Ransomware risk detection method and device, equipment and medium

Abstract

The invention relates to the technical field of artificial intelligence, and provides a ransomware risk detection method, device and equipment and a medium, which can accurately detect whether a target system has the risk of being attacked by ransomware in combination with a network traffic anomaly detection technology, a ransomware knowledge base and an artificial intelligence means. And traversing in the pre-maintained knowledge graph according to the detection result to obtain an effective repair strategy, so that an integrated automatic means for detecting the ransomware intrusion risk and perfecting the existing security strategy is provided, and the security of the system is fully ensured.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a ransomware risk detection method, device, equipment and medium. Background Art

[0002] As the intensity of ransomware attacks and harmful incidents continue to increase, enterprises and organizations are facing greater information security challenges.

[0003] Traditional security assessment tools tend to focus on static security configuration checks, or conduct checks based on compliance risk dimensions. They are not focused and lack in-depth analysis of the dynamic characteristics of ransomware attacks.

[0004] In view of this, it is necessary to provide a method that can accurately detect ransomware risks and provide repair strategies. Summary of the invention

[0005] In view of the above, it is necessary to provide a ransomware risk detection method, device, equipment and medium, aiming to solve the problem of low accuracy of ransomware risk detection and inability to provide reasonable response strategies.

[0006] A ransomware risk detection method, the ransomware risk detection method comprising:

[0007] Get a pre-built ransomware knowledge base;

[0008] Acquire an initial model, and train the initial model based on network traffic anomaly detection technology and the ransomware knowledge base to obtain a ransomware risk detection model;

[0009] In response to a ransomware risk detection instruction for a target system, performing risk detection on the target system using the ransomware risk detection model to obtain a detection result;

[0010] When the detection result shows that the target system has a ransomware risk, obtaining a pre-maintained knowledge graph;

[0011] Traversing the knowledge graph according to the detection result to obtain a repair strategy corresponding to the detection result;

[0012] The detection result and the repair strategy are sent to a designated terminal device.

[0013] According to a preferred embodiment of the present invention, the method further comprises:

[0014] crawling ransomware public opinion information using crawler technology at preset time intervals, and updating the ransomware knowledge base according to the ransomware public opinion information; and / or

[0015] When the uploaded ransomware sample information and the corresponding attack case are received, the ransomware knowledge base is updated according to the ransomware sample information and the corresponding attack case.

[0016] According to a preferred embodiment of the present invention, the initial model is trained based on the network traffic anomaly detection technology and the ransomware knowledge base to obtain the ransomware risk detection model, including:

[0017] Extracting ransomware features and attack patterns from the ransomware knowledge base;

[0018] Acquire network traffic characteristics under each attack mode based on the network traffic anomaly detection technology;

[0019] Constructing negative samples based on the ransomware features, the attack modes, and network traffic features under each attack mode;

[0020] Obtain network traffic features when there is no ransomware attack to construct positive samples;

[0021] The initial model is trained with the positive samples and the negative samples to obtain the ransomware risk detection model.

[0022] According to a preferred embodiment of the present invention, after obtaining the ransomware risk detection model, the method further includes:

[0023] Simulate ransomware attack behavior to obtain simulation data;

[0024] Performing accuracy testing on the ransomware risk detection model according to the simulation data;

[0025] When the accuracy of the ransomware risk detection model is greater than or equal to a preset threshold, determining that the ransomware risk detection model is available; or

[0026] When the accuracy of the ransomware risk detection model is less than the preset threshold, it is determined that the ransomware risk detection model is unavailable, and a prompt message is issued to optimize the training of the ransomware risk detection model.

[0027] According to a preferred embodiment of the present invention, before obtaining the pre-maintained knowledge graph, the method further includes:

[0028] Get historical remediation data on ransomware attacks;

[0029] Performing entity extraction and relationship extraction on the historical repair data to obtain each historical attack mode, each historical repair strategy, and a corresponding relationship between each historical attack mode and each historical repair strategy;

[0030] Each historical attack mode and each historical repair strategy is taken as a node, and each node is connected according to the corresponding relationship between each historical attack mode and each historical repair strategy to obtain the knowledge graph.

[0031] According to a preferred embodiment of the present invention, after obtaining the repair strategy corresponding to the detection result, the method further includes:

[0032] An automatic repair operation in the repair strategy is obtained, and the automatic repair operation is executed.

[0033] According to a preferred embodiment of the present invention, the method further comprises:

[0034] In response to the ransomware risk detection instruction, calling a security policy verification engine to detect basic security configuration data of the target system to obtain a basic security configuration detection result;

[0035] The basic security configuration detection result is sent to the designated terminal device.

[0036] A ransomware risk detection device, the ransomware risk detection device comprising:

[0037] An acquisition unit, for acquiring a pre-built ransomware knowledge base;

[0038] A training unit, used to obtain an initial model, and train the initial model based on network traffic anomaly detection technology and the ransomware knowledge base to obtain a ransomware risk detection model;

[0039] A detection unit, configured to respond to a ransomware risk detection instruction for a target system, perform risk detection on the target system using the ransomware risk detection model, and obtain a detection result;

[0040] The acquisition unit is further configured to acquire a pre-maintained knowledge graph when the detection result shows that the target system has a ransomware risk;

[0041] A traversal unit, used to traverse the knowledge graph according to the detection result to obtain a repair strategy corresponding to the detection result;

[0042] The sending unit is used to send the detection result and the repair strategy to a designated terminal device.

[0043] A computer device, comprising:

[0044] a memory storing at least one instruction; and

[0045] The processor executes the instructions stored in the memory to implement the ransomware risk detection method.

[0046] A computer-readable storage medium stores at least one instruction, and the at least one instruction is executed by a processor in a computer device to implement the ransomware risk detection method.

[0047] It can be seen from the above technical solutions that the present invention can combine network traffic anomaly detection technology, ransomware knowledge base and artificial intelligence means to accurately detect whether the target system is at risk of being attacked by ransomware, and traverse the pre-maintained knowledge graph according to the detection results to obtain an effective repair strategy, providing an integrated automated means of ransomware intrusion risk detection and improvement of existing security strategies, which fully ensures the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a flow chart of a preferred embodiment of the ransomware risk detection method of the present invention.

[0049] Figure 2 It is a functional module diagram of a preferred embodiment of the ransomware risk detection device of the present invention.

[0050] Figure 3 It is a structural schematic diagram of a computer device of a preferred embodiment of the ransomware risk detection method of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0052] like Figure 1 FIG. 1 is a flowchart of a preferred embodiment of the ransomware risk detection method of the present invention. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted.

[0053] The ransomware risk detection method is applied to one or more computer devices, wherein the computer device is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), a programmable gate array (FPGA), a digital signal processor (DSP), an embedded device, etc.

[0054] The computer device may be any electronic product that can perform human-computer interaction with a user, such as a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television (IPTV), a smart wearable device, etc.

[0055] The computer device may also include a network device and / or a user device, wherein the network device includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud consisting of a large number of hosts or network servers based on cloud computing.

[0056] The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0057] Among them, Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0058] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0059] The network where the computer device is located includes but is not limited to the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (VPN), etc.

[0060] S10, obtain a pre-built ransomware knowledge base.

[0061] In this embodiment, the ransomware knowledge base includes various attribute data of the ransomware, such as ransomware features, attack patterns, etc., and may also include questionnaires that support security awareness assessment needs, etc.

[0062] For example, some attribute data in the ransomware knowledge base can be found in the following table:

[0063]

[0064]

[0065] In this embodiment, the method further includes:

[0066] crawling ransomware public opinion information using crawler technology at preset time intervals, and updating the ransomware knowledge base according to the ransomware public opinion information; and / or

[0067] When the uploaded ransomware sample information and the corresponding attack case are received, the ransomware knowledge base is updated according to the ransomware sample information and the corresponding attack case.

[0068] The ransomware public opinion information may include the latest crawled ransomware attack events to help improve the accuracy and timeliness of the assessment.

[0069] The preset time interval can be configured according to actual needs, such as 1 month.

[0070] Through the above embodiments, the data recorded in the ransomware knowledge base can be kept up to date to improve the availability of data, thereby indirectly ensuring the accuracy of the subsequently trained model and maintaining the best detection effect of the model.

[0071] S11, obtaining an initial model, and training the initial model based on network traffic anomaly detection technology and the ransomware knowledge base to obtain a ransomware risk detection model.

[0072] In this embodiment, the initial model may be a deep learning model with detection effect, and intelligent evaluation can be performed using the initial model. For example, the initial model may be a convolutional neural network, a recurrent neural network, etc.

[0073] In this embodiment, the initial model is trained based on the network traffic anomaly detection technology and the ransomware knowledge base to obtain the ransomware risk detection model, including:

[0074] Extracting ransomware features and attack patterns from the ransomware knowledge base;

[0075] Acquire network traffic characteristics under each attack mode based on the network traffic anomaly detection technology;

[0076] Constructing negative samples based on the ransomware features, the attack modes, and network traffic features under each attack mode;

[0077] Obtain network traffic features when there is no ransomware attack to construct positive samples;

[0078] The initial model is trained with the positive samples and the negative samples to obtain the ransomware risk detection model.

[0079] Among them, the ransomware characteristics may include intrusion paths, etc.

[0080] The network traffic characteristics may include network traffic pattern, data packet size, time interval, etc.

[0081] Through the above embodiments, the latest and most comprehensive ransomware attributes and network traffic characteristics can be integrated to form a ransomware risk detection model trained by artificial intelligence to accurately detect whether there is a risk of ransomware attack.

[0082] In this embodiment, after obtaining the ransomware risk detection model, the method further includes:

[0083] Simulate ransomware attack behavior to obtain simulation data;

[0084] Performing accuracy testing on the ransomware risk detection model according to the simulation data;

[0085] When the accuracy of the ransomware risk detection model is greater than or equal to a preset threshold, determining that the ransomware risk detection model is available; or

[0086] When the accuracy of the ransomware risk detection model is less than the preset threshold, it is determined that the ransomware risk detection model is unavailable, and a prompt message is issued to optimize the training of the ransomware risk detection model.

[0087] The preset threshold value may be customized according to actual needs, such as 95%.

[0088] In the above embodiment, by simulating the attack behaviors of ransomware under various attack scenarios, the actual effect of the ransomware risk detection model can be tested, and when the detection effect does not meet expectations, prompt information for optimizing training is issued in time to achieve rapid improvement of the model.

[0089] S12, in response to a ransomware risk detection instruction for a target system, performing risk detection on the target system using the ransomware risk detection model to obtain a detection result.

[0090] In this embodiment, the target system may be a system of any enterprise, and the target system needs to have certain security protection capabilities to avoid data leakage due to malicious attacks by ransomware.

[0091] In this embodiment, the ransomware risk detection instruction may be triggered by relevant staff, such as an operation and maintenance engineer, a chief security officer, etc. of the target system.

[0092] In this embodiment, the current network traffic characteristics of the target system and other characteristics corresponding to the input of the ransomware risk detection model may be obtained, and the obtained characteristics may be input into the ransomware risk detection model for processing to obtain the detection result.

[0093] S13: When the detection result shows that the target system has a ransomware risk, obtain a pre-maintained knowledge graph.

[0094] In this embodiment, before obtaining the pre-maintained knowledge graph, the method further includes:

[0095] Get historical remediation data on ransomware attacks;

[0096] Performing entity extraction and relationship extraction on the historical repair data to obtain each historical attack mode, each historical repair strategy, and a corresponding relationship between each historical attack mode and each historical repair strategy;

[0097] Each historical attack mode and each historical repair strategy is taken as a node, and each node is connected according to the corresponding relationship between each historical attack mode and each historical repair strategy to obtain the knowledge graph.

[0098] Through the above embodiments, it is possible to pre-maintain a knowledge graph with each historical attack mode and each historical repair strategy as nodes and the corresponding relationship between each historical attack mode and each historical repair strategy as lines, thereby assisting in effective anomaly repair.

[0099] S14, traversing the knowledge graph according to the detection result to obtain a repair strategy corresponding to the detection result.

[0100] In this embodiment, the determined current attack mode is obtained from the detection result, and the knowledge graph is traversed with the current attack mode to obtain a repair strategy corresponding to the current attack mode.

[0101] Through the above embodiments, it is possible to automatically match the repair strategy when a ransomware risk is detected to assist relevant staff in quickly responding to ransomware attacks, thereby improving the protection efficiency of the system and reducing the losses caused by the ransomware.

[0102] In this embodiment, after obtaining the repair strategy corresponding to the detection result, the method further includes:

[0103] An automatic repair operation in the repair strategy is obtained, and the automatic repair operation is executed.

[0104] For example, the automatic repair operation may include changing configuration, updating security patches, etc.

[0105] In the above embodiment, for some repair operations that can be automatically executed, there is no need to wait and they can be executed directly, so as to improve the defense efficiency and reduce the need for manual intervention.

[0106] S15, sending the detection result and the repair strategy to a designated terminal device.

[0107] The designated terminal device may be a terminal device of a relevant staff member, such as an office computer of an operation and maintenance staff member.

[0108] In this embodiment, an evaluation report may also be automatically generated based on the detection results and the repair strategy. For example, the evaluation report may include risk scores, vulnerability details, repair strategies, etc. The evaluation report may also support customization to meet the specific needs of different users.

[0109] The above embodiments can reduce economic losses caused by data loss or system failure, and the automated repair suggestion and execution functions can effectively shorten the time from threat discovery to problem resolution.

[0110] In this embodiment, the method further includes:

[0111] In response to the ransomware risk detection instruction, calling a security policy verification engine to detect basic security configuration data of the target system to obtain a basic security configuration detection result;

[0112] The basic security configuration detection result is sent to the designated terminal device.

[0113] The basic security configuration data may include firewall rules, port opening conditions, encrypted communication configuration, etc.

[0114] The security policy checking engine can detect the basic security configuration data of the target system based on different types of pre-configured policy checking lists. The policy checking list can support customization and manual import.

[0115] In the above embodiment, after receiving the ransomware risk detection instruction, the security policy verification engine can be synchronously called to detect the basic security configuration data of the target system to determine whether the basic security configuration of the target system is compliant. In addition, regardless of whether the target system has a ransomware risk, the basic security configuration of the target system can be detected, and the basic security configuration detection result can be sent to the designated terminal device to ensure the completeness of the basic security configuration of the target system.

[0116] In this embodiment, the ransomware risk detection method can be deployed on an ultra-light security plug-in, which is easy to deploy and use quickly to extract and analyze security policies for different types of host operating systems, support multiple operating systems and network environments, and support docking with third-party platform capabilities, and can adapt to the needs of enterprises of different sizes. The plug-in corresponding to the ransomware risk detection can also be connected to the system to be evaluated through the network for online or offline evaluation.

[0117] This embodiment can also be used for other devices that have high security requirements and need to avoid ransomware attacks, such as portable luggage devices, etc. By deploying corresponding plug-ins in the portable luggage device, the security of the items in the box can be effectively guaranteed.

[0118] It can be seen from the above technical solutions that the present invention can combine network traffic anomaly detection technology, ransomware knowledge base and artificial intelligence means to accurately detect whether the target system is at risk of being attacked by ransomware, and traverse the pre-maintained knowledge graph according to the detection results to obtain an effective repair strategy, providing an integrated automated means of ransomware intrusion risk detection and improvement of existing security strategies, which fully ensures the security of the system.

[0119] like Figure 2 , which is a functional module diagram of a preferred embodiment of the ransomware risk detection device of the present invention. The ransomware risk detection device 11 includes an acquisition unit 110, a training unit 111, a detection unit 112, a traversal unit 113, and a sending unit 114. The module / unit referred to in the present invention refers to a series of computer program segments that can be executed by a processor and can perform fixed functions, which are stored in a memory. In this embodiment, the functions of each module / unit will be described in detail in subsequent embodiments.

[0120] Wherein, the acquisition unit 110 is used to acquire a pre-built ransomware knowledge base;

[0121] The training unit 111 is used to obtain an initial model, and train the initial model based on the network traffic anomaly detection technology and the ransomware knowledge base to obtain a ransomware risk detection model;

[0122] The detection unit 112 is used to respond to a ransomware risk detection instruction for a target system, perform risk detection on the target system using the ransomware risk detection model, and obtain a detection result;

[0123] The acquisition unit 110 is further configured to acquire a pre-maintained knowledge graph when the detection result shows that the target system has a ransomware risk;

[0124] The traversal unit 113 is used to traverse the knowledge graph according to the detection result to obtain a repair strategy corresponding to the detection result;

[0125] The sending unit 114 is used to send the detection result and the repair strategy to a designated terminal device.

[0126] It can be seen from the above technical solutions that the present invention can combine network traffic anomaly detection technology, ransomware knowledge base and artificial intelligence means to accurately detect whether the target system is at risk of being attacked by ransomware, and traverse the pre-maintained knowledge graph according to the detection results to obtain an effective repair strategy, providing an integrated automated means of ransomware intrusion risk detection and improvement of existing security strategies, which fully ensures the security of the system.

[0127] like Figure 3 , which is a schematic diagram of the structure of a computer device according to a preferred embodiment of the present invention for implementing a method for detecting ransomware risks.

[0128] The computer device 1 may include a memory 12 , a processor 13 , and a bus, and may also include a computer program stored in the memory 12 and executable on the processor 13 , such as a ransomware risk detection program.

[0129] Those skilled in the art will appreciate that the schematic diagram is merely an example of the computer device 1 and does not constitute a limitation on the computer device 1. The computer device 1 may be a bus-type structure or a star-type structure. The computer device 1 may also include more or less other hardware or software than shown in the diagram, or a different arrangement of components. For example, the computer device 1 may also include input and output devices, network access devices, etc.

[0130] It should be noted that the computer device 1 is only an example, and other existing or future electronic products that are suitable for the present invention should also be included in the protection scope of the present invention and included here by reference.

[0131] Among them, the memory 12 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 12 can be an internal storage unit of the computer device 1, such as a mobile hard disk of the computer device 1. In other embodiments, the memory 12 can also be an external storage device of the computer device 1, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 1. Further, the memory 12 can also include both an internal storage unit of the computer device 1 and an external storage device. The memory 12 can not only be used to store application software and various types of data installed on the computer device 1, such as the code of the ransomware risk detection program, etc., but also can be used to temporarily store data that has been output or is to be output.

[0132] In some embodiments, the processor 13 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 13 is the control core (Control Unit) of the computer device 1, and uses various interfaces and lines to connect the various components of the entire computer device 1, and executes or executes programs or modules stored in the memory 12 (for example, executing a ransomware risk detection program, etc.), and calls data stored in the memory 12 to execute various functions of the computer device 1 and process data.

[0133] The processor 13 executes the operating system of the computer device 1 and various installed applications. The processor 13 executes the applications to implement the steps in the above-mentioned various ransomware risk detection method embodiments, for example Figure 1 Steps shown.

[0134] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 12 and executed by the processor 13 to complete the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the computer device 1. For example, the computer program may be divided into an acquisition unit 110, a training unit 111, a detection unit 112, a traversal unit 113, and a sending unit 114.

[0135] The above-mentioned integrated unit implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, and includes a number of instructions for enabling a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to execute a portion of the ransomware risk detection method described in various embodiments of the present invention.

[0136] If the module / unit integrated in the computer device 1 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware devices through a computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of each of the above-mentioned method embodiments can be implemented.

[0137] The computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory, etc.

[0138] Furthermore, the computer-readable storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of the blockchain node, etc.

[0139] The blockchain referred to in this invention is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0140] The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The bus is represented by only one straight line, but it does not mean that there is only one bus or one type of bus. The bus is configured to realize the connection and communication between the memory 12 and at least one processor 13, etc.

[0141] Although not shown, the computer device 1 may also include a power source (such as a battery) for supplying power to each component. Preferably, the power source may be logically connected to the at least one processor 13 through a power management device, so that the power management device can realize functions such as charging management, discharging management, and power consumption management. The power source may also include any components such as one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, etc. The computer device 1 may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0142] Furthermore, the computer device 1 may also include a network interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is usually used to establish a communication connection between the computer device 1 and other computer devices.

[0143] Optionally, the computer device 1 may further include a user interface, which may be a display, an input unit (such as a keyboard), or a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touch device. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the computer device 1 and to display a visual user interface.

[0144] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0145] It can be understood by those skilled in the art that Figure 3 The structure shown does not constitute a limitation on the computer device 1, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0146] Combination Figure 1 , the memory 12 in the computer device 1 stores a plurality of instructions to implement a ransomware risk detection method, and the processor 13 can execute the plurality of instructions to implement:

[0147] Get a pre-built ransomware knowledge base;

[0148] Acquire an initial model, and train the initial model based on network traffic anomaly detection technology and the ransomware knowledge base to obtain a ransomware risk detection model;

[0149] In response to a ransomware risk detection instruction for a target system, performing risk detection on the target system using the ransomware risk detection model to obtain a detection result;

[0150] When the detection result shows that the target system has a ransomware risk, obtaining a pre-maintained knowledge graph;

[0151] Traversing the knowledge graph according to the detection result to obtain a repair strategy corresponding to the detection result;

[0152] The detection result and the repair strategy are sent to a designated terminal device.

[0153] Specifically, the specific implementation method of the processor 13 for the above instructions can refer to Figure 1 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0154] It should be noted that the data involved in this case were all obtained legally.

[0155] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0156] The present invention can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0157] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0158] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0159] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0160] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0161] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the present invention can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

[0162] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A ransomware risk detection method, characterized in that: The ransomware risk detection method comprises: Get a pre-built ransomware knowledge base; Acquire an initial model, and train the initial model based on network traffic anomaly detection technology and the ransomware knowledge base to obtain a ransomware risk detection model; In response to a ransomware risk detection instruction for a target system, performing risk detection on the target system using the ransomware risk detection model to obtain a detection result; When the detection result shows that the target system has a ransomware risk, obtaining a pre-maintained knowledge graph; Traversing the knowledge graph according to the detection result to obtain a repair strategy corresponding to the detection result; The detection result and the repair strategy are sent to a designated terminal device.

2. The ransomware risk detection method according to claim 1, characterized in that: The method further comprises: crawling ransomware public opinion information using crawler technology at preset time intervals, and updating the ransomware knowledge base according to the ransomware public opinion information; and / or When the uploaded ransomware sample information and the corresponding attack case are received, the ransomware knowledge base is updated according to the ransomware sample information and the corresponding attack case.

3. The ransomware risk detection method according to claim 1, characterized in that: The method of training the initial model based on the network traffic anomaly detection technology and the ransomware knowledge base to obtain the ransomware risk detection model includes: Extracting ransomware features and attack patterns from the ransomware knowledge base; Acquire network traffic characteristics under each attack mode based on the network traffic anomaly detection technology; Constructing negative samples based on the ransomware features, the attack modes, and network traffic features under each attack mode; Obtain network traffic features when there is no ransomware attack to construct positive samples; The initial model is trained with the positive samples and the negative samples to obtain the ransomware risk detection model.

4. The ransomware risk detection method according to claim 1, characterized in that: After obtaining the ransomware risk detection model, the method further includes: Simulate ransomware attack behavior to obtain simulation data; Performing accuracy testing on the ransomware risk detection model according to the simulation data; When the accuracy of the ransomware risk detection model is greater than or equal to a preset threshold, determining that the ransomware risk detection model is available; or When the accuracy of the ransomware risk detection model is less than the preset threshold, it is determined that the ransomware risk detection model is unavailable, and a prompt message is issued to optimize the training of the ransomware risk detection model.

5. The ransomware risk detection method according to claim 1, characterized in that: Before obtaining the pre-maintained knowledge graph, the method further includes: Get historical remediation data on ransomware attacks; Performing entity extraction and relationship extraction on the historical repair data to obtain each historical attack mode, each historical repair strategy, and a corresponding relationship between each historical attack mode and each historical repair strategy; Each historical attack mode and each historical repair strategy is taken as a node, and each node is connected according to the corresponding relationship between each historical attack mode and each historical repair strategy to obtain the knowledge graph.

6. The ransomware risk detection method according to claim 1, characterized in that: After obtaining the repair strategy corresponding to the detection result, the method further includes: An automatic repair operation in the repair strategy is obtained, and the automatic repair operation is executed.

7. The ransomware risk detection method according to claim 1, characterized in that: The method further comprises: In response to the ransomware risk detection instruction, calling a security policy verification engine to detect basic security configuration data of the target system to obtain a basic security configuration detection result; The basic security configuration detection result is sent to the designated terminal device.

8. A ransomware risk detection device, characterized in that: The ransomware risk detection device comprises: An acquisition unit, for acquiring a pre-built ransomware knowledge base; A training unit, used to obtain an initial model, and train the initial model based on network traffic anomaly detection technology and the ransomware knowledge base to obtain a ransomware risk detection model; A detection unit, configured to respond to a ransomware risk detection instruction for a target system, perform risk detection on the target system using the ransomware risk detection model, and obtain a detection result; The acquisition unit is further configured to acquire a pre-maintained knowledge graph when the detection result shows that the target system has a ransomware risk; A traversal unit, used to traverse the knowledge graph according to the detection result to obtain a repair strategy corresponding to the detection result; The sending unit is used to send the detection result and the repair strategy to a designated terminal device.

9. A computer device, characterized in that: The computer device comprises: a memory storing at least one instruction; and A processor executes instructions stored in the memory to implement the ransomware risk detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the at least one instruction is executed by a processor in a computer device to implement the ransomware risk detection method according to any one of claims 1 to 7.

Images