A ransomware detection method and device, electronic equipment and storage medium

Abstract

The present application provides a kind of ransomware detection method, device, electronic equipment and storage medium, it is related to ransomware detection field, method includes: using the detection program in the preset operating system kernel to the process information of each process appearing in operating system, file operation information generated when process calls file operation, network connection operation information generated when process calls network connection operation information record;Wherein, process information contains the association between process and its parent process;When detecting the suspicious process of calling file operation to the preset decoy file in storage space, according to process information, suspicious process and the process associated with suspicious process are all marked as to-be-detected process;According to all file operation information and all network connection operation information corresponding to all to-be-detected processes, detect whether suspicious process is ransomware process;Comprehensiveness and reliability of ransomware detection can be improved from multiple angles.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of ransomware detection, and particularly relates to a ransomware detection method and device, electronic equipment and a storage medium. BACKGROUND

[0002] Ransomware is one of the main threats to network security in recent years. The main behavior of this virus is to encrypt files, destroy data and lock systems. Specifically, it usually uses various means (such as infecting executable files or databases) to encrypt infected files, making it impossible for users to access or modify these files.

[0003] In related technologies, the detection and defense technology for ransomware usually has the defect of single detection dimension. With the continuous evolution of ransomware technology, it has added many processes to bypass security mechanisms, which can easily lead to more false positives or omissions in single detection schemes, and thus cannot effectively detect ransomware. SUMMARY

[0004] The purpose of the present application is to provide a ransomware detection method, device, electronic equipment and storage medium, which can detect whether a suspicious process belongs to ransomware based on the suspicious process, all file operations generated by the associated process associated with the suspicious process, and network connection operations, thereby improving the reliability and comprehensiveness of ransomware detection.

[0005] To solve the above technical problems, the present application provides a ransomware detection method, comprising:

[0006] The process information of each process appearing in the operating system, the file operation information generated by the process when calling the file operation, and the network connection operation information generated by the process when calling the network connection operation are recorded by using the preset detection program in the operating system kernel; wherein the process information contains the association relationship between the process and its parent process;

[0007] When a suspicious process that calls the file operation on the preset decoy file in the storage space is detected, the suspicious process and the processes associated with the suspicious process are all marked as detection processes according to the process information;

[0008] According to all file operation information and all network connection operation information corresponding to all detection processes, it is detected whether the suspicious process is a ransomware process.

[0009] Optionally, before detecting and recording the process information of each process appearing in the operating system, the file operation information generated by the process when calling the file operation each time, and the network connection operation information generated by the process when calling the network connection operation each time by using the preset detection program in the operating system kernel, it further comprises:

[0010] inserting a first probe into a process operation function, inserting a second probe into the file operation function, and inserting a third probe into the network connection operation function, wherein the process operation function comprises a process execution function and a process derivation function;

[0011] mounting the detection program at the insertion position of the first probe, the insertion position of the second probe, and the insertion position of the third probe;

[0012] The detection program preset in the operating system kernel detects and records the process information of each process appearing in the operating system, the file operation information generated by the process each time the file operation is called, and the network connection operation information generated by the process each time the network connection operation is called, comprising:

[0013] The detection program determines whether the process operation function is called through the first probe, and obtains the process information from the parameters of the process function when it is determined that the process operation function is called;

[0014] The detection program determines whether the file operation function is called through the second probe, and obtains the file operation information from the parameters of the file operation function when it is determined that the file operation function is called;

[0015] The detection program determines whether the network connection operation function is called through the third probe, and obtains the network connection operation information from the parameters of the network connection operation function when it is determined that the network connection operation function is called.

[0016] Optionally, after the detection program preset in the operating system kernel detects and records the process information of each process appearing in the operating system, the file operation information generated by the process each time the file operation is called, and the network connection operation information generated by the process each time the network connection operation is called, it further comprises:

[0017] The detection program obtains the process information, the file operation information and the network connection operation information from the kernel mode to the user mode through a hash graph.

[0018] Optionally, after the detection program preset in the operating system kernel detects and records the process information of each process appearing in the operating system, it further comprises:

[0019] According to the association relationship between each process and its parent process, a process tree is constructed;

[0020] According to the process information, the suspicious process and the processes associated with the suspicious process are marked as to-be-detected processes, comprising:

[0021] determine a process tree in which the suspicious process is located, and set all processes in the process tree as the to-be-detected processes.

[0022] Optionally, the process information further comprises a process entity file path, the file operation information comprises a file path of a file operated, and the network connection operation information comprises a network connection operation type, which is an inbound type or an outbound type.

[0023] The detecting whether the suspicious process is a ransomware process according to all the file operation information and all the network connection operation information corresponding to all the to-be-detected processes comprises:

[0024] According to the file operation information, adding all file paths operated by the to-be-detected processes to a suspicious file set.

[0025] According to the file operation information and the process entity file path of each to-be-detected process, adding all processes operating files corresponding to the process entity file path to a suspicious process set.

[0026] According to the network connection operation information, adding processes in the suspicious process set performing the inbound type of network connection operation to a suspicious inbound process set, and adding processes in the suspicious process set performing the outbound type of network connection operation to a suspicious outbound process set.

[0027] Determining a ransomware evaluation value according to the suspicious file set, the suspicious inbound process set and the suspicious outbound process set.

[0028] When it is determined that the ransomware evaluation value is greater than a preset threshold value, determining that the suspicious process is a ransomware process.

[0029] Optionally, the determining a ransomware evaluation value according to the suspicious file set, the suspicious inbound process set and the suspicious outbound process set comprises:

[0030] According to each file path in the suspicious file set, determining a preset file type operated by the to-be-detected processes and a file path coverage number of each preset file type operated by the to-be-detected processes, wherein each preset file type corresponds to multiple file paths, and each preset file type corresponds to a different file type weight.

[0031] When the suspicious inbound process set is empty, setting a preset inbound identification value as a first value, or when the suspicious inbound process set is not empty, setting the preset inbound identification value as a second value.

[0032] setting the preset outbound identification value as the first value when the suspicious outbound process set is empty, or setting the preset outbound identification value as the second value when the suspicious inbound process set is not empty;

[0033] determining the ransomware evaluation value according to the preset file types operated by the to-be-detected process, the file path coverage quantity of the to-be-detected process in each preset file type, the file type weight of each preset file type, the preset inbound identification value and the preset outbound identification value.

[0034] Optionally, the determining the ransomware evaluation value according to the preset file types operated by the to-be-detected process, the file path coverage quantity of the to-be-detected process in each preset file type, the file type weight of each preset file type, the preset inbound identification value and the preset outbound identification value comprises:

[0035] determining the ransomware evaluation value according to the preset file types operated by the to-be-detected process, the file path coverage quantity of the to-be-detected process in each preset file type, the file type weight of each preset file type, the preset inbound identification value and the preset outbound identification value according to the following formula:

[0036]

[0037] wherein S represents the ransomware evaluation value, k represents the total quantity of preset file types, T represents the total quantity of file paths corresponding to the nth preset file type, h represents the file path coverage quantity of the to-be-detected process corresponding to the nth preset file type, W represents the file type weight of the nth preset file type, i represents the preset inbound identification value, o represents the preset outbound identification value, and α and β respectively represent the weights of the preset inbound identification value and the preset outbound identification value. n n n

[0038] Optionally, after determining that the suspicious process is a ransomware process, the method further comprises:

[0039] setting the process information of each process in the suspicious process set as to-be-disabled process information;

[0040] performing process blocking on a process corresponding to each to-be-disabled process information.

[0041] The application further provides a ransomware detection device, comprising:

[0042] ​​​A kernel detection module is configured to record process information of each process in an operating system, file operation information generated by the process when calling a file operation, and network connection operation information generated by the process when calling a network connection operation by using a preset detection program in an operating system kernel, wherein the process information comprises an association relationship between the process and a parent process thereof.

[0043] A to-be-detected process marking module is configured to mark the suspicious process and processes associated with the suspicious process as to-be-detected processes according to the process information when detecting a suspicious process calling the file operation on a preset decoy file in a storage space.

[0044] A ransomware process detection module is configured to detect whether the suspicious process is a ransomware process according to all file operation information and all network connection operation information corresponding to all the to-be-detected processes.

[0045] The application further provides an electronic device comprising:

[0046] A memory configured to store a computer program;

[0047] A processor configured to implement the ransomware detection method when executing the computer program.

[0048] The application further provides a computer readable storage medium, wherein the computer readable storage medium stores computer executable instructions, and the computer executable instructions are loaded and executed by a processor to implement the ransomware detection method.

[0049] The application provides a ransomware detection method, comprising: recording process information of each process in an operating system, file operation information generated by the process when calling a file operation, and network connection operation information generated by the process when calling a network connection operation by using a preset detection program in an operating system kernel, wherein the process information comprises an association relationship between the process and a parent process thereof; marking the suspicious process and processes associated with the suspicious process as to-be-detected processes according to the process information when detecting a suspicious process calling the file operation on a preset decoy file in a storage space; and detecting whether the suspicious process is a ransomware process according to all file operation information and all network connection operation information corresponding to all the to-be-detected processes.

[0050] It can be seen that the present application firstly presets a detection program in the operating system kernel, and utilizes the detection program to record the process information of each process, the file operation information generated by the process when calling the file operation, and the network connection operation information generated by the process when calling the network connection operation. The process information includes the association relationship between the process and its parent process. In other words, the detection program can comprehensively record each process itself, the association between the process and its parent process, the file operation and the network connection operation performed by the process. In addition, the present application also presets a decoy file in the storage space. Further, when the suspicious process calling the preset decoy file in the storage space is detected based on the record of the detection program, the suspicious process and the processes associated with the suspicious process are marked as to-be-detected processes according to the process information, and whether the suspicious process is a ransomware process is detected according to all the file operation information and all the network connection operation information corresponding to all the to-be-detected processes, that is, whether the suspicious process is a ransomware process is comprehensively determined according to the file operation and the network connection operation performed by the suspicious process and the file operation and the network connection operation performed by all the processes associated with the suspicious process, so that the reliability of the ransomware detection can be improved. The present application also provides a ransomware detection device, an electronic equipment and a computer readable storage medium, which have the above beneficial effects. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute the embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on the provided drawings.

[0052] Figure 1 A flowchart of a ransomware detection method provided by an embodiment of the present application;

[0053] Figure 2 A structural block diagram of a ransomware detection system provided by an embodiment of the present application;

[0054] Figure 3 A flowchart of another ransomware detection method provided by an embodiment of the present application;

[0055] Figure 4 A structural block diagram of a ransomware detection device provided by an embodiment of the present application;

[0056] Figure 5 A structural block diagram of an electronic equipment provided by an embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0058] Ransomware is one of the main threats to network security in recent years. The main behavior of this virus is to encrypt files, destroy data and lock systems. Specifically, it usually uses various means (such as infecting executable files or databases) to encrypt infected files, causing users to be unable to access or modify these files.

[0059] In the related art, the detection and defense technology for ransomware usually has the defect of single detection dimension. For example, the related art can usually set a decoy file in the file path that the ransomware may operate, and can detect whether a process operates the decoy file. When detecting a process operating the decoy file, the related art can compare the process information of the process with a security policy, and perform corresponding operations on the process according to the security policy. However, this way is easy to produce more false positives, for example, normal processes in the operating system may also operate the decoy file; in addition, with the continuous evolution of ransomware technology, ransomware has increased many processes to bypass security mechanisms, thereby easily causing the related art solution to have more misjudgments or omissions, thereby failing to effectively detect ransomware. In view of this, the present application can provide a ransomware detection method, which can comprehensively detect whether a suspicious process belongs to ransomware based on the suspicious process, all file operations generated by associated processes associated with the suspicious process, and network connection operations, thereby improving the reliability and comprehensiveness of ransomware detection.

[0060] For ease of understanding, please refer to Figure 1 , Figure 1 A flowchart of a ransomware detection method provided by an embodiment of the present application, which can include:

[0061] S101, using a preset detection program in the operating system kernel to record process information of each process appearing in the operating system, file operation information generated by the process when calling a file operation, and network connection operation information generated by the process when calling a network connection operation; wherein the process information contains the association relationship between the process and its parent process.

[0062] This step is an important step required to improve the effect of ransomware detection. Specifically, the preset detection program in the operating system kernel can be used to obtain and record the process information of each process appearing in the operating system, the file operation information generated by the process when calling the file operation, and the network connection operation information generated by the process when calling the network connection operation. By collecting the above information, when a suspicious process is detected, it can be determined from multiple angles whether the suspicious process is a ransomware process according to the collected information, thereby improving the comprehensiveness of detection. The above information will be introduced below.

[0063] The process information is the information of the process itself. In order to facilitate understanding of the association relationship between processes, the process information needs to include the association relationship between each process and its parent process. In one possible case, the process information can be composed of a process identifier (PID), a user identifier (UID), a parent process identifier, and a process entity file path. Among them, the process identifier is used to uniquely mark the process. The user identifier is used to uniquely mark the user currently logged into the operating system, and the combination of the process identifier and the user identifier can uniquely determine each process appearing in each user state. The parent process identifier is used to uniquely mark the parent process of the current process, and the combination of the process identifier and the parent process identifier determines the association relationship between the process and its parent process. The process entity file path is the file path of the program file corresponding to the process in the storage space.

[0064] The file operation information is the information generated by the process each time it calls the file operation. The file operation is a system operation for operating a file, for example, it can be read, write, delete, etc. In order to facilitate the determination of each file operated by the process, the file operation information can include the file information operated by the process. In one possible case, the file operation information can be composed of a process identifier, a user identifier, and a file path, wherein the file is the file path of the file operated by the process in the storage space.

[0065] The network connection operation information is the information generated by the process each time it calls the network connection operation. The network connection operation is a system operation to be performed for connecting to the network. According to the data flow direction, the network connection operation can be divided into inbound operation and outbound operation. The inbound operation is to receive data transmitted by an external device and save it to the local device. The outbound operation is to send the data in the local device to the external device. In one possible case, the network connection operation information can be composed of a process identifier, a user identifier, and a network connection operation type, wherein the network connection operation type can be an inbound type and an outbound type.

[0066] As can be seen, by collecting the process information, file operation information and network connection operation information, the embodiment of the present application can determine each process appearing in the operating system, and can determine the association relationship between each process and other processes, and can also determine each file operated by the process and each network connection operation performed by the process. The reason for collecting the above information is that, with the continuous development of ransomware technology, a ransomware program can not be executed by a single process, but can be executed by multiple processes associated with each other, such as the multiple processes being associated with the same parent process. Moreover, each process of the ransomware can perform different contents, such as part of the processes being dedicated to performing file operations such as encryption and tampering on files, and another part of the processes being dedicated to receiving an encryption program transmitted by an external device, sending user privacy data to the external device, etc. Therefore, by collecting the process information, file operation information and network connection operation information appearing in the operating system in advance, the present application can comprehensively analyze all file operations and network connection operations performed by the suspicious process and other associated processes associated with the suspicious process, so as to more effectively detect the ransomware and all processes executing the ransomware program, and can effectively guarantee the effectiveness of the ransomware detection.

[0067] It should be noted that the embodiment of the present application does not limit the specific implementation manner of the detection program, as long as it can be set in the kernel state of the operating system. For example, the detection program can be an eBPF program (Extended Berkeley Packet Filter). In addition, the embodiment of the present application does not limit how the detection program obtains the process information, file operation information and network connection operation information, for example, a hook function, a probe, etc. can be used to insert a stake in the system operation function, and the detection program is mounted at the stake position, so that the detection program can detect the calling situation of the system operation function through the hook function or the probe, and obtain the required process information, file operation information or network connection operation information from the system operation function when the system operation function is called.

[0068] It should be noted that the embodiments of the present application do not limit the need to be inserted in which system operation function. For example, for process information collection, the process operation function such as process execution function (exec), process derivation function (fork) can be inserted; for file operation information collection, file operation function (such as read, write) can be inserted; for network connection operation information collection, network connection operation function (such as SSH operation function (SSH, Secure Shell, Secure Shell), socket operation function (socket, socket)) can be inserted. The present application does not limit the use of which probe or hook function for insertion. For example, for process operation function, tracepoint probe can be used for insertion; for file operation function, kprobe and kretprobe probe (both are return probes) can be used for insertion; for network connection operation function, kprobe probe can be used for insertion.

[0069] Based on this, before detecting and recording the process information of each process appearing in the operating system, the file operation information generated by the process each time the file operation is called, and the network connection operation information generated by the process each time the network connection operation is called by using the detection program preset in the operating system kernel, further comprising:

[0070] Step 11: inserting the first probe in the process operation function, inserting the second probe in the file operation function, and inserting the third probe in the network connection operation function; wherein the process operation function includes process execution function and process derivation function.

[0071] Among them, the first probe can be a tracepoint probe, the second probe can be a kprobe and a kretprobe probe, and the third probe can be a kprobe probe.

[0072] Step 12: mounting the detection program at the insertion position of the first probe, the insertion position of the second probe, and the insertion position of the third probe.

[0073] Correspondingly, the detection and recording of the process information of each process appearing in the operating system, the file operation information generated by the process each time the file operation is called, and the network connection operation information generated by the process each time the network connection operation is called by using the detection program preset in the operating system kernel can include:

[0074] Step 21: determining whether the process operation function is called by the detection program through the first probe, and acquiring the process information from the process function parameters when it is determined that the process operation function is called.

[0075] Step 22: determining whether the file operation function is invoked by the second probe using the detection program, and obtaining file operation information from the parameters of the file operation function when it is determined that the file operation function is invoked.

[0076] Step 23: determining whether the network connection operation function is invoked by the third probe using the detection program, and obtaining network connection operation information from the parameters of the network connection operation function when it is determined that the network connection operation function is invoked.

[0077] It should be noted that the embodiments of the present application do not limit how to obtain the required information from the parameters of the system operation functions, and related technologies of the operating system can be referred to.

[0078] Further, since the kernel program, such as the eBPF program, set in the kernel state of the operating system cannot have too large a size, the detection program in the embodiments of the present application can only have a simple information acquisition capability, and the virus detection program (i.e., the execution program of steps S102 and S103) for ransomware detection can be set in the user state. In actual working process, the detection program in the kernel state can send the collected process information, file operation information and network connection operation information to the virus detection program in the user state through a preset data transmission channel, wherein the data transmission channel is used to exchange data between the kernel state and the user state. The embodiments of the present application do not limit the specific data transmission channel, for example, for the eBPF program, it can be a hash map.

[0079] Based on this, after detecting and recording the process information of each process in the operating system, the file operation information generated by the process each time the file operation is invoked, and the network connection operation information generated by the process each time the network connection operation is invoked using the detection program preset in the kernel of the operating system, it can further include:

[0080] Step 31: obtaining the process information, the file operation information and the network connection operation information transmitted from the kernel state to the user state by the detection program through the hash map.

[0081] Further, to facilitate the search of all associated processes associated with the suspicious process, the embodiments of the present application can further construct a process tree according to the association relationship between each process and its parent process after collecting the process information. Each node in the process tree corresponds to a process, and the parent node of the node corresponds to the parent process of the process. In this way, after detecting the suspicious process, only the process tree in which the suspicious process is located needs to be determined, and the associated processes in the process tree can be determined. It can be understood that there can be multiple process trees.

[0082] S102, when detecting a suspicious process calling a preset decoy file in a storage space, marking the suspicious process and processes associated with the suspicious process as to-be-detected processes according to the process information.

[0083] In the embodiment of the present application, a decoy file can also be preset in the device storage space, and whether there is a process operating the decoy file can be determined according to the file operation information fed back by the detection program. When detecting a process operating the decoy file, the embodiment can mark it as a suspicious process, and then mark the suspicious process and processes associated with the suspicious process as to-be-detected processes according to the recorded process information, so as to perform ransomware detection based on all file operations and network connection operations performed by all to-be-detected processes. It should be pointed out that whether there is a direct association (such as a parent process) or an indirect association (such as a parent process of a parent process) with the suspicious process, it can be determined that it belongs to the associated process associated with the suspicious process. In this way, the embodiment of the present application can improve the detection coverage of the ransomware process, thereby improving the detection effect.

[0084] It should be pointed out that the embodiment of the present application does not limit the setting position and the setting number of the preset decoy file, which can be set according to the actual application demand.

[0085] Further, since the process tree can be constructed according to the process information in advance, when determining the to-be-detected process, the process tree in which the suspicious process is located can be determined, and then all processes in the process tree are set as the to-be-detected process.

[0086] Therefore, the marking of the suspicious process and the processes associated with the suspicious process as to-be-detected processes according to the process information includes:

[0087] Step 41: determining the process tree in which the suspicious process is located, and setting all processes in the process tree as the to-be-detected process.

[0088] S103, according to all file operation information and all network connection operation information corresponding to all to-be-detected processes, detecting whether the suspicious process is a ransomware process.

[0089] After all the processes to be detected are obtained, the embodiment of the present application detects whether the suspicious process is a ransomware process according to all the file operation information and all the network connection operation information corresponding to all the processes to be detected. The embodiment of the present application does not limit the specific detection manner. For example, whether the processes to be detected are ransomware processes can be determined according to the number of files operated by all the processes to be detected and the number of each type of network connection operation performed. In addition, detection can be further combined with the execution frequency of file operation and / or network connection operation. In addition, because different types of files in the operating system have different importance degrees for user and device operation, detection can be further combined with the file types operated by all the processes to be detected. In addition, because external attackers usually perform ransomware attacks based on a plurality of bot devices (i.e., attack devices that have been attacked by attackers), detection can be further combined with the number of IPs connected by various network connection operations. In addition, the above-mentioned file quantity, network connection operation quantity, file operation execution frequency, network connection operation execution frequency, file type operated, IP quantity connected, and the like can be used to calculate a ransomware evaluation value in a weighted manner, and whether the overall risk degree of the above-mentioned processes to be detected is greater than a preset threshold value can be determined according to the ransomware evaluation value, so as to determine whether the suspicious process is a ransomware process. It should be noted that the above-mentioned detection manners can be used arbitrarily and can be used in combination, and can be selected according to actual application requirements.

[0090] Based on the above embodiment, the present application can first preset a detection program in the operating system kernel, and can use the detection program to record the process information of each process in the operating system, the file operation information generated when the process calls file operation, and the network connection operation information generated when the process calls network connection operation. The process information includes the association relationship between the process and its parent process. In other words, the detection program can comprehensively record each process itself, the association between the process and its parent process, the file operation and network connection operation performed by each process. In addition, the present application can also preset a decoy file in the storage space. Further, when the suspicious process calling the file operation on the preset decoy file in the storage space is detected based on the record of the detection program, the suspicious process and the processes associated with the suspicious process can be marked as processes to be detected according to the process information, and whether the suspicious process is a ransomware process can be detected according to all the file operation information and all the network connection operation information corresponding to all the processes to be detected, that is, whether the suspicious process is a ransomware process can be comprehensively determined by comprehensively determining the file operation and network connection operation performed by the suspicious process and the file operation and network connection operation performed by all the processes associated with the suspicious process, so as to improve the reliability of ransomware detection.

[0091] Based on the above embodiments, the detection process of the ransomware will be described in detail below in combination with specific process information, file operation information and network connection operation information. In a possible case, the process information further includes a process entity file path, the file operation information includes a file path of a file being operated, and the network connection operation information includes a network connection operation type, which is an inbound type or an outbound type. Further, the detection of whether the suspicious process is a ransomware process according to all the file operation information and all the network connection operation information corresponding to all the processes to be detected can include:

[0092] S201, adding, according to the file operation information, all file paths operated by the processes to be detected to a suspicious file set.

[0093] In this step, since the file operation information includes the file path operated by the process, all the file paths operated by the processes to be detected can be screened from the file operation information and added to the suspicious file set.

[0094] S202, adding, according to the file operation information and the process entity file path of each process to be detected, all processes operating the file corresponding to the process entity file path to a suspicious process set.

[0095] The purpose of this step is to add the process most related to the suspected ransomware program to the suspicious process set, wherein the suspected ransomware program is the program corresponding to the suspicious process. This is because the processes to be detected also include some system processes, and it is not meaningful to detect these system processes, so the system processes can be screened out and only the process most related to the ransomware program is retained. To achieve this effect, the present application can add, according to the file operation information and the process entity file path of each process to be detected, all processes operating the file corresponding to the process entity file path to the suspicious process set. This is because the process is the basic execution entity of the program, so the process can form a file operation relationship with its program file, that is, the process performs file operations on the program file corresponding to it. Therefore, the present application can quickly screen out the process most related to the suspected ransomware program according to the process entity file path of each process to be detected, find the process operating the file corresponding to the process entity file path in the file operation information, and can exclude the system process, thereby improving the detection efficiency.

[0096] S203, adding, according to the network connection operation information, the process in the suspicious process set performing the network connection operation of the inbound type to a suspicious inbound process set, and adding the process in the suspicious process set performing the network connection operation of the outbound type to a suspicious outbound process set.

[0097] In this step, the processes performing inbound type network connection operations can be filtered out from the suspicious process set and added to a suspicious inbound process set, and the processes performing outbound type network connection operations can be filtered out from the suspicious process set and added to a suspicious outbound process set, to determine whether the ransomware performs suspicious inbound and outbound operations.

[0098] S204, determining a ransomware evaluation value according to the suspicious file set, the suspicious inbound process set and the suspicious outbound process set.

[0099] In this step, the ransomware evaluation value can be determined according to the suspicious file set, the suspicious inbound process set and the suspicious outbound process set. The embodiments of the present application do not limit the specific determination method of the ransomware evaluation value, which can be set according to actual application requirements. Hereinafter, a possible determination method of the ransomware evaluation value is introduced.

[0100] Firstly, the risk degree caused by the ransomware operating different types of files is different for the user and the operating system. Therefore, the embodiments of the present application can set multiple preset file types, and set a corresponding file type weight for each preset file type. In addition, since files of the same file type are usually stored in the same path, the embodiments of the present application can also set a corresponding file path for each preset file type. In this way, as long as each file path in the suspicious file set is matched with the file path corresponding to the preset file type, it can be determined which preset file type is operated by the process to be detected. It should be pointed out that each preset file type can correspond to one or more file paths. Further, since the more files operated by the process to be detected, the higher the possibility of belonging to the ransomware process, therefore, in addition to determining the preset file type operated by the process to be detected, the embodiments of the present application can also determine the corresponding file path coverage number of the process to be detected in each preset file type. For example, if a preset file type corresponds to three file paths, and the process to be detected operates two of them, then the corresponding file path coverage number of the process to be detected in the preset file type is 2. Further, the preset file type operated by the process to be detected and the corresponding file path coverage number in each preset file type can be weighted to obtain part of the value of the ransomware evaluation value.

[0101] Further, for the network connection operation of the inbound type and the outbound type, corresponding identification values can be set. A preset inbound identification value is set as a first value when the suspicious inbound process set is empty, or the preset inbound identification value is set as a second value when the suspicious inbound process set is not empty. A preset outbound identification value is set as the first value when the suspicious outbound process set is empty, or the preset outbound identification value is set as the second value when the suspicious inbound process set is not empty. The first value can be 0, and the second value can be 1. Further, the preset inbound identification value and the preset outbound identification value can be used as another part of the ransomware evaluation value.

[0102] Based on this, the determination of the ransomware evaluation value according to the suspicious file set, the suspicious inbound process set and the suspicious outbound process set can include:

[0103] Step 51: determining, according to each file path in the suspicious file set, a preset file type operated by the to-be-detected process and a file path coverage number of each preset file type operated by the to-be-detected process; wherein each preset file type corresponds to multiple file paths, and each preset file type corresponds to a different file type weight;

[0104] Step 52: setting a preset inbound identification value as a first value when the suspicious inbound process set is empty, or setting the preset inbound identification value as a second value when the suspicious inbound process set is not empty;

[0105] Step 53: setting a preset outbound identification value as the first value when the suspicious outbound process set is empty, or setting the preset outbound identification value as the second value when the suspicious inbound process set is not empty;

[0106] Step 54: determining the ransomware evaluation value according to the preset file type operated by the to-be-detected process, the file path coverage number of each preset file type operated by the to-be-detected process, the file type weight of each preset file type, the preset inbound identification value and the preset outbound identification value.

[0107] In a possible case, the ransomware evaluation value can be determined according to the preset file type operated by the to-be-detected process, the file path coverage number of each preset file type operated by the to-be-detected process, the file type weight of each preset file type, the preset inbound identification value and the preset outbound identification value according to the following formula:

[0108]

[0109] wherein S represents the ransomware evaluation value, k represents the total number of preset file types, T represents the file path coverage number of each preset file type, W represents the file type weight of each preset file type, I represents the preset inbound identification value, and O represents the preset outbound identification value. nh represents the total number of file paths corresponding to the nth preset file type n W represents the number of file path covers corresponding to the nth preset file type of the to-be-detected process n i represents a preset inbound identification value, o represents a preset outbound identification value, and alpha and beta represent the weights of the preset inbound identification value and the preset outbound identification value respectively.

[0110] It can be seen that the embodiment of the present application can determine the ransomware evaluation value from the aspects of file operation and network connection operation, and when investigating file operation, the risk degree of different types of files operated by the ransomware can be further considered, so that the reliability of the ransomware evaluation value can be ensured.

[0111] S205, when it is determined that the ransomware evaluation value is greater than a preset threshold, determining that the suspicious process is a ransomware process.

[0112] After obtaining the ransomware evaluation value, it can be judged whether it is greater than a preset threshold. If it is greater, it can be determined that the suspicious process is a ransomware process, otherwise it can be determined that the suspicious process is not a ransomware process, thereby effectively reducing misjudgment and improving the reliability of ransomware detection.

[0113] It should be noted that the embodiment of the present application does not limit the specific value of the preset threshold, which can be set according to actual application requirements.

[0114] Further, after determining that the suspicious process is a ransomware process, in order to avoid its continuous attack on the user equipment, the process information of each process in the suspicious process set can be set as the to-be-disabled process information, and the process of each process corresponding to the to-be-disabled process information is prevented, so as to eliminate malicious attacks.

[0115] Based on this, after determining that the suspicious process is a ransomware process, it can further include:

[0116] Step 61: setting the process information of each process in the suspicious process set as to-be-disabled process information;

[0117] Step 62: preventing the process corresponding to each to-be-disabled process information.

[0118] Based on the above embodiment, the above ransomware detection method will be introduced in detail in combination with specific examples. The present application provides a multi-dimensional detection method for ransomware based on eBPF, including a process acquisition device, a file operation acquisition device, a network connection acquisition device, a ransomware bait monitoring device, a process behavior portrait extraction device, and a ransomware behavior evaluation device. The schematic diagram is shown in the accompanying Figure 2 , Figure 2A structure block diagram of a ransomware detection system provided by an embodiment of the present application. The specific implementation process is as follows:

[0119] 1) Process acquisition device:

[0120] a) Mount eBPF programs of the tracepoint type at system functions sched_process_exec (process execution function) and sched_process_fork (process derivation function) to obtain process PID (process identifier), parent process PID (parent process identifier), user UID (user identifier), and process entity path. Upload to the process behavior portrait extraction device through the ring buffer (data transmission channel). Form ProcessInfoMap (process information set). Data is stored in the Hash Map (Hash Map) structure as follows:

[0121] Table 1 Process information set Hash Map

[0122]

[0123] 2) File operation acquisition device:

[0124] a) Mount eBPF programs of the kprobe type at system calls __x64_sys_open (open function), __x64_sys_openat (open function), and __x64_sys_unlinks (delete function) to obtain file path, process PID operating the file, and user UID operating the file, and upload the information to the process behavior portrait extraction logic through the ring buffer. Form two sets of file operations FilePathMap (file path set) and FilePIDMap (file operation process set). Data is stored in the Hash Map structure as follows:

[0125] Table 2 File path set

[0126] Key Value File path Process PID that operates the file

[0127] Table 3 File operation process set

[0128] Key Value Process PID that operates the file File path

[0129] 3) Network relationship acquisition device:

[0130] a) Mount the eBPF program of the krpobe type at the system call __x64_sys_connect, obtain the current process PID through the bpf auxiliary function. Upload to the process behavior portrait extraction device through the ring buffer. Form the inbound process PID set InProcessSet (inbound process set).

[0131] b) Mount the eBPF program of the krpobe type at the system call __x64_sys_accept, obtain the current process PID through the bpf auxiliary function. Upload to the process behavior portrait extraction device through the ring buffer. Form the outbound process PID set OutProcessSet (outbound process set).

[0132] 4) Ransomware decoy monitoring device:

[0133] Spray decoy at system critical locations, mount eBPF program at file operation system call based on eBPF technology, when the process operates on the decoy file, the eBPF program captures the current process PID and user UID, and uploads the information to the process behavior portrait extraction logic through the ring buffer. The process is a suspected ransomware process.

[0134] 5) Process behavior portrait extraction device:

[0135] a) Take the suspected ransomware process PID + user UID as the key, traverse ProcessInfoMap (process information set) to obtain the parent process PID and process entity path. Then take the parent process PID + user UID as the key, traverse ProcessInfoMap (process information set) in a loop, and finally obtain all process information ProcessChainMap (process chain set) of the suspected ransomware process related process chain. The data structure is as follows:

[0136] Table 4 Process chain set

[0137]

[0138]

[0139] b) Traverse the Key information of ProcessChainMap (process chain set), obtain all file information operated by the suspected ransomware process chain process from FilePIDMap (file operation process set), and form the set SuspiciousFileSet (suspicious file set);

[0140] c) Traverse the Value information of ProcessChainMap, get all process PIDs of the suspicious ransomware process chain entity file from FilePathMap, form a set SuspiciousProcessSet;

[0141] d) Take the intersection of SuspiciousProcessSet and InProcessSet, get SuspiciousInProcessSet;

[0142] e) Take the intersection of the Key set of ProcessChainMap and OutProcessSet, get SuspiciousOutProcessSet.

[0143] 6) Ransomware behavior evaluation device

[0144] Preceding explanation: The weight values in the following sets are examples, which can be flexibly set according to actual conditions.

[0145] a) Key file set A1:

[0146] System operation related key file set, weight 5% (ensure system normal operation, in order to achieve the purpose of ransom, this part is usually not encrypted, the weight is low).

[0147] Table 5 Key file set

[0148] File path File description / boot Grub configuration and kernel image file / etc / pam.d Login authentication configuration file / etc / host.conf Domain name resolution file / etc / ssh SSH configuration file / etc / audit Log and audit configuration file

[0149] b) Decoy file set A2:

[0150] Spray decoy file set, weight 25% (files that ransomware usually encrypt, weight is high).

[0151] Table 6 Decoy file set

[0152]

[0153]

[0154] c) Timed task file set A3:

[0155] System set the configuration file set of the scheduled task, weight 10% (ransomware usually persists encryption operations and executes them at a scheduled time to avoid being blocked by anti-virus software).

[0156] Table 7 Set of Timed Task Files

[0157] File path File description / etc / cron* Timed task configuration file / var / spool / cron Timed task configuration file / etc / anacrontab Timed task configuration file

[0158] d) System Random Startup Profile Set A4:

[0159] System Random Startup Profile Set, weight 10% (Ransomware usually adds encryption operations to the random startup tasks for automated execution).

[0160] Table 8 System Random Startup Profile Set

[0161] File path File description / etc / rc*.d Random startup configuration file / etc / rc.local Random startup configuration file / etc / init.d Random startup configuration file / etc / systemd Random startup configuration file / usr / lib / system / system Random startup configuration file / lib / systemd / system Random startup configuration file

[0162] e) Dynamic Library Configuration Set A5:

[0163] Dynamic Library Configuration Set, weight 5% (Ransomware usually tampers with this file to hide itself from security software).

[0164] Table 9 Dynamic Library Configuration Set

[0165] File path File description / etc / ld.so.preload Dynamic library configuration file

[0166] f) System Log File Set A6:

[0167] System Log Set, weight 5% (Ransomware usually deletes system logs to hide traces).

[0168] Table 10 System Log File Set

[0169] File path File description / var / log / messages* Information and error log after system startup / var / log / btmp* Record login failure information / var / log / wtmp* Record user login times and login times / var / log / cron Record task plan running log

[0170] g) Suspicious Inbound Process Set SuspiciouslnProcessSet:

[0171] Suspicious Inbound Set weight 20% (Most ransomware is transmitted to the host through the network).

[0172] h) Suspicious Outbound Process Set SuspiciousOutProcessSet:

[0173] Suspicious Outbound Set weight 20% (Most ransomware spreads laterally through the network).

[0174] i) Ransomware Behavior Assessment Formula:

[0175] SuspiciousFileSet intersects with A1-A6 sets, each set total number is T, and the intersection number of each set is h, and the weight is W. Suspicious inbound set i (1 when the set exists, and 0 when the set does not exist), suspicious outbound set o (1 when the set exists, and 0 when the set does not exist), the evaluation score is S, and the score is higher than the threshold value. When the score is higher than the threshold value, it is determined that the ransomware (n is currently limited to 6, and the value will change as the technology develops).

[0176]

[0177] Further, for the convenience of understanding, please refer to Figure 3 , Figure 3 The flowchart of another ransomware detection method provided by the embodiment of the application fully shows the whole process of the ransomware detection.

[0178] The ransomware detection device, electronic equipment, computer program product and computer readable storage medium provided by the embodiment of the application are described below, and the ransomware detection device, electronic equipment, computer program product and computer readable storage medium described below can be mutually corresponding and referred to with the ransomware detection method described above.

[0179] Please refer to Figure 4 , Figure 4 The structural block diagram of a ransomware detection device provided by the embodiment of the application, the device can include:

[0180] The kernel detection module 401 is configured to record process information of each process appearing in the operating system, file operation information generated by the process when calling a file operation, and network connection operation information generated by the process when calling a network connection operation by using a preset detection program in the operating system kernel, wherein the process information includes an association relationship between the process and its parent process.

[0181] The to-be-detected process marking module 402 is configured to mark the suspicious process and the processes associated with the suspicious process as to-be-detected processes according to the process information when detecting a suspicious process calling a preset decoy file in a storage space.

[0182] The ransomware process detection module 403 is configured to detect whether the suspicious process is a ransomware process according to all file operation information and all network connection operation information corresponding to all the to-be-detected processes.

[0183] Optionally, the device can further include:

[0184] The plug-in module is configured to plug in the first probe in a process operation function, plug in the second probe in a file operation function, and plug in the third probe in a network connection operation function.

[0185] The mounting module is configured to mount the detection program at the plug-in positions of the first probe, the second probe, and the third probe.

[0186] The kernel detection module 401 can include:

[0187] The process acquisition sub-module is configured to determine, by the detection program, whether the process operation function is called through the first probe, and acquire the process information from the parameters of the process function when it is determined that the process operation function is called.

[0188] The file operation acquisition sub-module is configured to determine, by the detection program, whether the file operation function is called through the second probe, and acquire file operation information from the parameters of the file operation function when it is determined that the file operation function is called.

[0189] The network connection operation acquisition sub-module is configured to determine, by the detection program, whether the network connection operation function is called through the third probe, and acquire network connection operation information from the parameters of the network connection operation function when it is determined that the network connection operation function is called.

[0190] Optionally, the apparatus can further include:

[0191] The data receiving module is configured to acquire the process information, the file operation information, and the network connection operation information from the kernel mode to the user mode by the hash graph.

[0192] Optionally, the apparatus can further include:

[0193] The process tree creation module is configured to construct a process tree according to the association relationship between each process and its parent process.

[0194] The to-be-detected process marking module 402 can include:

[0195] The to-be-detected process marking sub-module is configured to determine a process tree in which the suspicious process is located, and set all processes in the process tree as the to-be-detected processes.

[0196] Optionally, the process information further includes a process entity file path, the file operation information includes a file path of a file to be operated, and the network connection operation information includes a network connection operation type, which is an inbound type or an outbound type.

[0197] The ransomware process detection module 403 comprises:

[0198] A suspicious file set adding submodule is configured to add all file paths operated by the to-be-detected processes to a suspicious file set according to the file operation information.

[0199] A suspicious process set adding submodule is configured to add all processes operating files corresponding to process entity file paths to a suspicious process set according to the file operation information and the process entity file paths of the to-be-detected processes.

[0200] An inbound and outbound process set adding submodule is configured to add processes in the suspicious process set performing the inbound type of network connection operation to a suspicious inbound process set and add processes in the suspicious process set performing the outbound type of network connection operation to a suspicious outbound process set according to the network connection operation information.

[0201] An evaluation value determining submodule is configured to determine a ransomware evaluation value according to the suspicious file set, the suspicious inbound process set and the suspicious outbound process set.

[0202] A determining submodule is configured to determine that the suspicious process is a ransomware process when it is determined that the ransomware evaluation value is greater than a preset threshold value.

[0203] Optionally, the evaluation value determining submodule can comprise:

[0204] A file operation comparison unit is configured to determine a preset file type operated by the to-be-detected processes and a file path coverage number of each preset file type operated by the to-be-detected processes according to each file path in the suspicious file set; wherein each preset file type corresponds to multiple file paths, and each preset file type corresponds to a different file type weight.

[0205] An inbound identification value setting unit is configured to set a preset inbound identification value to a first value when the suspicious inbound process set is empty, or set the preset inbound identification value to a second value when the suspicious inbound process set is not empty.

[0206] An outbound identification value setting unit is configured to set a preset outbound identification value to the first value when the suspicious outbound process set is empty, or set the preset outbound identification value to the second value when the suspicious inbound process set is not empty.

[0207] The evaluation value determination unit is configured to determine the ransomware evaluation value according to preset file types operated by the to-be-detected process, the number of file path coverages of the to-be-detected process in each preset file type, a file type weight of each preset file type, the preset inbound identification value, and the preset outbound identification value.

[0208] Optionally, the evaluation value determination unit is configured to:

[0209] The evaluation value determination unit is configured to determine the ransomware evaluation value according to preset file types operated by the to-be-detected process, the number of file path coverages of the to-be-detected process in each preset file type, a file type weight of each preset file type, the preset inbound identification value, and the preset outbound identification value.

[0210]

[0211] wherein S represents the ransomware evaluation value, k represents the total number of preset file types, T represents the total number of file paths corresponding to the nth preset file type, h represents the number of file path coverages of the to-be-detected process corresponding to the nth preset file type, W represents the file type weight of the nth preset file type, i represents the preset inbound identification value, o represents the preset outbound identification value, and a and b represent the weights of the preset inbound identification value and the preset outbound identification value, respectively. n n n

[0212] Optionally, the ransomware process detection module 403 can include:

[0213] The to-be-disabled process information setting sub-module is configured to set the process information of each process in the suspicious process set as to-be-disabled process information.

[0214] The process disabling sub-module is configured to perform process blocking on a process corresponding to each to-be-disabled process information.

[0215] For details, please refer to Figure 5 , Figure 5 A structural block diagram of an electronic device provided by an embodiment of the present application is provided. The electronic device 50 includes a processor 51 and a memory 52. The memory 52 is configured to store a computer program. The processor 51 is configured to execute the computer program to perform the ransomware detection method provided by the foregoing embodiments.

[0216] For details of the ransomware detection method, please refer to the corresponding content provided in the foregoing embodiments, which will not be described here.

[0217] ​​​And, the memory 52 as a resource storage carrier can be a read-only memory, a random memory, a magnetic disk or an optical disk, etc., and the storage mode can be temporary storage or permanent storage.

[0218] In addition, the electronic device 50 further includes a power supply 53, a communication interface 54, an input / output interface 55 and a communication bus 56; wherein the power supply 53 is used to provide working voltage for each hardware device on the electronic device 50; the communication interface 54 can create a data transmission channel between the electronic device 50 and external devices, and the communication protocol followed by the communication interface 54 is any communication protocol applicable to the technical solution of the present application, which is not limited here; the input / output interface 55 is used to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which is not limited here.

[0219] The embodiment of the present application further provides a computer program product, including computer programs / instructions, which are executed by a processor to realize the ransomware detection method as described in the above embodiment.

[0220] Since the embodiments of the computer program product part correspond to the embodiments of the ransomware detection method part, the embodiments of the computer program product part are described in the description of the embodiments of the ransomware detection method part, and will not be repeated here.

[0221] The embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the ransomware detection method as described in the above embodiment.

[0222] Since the embodiments of the computer readable storage medium part correspond to the embodiments of the ransomware detection method part, the embodiments of the storage medium part are described in the description of the embodiments of the ransomware detection method part, and will not be repeated here.

[0223] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the related parts are described in the method part.

[0224] Those skilled in the art will further realize that the mere concepts, teachings, examples, and steps described in the foregoing description are not meant to limit or restrict the scope of the present application in any way. Rather, the scope of the present application encompasses various alternatives, modifications, equivalents, and improvements therein. Therefore, it is to be understood that the application is not to be limited to the specific examples described in the foregoing description. In addition, it should be understood that the application includes all modifications, equivalents, and alternatives falling within the scope of the appended claims.

[0225] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in random access memory (RAM), flash memory, read-only memory (ROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium can be integral to the processor. The processor and the storage medium can reside in an application-specific integrated circuit (ASIC).

[0226] The above provides a ransomware detection method, device, electronic equipment and storage medium. The principles and implementation manners of the present application are described by applying specific examples. The above description of the embodiments is only used to help understand the method of the present application and its core idea. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, the present application can be improved and modified in many ways. These improvements and modifications also fall within the scope of the present application.

Claims

1. A method of detecting a ransomware, characterized by, The method comprises the following steps: Recording process information of each process in the operating system, file operation information generated by the process when calling file operation, and network connection operation information generated by the process when calling network connection operation by using a preset detection program in the operating system kernel; the process information contains the association between the process and its parent process; When a suspicious process calling a preset bait file in the storage space is detected, the suspicious process and the processes associated with the suspicious process are marked as to-be-detected processes according to the process information; Detecting whether the suspicious process is a ransomware process according to all file operation information and all network connection operation information corresponding to all the to-be-detected processes; The process information further contains a process entity file path, the file operation information contains a file path of a file being operated, and the network connection operation information contains a network connection operation type, which is an inbound type or an outbound type; The step of detecting whether the suspicious process is a ransomware process according to all file operation information and all network connection operation information corresponding to all the to-be-detected processes comprises the following steps: Adding all file paths operated by the to-be-detected processes to a suspicious file set according to the file operation information; Adding all processes operating the files corresponding to the process entity file paths of the to-be-detected processes to a suspicious process set according to the file operation information and the process entity file paths of the to-be-detected processes; Adding processes in the suspicious process set performing the network connection operation of the inbound type to a suspicious inbound process set, and adding processes in the suspicious process set performing the network connection operation of the outbound type to a suspicious outbound process set according to the network connection operation information; Determining a ransomware evaluation value according to the suspicious file set, the suspicious inbound process set, and the suspicious outbound process set; Determining that the suspicious process is a ransomware process when the ransomware evaluation value is greater than a preset threshold value; The step of determining a ransomware evaluation value according to the suspicious file set, the suspicious inbound process set, and the suspicious outbound process set comprises the following steps: Determining a preset file type operated by the to-be-detected processes and the number of file path covers of each preset file type by the to-be-detected processes according to each file path in the suspicious file set; each preset file type corresponds to multiple file paths, and each preset file type corresponds to a different file type weight; Setting a preset inbound identification value to a first value when the suspicious inbound process set is empty, or setting the preset inbound identification value to a second value when the suspicious inbound process set is not empty; Setting a preset outbound identification value to the first value when the suspicious outbound process set is empty, or setting the preset outbound identification value to the second value when the suspicious inbound process set is not empty; The ransomware evaluation value is determined according to the preset file type operated by the to-be-detected process, the file path coverage quantity of the to-be-detected process for each preset file type, the file type weight of each preset file type, the preset inbound identification value and the preset outbound identification value.

2. The ransomware detection method of claim 1, wherein, Before the detection program preset in the operating system kernel records the process information of each process appearing in the operating system, the file operation information generated by the process each time the file operation is called, and the network connection operation information generated by the process each time the network connection operation is called, the method further comprises the following steps of: The first probe is inserted into the process operation function, the second probe is inserted into the file operation function, and the third probe is inserted into the network connection operation function; wherein the process operation function comprises a process execution function and a process derivation function; The detection program is mounted at the insertion position of the first probe, the insertion position of the second probe and the insertion position of the third probe; The detection program records the process information of each process appearing in the operating system, the file operation information generated by the process each time the file operation is called, and the network connection operation information generated by the process each time the network connection operation is called, comprising the following steps of: The detection program determines whether the process operation function is called through the first probe, and obtains the process information from the parameters of the process function when it is determined that the process operation function is called; The detection program determines whether the file operation function is called through the second probe, and obtains the file operation information from the parameters of the file operation function when it is determined that the file operation function is called; The detection program determines whether the network connection operation function is called through the third probe, and obtains the network connection operation information from the parameters of the network connection operation function when it is determined that the network connection operation function is called.

3. The ransomware detection method of claim 2, wherein, After the detection program preset in the operating system kernel records the process information of each process appearing in the operating system, the file operation information generated by the process each time the file operation is called, and the network connection operation information generated by the process each time the network connection operation is called, the method further comprises the following steps of: The process information, the file operation information and the network connection operation information from the kernel state to the user state of the detection program are obtained through a hash graph.

4. The ransomware detection method of claim 1, wherein, After the detection program preset in the operating system kernel records the process information of each process appearing in the operating system, the method further comprises the following steps of: A process tree is constructed according to the association relationship between each process and its parent process; The suspicious process and the processes associated with the suspicious process are marked as to-be-detected processes according to the process information, comprising the following steps of: The process tree in which the suspicious process is located is determined, and all processes in the process tree are set as the to-be-detected processes.

5. The ransomware detection method of claim 1, wherein, The ransomware evaluation value is determined according to the preset file type operated by the to-be-detected process, the file path coverage quantity of the to-be-detected process in each preset file type, the file type weight of each preset file type, the preset inbound identification value and the preset outbound identification value, and includes: The ransomware evaluation value is determined according to the preset file type operated by the to-be-detected process, the file path coverage quantity of the to-be-detected process in each preset file type, the file type weight of each preset file type, the preset inbound identification value and the preset outbound identification value, and includes: ； wherein S represents the ransomware evaluation value, k represents the total number of preset file types, T n represents the total number of file paths corresponding to the nth preset file type, h n represents the file path coverage number of the to-be-detected process corresponding to the nth preset file type, W n represents the file type weight of the nth preset file type, i represents a preset inbound identification value, o represents a preset outbound identification value, and a and β represent the weights of the preset inbound identification value and the preset outbound identification value, respectively.

6. A ransomware detection apparatus, characterized by, The kernel detection module is configured to record process information of each process in the operating system, file operation information generated by the process when calling a file operation, and network connection operation information generated by the process when calling a network connection operation by using a preset detection program in the operating system kernel, wherein the process information includes an association relationship between the process and its parent process. The to-be-detected process marking module is configured to mark the suspicious process and processes associated with the suspicious process as to-be-detected processes according to the process information when detecting a suspicious process calling a preset decoy file in a storage space. The ransomware process detection module is configured to detect whether the suspicious process is a ransomware process according to all file operation information and all network connection operation information corresponding to all the to-be-detected processes. The process information further includes a process entity file path, the file operation information includes a file path of a file being operated, and the network connection operation information includes a network connection operation type, which is an inbound type or an outbound type. The ransomware process detection module includes: The suspicious file set adding submodule is configured to add all file paths operated by the to-be-detected processes to a suspicious file set according to the file operation information. The suspicious process set adding submodule is configured to add all processes operating files corresponding to process entity file paths to a suspicious process set according to the file operation information and the process entity file paths of the to-be-detected processes. The inbound and outbound process set adding submodule is configured to add processes in the suspicious process set performing the network connection operation of the inbound type to a suspicious inbound process set and add processes in the suspicious process set performing the network connection operation of the outbound type to a suspicious outbound process set according to the network connection operation information. The evaluation value determining submodule is configured to determine a ransomware evaluation value according to the suspicious file set, the suspicious inbound process set and the suspicious outbound process set. The determination submodule is configured to determine that the suspicious process is a ransomware process when determining that the ransomware evaluation value is greater than a preset threshold. The evaluation value determining submodule includes: ​ The file operation comparison unit is configured to determine, according to each file path in the suspicious file set, a preset file type operated by the to-be-detected process and a file path coverage number of each preset file type operated by the to-be-detected process; each preset file type corresponds to multiple file paths, and each preset file type corresponds to a different file type weight; The inbound identification value setting unit is configured to set a preset inbound identification value to a first value when the suspicious inbound process set is empty, or set the preset inbound identification value to a second value when the suspicious inbound process set is not empty; The outbound identification value setting unit is configured to set a preset outbound identification value to the first value when the suspicious outbound process set is empty, or set the preset outbound identification value to the second value when the suspicious inbound process set is not empty; The evaluation value determination unit is configured to determine the ransomware evaluation value according to the preset file type operated by the to-be-detected process, the file path coverage number of each preset file type operated by the to-be-detected process, the file type weight of each preset file type, the preset inbound identification value, and the preset outbound identification value.

7. An electronic device, comprising: The computer readable storage medium stores computer executable instructions, and the computer executable instructions are loaded and executed by the processor to implement the ransomware detection method according to any one of claims 1 to 5. The computer readable storage medium stores computer executable instructions, and the computer executable instructions are loaded and executed by the processor to implement the ransomware detection method according to any one of claims 1 to 5. ​ 8. A computer-readable storage medium, characterized in that, ​

Images