Ransomware processing method and device

Abstract

The embodiment of the invention provides a ransomware processing method and device, relates to the technical field of storage, and aims to construct a ransomware feature library more efficiently and comprehensively so as to carry out related virus analysis work according to the ransomware feature library. The method comprises the steps that attack information of each kind of ransomware virus in multiple kinds of ransomware viruses is obtained, the attack information of a first ransomware virus comprises an IO sequence generated in the process that the first ransomware virus attacks a storage system and attacked data content, and the first ransomware virus is any kind of ransomware virus in the multiple kinds of ransomware viruses; extracting virus features of each ransomware virus from the attack information of each ransomware virus; and establishing a ransomware feature library by using the virus features of the multiple ransomware viruses, wherein the ransomware feature library is used for carrying out at least one of the following processing on the ransomware viruses: feature query, correlation analysis, virus evolution or ransomware virus prevention scheme test.

Description

[0001] This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office on June 8, 2023, with application number 202310677654.7 and application name “A Ransomware Processing Device”, all contents of which are incorporated by reference in this application. Technical Field

[0002] The embodiments of the present application relate to the field of storage technology, and in particular, to a method and device for processing a ransomware virus. Background Art

[0003] Attackers implant ransomware into storage systems to encrypt data in the storage systems, making it impossible for users to access the data.

[0004] Data security is particularly important for storage systems. In order to ensure the security of storage systems, it is necessary to conduct a comprehensive analysis of ransomware, understand the virus characteristics of various ransomware, and then design anti-ransomware solutions based on the virus characteristics of ransomware. At present, ransomware is constantly updated and the number of new ransomware has increased dramatically. However, there is still a lack of solutions for ransomware processing for storage systems, and a ransomware processing method is urgently needed. Summary of the invention

[0005] The embodiments of the present application provide a method and device for processing a ransomware virus, which can more efficiently and comprehensively construct a ransomware virus feature library to facilitate related virus analysis work based on the ransomware virus feature library.

[0006] In order to achieve the above purpose, the embodiment of the present application adopts the following technical solution:

[0007] In a first aspect, an embodiment of the present application provides a method for processing a ransomware virus, comprising: obtaining attack information of each of a plurality of ransomware viruses, wherein the attack information of a first ransomware virus includes an input / output IO sequence and attacked data content generated in a process in which the first ransomware virus attacks a storage system, and the first ransomware virus is any one of a plurality of ransomware viruses; and extracting virus features of each ransomware virus from the attack information of each ransomware virus; and then organizing the virus features of the plurality of ransomware viruses into a ransomware virus feature library, which is used to perform at least one of the following processing on the ransomware virus: feature query, correlation analysis, virus evolution, or anti-ransomware virus solution testing.

[0008] The ransomware processing method provided in the embodiment of the present application is an automatic construction method of a ransomware feature library implemented by an electronic device. Compared with the method of manually collecting virus features of the ransomware, this method can more efficiently and comprehensively construct a ransomware feature library, so as to perform related virus analysis work according to the ransomware feature library.

[0009] In a possible implementation, the above-mentioned acquisition of attack information of each of the multiple ransomware viruses includes: using multiple ransomware viruses to attack the storage system respectively, and acquiring attack information of each of the multiple ransomware viruses. That is to say, in the process of actively attacking the storage system using multiple ransomware viruses respectively, that is, using existing ransomware viruses to actively attack the storage system, in order to protect the data in the storage system from being destroyed, it is not necessary to attack the real storage system, but to attack the storage system in a simulated manner, and acquire attack information. Among them, the IO sequence in the attack information is the input and output information generated when the ransomware virus exchanges data with the storage system during the process of attacking the storage system, and the data content attacked is the encrypted data information generated in the storage system when the ransomware virus attacks the storage system.

[0010] Optionally, the situation where the ransomware attacks the storage system may also be that the storage system is attacked by the ransomware in an actual business operation environment.

[0011] In one possible implementation, the ransomware processing method provided in the embodiment of the present application further includes: constructing an isolated environment including a storage system; and running multiple ransomware viruses that attack the storage system in the isolated environment respectively, that is, in the isolated environment, using the ransomware virus to actively attack the storage system in a simulated manner.

[0012] Optionally, the isolation environment may be a sandbox platform, and the ransomware processing device (such as a computing device) obtains relevant information of the storage system and creates a sandbox platform including the storage system, and then the ransomware processing device can control the sandbox platform to run multiple ransomware viruses in the ransomware virus list, so that the ransomware viruses attack files in the storage system. When the sandbox platform includes a storage system, the attack method of using multiple ransomware viruses to attack the storage system is to use multiple ransomware viruses to attack the storage system in series. When the sandbox platform includes multiple storage systems, the attack method of using multiple ransomware viruses to attack the storage system may be to use multiple ransomware viruses to attack multiple storage systems in parallel.

[0013] In a possible implementation, the method for processing ransomware provided in the embodiment of the present application further includes: performing correlation analysis on multiple ransomware viruses based on virus features in a ransomware virus feature library to obtain correlation relationships between the multiple ransomware viruses.

[0014] Optionally, based on the virus features in the ransomware virus library, a clustering algorithm can be used to cluster from one or more dimensions of the above-mentioned ransomware virus feature types, and the ransomware viruses corresponding to similar virus features can be divided into a ransomware virus set. It can also be considered that the result of the correlation analysis of multiple ransomware viruses is one or more ransomware virus sets, and the ransomware viruses in the same ransomware virus set have a correlation relationship.

[0015] In a possible implementation, based on the above-obtained ransomware feature library and the association relationship of ransomware, the ransomware processing device can also use a knowledge graph tool to generate a ransomware knowledge graph indicating the association relationship of multiple ransomware. Using the knowledge graph tool to convert the ransomware association into a ransomware knowledge graph can more intuitively reflect the association relationship between ransomware and facilitate users to query relevant information of ransomware.

[0016] In an embodiment of the present application, after the ransomware processing device determines the ransomware associated with the target ransomware, it can output information about the associated ransomware in the form of a knowledge graph. The ransomware processing device also includes a visualization platform, which displays a ransomware knowledge graph that can indicate the association between the target ransomware and other ransomware.

[0017] In one possible implementation, the ransomware processing method provided in an embodiment of the present application also includes: receiving a first query request, the first query request being used to query a ransomware that is associated with a target ransomware; and in response to the first query request, determining a ransomware associated with the target ransomware based on an association relationship among multiple ransomwares; and outputting information about the ransomware associated with the target ransomware.

[0018] In a possible implementation, the ransomware processing method provided in the embodiment of the present application further includes: receiving a second query request, the second query request being used to query virus information of a target ransomware; and outputting information of the target ransomware in response to the second query request. The ransomware information may include basic information of the ransomware, such as the virus family to which the ransomware belongs, a hash value, etc.) and / or virus features of the ransomware extracted from the above attack information.

[0019] In a possible implementation, the method for processing ransomware provided in the embodiment of the present application also includes: generating a new ransomware based on multiple ransomware. In practical applications, ransomware will be continuously updated and iterated, thereby generating new ransomware, resulting in the inability of existing anti-ransomware solutions to detect new ransomware. In the embodiment of the present application, based on the existing multiple ransomware, the ransomware is evolved and simulated, thereby simulating and generating one or more new ransomware, so that an effective anti-ransomware solution can be designed for the new ransomware, which helps to improve the security performance of the storage system.

[0020] In a possible implementation, the above-mentioned generation of a new ransomware virus based on multiple ransomware viruses includes: recombining the virus features of multiple ransomware viruses in the ransomware virus feature library to obtain a new ransomware virus, and the new virus feature can indicate a new ransomware virus. For example, the traversal order of the above-mentioned same-level directories, the attack path of the multi-level directory, the attack mode, the attack speed feature, the attack thread feature, the location feature of the attack content, the entropy value feature of the attack content, the priority of the attack file, and the type of the attack file can be combined to obtain a set of new virus features. The virus features can be combined manually or randomly.

[0021] In a possible implementation, after one or more new virus features are obtained through virus feature recombination, the new virus features are updated to the ransomware virus feature library, so that the virus features of the ransomware virus feature library are more comprehensive, which is helpful for the design of anti-ransomware solutions.

[0022] In a possible implementation, the above-mentioned generation of a new ransomware virus based on multiple ransomware viruses includes: replacing the encryption algorithm of one of the multiple ransomware viruses to obtain a new ransomware virus, and the new encryption algorithm can indicate a new ransomware virus. Evolving the ransomware virus based on the new encryption algorithm can construct a new ransomware virus with a more complex encryption mode or a more difficult to distinguish ransomware virus.

[0023] In a possible implementation, the ransomware processing method provided in the embodiment of the present application also includes: testing and optimizing one or more anti-ransomware solutions based on multiple ransomware viruses, thereby generating a test report of one or more anti-ransomware solutions, and the test report includes the test results and optimization suggestions of the anti-ransomware solutions. Among them, the test results of the anti-ransomware solutions include the detection rate and / or missed detection rate of one or more anti-ransomware solutions, and the optimization suggestions in the test report are used to optimize one or more anti-ransomware solutions. In the embodiment of the present application, detecting and optimizing anti-ransomware based on multiple ransomware viruses helps to improve the security reliability and detection accuracy of the anti-ransomware solution.

[0024] Optionally, the ransomware virus test set includes one or more ransomware viruses, and the one or more ransomware viruses may be from at least one of the following virus sets: a first virus set, a second virus set, or a third virus set. The ransomware viruses in the first virus set are from the multiple ransomware viruses in the ransomware virus feature library used to form the ransomware virus feature library, the ransomware viruses in the second virus set are from the one or more new ransomware viruses generated above, and the ransomware viruses in the third virus set are from the ransomware viruses in the first virus set and / or the second virus set after de-redundancy, for example, based on the clustering results of the virus features, the sets with the same virus features are removed to obtain the third virus set.

[0025] In one possible implementation, the ransomware processing device executes the test process of the anti-ransomware solution, which may include: when the ransomware in the ransomware test set is running in a sandbox platform (the sandbox platform may be the same as or different from the sandbox platform used when constructing the ransomware feature library), running one or more anti-ransomware solutions to detect the ransomware running in the sandbox platform; and generating test reports for one or more anti-ransomware solutions based on the test results of the ransomware.

[0026] In a second aspect, an embodiment of the present application provides a ransomware virus processing device, including: a feature library creation module, which is used to obtain attack information of each ransomware virus among multiple ransomware viruses; and extract virus features of each ransomware virus from the attack information of each ransomware virus; and organize the virus features of multiple ransomware viruses into a ransomware virus feature library; wherein the attack information of the first ransomware virus includes an input and output IO sequence and the attacked data content generated in the process of the first ransomware virus attacking the storage system, and the first ransomware virus is any one of the multiple ransomware viruses; the ransomware virus feature library is used to perform at least one of the following processing on the ransomware virus: feature query, correlation analysis, virus evolution or anti-ransomware virus solution testing.

[0027] In a possible implementation, the feature library creation module is specifically used to use the multiple ransomware viruses to attack the storage system and obtain attack information of each of the multiple ransomware viruses.

[0028] In a possible implementation, the feature library creation module is further used to build an isolated environment including the storage system; and to respectively run the multiple ransomware viruses that attack the storage system in the isolated environment.

[0029] In a possible implementation, the ransomware virus processing device provided in the embodiment of the present application also includes: a correlation analysis module; the correlation analysis module is used to perform correlation analysis on multiple ransomware viruses based on virus features in the ransomware virus feature library to obtain correlation relationships between the multiple ransomware viruses.

[0030] In one possible implementation, the ransomware processing device also includes an information query module; the information query module is used to receive a first query request, the first query request is used to query the ransomware that has an associated relationship with the target ransomware; and in response to the first query request, determine the ransomware associated with the target ransomware based on the association relationship between multiple ransomware; and output the ransomware information associated with the target ransomware.

[0031] In a possible implementation, the information query module is further used to receive a second query request, where the second query request is used to query virus information of a target ransomware virus; and in response to the second query request, output information of the target ransomware virus.

[0032] In a possible implementation, the ransomware virus processing device provided in the embodiment of the present application further includes a ransomware virus evolution module, and the ransomware virus evolution module is used to generate a new ransomware virus based on multiple ransomware viruses.

[0033] In a possible implementation, the ransomware virus evolution module is specifically used to recombine the virus features of multiple ransomware viruses in the ransomware virus feature library to obtain a new ransomware virus.

[0034] In a possible implementation, the ransomware evolution module is specifically used to replace the encryption algorithm of a ransomware virus among multiple ransomware viruses to obtain a new ransomware virus.

[0035] In one possible implementation, an embodiment of the present application provides a ransomware processing device that also includes an anti-ransomware testing module; the anti-ransomware testing module is used to test and optimize one or more anti-ransomware solutions based on multiple ransomware viruses.

[0036] In the first and second aspects above, when the storage system is stored in a file storage mode, the virus features of the ransomware virus include one or more of the following features: input and output features, attack content features, or attack priority features. Among them, the input and output features include at least one of the following: the traversal order of directories at the same level, the attack path of multi-level directories, the attack mode, the attack speed feature, or the attack thread feature; the attack priority feature includes the priority of the attack file and / or the type of the attack file; the attack content feature includes the location feature of the attack content and / or the entropy value feature of the attack content.

[0037] Among them, the traversal order of the directories at the same level can indicate the traversal order in which the ransomware attacks the files in the storage system.

[0038] The attack path of the multi-level directory can indicate which directory the ransomware starts to encrypt files from.

[0039] The attack mode can indicate how the ransomware encrypts files. For example, one attack mode is read-encrypt-write, and another mode is read-write-delete.

[0040] The attack speed can indicate how quickly the ransomware encrypts your files, for example, slow encryption or fast encryption.

[0041] The attack thread feature can indicate whether the ransomware performs encryption in a single thread or multiple threads.

[0042] The location of the attack content can indicate which parts of the file the ransomware encrypted.

[0043] The entropy value feature can indicate the change in the entropy value of a file after the ransomware encrypts the file. For example, the entropy value of the encrypted file is a high entropy value, or the entropy value of the encrypted file is a normal entropy value.

[0044] The priority of attacking a file may indicate the priority with which the ransomware attacks the file. For example, the priority of a file may be determined according to a keyword contained in the file name or the file content, or the priority of a file may be determined according to a file type.

[0045] The type of the attacked file can indicate what types of files the ransomware has attacked. For example, the type of the attacked file is recorded in an attack type whitelist.

[0046] In the first and second aspects above, when the storage system is in block storage, the virus features of the ransomware virus include input and output features and / or attack content features. The input and output features include at least one of the following: encryption order of the logic unit, attack thread features or attack mode; the attack content features include entropy features of the attack content.

[0047] Among them, the encryption order of LUN indicates the order in which the ransomware attacks multiple LUNs; the attack thread feature can indicate whether the ransomware encrypts in a single thread or multiple threads; the attack mode can indicate how the ransomware encrypts files. The attack content feature can include the entropy value feature of the attack content, which can indicate the change in the entropy value of the data after the ransomware encrypts the data.

[0048] In a third aspect, an embodiment of the present application provides a computing device, comprising a memory and at least one processor connected to the memory, the memory being used to store computer program code, the computer program code comprising computer instructions, which, when executed by at least one processor, enable the computing device to execute the method of the first aspect and any one of its possible implementations.

[0049] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing computer instructions, which, when executed on a computer, execute the method of the first aspect and any one of its possible implementations.

[0050] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes computer instructions. When the computer instructions are run on a computer, the method of the first aspect and any one of its possible implementations is executed.

[0051] In a sixth aspect, an embodiment of the present application provides a chip system, comprising: a processor, configured to call and run a computer program from a memory, so that a terminal device equipped with the chip system executes the method of the first aspect and any one of its possible implementation methods.

[0052] In a seventh aspect, an embodiment of the present application provides a storage system, including a computing device and a storage medium communicating with the computing device; the storage medium is used to store data, and the computing device is used to execute the method described in any one of the first aspect and its possible implementations. Optionally, the storage medium can be RAM, ROM, cache memory (cache), flash memory (flash), optical storage, disk storage medium (floppy disk, hard disk, tape) or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer.

[0053] It should be understood that the beneficial effects achieved by the technical solutions of the second to seventh aspects of the present application and the corresponding possible implementation methods can be referred to the technical effects of the first aspect and its corresponding possible implementation methods mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of the architecture of a ransomware processing system provided in an embodiment of the present application;

[0055] Figure 2 A schematic diagram of the hardware structure of a computing device provided in an embodiment of the present application;

[0056] Figure 3 A schematic diagram of an application scenario of the ransomware processing method provided in an embodiment of the present application;

[0057] Figure 4 One of the schematic diagrams of a method for processing a ransomware virus provided in an embodiment of the present application;

[0058] Figure 5 A framework diagram for creating a ransomware virus feature library provided in an embodiment of the present application;

[0059] Figure 6 A second schematic diagram of a method for processing a ransomware virus provided in an embodiment of the present application;

[0060] Figure 7 A third schematic diagram of a method for processing a ransomware virus provided in an embodiment of the present application;

[0061] Figure 8 A framework diagram of a ransomware virus correlation analysis and visual query process provided in an embodiment of the present application;

[0062] Fig. 9 A fourth schematic diagram of a method for processing a ransomware virus provided in an embodiment of the present application;

[0063] Fig.10 A framework diagram of the evolution process of a ransomware virus provided in an embodiment of the present application;

[0064] Fig.11 A fifth schematic diagram of a method for processing a ransomware virus provided in an embodiment of the present application;

[0065] Fig.12 A framework diagram of a testing process of an anti-ransomware solution provided in an embodiment of the present application;

[0066] Fig.13 A complete flowchart of the method for processing ransomware provided in an embodiment of the present application;

[0067] Fig.14 One of the structural schematic diagrams of a ransomware virus processing device provided in an embodiment of the present application;

[0068] Fig.15 A second structural diagram of a ransomware virus processing device provided in an embodiment of the present application;

[0069] Fig.16 A schematic diagram of the structure of a ransomware virus processing system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0071] The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects rather than to describe a specific order of the objects. For example, a first query request and a second query request are used to distinguish different query requests rather than to describe a specific order of the query requests.

[0072] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0073] In the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more than two, and "plurality" may also be described as at least two.

[0074] First, some concepts involved in a method and device for processing a ransomware virus provided in an embodiment of the present application are explained.

[0075] 1. Ransomware

[0076] Ransomware is a malware that hackers use to hijack user data and extort money from users by locking the screen, encrypting data, etc. Hackers use system vulnerabilities or phishing to implant viruses into user computers or servers to encrypt data on the hard drive or even the entire hard drive, and then demand a ransom from the victim before decrypting the data.

[0077] 2. Network attached storage (NAS) system

[0078] NAS system is a storage system that uses file storage as its storage method. The storage devices (i.e., storage nodes, also known as network storage) in the storage system are connected to the host (computing node) through a standard network topology (such as Ethernet), so that the storage space of the storage device can be shared. The NAS system contains a file system, and data is stored in the form of files to form a file system. The NAS system can act as a remote file server, and multiple users can access files stored in the NAS system through the network. The NAS system supports multiple file protocols, such as the network file system (NFS) protocol, the common internet file system (CIFS) protocol, the file transfer protocol (FTP), the hypertext transfer protocol (HTTP), etc. NAS systems may include but are not limited to OceanStor Dorado, OceanStorPacific, and Fusion Cube.

[0079] The NAS system has the following advantages: plug and play; network connection via TCP / IP, convenient for network connection based on existing enterprise network; support for different file protocols, facilitating file sharing.

[0080] 3. Storage area network (SAN) system

[0081] SAN system is a storage system with block storage. The storage devices (i.e. storage nodes) in the storage system are connected to the host (i.e. computing node) through SAN. SAN is a regional network dedicated to data storage that uses Fibre Channel (FC) technology to connect storage devices and hosts through Fibre Channel switches. SAN system supports small computer system interface (SCSI), Fibre Channel arbitrated loop (FC-AL) interface, etc.

[0082] The SAN system has the following advantages: It supports high-speed transmission of large-capacity data between hosts and storage devices.

[0083] 4. Sandbox (or sandbox platform)

[0084] Sandboxie is a virtual system program (virtual software), an execution environment that restricts program behavior according to security policies. Sandbox creates an isolated environment for independent operations. In the field of network security, sandbox is mainly used to test suspicious software, test viruses, etc. Sandbox is restricted from the following program behaviors:

[0085] Cannot run any local executable programs.

[0086] Cannot read any information from or write any information to the local computer file system.

[0087] Aside from Java version information and a few innocuous operating system details, no information about the local computer can be viewed. In particular, code in the sandbox cannot view information such as usernames, email addresses, etc.

[0088] Remotely loaded programs cannot communicate with any host other than the server from which the program was downloaded.

[0089] Based on the above, it can be understood that running suspicious software or viruses in a sandbox is safe and will not pose a security threat to the information in the user's local computer.

[0090] The sandbox platform involved in the embodiments of the present application is an isolated environment that includes a simulated storage system, that is, the sandbox platform includes a storage system, which may be referred to as a sandbox platform or a sandbox environment in the following embodiments. When a ransomware virus is run in the sandbox platform, the ransomware virus will attack the data in the storage system. During the process of the ransomware virus attacking the data in the storage system, the ransomware virus processing device can obtain the virus characteristics of the ransomware virus based on the attack information generated during the attack. Furthermore, when a ransomware virus is run in the sandbox platform, an anti-ransomware virus solution can be run in the sandbox platform to detect the ransomware virus running on the sandbox platform, and then determine the test results of the anti-ransomware virus solution based on the test results.

[0091] It is understandable that ransomware is a major security risk for hosts and storage systems. In order to ensure the safe use of hosts and storage systems, a comprehensive analysis of ransomware is required. After obtaining the virus characteristics of the ransomware, an effective anti-ransomware solution can be designed based on the virus characteristics of the ransomware.

[0092] At present, for the host side, the characteristics of the ransomware virus on the host side are usually counted and collected manually. For example, the characteristics of the ransomware virus attack on the host side are obtained, such as the behavior of modifying the registry, the behavior of modifying the host side account settings, etc.; for another example, the characteristics of the ransomware virus resource consumption on the host side are obtained, such as CPU usage, memory occupancy, etc. However, for the storage side, there is a lack of methods for collecting virus characteristics of ransomware viruses.

[0093] Moreover, as ransomware is constantly updated and iterated, the number of new types of ransomware has increased dramatically, and it is difficult to comprehensively collect the characteristics of new types of viruses. In other words, it is relatively difficult to collect the virus characteristics of ransomware.

[0094] In response to the above problems, the embodiments of the present application provide a method for processing ransomware, wherein the ransomware processing device can obtain the attack information (including IO sequence and attacked data content) generated during the storage process of each ransomware attack among multiple ransomware, and extract the virus features of each ransomware from the attack information of each ransomware; then the virus features of multiple ransomware are organized into a ransomware feature library, which is used to perform at least one of the following processing on the ransomware: feature query, correlation analysis, virus evolution, or anti-ransomware solution testing. The ransomware processing method provided in the embodiments of the present application can more efficiently and comprehensively construct a ransomware feature library, so as to facilitate related virus analysis work based on the ransomware feature library.

[0095] refer to Figure 1The embodiment of the present application provides a ransomware virus processing system, which includes a ransomware virus processing device 101 and a storage system 102. The ransomware virus processing device 101 and the storage system 102 are communicatively connected. The ransomware virus processing device 101 obtains attack information generated during the ransomware virus attack on the storage system 102, and extracts virus features from the attack information, collects virus features of multiple ransomware viruses and forms a ransomware virus feature library.

[0096] Among them, the ransomware virus processing device 101 includes a processor, a memory and a communication interface. Among them, a sandbox platform including a storage system 102 is deployed in the processor, and the sandbox platform is used to run the ransomware virus to simulate an attack on the storage system 102. The memory stores instructions corresponding to the execution of the ransomware virus processing method. After the processor executes the instructions in the memory, it executes the ransomware virus processing method provided in the embodiment of the present application to create a ransomware virus feature library. Optionally, the ransomware virus feature library can be stored in the memory of the ransomware virus processing device 101, or in other devices (such as database devices). The communication interface is used to communicate with other devices. For example, communicate with the storage device in the storage system 102 to obtain relevant information of the storage system 102.

[0097] The storage system 102 includes one or more storage devices ( Figure 1 Two storage devices are illustrated in the figure), each storage device includes a controller, a communication interface and multiple hard disks (multiple hard disks form a storage array). The controller includes a processor and a memory. The processor is used to process data access requests from the outside or internally generated data access requests, such as metadata management, deduplication, data compression, virtualized storage space and address conversion, etc. The memory is used to temporarily store data to be written to the hard disk or data read from the hard disk. The communication interface can be a network card for communicating with the ransomware virus processing device 101 or other hosts. Multiple hard disks are used to store data persistently.

[0098] Combination Figure 1 , the storage system 102 can be a centralized storage system or a distributed storage system; or, the storage system 102 can be a block storage system (such as a SAN system), a file storage system (such as a NAS system) or an object storage system. The embodiment of the present application does not specifically limit the type of the storage system 102.

[0099] Optionally, the ransomware virus processing device may be a device having processing and storage functions independent of the storage system, such as a computing device, such as a server, a desktop computer, etc. The ransomware virus processing device may also be located inside the storage system, for example, it may be located on any storage device in the storage system; specifically, the ransomware virus processing device may be located on a controller in a storage device. This is not limited in the embodiments of the present application.

[0100] Taking the ransomware virus processing device as an independent computing device as an example, Figure 2 A schematic diagram of the hardware structure of a computing device provided in an embodiment of the present application is provided. Figure 2 The various components shown in the EMBODIMENTS 2000 may be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application specific integrated circuits.

[0101] like Figure 2 As shown, the computing device may include: a processor 201, a memory 202, and a communication interface 203. The processor 201, the memory 202, and the communication interface 203 may be connected to each other via a bus 204, or in other ways.

[0102] The processor 201 is the control center of the computing device. The processor 201 may be a general-purpose central processing unit (CPU) or other general-purpose processors. The general-purpose processor may be a microprocessor or any conventional processor.

[0103] The controller in the processor 201 is the nerve center and command center of the computing device. The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of fetching and executing instructions. Optionally, a memory can also be set in the processor 201 to store instructions and data. Exemplarily, the processor 201 may include one or more CPUs, such as Figure 2 CPU 0 and CPU 1 are shown in .

[0104] The memory 202 includes, but is not limited to, a random access memory (RAM), a read only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, or an optical memory, a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer. In the embodiment of the present application, the memory 202 can store information such as computer instructions.

[0105] In one possible implementation, the memory 202 may exist independently of the processor 201. The memory 202 may be connected to the processor 201 via the bus 204, and is used to store data (such as a virus signature library, etc.), instructions, or program codes. When the processor 201 calls and executes the instructions or program codes stored in the memory 202, the relevant steps in the method for processing the ransomware virus provided in the embodiment of the present application can be implemented.

[0106] In another possible implementation, the memory 202 may also be integrated with the processor 201 .

[0107] The communication interface 203 may be a transceiver module for communicating with other devices or communication networks (e.g. Figure 2 The communication interface 203 can receive instructions, messages or data, etc. by communicating with the log management platform or node information processing platform shown in the figure), such as Ethernet, RAN, wireless local area networks (WLAN), etc. The transceiver module can be a device such as a transceiver or a transceiver. Optionally, the communication interface 203 can also be a transceiver circuit located in the processor 201, which is used to realize the signal input and signal output of the processor. The communication interface 203 can be a wired interface (port), such as a fiber distributed data interface (FDDI), a gigabit Ethernet (GE) interface, or the communication interface 203 can also be a wireless interface.

[0108] The bus 204 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus may also be divided into a serial bus and a parallel bus. For ease of representation, Figure 2 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0109] Optionally, the computing device in the embodiment of the present application may further include an input / output interface 205, which is used to connect to an input device and receive information input by a user through the input device. The input device includes but is not limited to a keyboard, a touch screen, a microphone, and the like. The input / output interface 205 is also used to connect to an output device to output the processing results of the processor 201 (such as ransomware information or a test report of an anti-ransomware solution, etc.), and the output device includes but is not limited to a display, a printer, and the like.

[0110] It should be noted that Figure 2 The computing device shown is only one example of a computing device that can have more than Figure 2 More or fewer components may be shown, two or more components may be combined, or there may be a different configuration of components.

[0111] Combined with the above Figure 1 The ransomware processing system shown and Figure 2 The computing device shown, Figure 3 A schematic diagram of an application scenario of the ransomware virus processing method provided in an embodiment of the present application is shown. Figure 3 The ransomware processing method provided in the embodiment of the present application may include four aspects, namely:

[0112] 1. Creation of ransomware virus signature database

[0113] Run multiple ransomware viruses in an isolated environment (e.g., a sandbox platform) to make the ransomware viruses attack files in the storage system. Collect attack information (including IO sequence and attacked data content) generated by the attack process during the ransomware virus attack on files in the storage system, and extract virus features of the ransomware viruses from the attack information, so as to construct virus features of multiple ransomware viruses into a virus feature library.

[0114] 2. Ransomware Correlation Analysis

[0115] Based on the above-obtained ransomware feature library, the correlation between multiple ransomware viruses can be analyzed, and according to the correlation between the ransomware viruses, a visual ransomware virus knowledge graph that can reflect the correlation between the ransomware viruses is generated ( Figure 3 The ransomware knowledge graph shown is only a schematic diagram and does not limit the ransomware knowledge graph obtained in the embodiment of the present application) for users to query virus features and related ransomware.

[0116] Combination Figure 3The ransomware knowledge graph shown in FIG. 1 is briefly described below. The ransomware knowledge graph is a manifestation of the association relationship of ransomware in one or more feature dimensions (the following embodiment will introduce the knowledge graph in detail in combination with virus features). Figure 3 In the ransomware knowledge graph shown, R1, R2, R3, and R4 represent four types of ransomware, and a line between two of the four types of ransomware indicates that the two connected ransomware have an association relationship. Optionally, feature attributes may also be reflected in the ransomware knowledge graph, and the feature attributes may indicate on which feature dimension the associated ransomware has an association relationship.

[0117] 3. Ransomware evolution

[0118] Based on the ransomware virus feature library obtained above, the ransomware virus can be evolved to generate (i.e. simulate) one or more new ransomware viruses. On this basis, the virus features of the new ransomware virus can also be updated to the ransomware virus feature library. Alternatively, the encryption algorithm of the existing ransomware virus can be replaced to achieve the evolution of the ransomware virus and generate one or more new ransomware viruses.

[0119] 4. Anti-ransomware solution testing

[0120] A ransomware virus (which may be an existing ransomware virus and / or a newly generated ransomware virus) is run in the sandbox platform. During this process, one or more anti-ransomware solutions are run to detect the ransomware virus running in the sandbox platform and generate a test report.

[0121] In combination with the above, the method for processing the ransomware virus provided in the embodiment of the present application is described in detail below. Figure 4 As shown, the method for processing the ransomware virus provided in the embodiment of the present application is as follows S401-S403.

[0122] S401. Obtain attack information of each of the multiple ransomware viruses.

[0123] For a first ransomware virus among multiple ransomware viruses, the attack information of the first ransomware virus includes an input / output IO sequence generated in a process in which the first ransomware virus attacks a storage system and the attacked data content. The first ransomware virus is any one of the multiple ransomware viruses.

[0124] Optionally, in an embodiment of the present application, the storage method of the storage system may be file storage, for example, the storage method of the above-mentioned NAS system is file storage; the storage method of the storage system may also be block storage, for example, the storage method of the above-mentioned SAN system is block storage.

[0125] The IO sequence in the above attack information is the input and output information generated when the ransomware exchanges data with the storage system during the process of attacking the storage system. The attacked data content is the encrypted data information generated in the storage system when the ransomware attacks the storage system.

[0126] Combination Figure 5 A framework diagram of the processing process of the ransomware virus shown is a framework diagram of the process of creating a ransomware virus feature library. Optionally, the IO sequence can be collected by an IO collector, for example, by an extended Berkeley packet filter (eBPF) framework or by audit logs. The attacked data content can be collected by a content comparator, which compares the encrypted data with the content of the data before the attack to locate the attacked data content.

[0127] In one implementation, if the storage system is a file storage system, the IO information may include: operation mode (such as read, write, delete, create, rename), operation object (such as the file path and file name of the operation), operation time, mount protocol (such as NFS, CIFS), host IP address of the operation, host name of the operation, etc. The data content attacked is the encrypted content information of the file.

[0128] In another implementation, if the storage system is in block storage mode, the IO information includes: operation mode (such as read, write, delete), operation LUN corresponding ID (LUN is a logical storage unit in the SAN system, and each LUN has an index ID), operation LUN data starting LBA (LBA is a logical block address, indicating the location of data in the LUN), operation time, and operation length (such as the length of read and write data).

[0129] In the embodiment of the present application, the above-mentioned ransomware virus attacking the storage system may include two situations, one of which is to actively attack the storage system using the ransomware virus in a simulated manner in an isolated environment, and the other is that the storage system is attacked by the ransomware virus in the actual environment of business operation.

[0130] Accordingly, combined Figure 4 ,like Figure 6 As shown, in one implementation, the above S401 can be specifically implemented through S4011.

[0131] S4011. Use multiple ransomware viruses to attack the storage system respectively, and obtain attack information of each of the multiple ransomware viruses.

[0132] That is to say, a plurality of ransomware viruses are used to actively attack the storage system. In the process of using the existing ransomware virus to actively attack the storage system, in order to protect the data in the storage system from being destroyed, the storage system may not be attacked in a real way, but may be attacked in a simulated way to obtain the attack information.

[0133] On this basis, the ransomware virus processing method provided in the embodiment of the present application also includes: constructing an isolated environment including a storage system, and running multiple ransomware viruses that attack the storage system in the isolated environment respectively.

[0134] Optionally, the isolation environment can be a sandbox platform, and the ransomware processing device (such as a computing device) obtains relevant information of the storage system and creates a sandbox platform including the storage system. The ransomware processing device can then control the sandbox platform to run multiple ransomware viruses in the ransomware virus list, so that the ransomware viruses attack files in the storage system.

[0135] In an embodiment of the present application, one way for a storage device to build a sandbox platform is to physically connect the storage device to a server, and make the storage device and the server in the same network, and isolate the network from other devices. The storage system of the storage device is mounted to the server through a protocol, and then a virtual machine is built in the server (for example, using VMware tools), the storage system is shared in the virtual machine, and the ransomware is run in the virtual machine. In other words, the sandbox platform is a virtual machine that includes a storage system, and the isolated environment can be automatically restored by rolling back a snapshot of the virtual machine after each run.

[0136] In one implementation, when the sandbox platform includes a storage system, the attack method of using multiple ransomware viruses to attack the storage system is to use multiple ransomware viruses to attack the storage system serially.

[0137] In another implementation, when the sandbox platform includes multiple storage systems, the attack method of using multiple ransomware viruses to attack the storage systems may be to use multiple ransomware viruses to attack the multiple storage systems in parallel. Optionally, at the same time, the ransomware viruses that attack the multiple storage systems may be different.

[0138] S402: Extract virus features of each ransomware virus from attack information of each ransomware virus.

[0139] In an embodiment of the present application, when the storage system is stored in a file format, the virus features of the ransomware virus include one or more of the following features: input and output features, attack content features, or attack priority features.

[0140] refer to Figure 5As described in the above embodiment, for a storage system (such as a NAS system) whose storage mode is file storage, the attack information of the ransomware virus includes an IO sequence and the attacked data content. Optionally, the above input and output features and attack priority features can be extracted from the IO sequence, and the above attack content features can be extracted from the attacked data content.

[0141] The following introduces the input and output features, attack content features, and attack priority features respectively.

[0142] 1. Input and output characteristics

[0143] The input and output characteristics of the ransomware virus include at least one of the following: the traversal order of directories at the same level, the attack path of multi-level directories, the attack mode, the attack speed characteristic or the attack thread characteristic.

[0144] The traversal order of the same-level directories can indicate the traversal order in which the ransomware attacks the files in the storage system. For example, the traversal order of the same-level directories can be sorted by file name, or by file size, or by the latest modification time of the file (for example, modification time from front to back, etc.), or by other attributes, which is not limited in the embodiments of the present application.

[0145] The attack path of the multi-level directory can indicate which directory the ransomware starts to encrypt files from. For example, encrypting files from the root directory, or from a specific directory (such as the document directory).

[0146] The attack mode can indicate how the ransomware encrypts the file. For example, one attack mode is read-encrypt-write, which means first reading the data in the file, then encrypting the data in the file, and then writing the new data to overwrite the original data; another mode is read-write-delete, which means first reading the file (called the original file), encrypting the data in the original file, writing it to the newly created file (new file), and then deleting the original file. It can be understood that the attack mode can also be other modes, which are not limited in the embodiments of the present application.

[0147] The attack speed can indicate how fast the ransomware encrypts files. For example, slow encryption or fast encryption, where slow encryption means that the number of attack IOs of the ransomware accounts for a relatively low proportion of the total number of normal input and output of the user. It should be understood that since the number of attack IOs of the ransomware is relatively small, the ransomware with slow encryption is not easy to be detected.

[0148] The attack thread feature can indicate whether the ransomware is encrypted in a single thread or multiple threads. Single thread corresponds to serial processing, such as serial reading or serial encryption; multiple threads correspond to batch processing, such as batch reading or batch encryption.

[0149] 2. Attack Content Characteristics

[0150] The attack content features of the ransomware virus include location features of the attack content and / or entropy value features of the attack content.

[0151] The location of the attack content can indicate which parts of the file the ransomware has encrypted, for example, encrypting all the data in the file, or encrypting a certain part of the data at the beginning, middle, or end of the file, or encrypting the file interval (for example, encrypting part of the data at fixed intervals).

[0152] The entropy value feature can indicate the change in the entropy value of the file after the ransomware encrypts the file. For example, the entropy value of the encrypted file is a high entropy value, or the entropy value of the encrypted file is a normal entropy value. It should be understood that the entropy value of a file is an indicator used to measure the degree of disorder of the file content (i.e., data). The higher the entropy value, the more disordered the data.

[0153] Optionally, in some special scenarios, the attack content characteristics of the ransomware virus may also include other encryption characteristics. For example, in the scenario where the ransomware virus attacks the database, the attack content characteristics may also include special encryption characteristics, such as full encryption of the database, page encryption, or column encryption.

[0154] 3. Attack Priority Characteristics

[0155] The attack priority characteristics of the ransomware virus include the priority of the attacked file and / or the type of the attacked file.

[0156] Among them, the priority of attacking files can indicate the priority with which the ransomware attacks files. For example, the priority of a file can be determined according to the priority of the keywords contained in the file name or the file content. For example, the attack priority of a file containing the keyword "password" is higher than the attack priority of a file containing the keyword "bill". When the ransomware attacks a file, it will first encrypt the file containing the keyword "password" and then encrypt the file containing the keyword "bill". Alternatively, the priority of a file can be determined according to the file type. When the ransomware attacks a file, it will first encrypt files with higher file type priorities and then encrypt files with lower file type priorities.

[0157] The type of the attacked file can indicate what type of files the ransomware has attacked. For example, the type of the attacked file is recorded in a whitelist of attack types.

[0158] Combined with the description in the above embodiment, for a storage system (such as a SAN system) whose storage method is block storage, the attack information of the ransomware virus includes an IO sequence and the attacked data content, and the virus features of the ransomware virus include one or more of the following features: input and output features or attack content features. Among them, the input and output features are extracted from the IO sequence, and the attack content features are extracted from the attacked data content.

[0159] In a storage system where the storage method is block storage, the input and output characteristics may include at least one of the following: encryption order of logical units (which may be referred to as LUNs for short), attack thread characteristics, and attack modes. The encryption order of LUNs indicates the order in which the ransomware attacks multiple LUNs; the attack thread characteristics may indicate whether the ransomware encrypts in a single thread or multiple threads; the attack mode may indicate how the ransomware encrypts files, for example, one attack mode is read-write-delete. For the attack thread characteristics and attack modes, please refer to the relevant description of the above embodiments, which will not be repeated here.

[0160] For a storage system with block storage as the storage method, the attack content feature may include an entropy value feature of the attack content, and the entropy value feature may indicate the change in the entropy value of the data after the ransomware encrypts the data. For example, the data in the encrypted LUN becomes high entropy value data.

[0161] S403: The virus features of multiple ransomware viruses are organized into a ransomware virus feature library, and the ransomware virus feature library is used to perform at least one of the following processing on the ransomware viruses: feature query, correlation analysis, virus evolution, or anti-ransomware virus solution testing.

[0162] In the embodiment of the present application, the ransomware virus feature library includes virus features of multiple ransomware viruses, and more virus analysis work can be completed based on the ransomware virus feature library. For example, ransomware virus information can be queried based on the ransomware virus feature library, the association between ransomware viruses can be analyzed based on the ransomware virus feature library, and virus evolution can be performed based on the ransomware virus feature library to simulate more viruses, which is helpful for designing corresponding anti-ransomware virus solutions. Existing anti-ransomware virus solutions can also be tested based on the ransomware virus feature library, which is helpful for improving anti-ransomware virus solutions and improving the security performance of storage systems.

[0163] The ransomware processing method provided in the embodiment of the present application is that the ransomware processing device obtains the attack information generated in the process of multiple ransomware viruses attacking the storage system, and extracts the virus characteristics of the ransomware viruses from the attack information of each ransomware virus; and then the virus characteristics of the multiple ransomware viruses are organized into a ransomware virus feature library. The ransomware processing method provided in the embodiment of the present application is an automatic construction method of a ransomware virus feature library implemented by a ransomware virus processing device. Compared with the method of manually collecting the virus characteristics of the ransomware virus, this method can more efficiently and comprehensively construct a ransomware virus feature library, so as to facilitate the execution of related virus analysis work according to the ransomware virus feature library.

[0164] Combination Figure 4 ,like Figure 7 As shown, based on the contents of S401-S403 above, the method for processing the ransomware virus provided in the embodiment of the present application may further include S404.

[0165] S404: Based on the virus features in the ransomware virus feature library, correlation analysis is performed on multiple ransomware viruses to obtain correlation relationships between the multiple ransomware viruses.

[0166] In the embodiment of the present application, the ransomware viruses can be clustered using a clustering algorithm based on the virus features in the ransomware virus library, and the ransomware viruses corresponding to similar virus features can be divided into a ransomware virus set. It can also be considered that the result of the correlation analysis of multiple ransomware viruses is one or more ransomware virus sets, and the ransomware viruses in the same ransomware virus set have a correlation relationship.

[0167] Optionally, an unsupervised clustering algorithm is used to perform multi-level clustering on the virus features in the ransomware virus feature library to obtain one or more ransomware virus sets. Unsupervised clustering algorithms include, but are not limited to, K-means, K-means++, HDBSCAN, and other algorithms.

[0168] Combination Figure 8 The framework diagram of the ransomware processing process shown in the figure is a framework diagram of the ransomware correlation analysis and visual query process. The multi-level clustering of virus features refers to clustering from one or more dimensions of the ransomware feature types. For example, taking the input and output features, attack content features, and attack priority features of the NAS system as examples, the multi-level clustering can include the following clustering methods:

[0169] The first type is clustering based on input and output features.

[0170] This clustering method uses all input and output features in the ransomware feature library as clustering objects, and executes the clustering algorithm to obtain one or more ransomware sets. For one of the ransomware sets, the input and output features of the ransomware in the ransomware set are similar, that is, there is a correlation in this feature dimension of the input and output features.

[0171] The second type is clustering based on attack content features.

[0172] This clustering method uses all attack content features in the ransomware feature library as clustering objects, and executes a clustering algorithm to obtain one or more ransomware sets. For one of the ransomware sets, the attack content features of the ransomware in the ransomware set are similar, that is, there is a correlation in this feature dimension of the attack content features.

[0173] The third type: clustering based on attack priority features

[0174] This clustering method uses all attack priority features in the ransomware feature library as clustering objects, and executes the clustering algorithm to obtain one or more ransomware sets. For one of the ransomware sets, the attack priority features of the ransomware in the ransomware set are similar, that is, there is a correlation in this feature dimension of the attack priority feature.

[0175] Fourth, clustering based on input and output features and attack content features

[0176] This clustering method uses all input and output features and attack content features in the ransomware feature library as clustering objects, and executes the clustering algorithm to obtain one or more ransomware sets. For one of the ransomware sets, the ransomware has a correlation in the feature dimensions of input and output features and attack content features.

[0177] Fifth, clustering based on input and output features and attack priority features

[0178] This clustering method uses all input and output features and attack priority features in the ransomware feature library as clustering objects, and executes the clustering algorithm to obtain one or more ransomware sets. For one of the ransomware sets, the ransomware has a correlation in the feature dimensions of input and output features and attack priority features.

[0179] Sixth, clustering based on attack content features and attack priority features

[0180] This clustering method uses all attack content features and attack priority features in the ransomware feature library as clustering objects, and executes a clustering algorithm to obtain one or more ransomware sets. For one of the ransomware sets, the ransomware has a correlation in the feature dimensions of the attack content feature and the attack priority feature.

[0181] Seventh, clustering based on input and output features, attack content features, and attack priority features

[0182] This clustering method is the clustering of global features or overall features, that is, all virus features in the ransomware virus feature library are used as clustering objects, and the clustering algorithm is executed to obtain one or more ransomware virus sets. For one of the ransomware virus sets, the global features of the ransomware viruses in the ransomware virus set are all associated.

[0183] refer to Figure 8 Optionally, in an embodiment of the present application, based on the above-obtained ransomware feature library and the association relationship between ransomware viruses, the ransomware virus processing device may also use a knowledge graph tool to generate a ransomware virus knowledge graph indicating the association relationship between multiple ransomware viruses.

[0184] Based on the correlation analysis result of the virus features in S404, the knowledge graph tool is used to convert the ransomware virus correlation into a ransomware virus knowledge graph, which can more intuitively reflect the correlation between the ransomware viruses and also facilitate users to query the relevant information of the ransomware viruses.

[0185] Exemplarily, the knowledge graph tool may be a Neo4j platform. For the process of generating a ransomware knowledge graph using the knowledge graph tool, reference may be made to the relevant description of generating a knowledge graph in the prior art materials, which will not be described in detail in the embodiments of the present application.

[0186] In one implementation, the ransomware processing method provided in the embodiment of the present application supports correlation query of multiple ransomware viruses, and the ransomware processing method provided in the embodiment of the present application also includes: the ransomware processing device receives a first query request, and the first query request is used to query the ransomware virus that has an associated relationship with the target ransomware virus; then the ransomware processing device responds to the first query request, and determines the ransomware virus associated with the target ransomware virus according to the association relationship of multiple ransomware viruses; and outputs the ransomware virus information associated with the target ransomware virus.

[0187] It can be understood that after the ransomware processing device determines the ransomware associated with the target ransomware, it can output the information of the associated ransomware in the form of a knowledge graph. The ransomware processing device also includes a visualization platform, which displays a ransomware knowledge graph that can indicate the association between the target ransomware and other ransomware.

[0188] Optionally, the first query request may be a request to query a ransomware virus that is associated with the target ransomware virus in a certain feature dimension, such as querying a ransomware virus that is associated with the input and output features of the target ransomware virus. The first query request may also be a request to query a ransomware virus that is associated with the target virus in multiple feature (or combined feature) dimensions, such as querying a ransomware virus that is associated with both the input and output features and the attack priority features of the target ransomware virus.

[0189] In one implementation, the ransomware processing method provided in the embodiment of the present application also supports the correlation query of a single ransomware, and the ransomware processing method provided in the embodiment of the present application further includes: the ransomware processing device receives a second query request, the second query request is used to query the information of the target ransomware; and in response to the second query request, displays the information of the target ransomware. The ransomware information may include basic information of the ransomware (such as the virus family to which the ransomware belongs, HASH value, etc.) and / or the virus characteristics of the ransomware obtained through S403.

[0190] Combination Figure 4 ,like Fig. 9 As shown, based on the contents described in S401-S403 above, the method for processing the ransomware virus provided in the embodiment of the present application may further include S405.

[0191] S405. Generate one or more new ransomware viruses based on the multiple ransomware viruses.

[0192] In actual applications, ransomware viruses will be continuously updated and iterated, thereby generating new ransomware viruses, which makes the existing anti-ransomware virus solution unable to detect the new ransomware viruses. In the embodiment of the present application, based on the existing multiple ransomware viruses, the ransomware viruses are evolved and simulated, thereby simulating and generating one or more new ransomware viruses, so that an effective anti-ransomware virus solution can be designed for the new ransomware viruses, which helps to improve the security performance of the storage system.

[0193] Combination Fig.10 A framework diagram of the processing process of the ransomware virus shown is a framework diagram of the evolution process of the ransomware virus. In one implementation, in the above S405, the method for generating a new ransomware virus may include S4051.

[0194] S4051. Recombining the virus features of multiple ransomware viruses in a ransomware virus feature library to obtain a new ransomware virus.

[0195] In an embodiment of the present application, the virus features of multiple ransomware viruses are recombined to obtain a new set of virus features, and the new virus features can indicate a new ransomware virus.

[0196] For example, taking a NAS system as an example, the above-mentioned traversal order of the same-level directory, the attack path of the multi-level directory, the attack mode, the attack speed feature, the attack thread feature, the location feature of the attack content, the entropy value feature of the attack content, the priority of the attack file, and the type of the attack file can be combined to obtain a new set of virus features. Optionally, the virus features can be combined manually or randomly.

[0197] It should be understood that a new virus feature corresponds to a new ransomware virus. Multiple sets of new virus features can be obtained by combining the features of multiple ransomware viruses multiple times according to the method S4051. Therefore, multiple new ransomware viruses can be obtained.

[0198] For example, take the five ransomware viruses in the ransomware virus feature library as an example. Each ransomware virus includes 10 virus features. The virus features of these five ransomware viruses are:

[0199] Virus characteristics of ransomware virus 1: {a1, b1, c1, d1, e1, f1, h1, i1, g1, k1};

[0200] Virus characteristics of ransomware virus 2: {a2, b2, c2, d2, e2, f2, h2, i2, g2, k2};

[0201] Virus characteristics of ransomware virus 3: {a3, b3, c3, d3, e3, f3, h3, i3, g3, k3};

[0202] Virus characteristics of ransomware virus 4: {a4, b4, c4, d4, e4, f4, h4, i4, g4, k4};

[0203] Virus characteristics of ransomware virus 5: {a5, b5, c5, d5, e5, f5, h5, i5, g5, k5};

[0204] The virus features of the above five ransomware viruses are recombined. For example, the virus features of ransomware virus 1 are recombined with the virus features of ransomware virus 2. For example, the virus feature d1 of ransomware virus 1 is modified to the virus feature d2 of ransomware virus 2. In this way, a new set of virus features can be obtained, and the new virus features correspond to a new ransomware virus, such as ransomware virus 6.

[0205] The virus characteristics of ransomware virus 6 are: {a1, b1, c1, d2, e1, f1, h1, i1, g1, k1}.

[0206] For another example, the virus features of ransomware virus 3, ransomware virus 4, and ransomware virus 5 are reorganized, such as modifying the virus feature a3 of ransomware virus 3 to the virus feature a5 of ransomware virus 5, and modifying the virus feature g3 of ransomware virus 3 to the virus feature g4 of ransomware virus 4, so that a new set of virus features can be obtained, and the new virus features correspond to a new ransomware virus, such as ransomware virus 7.

[0207] The virus characteristics of ransomware virus 7 are: {a5, b3, c3, d3, e3, f3, h3, i3, g4, k3}.

[0208] After one or more new virus features are obtained through virus feature recombination, the new virus features are updated to the ransomware virus feature library, making the virus features of the ransomware virus feature library more comprehensive, which is helpful for the design of anti-ransomware virus solutions.

[0209] Furthermore, for the newly added virus features in the ransomware feature library, the correlation between the new ransomware and the existing ransomware can be analyzed, and the new ransomware can be added to the ransomware knowledge graph.

[0210] refer to Fig.10 As shown in the framework diagram, in another implementation, in the above S405, the method for generating a new ransomware virus may include S4052.

[0211] S4052. Replace the encryption algorithm of one of the multiple ransomware viruses to obtain a new ransomware virus.

[0212] In the embodiment of the present application, the ransomware virus can be evolved based on the new encryption algorithm to construct a new ransomware virus with a more complex encryption mode or a more difficult to distinguish. It is understandable that when the virus characteristics of the ransomware virus do not change, the encryption algorithm of the ransomware virus is replaced to obtain a new encryption algorithm, and the new encryption algorithm can indicate a new ransomware virus. For example, the encryption algorithm of a ransomware virus is an RSA encryption algorithm and / or an advanced encryption standard (AES) encryption algorithm, and the encryption algorithm is replaced with a quantum encryption algorithm or an obfuscated encryption algorithm, etc.

[0213] In combination with S4051 and S4052, after the new ransomware virus is generated, a virus simulator is used to generate a code script of the new ransomware virus to simulate the operation of the new virus.

[0214] As ransomware is constantly updated and the number of new viruses increases dramatically, there is an urgent need for a method to perform performance testing on anti-ransomware solutions (methods for detecting ransomware) to test the security reliability and detection accuracy of anti-ransomware solutions. Fig. 9 ,like Fig.11 As shown, the method for processing ransomware provided in the embodiment of the present application may further include S406.

[0215] S406. Test and optimize one or more anti-ransomware solutions based on multiple ransomware viruses.

[0216] In an embodiment of the present application, a ransomware test set can be used to test and optimize one or more anti-ransomware solutions, and a test report of one or more anti-ransomware solutions can be generated, and the test report includes the test results and optimization suggestions of the anti-ransomware solutions. Among them, the test results of the anti-ransomware solutions include the detection rate and / or missed detection rate of one or more anti-ransomware solutions, and the optimization suggestions in the test report are used to optimize one or more anti-ransomware solutions.

[0217] Among them, the ransomware virus test set includes one or more ransomware viruses, and the one or more ransomware viruses can come from at least one of the following virus sets: a first virus set, a second virus set or a third virus set; the ransomware viruses in the first virus set come from the multiple ransomware viruses in the ransomware virus feature library used to be established in the above S401, the ransomware viruses in the second virus set come from the one or more new ransomware viruses generated in the above S405, and the ransomware viruses in the third virus set come from the ransomware viruses in the first virus set and / or the second virus set after de-redundancy, for example, based on the clustering results of virus features, the sets with the same virus features are eliminated to obtain the third virus set.

[0218] Combination Fig.12 A framework diagram of the ransomware processing process shown is a framework diagram of the testing process of the anti-ransomware solution. The embodiment of the present application can provide a test platform for testing the anti-ransomware solution. For example, the test platform is deployed in a ransomware processing device. The test mode configuration and test data set configuration can be performed in the test platform, and the test process of the anti-ransomware solution can be automatically executed to output a test report of the anti-ransomware solution.

[0219] The test mode includes single solution test or multi-solution comparison test. Single solution test refers to the security performance test of a specific anti-ransomware solution, and multi-solution comparison test refers to the comparison test of multiple anti-ransomware solutions. Users can set the test mode to single solution test or multi-solution comparison test.

[0220] In one implementation, the ransomware processing device executes the test process of the anti-ransomware solution, which may include: when the ransomware in the ransomware test set is running in a sandbox platform (the sandbox platform may be the same as or different from the sandbox platform used when building the ransomware feature library), running one or more anti-ransomware solutions to detect the ransomware running in the sandbox platform; and generating test reports for one or more anti-ransomware solutions based on the test results of the ransomware.

[0221] In an embodiment of the present application, after the ransomware virus processing device builds the sandbox platform, it initializes the sandbox platform according to the user's configuration, and then controls the sandbox platform to automatically traverse the ransomware virus in the ransomware virus test set, and runs the anti-ransomware virus solution to detect the ransomware virus. After a ransomware virus is run, the ransomware virus processing device collects the test results of the anti-ransomware virus solution, and outputs optimization suggestions based on the test results, and then presents the test results and optimization suggestions to the user as the content of the test report. It should be noted that after a ransomware virus is run, the ransomware virus processing device can automatically restore the initialization settings of the sandbox platform, for example, by initializing in the sandbox platform through a snapshot script with a preset recovery time.

[0222] In an embodiment of the present application, the detection rate and / or missed detection rate of the ransomware virus may be the detection rate and / or missed detection rate of the ransomware virus in a certain characteristic dimension. The optimization suggestions for the anti-ransomware solution may include optimization suggestions for an anti-ransomware method for a certain ransomware virus, or optimization suggestions for an anti-ransomware method for a ransomware virus with certain characteristics.

[0223] For example, if the anti-ransomware solution fails to detect a certain type of ransomware, the output optimization suggestion may be to recommend optimization for that type of ransomware, to ensure that the optimized anti-ransomware solution can accurately detect that type of ransomware. For another example, if the anti-ransomware solution fails to detect a ransomware with a certain feature, the output optimization suggestion may be to recommend optimization for that ransomware with that feature, to ensure that the optimized anti-ransomware solution can accurately detect that ransomware with that feature.

[0224] Optionally, in an embodiment of the present application, optimization strategies for multiple anti-ransomware solutions can also be pre-configured, and the optimization strategies have a corresponding relationship with the test results. In this way, the ransomware processing device can match the appropriate optimization strategy according to the test results, and then prompt the user to improve the anti-ransomware solution according to the optimization strategy.

[0225] For example, for a ransomware virus whose virus signature is the attack content signature, if the anti-ransomware method cannot detect the ransomware virus, a possible optimization suggestion is: it is recommended to detect the entire content, or to increase the content detection sampling points to conduct a comprehensive detection of the content of the ransomware virus attack, which will help detect the ransomware virus.

[0226] For example, for a ransomware virus with a virus characteristic of slow encryption, if the anti-ransomware method cannot detect the ransomware virus, a possible optimization suggestion is: it is recommended to expand the IO detection range, such as extending the IO detection time or increasing the number of detected IOs, so as to increase the detection range of the ransomware virus and help detect the ransomware virus.

[0227] In summary, Fig.13 The complete flow chart of the method for processing ransomware provided in the embodiment of the present application is shown. The above is a complete introduction of the above embodiment. Figure 3 The 4 aspects described.

[0228] like Fig.13 As shown, the ransomware feature library creation process includes running the ransomware to obtain attack information, extracting ransomware features, and building a ransomware feature library; the ransomware correlation analysis process includes feature clustering, generating a ransomware knowledge graph, and ransomware information query; the ransomware evolution process includes virus feature evolution or encryption algorithm evolution, and new ransomware simulation; the anti-ransomware solution testing process includes configuring test modes and test data sets, generating test results, and optimization suggestions. Fig.13 For more description of the complete process of the ransomware virus processing method shown, please refer to the relevant description in the above embodiment, which will not be repeated here.

[0229] It is understandable that, in order to realize the above functions, the above-mentioned ransomware virus processing device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the method steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments of the present application.

[0230] The embodiment of the present application can divide the functional modules of the above-mentioned ransomware virus processing device according to the above-mentioned method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0231] In the case of dividing each functional module into corresponding functional modules, Fig.14 A possible structural diagram of the ransomware virus processing device involved in the above embodiment is shown. The ransomware virus processing device includes an acquisition module 1401, a feature extraction module 1402 and a processing module 1403.

[0232] Among them, the acquisition module 1401 is used to execute S401 (including S4011) in the above method embodiment; the feature extraction module 1402 is used to execute S402 in the above method embodiment; and the processing module 1403 is used to execute S403 in the above method embodiment.

[0233] Optionally, the ransomware virus processing device provided in the embodiment of the present application further includes an analysis module 1404 , a receiving module 1405 , a determination module 1406 , an output module 1407 , a generation module 1408 and a testing module 1409 .

[0234] The analysis module 1404 is used to execute S404 in the above method embodiment.

[0235] The receiving module 1405 is used to receive a first query request, the first query request is used to query the ransomware virus associated with the target ransomware virus; the determining module 1406 is used to determine the ransomware virus associated with the target ransomware virus; the output module 1407 is used to output the ransomware virus associated with the target ransomware virus. The receiving module 1405 is also used to receive a second query request, the second query request is used to query the information of the target ransomware virus; the output module 1407 is also used to output the information of the target ransomware virus.

[0236] The generation module 1408 is used to execute S405 (including S4051 or S4052) in the above method embodiment.

[0237] The testing module 1409 is used to execute S406 in the above method embodiment.

[0238] like Fig.15As shown, an embodiment of the present application also provides a ransomware virus processing device, which includes a feature library creation module 1501, a correlation analysis module 1502, a ransomware virus evolution module 1503, an anti-ransomware virus testing module 1504 and an information query module 1505.

[0239] In combination with the steps performed by each module of the above-mentioned ransomware virus processing device, it can be known that the above-mentioned acquisition module 1401, feature extraction module 1402, and processing module 1403 perform corresponding steps to create a ransomware virus feature library. Therefore, the acquisition module 1401, feature extraction module 1402, and processing module 1403 can be integrated together, for example, integrated in Fig.15 The feature library creation module 1501 in the embodiment is used to create the ransomware feature library, thereby executing the creation process of the ransomware feature library in the above embodiment.

[0240] The steps corresponding to the above analysis module 1404 can realize the correlation analysis of the ransomware virus. Therefore, the analysis module 1404 can be integrated in Fig.15 The correlation analysis module 1502 in the embodiment is used to perform the correlation analysis process of the ransomware virus in the above embodiment.

[0241] The receiving module 1405, the determining module 1406 and the output module 1407 perform corresponding steps to realize the information query of the ransomware virus. Therefore, the receiving module 1405, the determining module 1406 and the output module 1407 can be integrated together, for example, integrated in Fig.15 The information query module 1505 in the embodiment is used to execute the information query process of the ransomware virus in the above embodiment.

[0242] The above-mentioned test module 1409 executes the corresponding steps to test the anti-ransomware solution. Therefore, the test module 1409 can be Fig.15 The anti-ransomware test module 1504 in.

[0243] The above-mentioned generation module 1408 executes the corresponding steps to evolve the ransomware virus. Therefore, the generation module 1408 can be integrated in Fig.15 The ransomware evolution module 1503 in the embodiment is used to execute the ransomware evolution process in the above embodiment.

[0244] The modules of the ransomware virus processing device can also be used to perform other actions in the method embodiment. All relevant contents of the steps involved in the method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0245] For more details on how the modules included in the ransomware virus processing device implement the above functions, please refer to the descriptions in the previous method embodiments, which will not be repeated here. Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments.

[0246] In combination with the above content, the present application embodiment also provides a ransomware virus processing system, such as Fig.16 As shown, the ransomware virus processing system may include a computing device 1601 and a security platform 1602 (which is an independent device such as a security all-in-one machine). Among them, the computing device 1601 is used to create a ransomware virus feature library and perform anti-ransomware solution testing based on the ransomware virus feature library, that is, the above-mentioned feature library creation module 1501 and anti-ransomware virus testing module 1504 are deployed in the computing device 1601; the security platform 1602 is used to perform ransomware virus correlation analysis, information query and ransomware virus evolution, that is, the above-mentioned correlation analysis module 1502, information query module 1505, and ransomware virus evolution module 1503 are deployed in the security platform.

[0247] In an embodiment of the present application, the above-mentioned correlation analysis module 1502, information query module 1505, and ransomware evolution module 1503 are separately placed in a device isolated from the computing device, which can support other devices to query the ransomware information on the one hand. Optionally, the virus characteristics of the ransomware can also be stored through an independent graph database (i.e., a knowledge graph), so that the information of a single ransomware or the association relationship of multiple ransomware viruses can be visually displayed. On the other hand, a separate interface can be provided to support external calls to the ransomware evolution module 1503, so that the generated ransomware can be used for testing the anti-ransomware solution, for example, it can be used to test the anti-ransomware solution for other storage systems.

[0248] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instruction is loaded and executed on a computer, the process or function in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instruction can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) mode or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a magnetic disk, a magnetic tape), an optical medium (eg, a digital video disc (DVD)), or a semiconductor medium (eg, a solid state drive (SSD)).

[0249] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0250] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0251] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0252] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0253] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, or all or part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk, and other media that can store program codes.

[0254] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for processing a ransomware virus, characterized in that: include: Acquire attack information of each of the multiple ransomware viruses; wherein the attack information of the first ransomware virus includes an input / output IO sequence generated in the process of the first ransomware virus attacking the storage system and the attacked data content; the first ransomware virus is any one of the multiple ransomware viruses; Extracting virus features of each ransomware virus from the attack information of each ransomware virus; The virus features of the multiple ransomware viruses are organized into a ransomware virus feature library, and the ransomware virus feature library is used to perform at least one of the following processing on the ransomware viruses: feature query, correlation analysis, virus evolution, or anti-ransomware virus solution testing.

2. The method according to claim 1, characterized in that The storage system is stored in a file format. The virus features of the ransomware virus include one or more of the following features: input and output features, attack content features, or attack priority features; The input and output features include at least one of the following: the traversal order of the same-level directories, the attack path of the multi-level directories, the attack mode, the attack speed feature or the attack thread feature; The attack priority feature includes the priority of the attack file and / or the type of the attack file; The attack content feature includes a location feature of the attack content and / or an entropy value feature of the attack content.

3. The method according to claim 1, characterized in that The storage system is a block storage system. The virus characteristics of the ransomware virus include input and output characteristics and / or attack content characteristics; The input and output characteristics include at least one of the following: encryption order of the logic unit, attack thread characteristics or attack mode; The attack content feature includes an entropy value feature of the attack content.

4. The method according to any one of claims 1 to 3, characterized in that: The acquiring of attack information of each of the multiple ransomware viruses includes: The storage system is attacked by the multiple ransomware viruses respectively, and attack information of each of the multiple ransomware viruses is obtained.

5. The method according to claim 4, characterized in that The method further comprises: Building an isolated environment including the storage system; The multiple ransomware viruses that attack the storage system are respectively run in the isolated environment.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Based on the virus features in the ransomware virus feature library, correlation analysis is performed on the multiple ransomware viruses to obtain correlation relationships between the multiple ransomware viruses.

7. The method according to claim 6, characterized in that The method further comprises: Receive a first query request, where the first query request is used to query a ransomware virus associated with a target ransomware virus; In response to the first query request, determining a ransomware virus associated with the target ransomware virus according to the association relationship between the multiple ransomware viruses; Output the ransomware information associated with the target ransomware.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Receive a second query request, where the second query request is used to query virus information of a target ransomware virus; In response to the second query request, information about the target ransomware virus is output.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Based on the multiple ransomware viruses, a new ransomware virus is generated.

10. The method according to claim 9, characterized in that The method of generating a new ransomware virus based on the multiple ransomware viruses includes: The virus features of the multiple ransomware viruses in the ransomware virus feature library are recombined to obtain a new ransomware virus.

11. The method according to claim 9, characterized in that The method of generating a new ransomware virus based on the multiple ransomware viruses includes: The encryption algorithm of one of the multiple ransomware viruses is replaced to obtain a new ransomware virus.

12. The method according to any one of claims 1 to 11, characterized in that: The method further comprises: One or more anti-ransomware solutions are tested and optimized based on the multiple ransomware viruses.

13. A ransomware virus processing device, characterized in that: include: Feature library creation module; The feature library creation module is used to obtain attack information of each ransomware virus among multiple ransomware viruses; and extract virus features of each ransomware virus from the attack information of each ransomware virus; and organize the virus features of the multiple ransomware viruses into a ransomware virus feature library; wherein the attack information of the first ransomware virus includes an input and output IO sequence and attacked data content generated in the process of the first ransomware virus attacking the storage system, and the first ransomware virus is any one of the multiple ransomware viruses; the ransomware virus feature library is used to perform at least one of the following processing on the ransomware virus: feature query, correlation analysis, virus evolution or anti-ransomware virus solution testing.

14. The ransomware virus processing device according to claim 13, characterized in that: The feature library creation module is specifically used to respectively use the multiple ransomware viruses to attack the storage system and obtain attack information of each of the multiple ransomware viruses.

15. The ransomware virus processing device according to claim 14, characterized in that: The feature library creation module is further used to construct an isolated environment including the storage system; and to respectively run the multiple ransomware viruses that attack the storage system in the isolated environment.

16. The ransomware virus processing device according to any one of claims 13 to 15, characterized in that: The ransomware virus processing device further includes: a correlation analysis module; The correlation analysis module is used to perform correlation analysis on the multiple ransomware viruses based on the virus features in the ransomware virus feature library to obtain correlation relationships between the multiple ransomware viruses.

17. The ransomware virus processing device according to any one of claims 13 to 16, characterized in that: The ransomware virus processing device also includes a ransomware virus evolution module; The ransomware virus evolution module is used to generate a new ransomware virus based on the multiple ransomware viruses.

18. The ransomware virus processing device according to any one of claims 13 to 17, characterized in that: The ransomware virus processing device also includes an anti-ransomware virus testing module; The anti-ransomware testing module is used to test and optimize one or more anti-ransomware solutions based on the multiple ransomware viruses.

19. A computing device, characterized in that The method comprises a memory and at least one processor connected to the memory, wherein the memory is used to store computer program code, and the computer program code comprises computer instructions. When the computer instructions are executed by the at least one processor, the computing device executes the method according to any one of claims 1 to 12.

20. A computer-readable storage medium, characterized in that: Computer instructions are stored, and when the computer instructions are executed on a computer, the method according to any one of claims 1 to 12 is executed.

21. A storage system, characterized in that: A computing device and a storage medium in communication with the computing device; The storage medium is used to store data; The computing device is configured to execute the method according to any one of claims 1 to 12.

Images