viruses in the computer or install the hard disk and ransomware protection program on a safe and virus-free isolated network computer.

[0044] S6: Use the ransomware protection program to extract data from a hard drive infected with ransomware. Before data extraction, the ransomware protection program will write a verification file for verification. According to the standard template library built into the ransomware protection program, a 50MB MDF database file will be written to the operating system desktop. After the MDF database file is written, the ransomware protection program will wait for a 300-second countdown to complete, and then compare the file name, file size, and file hexadecimal code according to the built-in template library. If there is any inconsistency after the comparison, return to S5.

[0045] S7: If all are consistent after comparison, the private key in the dongle or saved by the user is imported to decrypt the INDX table sector corresponding to the protected folder. After the decryption is completed, the directory can be accessed normally.

[0046] S8: The ransomware protection program calls the compression algorithm to decompress the files in the directory and complete the data extraction.

[0047] The present invention is a method suitable for individuals and small businesses, with low cost, no high software, hardware and labor costs, high reliability, and based on the working principle of the file system, to block the ransomware virus from traversing the disk to generate an attack directory tree. It is not limited to the operating system. This article only uses NTFS as an example. Other operating systems such as Linux, Ubuntu, Kylin, and Tongxin use EXT2, EXT3, EXT4, REFS, UFS, APFS, HFS, HFS+, and various domestic log-type file systems and tree-like file systems.

[0048] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A data extraction method for defending against ransomware based on a file system directory table, characterized in that: include: Step 1: The ransomware protection program extracts computer hardware information to generate a key, and then encrypts the INDX table sector corresponding to the protected folder based on the key; Step 2: When the computer is attacked by ransomware, install the ransomware protection program in a safe and virus-free system environment, import the key, decrypt the INDX table sector corresponding to the protected folder, and extract the backed-up data in the folder; After step 1 and before step 2, the method further includes: Step 101: Each time before the user backs up data, the ransomware protection program writes the MDF database file according to the standard template library and verifies whether the file name, file size and file hexadecimal code of the MDF database file are consistent with the built-in template library; If there is any inconsistency, go to step 2, if all are consistent, go to step 102; Step 102: After the data synchronization is completed, the ransomware protection program uses an asymmetric algorithm to encrypt the INDX table sector corresponding to the protected folder according to the computer's hardware ID, making it inaccessible and giving a prompt: the file or directory is damaged and cannot be read.

2. The method according to claim 1, characterized in that The step 1 comprises: Step 11: Install the ransomware protection program at the file system layer, and set parameters according to the ransomware protection program guidance; the parameters include the protected folder path, automatic backup source file\folder path, synchronization rules, and synchronization time; the protected folder path selects the partition root directory folder; Step 12: The ransomware protection program generates an asymmetric algorithm private key based on the computer's hardware ID. The ransomware protection program encrypts the INDX table sector corresponding to the protected folder using an asymmetric encryption algorithm. After encryption, the file system layer is completely inaccessible through the protected folder, thereby blocking the ransomware encryption attack.

3. The method according to claim 2, characterized in that The step 12 comprises: The ransomware defense program generates an asymmetric algorithm private key based on the computer's hardware ID; after writing the private key into the encryption dongle that comes with the ransomware defense program or exporting the private key into a file for the user to store, and writing it into the built-in database of the ransomware defense program, the ransomware defense program begins to encrypt the INDX table sector corresponding to the protected folder using an asymmetric encryption algorithm based on the computer's hardware ID. After the encryption is completed, the file system layer is completely inaccessible through the protected folder, resulting in the ransomware being unable to generate a directory tree to be attacked for the files under the protected folder and all the files in its subfolders, thereby blocking the ransomware encryption attack.

4. The method according to claim 1, characterized in that: The step 1 also includes: After decrypting the INDX table corresponding to the protected folder, it takes effect immediately. When you access the protected folder again, you can read and write files in the directory corresponding to the protected file without restarting the operating system or the hard disk.

5. The method according to claim 1, characterized in that: The step 101 further includes: After verifying that the file name, file size and file hexadecimal code of the MDF database file are consistent with the built-in template library, the ransomware protection program calls the private key in the database at the specified time to decrypt the INDX table sector corresponding to the protected folder according to the automatic backup parameters set by the user, and then compresses the data using a compression algorithm and writes it to the protected folder based on the source file and folder path specified by the user and the synchronization rules set by the user.

6. The method according to claim 1, characterized in that The step 2 comprises: Step 201: After discovering that the computer is infected with a ransomware virus, first check and kill the virus to confirm that there is no active virus in the computer or install the hard disk and ransomware virus protection program on a safe and virus-free isolated network computer; Step 202: Import the key, decrypt the INDX table sector corresponding to the folder protected by the ransomware protection program, decrypt the INDX table sector corresponding to the protected folder, and after the decryption is completed, the directory corresponding to the protected folder can be accessed normally to extract data.

7. The method according to claim 6, characterized in that After step 201 and before step 202, the following steps are further included: The ransomware protection program writes a verification file for verification.

8. The method according to claim 7, characterized in that The ransomware protection program writes a verification file for verification, including: The MDF database file is written according to the standard template library built into the ransomware protection program. After the MDF database file is written, the ransomware protection program waits for a preset time and then verifies whether the file name, file size and file hexadecimal code of the MDF database file are consistent with the built-in template library; If there is any inconsistency, return to step 201; if all are consistent, go to step 202.

9. The method according to claim 6, characterized in that The step 202 includes: Import the private key in the dongle or saved by the user, decrypt the INDX table sector corresponding to the protected folder, and the directory can be accessed normally after the decryption is completed; The ransomware protection program calls the compression algorithm to decompress the files in the directory and extract the backup data in the files in the directory.

Images